{ "Event": { "published": true, "date": "2023-08-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-26", "timestamp": 1693094582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e7940a60-94ed-4611-8125-eb6dc5eeb8b6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03100437-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042579, "uuid": "bdbbb840-edff-4267-90aa-0fa7145bb0a8", "comment": "Malware payload (Mirai)", "value": "61e01fab4d6f1768ccf33d8000659767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042579, "uuid": "b8b95c95-fed4-4143-b45b-e570afe4aed7", "comment": "Malware payload (Mirai)", "value": "0001bd7c5cea6a85bf720c91172db6d6d4bbfbda44d09efaa9bb6893f995f71a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042579, "uuid": "e4fbc0e0-7715-4173-8de8-9565f2073a80", "comment": "Malware payload (Mirai)", "value": "21b6c32b9166e8fa0c7f20743b00c1c7e3d3fd80", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042579, "uuid": "2619ae08-a07b-488c-8217-5013603cedb9", "comment": "Malware payload (Mirai)", "value": "67f418e6be1d9d9c6ea77a0da1456f82f70b8b1fb5be78f17a3256390504ec67a9db83e118bc85855719199a38cb1ce8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042579, "uuid": "3de46ee7-ceb9-40ea-9c32-087abb8338e3", "value": "T1D2D30956F8819B12D5C111BAFE0E124E37131B78E3DE72026D246F747B8A9BB0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042579, "uuid": "5133168a-21db-4cd5-b12e-16dd6a4734c3", "value": "3072:HrUXKzY+WXjlSywaaba9uSj8GC48iJR5C:Hr8QWXJSyjateV8iJRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042579, "uuid": "6a46bc44-5b76-463a-989b-31d8f7604ffc", "value": 138044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042579, "uuid": "2148acd5-2e6e-48ef-a67e-689bb1478cea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042579, "uuid": "2a22dea0-3b78-4b8a-a50d-478e5fac1d86", "value": "concakhbtandhuy.arm6-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4148d498-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046120, "uuid": "e4e82f88-450e-434a-9a71-ff27aa4a4d76", "comment": "Malware payload", "value": "c183af434ecaa261c0daf6865716356a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046120, "uuid": "9a1b3cb8-942f-427e-b03b-90dc0da09207", "comment": "Malware payload", "value": "00b5e180cd35d2d54f88732daaac742a9a3f3be660b6043dc977831dca2792a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046120, "uuid": "e98b49b3-7449-4da0-a753-fda76d482923", "comment": "Malware payload", "value": "3f9e1650e3bbe3bae1abcc023d4daad10bb6153e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046120, "uuid": "18b1f669-bd92-4741-9b0d-1bdbcc92eeba", "comment": "Malware payload", "value": "8f6bcb7c0bb3e82fc7f9913a26539439759d5704d1ee6bb4834b8c6e95c00b928bac7f4a8692dc69b4e07afea3ac6443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046120, "uuid": "02c0012e-9028-406b-98a4-03a142fc9e92", "value": "T15C35F9AD385298B3C1F5CD3484F4B520805EA57BABA007C79366277F24A4BE5E7783D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046120, "uuid": "623cb9d3-94c9-4076-9edf-bfed3fe68b77", "value": "b02ea25de75b6fe6569f67ac27e3cbb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046120, "uuid": "88b2b3ac-2853-40dd-9348-5c62e6521ed8", "value": "12288:uF4LKBDdBC5O0Bg21XhmSSjT2CvLVEYLrMZiXofsiDkZ:uF4LvFw2CvREYvkqofsiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046120, "uuid": "cbd5095e-bac2-4f25-a735-70e233d7c67b", "value": 1142224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046120, "uuid": "55a5ab28-ad9e-4384-82ff-112240d351aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046120, "uuid": "5e0e9c79-778e-450b-9c17-ea76015247a9", "value": "SecuriteInfo.com.Program.Kuaizip.1.32394.27857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa5905a-4432-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069605, "uuid": "6245d2e6-d71c-4bf8-a5b7-34d260017744", "comment": "Malware payload (Mirai)", "value": "812709d3e397f1c5f561f35e04909603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069605, "uuid": "4f5a055c-1e9b-4bc4-8dcf-f63df6157e14", "comment": "Malware payload (Mirai)", "value": "01477b6a8f74b321c7b3191ab81e0d1560db1c6dcf4f6a80eeacde1817cc7683", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069605, "uuid": "ad8ef74a-3020-4722-9464-fae8ac0d6a9f", "comment": "Malware payload (Mirai)", "value": "02e7cb23148a10b900e0477dc1c79170f02d23ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069605, "uuid": "f255122c-8d0d-45d1-8afc-d3792f32a469", "comment": "Malware payload (Mirai)", "value": "eae9d7c0d1bda62376c22548273c0bec8f3fb9cc32a084184825a32519fda87e49beb501e7d51d663bedd3bc6de4e2e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069605, "uuid": "d99d71c7-2840-4202-8eed-f29141d61ed7", "value": "T1A8D2E16CC55D7A15C66D3EB951DE8AF9284CB0C0A3ADE5CE17238448B617B8BFC071A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069605, "uuid": "36109d36-52f4-48dc-b721-0b049322869a", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNps4JbiWUy:1bDs06t4BEub4sU/MbUBmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069605, "uuid": "c760330b-010c-4392-87a6-fe58b48f18e4", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069605, "uuid": "a00cf4e2-b72f-44fa-a69e-bb0ae3d9223d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069605, "uuid": "dbc3b2c6-123e-45f9-a10c-050f206f289a", "value": "812709d3e397f1c5f561f35e04909603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f492d667-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083357, "uuid": "2049b134-e9fa-4f4a-9b9e-6783b2190b62", "comment": "Malware payload", "value": "ea652aeb1f2d6e5473a3e5509794a01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083357, "uuid": "5e957e3f-388f-45eb-af81-3fcc52fe958b", "comment": "Malware payload", "value": "01df1df18b2f821769b994ac5ca883d75146f34b8544b65d2fab6eec610e14ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083357, "uuid": "5d19b17a-fce9-4112-a37d-366284ca95d8", "comment": "Malware payload", "value": "1706a3f59361bae768f532deeeab65604cadd3f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083357, "uuid": "0423c5c3-cb5a-4748-bea4-613209c0b22d", "comment": "Malware payload", "value": "8831d967c7fbb76b4bdcc35c924dfb7e783f21530dbb76e9272a957e1ca12be6c267308bd44ed5f8f02a68224c782fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083357, "uuid": "d9d1a6cd-84fd-4ccc-818e-e7e1ccdb9942", "value": "T179A6331587875E39CE8C8E3CA09F0F2BA7A08FD11478615243C575CF7A7A68B2D7319A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083357, "uuid": "f488180f-5855-47ea-9e47-f00aa3188511", "value": "c9a3edae9204609d90d0770c3583acd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083357, "uuid": "942f1011-8f5d-481a-936c-08eafd40b401", "value": "98304:QmrXgqHU+DTwl9zOHz7t1Q5RRlWY9HJ3CChZfYQmGkHxEW6jixpTYk:lXg4U4TIqY5BZdwnGIkjixRYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083357, "uuid": "b084ab69-66dc-465a-84d5-d6d630f82ebc", "value": 9899548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083357, "uuid": "cd1053e9-8296-44ec-b4b2-5affd4c20fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083357, "uuid": "730a1dc0-999d-4699-9837-302348a047a5", "value": "up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d90c86-446b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693093805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093805, "uuid": "0b102a48-3cb0-48d8-9e49-6692f57414f0", "comment": "Malware payload (Mirai)", "value": "b183ad26dee012f5f9e3733ee845ef9c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093805, "uuid": "48dd455f-dfdb-428e-a389-db651463db16", "comment": "Malware payload (Mirai)", "value": "0226b38998daab4f2c846f4a7210643238705fcb173d589de33ea676ef48d97f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093805, "uuid": "61aff23c-7a95-489d-891d-c0582621dee4", "comment": "Malware payload (Mirai)", "value": "85e8cd66b84836bf3a79a993f26c4e58664eaad0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093805, "uuid": "92ec6c31-a33b-4949-a008-eafbabb85af6", "comment": "Malware payload (Mirai)", "value": "2f0eb5d34a1fd5261d8075633ab5cf517ef8d3017cffee40a59b92182ebe081ac0eea1cd8a1920fd7eb9bb9a0fa43374", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093805, "uuid": "767b03f1-cf90-4bf8-887f-cb48922ba5b2", "value": "T1DD4302716A1C83BCC3B56CFEC5F7C2A1E8FB957A6CA5B9A59540184860223009CF9BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093805, "uuid": "3ae7dff2-5beb-4f6a-b4bb-0ff53b352c12", "value": "1536:PFBn23bd9cLu2BNrimUSWi0LV7Fh1A1agc5h:9I38lzypLV7Fh1Cab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693093805, "uuid": "6b99debb-4923-4130-9daa-8a9973b55ac7", "value": 56032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693093805, "uuid": "c5f16efc-308d-4537-a44b-631606caaca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093805, "uuid": "8b8bae37-7059-434f-a5a7-b770d5143648", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01eab19-4454-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693084074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084074, "uuid": "d99a268a-1a9e-4284-a07e-935fc91795c7", "comment": "Malware payload", "value": "0520b6360568552aca134542415a76cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084074, "uuid": "63a749ce-27bb-4e0d-9bfb-b87c9bcdbce3", "comment": "Malware payload", "value": "023c62a7f9a3b29de07199fadb01e927fbeff53868303fa008a72eaa3c8606b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084074, "uuid": "2190d19f-85d0-469e-8e09-42859234fbf2", "comment": "Malware payload", "value": "97f64478bd6ebb490d67cd0ec7943c4c94461809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084074, "uuid": "711220d5-225f-4c13-a049-c1f58bb33503", "comment": "Malware payload", "value": "1df9c493e57ac5ca6409ed05e523fc6ec7e4bfb82f1cb00e0f3681cc1849755cf17f02161507fed1309967ce279573c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084074, "uuid": "e83d3f4b-d54b-4fac-b9bd-0c3b8550ff9f", "value": "T1D966AEC1E7C781B2EDE22179156BE25B4A366D064311C6D7B3983E16F8303E2797B2C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084074, "uuid": "105a1f6d-1114-47f3-b4db-d061b322e596", "value": "0f38e6d5b286c8ef5d43561518e55020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084074, "uuid": "9f76976c-d5a2-4a02-93db-39918c0d4b48", "value": "196608:UtC/n7/ms6rGPEq8AKi+MOCEJsv6tWKFdu9CZ:7CDJsv6tWKFdu9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084074, "uuid": "41176cbe-b74c-454b-a652-14fa12eab062", "value": 6854656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084074, "uuid": "3d4fe850-483a-44e3-88ae-ab34fb3a3dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084074, "uuid": "820ee485-4941-419f-a829-a54278fc3e91", "value": "MD5Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39830ca8-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046107, "uuid": "6ede094a-43eb-4708-bfd1-42fe759b6865", "comment": "Malware payload", "value": "671b0f9a98eb47c05033ec7baff0adfd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046107, "uuid": "6c1518fd-17c3-4f0f-a79e-2007a78b0825", "comment": "Malware payload", "value": "02c14eefeefad691ad34737fbb3f078751e4a768ae9cf3889df9cae2da01a922", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046107, "uuid": "025f6438-c0dd-4bbe-b47f-34ef4cd45e4c", "comment": "Malware payload", "value": "a935bfecc073a892cffbd7e419a8b1bf3aa70c09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046107, "uuid": "82f5c848-384a-45ac-95ad-6a102e91dea4", "comment": "Malware payload", "value": "7a8bf436cd243b3dfbe6e6df56786652e6ae8ccee95252deab2abae91bec2eab7aa5e5271e23c3348259e121f0ecda3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046107, "uuid": "56383e79-9df5-4d43-919c-016ef97a0a0a", "value": "T12B6501F75E37AC59C19478BF2EB366454CBAD01424AF5C16B0B326A7E1DAC8408D705F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046107, "uuid": "44685ea1-c075-4b62-96be-4a58fa42583b", "value": "8922c59b15625f9acce201c7e86ee711", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046107, "uuid": "25e82087-9293-41f8-af62-224376b8a7f4", "value": "24576:8goAnNKqRtVLe3VMCrX9yTDTzrPPtiGA+q7gMgYXnCF13Gn379xM3+Mdc:8FAnNKqFqVMCziT91tMgpT2n38Rdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046107, "uuid": "2226204f-e2a7-4341-a21a-009d1acf8fe8", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046107, "uuid": "6c357b2c-a8d2-44f3-871d-be7932056451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046107, "uuid": "77502327-33d5-4010-a112-c2188596fb65", "value": "SecuriteInfo.com.Win32.InjectorX-gen.9236.27357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce066316-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081145, "uuid": "d4fd287a-b849-4bfa-bb05-9f195f09ae6d", "comment": "Malware payload (Mirai)", "value": "6573cdb6b9b8bc1b33d718d16f6c1ace", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081145, "uuid": "7078281b-037e-4fb6-982f-2ed516b094c4", "comment": "Malware payload (Mirai)", "value": "03860d7b3594de9c22fc5156e288434f09f56ed9557640561d83b8f3b2daed95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081145, "uuid": "2dbddce7-b030-4369-9ff2-ce4f9320f1af", "comment": "Malware payload (Mirai)", "value": "1f2d1c01ada9556f753618bf4a9011b1a64a45b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081145, "uuid": "51a46edf-395b-4af1-95d4-8fd804f772c5", "comment": "Malware payload (Mirai)", "value": "3912b3d88b688d36f4a83f65a9a9933e2c0e88b39c6f5e2dddf0d89952d3dd97222b4974e3a4bbf8fec79a9a8bbb2151", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081145, "uuid": "15f64683-8594-46c8-94a5-e6bea89b81e9", "value": "T18B93E64BEF610EFBD86FEE3305E80B4135DC565722A92B393670C928F64A54B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081145, "uuid": "3f4393ce-289b-4526-b883-c631755d5164", "value": "1536:yixxsA9VLvqPCqEL9E1PAOIqFncqyYERbr+A1AqlZBj9eyswaJdlUqupfdM9f:yix5QHcEohdr+eAqlyd50M9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081145, "uuid": "6259f258-66af-4709-823c-a53490415edf", "value": 89948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081145, "uuid": "fb4e4417-bca0-471c-a2b2-1e83dde1b72a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081145, "uuid": "fbbc07b4-4503-41ed-b4d5-fd4409d41f29", "value": "6573cdb6b9b8bc1b33d718d16f6c1ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273c9a2b-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046076, "uuid": "249f51cb-66a5-489a-b6fb-d7a6f5a7410c", "comment": "Malware payload", "value": "b42ece161945127bfb6b591f4b1ee2e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046076, "uuid": "cb64da37-5adb-44f9-979e-53b5dd4f3e22", "comment": "Malware payload", "value": "03be07b36a4b562720b1623cd1f6923405ebf15ca71fb112bb76ef2d6495b769", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046076, "uuid": "97c27be7-619f-474b-9a52-33069415a2a7", "comment": "Malware payload", "value": "936e35b15e097ab225d2839316aff0e6b61724da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046076, "uuid": "a08265ba-108a-4889-8875-a398db13f269", "comment": "Malware payload", "value": "8b888c57630258e8f47c279c1f5087a80d2c6e9e542f16e3d10303999fe81751536c5baeba71ef47a22da2c005ecfee3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046076, "uuid": "fda4e924-ac9c-4256-80ec-d05adfc6e46f", "value": "T1C1B35A0174918032D5BE5D3505A5E2629B3D7960CFD58F5F2BA90AAD0FB82C0BF35A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046076, "uuid": "d4907f0a-038d-49ce-8224-bbe9ca1b5137", "value": "0111e27ab3dc3b3556ed556a60faac73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046076, "uuid": "96da5494-ff48-474c-b107-942fb529f9c4", "value": "1536:y3mgW+VG2ikVsu0sjIoqaqRzEOnrdDxyWttQousWncdQMqZtIw5QtUQByA5bp3hy:8mTssoXQzNrdttFFQMqZtIw5Q+QrxHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046076, "uuid": "fe1c6c57-3c9a-4a77-a3e1-5f0b69bf6a11", "value": 107936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046076, "uuid": "85af9e79-6c6f-4e03-bad7-02aa5b24f496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046076, "uuid": "c54c6970-9c70-4b57-bd03-56281c2f1dd3", "value": "SecuriteInfo.com.Program.Kuaizip.1.17768.12927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0591e8a3-43eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693038718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038718, "uuid": "1eb7ed98-1ee2-4787-add6-1b49837d4859", "comment": "Malware payload (Amadey)", "value": "511a1804c2d2b80569c88519d6c3e57b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038718, "uuid": "82190f7e-9131-496f-a744-06418a0af2a9", "comment": "Malware payload (Amadey)", "value": "03e5caf41ee389b7f23d1ff1f0b57f129c820eb74fa6795aa35ef3ff4b7add83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038718, "uuid": "5448a62c-a42a-4256-a420-5fb514a7e1d9", "comment": "Malware payload (Amadey)", "value": "e04e1e29616d45f2df4ff6f9bd3a7cacc1f65556", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038718, "uuid": "9f2fb4bc-ee00-481b-8baf-e90c3ffebb43", "comment": "Malware payload (Amadey)", "value": "1d874f9722f6a950a5385569b4033eacaff800f86857aa7862361540cb1f8462836c3505c2f5524819401d3df4ca2461", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038718, "uuid": "b6385291-8d03-4b48-8ef8-5a6f137bd835", "value": "T1DC15120367E8D472D8756B7068B623831E397CA2AD78876B1784690B0DB25E8F533737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038718, "uuid": "3f2cd8a0-0a6c-42ee-9df5-132949331025", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038718, "uuid": "b22a7c81-63c1-49cd-bdf2-c4c30b03596c", "value": "24576:pyptgp6ZKoiWlozWJGJY30dVhBk7tqFpCd:cvM6MoiWezWkJyEVhBaq/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038718, "uuid": "94763916-d5ae-4b2a-8488-770f4b8d43bd", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038718, "uuid": "f3cd0e94-8bb0-46c7-acd7-078b17a8978d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038718, "uuid": "330dc355-8665-4111-9d67-680e591184ea", "value": "511a1804c2d2b80569c88519d6c3e57b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e95409d-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084931, "uuid": "d89c06d7-7697-44ed-83a2-4c0f87799fa6", "comment": "Malware payload (Mirai)", "value": "9a454ae445215dbd07309faba592386b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084931, "uuid": "ced0aff9-5eea-4f18-aec4-5e695c3c40e4", "comment": "Malware payload (Mirai)", "value": "047ff366def42d02e86a4172352d41289c828de493590b8dce2ea90455179855", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084931, "uuid": "e3973ada-bb27-45a0-82b5-966535c2f366", "comment": "Malware payload (Mirai)", "value": "760c1c679626739617979cfeee7304cb4272bf0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084931, "uuid": "a4c7c110-c034-43bf-9079-3f5bbec8676d", "comment": "Malware payload (Mirai)", "value": "4198f0619bc9762b3bb3dcf592381e369e0fb83de769ea271343011b3cdaf97d901e57d559c390caa6b7204f59c0c808", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084931, "uuid": "cab536fc-210f-49bb-ad48-22c12dfff59e", "value": "T171F31A46EB408B13C0D62BB9FADF424533239B5497EB73059528AFF43F8679A4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084931, "uuid": "b65c59f5-c8a3-47a5-bde4-2c879575d63b", "value": "3072:z621WpoWkYaazkqzZoMDMsCX8Ae/yR7ZkonM/ROj7Xud9:D1WGxYaazkqVooyHe/sznM/ROj7Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084931, "uuid": "11229fa5-dd29-4c10-a555-204d93fc196d", "value": 171914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084931, "uuid": "a7c1cd01-ac3d-4c3f-a0af-25f37a0b7fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084931, "uuid": "06abccd2-b4b4-40b0-84ff-3b2eeea870ac", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1bbf76-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046116, "uuid": "bd4fe05b-bb55-48fc-bfa5-12b1db2e1c6f", "comment": "Malware payload", "value": "29e7241f657f789030f3a55f047eac99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046116, "uuid": "e4ce2d67-2c10-4350-9c17-4587888decf6", "comment": "Malware payload", "value": "05270b9866edb4029cbd9e5823c9f41dbc53f14ff0dcedbed00626c5ce6affa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046116, "uuid": "16b42177-3309-467a-9c33-a28204d28f38", "comment": "Malware payload", "value": "d7e2a30535469394e577ac02b4f97b3bd8c0a9e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046116, "uuid": "89af4970-c737-44f3-9951-c309c80beadc", "comment": "Malware payload", "value": "608dc6104b579bc82aa8ce404e84ca29fad4fa30e75cf062a5a1f7a086b8c95021382566e38f7016013acb49db840896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046116, "uuid": "6353ae8f-cdb2-4f23-b01c-f4f94db81fe5", "value": "T17CB57D31EAC2C872D5D154709B296A547A987DB23F1411CBEA4C3E9D3B784E3163B3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046116, "uuid": "fb9cc5fe-41f6-4cd1-9f2e-08cc737fd932", "value": "73fff026f3306c477cd87c297c655ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046116, "uuid": "8bc84c44-83b0-4fbb-b522-9c3bac02dc9f", "value": "49152:siuDoVZzjWB3vGs7+swMU/5LjtmWWnVkOJIqbnzJ6d1bR3o5dm:sUZzaB3vLTVkOJIqbnzkHbR37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046116, "uuid": "2e7900be-88e2-4c15-927c-4b895aadb494", "value": 2274208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046116, "uuid": "ab39c07b-ce62-40fe-ac22-873614dd8e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046116, "uuid": "a9add9dc-bdba-4f78-8ec1-2df31ace8021", "value": "SecuriteInfo.com.Program.Kuaizip.1.28363.3698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce2c808-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693038703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038703, "uuid": "fc81af49-ecb0-43d7-862d-892384e4c381", "comment": "Malware payload (Stealc)", "value": "4ab252a7c258896d16c0947eb923367b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038703, "uuid": "3d475483-f917-4354-91eb-166958b6f831", "comment": "Malware payload (Stealc)", "value": "05564e0d6fe1ae0a70943353d51dd0bc19a47ec896ee36533632d34b9f557a90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038703, "uuid": "bf9ee600-3c38-4f9d-8416-117136349457", "comment": "Malware payload (Stealc)", "value": "d088b8fdc1b6ed67beb858860db6eced74323c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038703, "uuid": "43e3afdd-5eb9-4bf4-85c4-a3f17bff7b03", "comment": "Malware payload (Stealc)", "value": "f5c4e2676231fc9aba0927150c6458c82932e6c4b0ee0cc4ee6441d6da95104c21c85343a0047f6b94f84d38a9711854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038703, "uuid": "61671a33-189b-4283-bc65-79d6917b1748", "value": "T15744CF1179D2D4BEC89204309824F7F4767FB8338699898777683F6F3D31392A6A6352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038703, "uuid": "93756b2b-b8ca-402d-94bf-e4f353489c79", "value": "478e1adb03a4046019e6832a1ee52bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038703, "uuid": "6c909265-120f-4e03-8d99-e55119c2cf71", "value": "3072:lFXQCIKlTtEL5p3R59wSw3FS7k+3FgupnBgw9b7+85vysFG3Z5R9lR/TAGRO:lBQ6T+L5tR5yDMk+m8aw9nYQ8FDNT9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038703, "uuid": "c1883714-8b2e-4a79-8e28-6fab06d3a0aa", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038703, "uuid": "f141bfc7-b3be-483d-8a77-ed63048bca08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038703, "uuid": "04a9d836-fc76-4928-8bd4-437c702f5b29", "value": "4ab252a7c258896d16c0947eb923367b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d147fa9-43e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693037684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037684, "uuid": "7d9da8f1-4aa4-425f-837d-42b7cab6649c", "comment": "Malware payload (Formbook)", "value": "a9873a6bbc2bca4b14f3cf211d0fb231", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037684, "uuid": "84be7a48-533b-4200-a9eb-ae649dd7b6f8", "comment": "Malware payload (Formbook)", "value": "056423487d9c1640e5a94f843a5068f537fdaeac6cffd6225eb7d34c0b27434b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037684, "uuid": "1f30a5f5-bf25-4cce-8cb8-2990ad4f429e", "comment": "Malware payload (Formbook)", "value": "9aa9e1a85595fe3733b276196f2052c0bdc0e470", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037684, "uuid": "5012a954-29de-4e9a-b20f-c5719e9d79ba", "comment": "Malware payload (Formbook)", "value": "61dcc3643a771a3ef7ba6823ac85e04a04c8dcb045a0b62ec133c7a1a39983742a2d2208d535b384854294f600ce4249", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037684, "uuid": "4e7db001-f7c4-4fe0-afc5-a04f86507465", "value": "T14C63B56EE30F0959DF56967B834A4E4906FCB73DB38540B138AC973437AD82E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037684, "uuid": "d368b310-3ad1-44fd-b82a-fcafdfbf2272", "value": "1536:BwAlRmlZYFfZ8PZOGdOX/XLGfaiVb5xtjvFsu3AZsyatxFO5O5889jnhjE6VLnUu:BwAlUZYFfeBOGOv7Gfailtj9suOsyath", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693037684, "uuid": "d6f4d290-efaa-4942-b4f6-f20518e841f9", "value": 72544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693037684, "uuid": "73ef9035-5565-4c50-a36b-61eff733fd62", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037684, "uuid": "af690527-6bb1-41ae-adfe-4e21c39eb78d", "value": "INVOICE-678738.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a44ec20-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1693083447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083447, "uuid": "0cb8cfe4-946d-4eae-8831-0ea3d96fe1f5", "comment": "Malware payload (BitRAT)", "value": "03b9dd8b1e16ad5c2a605ad6b18493a7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083447, "uuid": "752974cb-671e-409d-a685-29a0ac5ab186", "comment": "Malware payload (BitRAT)", "value": "06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083447, "uuid": "d0f4a778-ff7c-4426-bba7-ac3a0f649b51", "comment": "Malware payload (BitRAT)", "value": "725f4473d8e09a8a9fcad2e8900dfb74623d4f18", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083447, "uuid": "8531c0ce-3aea-405a-bcdc-bba5a4c0ed19", "comment": "Malware payload (BitRAT)", "value": "1e5bc1d521750ede14302c53ec0aa9ec74505f4049f9fc9440602490f20016d9ef4ab19957d1131c28e7061c401ce3f4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083447, "uuid": "baeb2c61-210a-4d13-8735-8933632842ba", "value": "T16286D011B5958C6BD5565238CAEFB33B223CF6600B23C7C367506A394E73AC13E66B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083447, "uuid": "7c2c5a82-a24b-4099-a3eb-495242ce83e4", "value": "2b817dc1b1849c6a436f0647be7673e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083447, "uuid": "36806bef-45dd-4520-8a08-7fc5cfe54223", "value": "196608:LIRcbH4jSteTGvwxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfA:LdHsfuwxwZ6v1CPwDv3uFteg2EeJUO9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083447, "uuid": "d84f9efc-6868-48e8-95a1-7fb38b3f914a", "value": 8177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083447, "uuid": "f74e1d7f-2bf3-498c-9882-643cb4017aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083447, "uuid": "df2639bf-e963-49e0-9037-79e00481c2bd", "value": "time.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4d2c6b-4462-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693089895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693089895, "uuid": "7d15cabb-1825-488b-a50b-2118f023da38", "comment": "Malware payload", "value": "1c0fe606ea62c286d3b337f94b826704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693089895, "uuid": "ca4adb3f-093e-432f-b757-b910f532affb", "comment": "Malware payload", "value": "072d9ec624a9f2068e8305f8a3ccb7b709555c5de8404ccae95d0c53b398cd5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693089895, "uuid": "8fa9e0a5-59ba-4382-b04a-22b075f7f6e3", "comment": "Malware payload", "value": "274462a822955cf5ef71b1515152d2243cc723cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693089895, "uuid": "da22c220-ca4b-4f09-8afe-b65f12501322", "comment": "Malware payload", "value": "f59585e7c626f816f8f807b7c3711bc165214ea74e2ffc11d25fbea3de5c190ab5b643fd8be3b58fcd5a8506e50e0fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693089895, "uuid": "1e4831b3-20ae-4814-80f8-bc0f869c83b3", "value": "T149D52390BAC58031D8A1187612E196702B7D7C341B7A8FE71794AE5F9F392C49E39F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693089895, "uuid": "2497a342-2992-4c5b-8b77-c2193855d02a", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693089895, "uuid": "68fd5ff6-bc92-43cb-95b8-fc9017733477", "value": "49152:8cbi6Cemla598sz/G21H/M1aZczGdBs3UR0wHx8scuLgXvRlySVmpHh:8cb0lAPjG2G33U01NuSqcmNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693089895, "uuid": "e2734828-ccdc-4c2c-ad40-80a42200d768", "value": 2842925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693089895, "uuid": "b36540b3-117b-42f5-8c5c-d8daba12b34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693089895, "uuid": "6c5adba7-9f1d-415c-a288-fd93a91e2aad", "value": "SecuriteInfo.com.Win32.InjectorX-gen.13289.22531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eeaed5-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693038611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038611, "uuid": "d5f097de-bcf0-45d0-8e3b-f2ed3c2c8fcc", "comment": "Malware payload (XWorm)", "value": "a7ab9c71ef3ef84407cb04c48a50918b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038611, "uuid": "b7683827-406a-4027-92fb-ddb1acb362cc", "comment": "Malware payload (XWorm)", "value": "0ab11e7747bcda8ceb0de89503018a9a9f0fa18e975fd14f20680554aa087af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038611, "uuid": "f0954144-bf79-4ad4-9dea-b8246678fd05", "comment": "Malware payload (XWorm)", "value": "cf40c5c936623aca890de868cc2d98d60f3230db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038611, "uuid": "85fc364d-e9c1-4b6b-b1dd-ee031e9319cb", "comment": "Malware payload (XWorm)", "value": "53eea1f8877bf0b2d5de829ff50f53788c11a45a4155e76b033aeb4d1645999dfc6b9e2891cdb2a23fdae62f6421bf90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038611, "uuid": "6a408736-bc04-4e04-87e9-ee3d112f2fc7", "value": "T18FA4B15A0AE93C10DC9FC52DA76F7DAC4392034A5A0274A906FF4C586B3D6CF21E5DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038611, "uuid": "13c3a8f7-e8f6-4ade-ba8f-2cca93ca4f93", "value": "341ef3eec107cf8949a849080b1bfce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038611, "uuid": "79799acb-47b5-42bf-b040-7964cde1776e", "value": "3072:vJv3MDsAExVMgNzX9V1iuTTiQNxbehjnONWYKIqMOA6p7qrHbyrwJrDExXXhBne6:d1ASxbehjnOgYvTG8nlro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038611, "uuid": "8a839760-54fb-4d12-8559-1727687e41db", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038611, "uuid": "f781c266-c900-45e1-b7be-cb093e3444aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038611, "uuid": "1373c30e-95af-4e4f-a0e1-4bc1e518c68a", "value": "a7ab9c71ef3ef84407cb04c48a50918b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb07f945-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083261, "uuid": "623f80da-76c1-49e3-b572-49f24dc84725", "comment": "Malware payload", "value": "04e8b76ec68fada9403ff7e64655f668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083261, "uuid": "e6eb49aa-cba0-400b-83cf-2ab39c354804", "comment": "Malware payload", "value": "0ad6fccbb0ab2d01736b1b16dfddd38458fe18d6e6d655760c106584e3bb49a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083261, "uuid": "77515099-18fe-467a-be96-1ad0105f5d5b", "comment": "Malware payload", "value": "cf3b037886e231e92dce2b5450209c101eea932c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083261, "uuid": "1577be37-f7dc-4f34-b42f-cf47bfe822e3", "comment": "Malware payload", "value": "91ceb1783ab129e9eb16c3ddd52ef99089970a9ac2e53e65f36ae373333c287cc5ee04a60a3a33f147bdcf0244fedb7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083261, "uuid": "3e1dc022-ca74-467f-b2ad-e152ac751f9c", "value": "T1F4D6F123F14180A1C5961EB1797A7B386EBCAEA51B758687E7F0FD60BD32031D72250E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083261, "uuid": "8afb670d-42a7-4f5c-a358-7eb201919039", "value": "45d7ac4770e5299403c09d9266fec258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083261, "uuid": "28b58383-0f1d-4142-8d50-3ba4047df154", "value": "196608:MmZwQ5AeUu9H9qcZNvYzhsch7stnb2I34hGOCGTW4+MqX:JZwQ5A09dqcZizh3hAT34hGOCGW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083261, "uuid": "0ba4f407-7a73-42be-972b-416e6e3f5236", "value": 13328384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083261, "uuid": "81d2450f-2d1c-4695-9784-a40f673514a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083261, "uuid": "c68e1bf1-9943-43ce-a6b3-3f14f150f27c", "value": "DS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b96c9e-4426-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693064359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064359, "uuid": "9100e7c1-0236-413b-b255-c3669f28f721", "comment": "Malware payload", "value": "7e0692f8a2097f7c563c56b046fa5e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064359, "uuid": "11325d66-4239-4514-9bf1-b6c5bfdccb28", "comment": "Malware payload", "value": "0ae2be648fab712257457725c0bca30f2490b056f7f1f546746253dd72c1bd44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064359, "uuid": "e27575c7-33fe-406d-8149-02f5840063ce", "comment": "Malware payload", "value": "e76b83089620a8bbab891175d16bcd2aeaba234c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064359, "uuid": "0d274d7f-d246-4365-929d-cb18f9eb2f72", "comment": "Malware payload", "value": "579704c338d60d6c64fb4e9b48b8b8770ac7ea629680eff7099300e506d31eee19c61093cd760f9b131e117e5a657228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064359, "uuid": "f5c2842a-ac28-41ab-a833-5d2c666f46e0", "value": "T158E52342368585B3E1A36D322E60AB2986FDF8600F51D7CF13914D1DBD32BC297376A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064359, "uuid": "845d9827-9977-4dfc-a98c-f6c6a102381e", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064359, "uuid": "64991f1c-f22f-4a6c-9a02-dbd4924c1c88", "value": "49152:2WhlHLBfJXAE9opaDfo3kkAtMEVayyWTol3nk3/YDH15c60Nu0VeKdtTs/4ms:2WhlrBfKEOpaDfo3iVayy4ol3ns4VjGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693064359, "uuid": "c1b5df8d-c037-4381-9c7a-0a0d031cd092", "value": 3050564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693064359, "uuid": "a7be06b0-c1dd-45eb-9fc6-9090a6132477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064359, "uuid": "035f80ae-69dd-4230-bef9-42f379e95b05", "value": "SecuriteInfo.com.Win32.InjectorX-gen.14576.17680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603e43a3-43dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693032428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032428, "uuid": "022aed10-6011-448f-855d-5eb1273ecd9c", "comment": "Malware payload (Formbook)", "value": "a32ef83808036941c73fb567a2a63a43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032428, "uuid": "2334ad24-673a-49d8-9b99-2cb05e153579", "comment": "Malware payload (Formbook)", "value": "0b6787b9226255086a296198f8075b09bef790ebce89c8b3020f9ca2e3ea859f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032428, "uuid": "25ddbae4-b79b-47d4-82ce-6574a5e13800", "comment": "Malware payload (Formbook)", "value": "20d735d51b1d9397a69957c20ef54b3f67b97d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032428, "uuid": "db450bb4-70fc-4658-9a99-7117c89f6ed5", "comment": "Malware payload (Formbook)", "value": "da3d847511a87e20e93ce6dbf1cf4783f28a44434dee728bbfc27ae1630934750afae589d66fdd649cd9d2e5ae973700", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032428, "uuid": "1f4683e0-e122-4905-89f1-d825e00b245b", "value": "T114F4F10062F88654E1BEABF686B416540B37B6665A33E74ECDD414DE1EB27C04F1AB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032428, "uuid": "e812b5fd-dfb1-4f27-8a82-2ae11c99bbd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032428, "uuid": "8d55872b-7fdc-43f1-a0d6-0fc35b7e29bd", "value": "12288:V8chkVgEgL7hkrcltFXl76t8i/8QK1ox2Qewr0Gjag64JSp:6chqgNlkktdl76t8i41dwr0GjhSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693032428, "uuid": "3223d8b8-4093-4470-b351-b68c5113a962", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693032428, "uuid": "04477b42-5f2f-42eb-ad06-b3bec30d8ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032428, "uuid": "284b01ed-aba4-4bc1-81ea-f20c5254548a", "value": "a32ef83808036941c73fb567a2a63a43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba142c0e-4403-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1693049329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049329, "uuid": "6d22d5fc-81df-46ed-b26f-c2a5c813eb34", "comment": "Malware payload (MarsStealer)", "value": "0074aba30d947d03cfa0eb80714584c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049329, "uuid": "8de55a82-f6d6-441a-8081-f49245156ce5", "comment": "Malware payload (MarsStealer)", "value": "0cd41ce6482bced75d2d9e9ed1395b7ef2abc8d76c6a1ffdfd0f72193719f282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049329, "uuid": "e99bada2-d572-4c1b-816b-2d8c67c37d25", "comment": "Malware payload (MarsStealer)", "value": "c4acd9870a32ad8633e1dc282105b62f440c49d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049329, "uuid": "48460ad1-8d83-46e6-9746-5b93bfe3ff3d", "comment": "Malware payload (MarsStealer)", "value": "7f957036a9c3be16e51f89dc82ab254a55635444f0a90639d7e228feca4b1f1b4994abea3d72ccc5435f4e551475a73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049329, "uuid": "05a07288-3ea8-4386-9704-19884538beba", "value": "T1B5663322524ED379CCA70175D9F070F64B58DC4E8571EBABA5F87E0C7AA07822BB416C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049329, "uuid": "c48632da-7a3d-46df-b722-6921f4b58a24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049329, "uuid": "30ebe16b-133a-4c7e-80c3-b6dc4229d587", "value": "196608:3AkSvY5aIIGjIYEBCXaTvwnDaBybaf9n:3ANA42IZXwmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049329, "uuid": "f6b3ff98-f273-4b0b-810a-6850394c5477", "value": 6650880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049329, "uuid": "3400532e-701d-4a36-ae7c-08608123ff29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049329, "uuid": "fda06ee5-46df-491e-930e-372e0bef688a", "value": "Allergy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1c1c25-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046138, "uuid": "946a9c12-d673-44e8-b458-d8472e268ba9", "comment": "Malware payload", "value": "e8f2e441853fea00dd6e1c87d3f66775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046138, "uuid": "2c3cdc14-a2cd-4367-86cc-0a176e8d94e7", "comment": "Malware payload", "value": "0d3acbc0a56b99467b21aa2eccf2d7207b0e173b8b48fcd9b81e2b66a9ae1002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046138, "uuid": "baa9aaea-b79a-43b5-b7e4-942eee3288d3", "comment": "Malware payload", "value": "9a62a8395b41751439794ad0483b6b6e464e00ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046138, "uuid": "0d4a36c7-dae2-42aa-bbc2-52d9f6c82c6f", "comment": "Malware payload", "value": "1533e846a6d621f2e71388c91f9f2dba070d6114b4e9d59eb41b4fdb40cd459ff7853f622b0b44f284eed1f178649364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046138, "uuid": "45deceba-542e-4500-b26e-0ad946658584", "value": "T1FD16331AB99089B1C83258794FE2D6B1192D3D606F738DDFD365365C4B302D0BB3AAA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046138, "uuid": "9528f537-6f54-4b59-b687-3e200cb2a85e", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046138, "uuid": "f24eb325-4af5-4787-b7c9-9b0d8dc17a30", "value": "98304:4J4xahbx26J9MTr2/omY1SsU6HN5mGU6w0SVu3now:4JNRJa+/omYwsZzmG3BWu3ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046138, "uuid": "3ba52f2b-b370-4f47-9d45-c55b07dd8715", "value": 4030195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046138, "uuid": "0807da0b-52a2-4d7e-8e8f-7fb7fc149500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046138, "uuid": "e175d04a-73be-405f-b9bd-68f4d79e2c86", "value": "e8f2e441853fea00dd6e1c87d3f66775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2315fe-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046086, "uuid": "8f833834-50f5-4647-8c47-89aa63d2bad1", "comment": "Malware payload", "value": "93edd12d82aa6e87281b9fab595bf8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046086, "uuid": "41542054-edf1-4769-9d13-cd7de764b74d", "comment": "Malware payload", "value": "0e782bce63181d04c35f39f7ab125ac35bb06e51b17682fbd89a255954cc5b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046086, "uuid": "6f450ac5-03d8-4ec0-a855-af7d3215630c", "comment": "Malware payload", "value": "7661768e70cfc85dea5e2ecf2460aea2c8ab5aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046086, "uuid": "321d905c-862f-460e-93a6-edd5333fecb3", "comment": "Malware payload", "value": "9f8e026552b2d7d57d74dddf6ca706447604f95545df746711e0f5088b82f9061a8a3313d937b29cc2e02e7563d29c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046086, "uuid": "998f708b-7fa7-4746-b302-82fc55c17e33", "value": "T18925C4DD3C08D027DD6203F049B85EA2243D691C07D443D7BAB4976A75E04E2EB7EADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046086, "uuid": "a1c643f6-d1d4-47d6-92c1-2201ccb03a50", "value": "f8220518ea0c630292ce55fe4beb0533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046086, "uuid": "876dcda0-edc5-4e55-9c7a-e8027bf57195", "value": "24576:w7o7XiZBAE9qz2EEozUc4VVfPwS5J/kfDH9E:jQt94ifDd5hCxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046086, "uuid": "e1496246-6187-401d-942e-fab73fa7aa48", "value": 1006544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046086, "uuid": "6460b01f-dd1a-4a15-8606-75a567f7508d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046086, "uuid": "bc27e9df-a964-4374-9c9c-7a231c05121b", "value": "SecuriteInfo.com.Program.Kuaizip.1.25136.17847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c5cef8-4457-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085320, "uuid": "4f196d51-6fa5-411a-8fc9-5d464250624f", "comment": "Malware payload", "value": "9a0061531cd76bc700aa19b995a2ef2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085320, "uuid": "3ee63ede-17cd-484b-974e-584b9c2b3394", "comment": "Malware payload", "value": "0f10d9369da48622c47b87f91190889d0188449c43e39bd5bfcd24f73e7b6e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085320, "uuid": "a4f1b46c-76fb-4e03-9e1c-9198c163716b", "comment": "Malware payload", "value": "29e75bb6538c637b4332eb07e9d3981fae8a08a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085320, "uuid": "d796ddd5-7d5e-4581-99e5-fde40caf6574", "comment": "Malware payload", "value": "1d7116a7873a526b6ca0c6e01b32793f8204af64e2d309a0a167e3e391046ce743a49bffea4bb5a3c691eead5112ea0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085320, "uuid": "ca3c2dfb-ffe4-4430-b893-b609ef835ba3", "value": "T10736339AB11856B6F358F2FA265739081D0BD7CC3BB5A7B087DAB038587F0A4C06C579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085320, "uuid": "97ac6729-d97a-4a5b-9187-6a8959e5b8f5", "value": "4b8ea275b01195301d047f45b8ba14d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085320, "uuid": "94058787-7a41-4993-ab2e-d26055e68cb6", "value": "98304:XPgPWgHmckLSqA0l0BWlIfTJ77dC+g/g0Eb8dAkJhZCOka4yVT//cJDINHCIzq:/wWgGck+D0lOUYTJndCZg0Eb8KSbT7Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085320, "uuid": "4faaa36b-91a4-4aec-b89d-cc62d4faf79c", "value": 5140315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085320, "uuid": "6b8b17fa-336b-4115-8982-6b040af24cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085320, "uuid": "85ebefb1-2242-4dcc-83d0-6b967904f70f", "value": "adm_atu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1d6655-43dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693032605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032605, "uuid": "df25630a-96bb-459b-a997-ae22cce16e9a", "comment": "Malware payload", "value": "cfe0036af475d6169feb38e49a2bf404", "object_relation": "md5", "Tag": [ { "name": "Builder", "colour": "#728AE6", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032605, "uuid": "67f648c9-a867-4135-81c7-265dadb7f2db", "comment": "Malware payload", "value": "0fd4dbac52375aca25608b5a4e82c929db4af1b0860e3102122350843fe79bf6", "object_relation": "sha256", "Tag": [ { "name": "Builder", "colour": "#728AE6", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032605, "uuid": "be5c3702-4cf9-4412-a8e2-ff5fd99e6dfd", "comment": "Malware payload", "value": "c0919bf4873f00780720742897dee817d69c8fee", "object_relation": "sha1", "Tag": [ { "name": "Builder", "colour": "#728AE6", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032605, "uuid": "05571e5b-17b3-4066-9c9e-3e997a74cab6", "comment": "Malware payload", "value": "1ada9bd79bffc3d5e2789a0af51d158ad9a3842029eac7befeaa2c730313d575ce2ff51e552634e97f7623424bc31515", "object_relation": "sha3-384", "Tag": [ { "name": "Builder", "colour": "#728AE6", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032605, "uuid": "d68777da-9c64-4b04-9db0-2862af8c2497", "value": "T1496423FF78448418E6AD44BF91E88609CF2EDD095325946F0DDCA84FF5B1281C3F6696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032605, "uuid": "b4b2f937-c6a1-44d2-947c-0683fe6a82a4", "value": "6144:UCsk/lGlXkzWddlhMrHzsDYU1y4ISDnvhiy1CiLtOtJJqXkzWdtjhMJk2:v5ukzYdfE0YUGIvNt8tgkzYttM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693032605, "uuid": "b6b5d5f4-f806-44ac-b09c-3291f92242d0", "value": 311019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693032605, "uuid": "95c15c41-c7de-4041-87b1-6a80ebf8d85f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032605, "uuid": "707fee2b-b079-4504-acc4-d2ade6edb610", "value": "Ransomware-Maker.cs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad47243-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042592, "uuid": "9e77e545-e5a2-4cea-b68f-b85c4d13f317", "comment": "Malware payload (Mirai)", "value": "4329ec6ea59b13063ce7843176b5fb3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042592, "uuid": "3601f1ec-9f38-47a5-950c-989a315b314c", "comment": "Malware payload (Mirai)", "value": "10e3ed4be00d6b3905e78f8dcdfa0e1a36c2b6d42fa9ee7c2fbe89cfe2ef7eec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042592, "uuid": "17992d17-92e7-48ff-8350-abe89eb28778", "comment": "Malware payload (Mirai)", "value": "c9974a0989c3253214d7864bdd4e1f26181eb92a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042592, "uuid": "fa7a5211-8298-4809-968c-7fd43f85e891", "comment": "Malware payload (Mirai)", "value": "b0c9ae1e405b18e1f9ebc89639ff615c88885d642dff017d05a16f16ad9fd7aa1e13d3930703e4e6093239fcb9516763", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042592, "uuid": "1ac3e871-b3fb-4b3c-a5f0-97a2e16ce34b", "value": "T169F3C81AAB510FBBDCAFDD3702E90B0239CCA55722A43F763674D528F54A50B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042592, "uuid": "937f8a59-5525-464c-9b26-2f3b4a068366", "value": "3072:MhdpFxtbYbyX72o8TIUU9ypqnNJg049Llz:MhdpFxtb0yL2hIUQygnf3KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042592, "uuid": "5895586b-187f-493e-a8ff-41b65b0d391f", "value": 169648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042592, "uuid": "dc39ad36-020c-4adf-87f8-5aea7f952cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042592, "uuid": "1a42ce93-79be-44a7-9b61-ee6e76f1ba66", "value": "concakhbtandhuy.mpsl-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2be7697-43e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693037747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037747, "uuid": "7766be3a-dd01-4784-99b3-c44d555c20c4", "comment": "Malware payload (AsyncRAT)", "value": "3418b017427242f8e467d4e11afb3426", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037747, "uuid": "3f3b6a73-320f-4e48-80de-0c9e91da6a1d", "comment": "Malware payload (AsyncRAT)", "value": "13b8c773e428e2f60d78e8d9bd303ffe79d827a155a0885f977096b151a98834", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037747, "uuid": "0ccd5425-8a55-440d-b8e0-1e1f3612998d", "comment": "Malware payload (AsyncRAT)", "value": "8511051afa03fea4abe6e37a8ee4224ae377e7a9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037747, "uuid": "4743f2c6-65bf-4478-ba40-96dc394ad921", "comment": "Malware payload (AsyncRAT)", "value": "8136d7e08b03512421df4b79ea9fea1a285aa6911a47d9a88ff373a17dfa11002d6c8f3b410e131b816496c99044935e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037747, "uuid": "0ba4fc58-8ca5-4bc6-be83-a079736a8100", "value": "T1B5051279FBECC40AEB8C27B89CEA11F652F1964C3453E3E9110965B9A7063E17D4620F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037747, "uuid": "7391c64b-2511-49ca-94e6-703c3ba9903d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037747, "uuid": "3cbd9e76-b275-4d92-892b-9af7d60c434b", "value": "24576:Vu+b6Xs7mZRFpJbeja1gXSecUDnJTCT77SR6hXR:Q+PmjFrSa1gXSecEVcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693037747, "uuid": "c8e270ba-4202-4769-9503-05ebfc5e836c", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693037747, "uuid": "2a79dbdd-b574-4edd-b176-54b515838b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037747, "uuid": "aa19be62-b510-489c-8889-e0fa81a9672f", "value": "3418b017427242f8e467d4e11afb3426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6fcf9c-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693038708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038708, "uuid": "2fc9eb29-87ba-4d4c-853f-df058d81aee3", "comment": "Malware payload (Stealc)", "value": "95a5271960e44c8eae07e31717662af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038708, "uuid": "2bdb6852-aaab-48f5-b4f0-160d6d75f38a", "comment": "Malware payload (Stealc)", "value": "13ce643b4ba34757d8d5fa9e071308fbb0120bd467588a4b3b7e6181275af6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038708, "uuid": "c48bca98-ba17-4876-82e4-7fb2b82bee66", "comment": "Malware payload (Stealc)", "value": "a6cc5ee6469dba1be403c9f2f0228b1b048d7255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038708, "uuid": "6b524e73-e4a7-487d-8586-4be88d873847", "comment": "Malware payload (Stealc)", "value": "12799a12e1d2c75bb55d6356d153c1328b2670ae422b169af91c733ff60823d0c77660862f869e9a607078898b5a3ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038708, "uuid": "c3a3b55b-fb52-4792-a28c-28084736ba9c", "value": "T1D044BF127A92D472CB9784349820C6F525FFB8729699948737683F7F3D33392A667302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038708, "uuid": "b8ee3a09-b35b-4fd3-b013-dc8fb61c8b81", "value": "d3222423d0989f54e4fb484f2a3e8764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038708, "uuid": "f7a463fd-a527-4808-95b1-5ff472764af1", "value": "3072:eXQOEP7TbwLId7P0e2mX3ChyEcYr/zt1e1hSBRb2df5aHK5M36sTApRO:msjTcLIN0e9ihyVu/zBZfRTaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038708, "uuid": "6e8d1eb0-91a4-4e3d-bf1c-dda5ef2aa48f", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038708, "uuid": "d6bcacee-1cbc-4d6c-ae37-c45b49a62544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038708, "uuid": "d76c158d-0246-4bbd-8345-f618ca9bf2c2", "value": "95a5271960e44c8eae07e31717662af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffaf10c-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693087000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087000, "uuid": "eab807b4-20b5-492d-9ba3-32c4e5ab43fd", "comment": "Malware payload", "value": "68dcbfa86ca082b7b0e6e2586abec5ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087000, "uuid": "de9199e4-1f55-4601-81f5-411a5eb8ac53", "comment": "Malware payload", "value": "1420d2c3eb7ffe709845a96e74d9deb2cdd375c1aaf43a35e347ea96a8b1e832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087000, "uuid": "92f0cfb0-3ef0-4848-8784-8f37dbc2c312", "comment": "Malware payload", "value": "0c75ea732140c66aa27e8f84638034ff5a08d47e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087000, "uuid": "890718e5-ad73-428f-bd2f-795f5642601c", "comment": "Malware payload", "value": "bf634175e554c3c0e7f7988b572ec089099d7ec34b57d19ac2b93a70d3a619925c531cacfc79d68867f4231361602288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087000, "uuid": "c4bc8c0a-ff27-43c2-820a-1ca2b4e9305e", "value": "T1BE656D2AEB1525B4DB635371C59EEB7B9B14B52480329E3FFF46EE0CA8330127C99251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087000, "uuid": "e047b1f1-2210-4ef5-ad6b-ee8c41877939", "value": "2bba10bc6e6e0c67365da76653e3e10d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087000, "uuid": "ed2bd80d-21b4-47bb-a503-89919b0dc8a3", "value": "24576:F5EHk0PMCqYOY+q6bQ6fMWfdruPgiAtAzNK4QmjF0t5L:ik0PMxMX0CjF0t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693087000, "uuid": "ae260c40-24f5-41df-967b-5928d034a4af", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693087000, "uuid": "f7ba08e5-cf1b-4877-b8c2-7245b4f66c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087000, "uuid": "01a4a5fe-c305-4986-8f3a-75bbc614051b", "value": "68dcbfa86ca082b7b0e6e2586abec5ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d709dcc3-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015447, "uuid": "1af057cf-6281-4df0-8fbd-aa7ba0fc8ec3", "comment": "Malware payload (Mirai)", "value": "bdaa4654d0d8992aeab6e163171f45d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015447, "uuid": "31d0c64f-fd42-49d5-895f-82ccca54fa98", "comment": "Malware payload (Mirai)", "value": "16fa8aa2925a73337b10db7ecdbb2113be1cea02bf01973ac1ebafbb4dd41873", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015447, "uuid": "00f82ea4-973d-495b-97df-b72cd2ab29f7", "comment": "Malware payload (Mirai)", "value": "a4e8fa98ace95e463385eaa5074542e0ed3e5cc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015447, "uuid": "50927892-8337-4719-9793-c4eadcd405da", "comment": "Malware payload (Mirai)", "value": "8c05136824e0572bf68723d885e3ec5699c01ce8033b071150945bac234edafcb2ecded433833f5fb1a4697d14b8f6a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015447, "uuid": "2dfbe8db-aa7c-4a1c-934c-1efc2d8620cb", "value": "T1FF539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015447, "uuid": "cd79a969-bdb3-4b48-8d10-4a0e9eea1003", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015447, "uuid": "ba4c06b3-2d35-40b4-886d-eff20695b2b8", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015447, "uuid": "8435bfbd-c854-4ea3-aab3-979b8663bf47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015447, "uuid": "1c8a51ff-b0fc-4154-9bd9-87f0d62dc25a", "value": "bdaa4654d0d8992aeab6e163171f45d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319d55e8-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693086896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086896, "uuid": "932c406a-df29-49a0-8976-a85d011b66ab", "comment": "Malware payload (Mirai)", "value": "e5f7414e9244f8dc20158e5e41f96aea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086896, "uuid": "d42b17e2-b917-46f9-ab31-0990165eb2f3", "comment": "Malware payload (Mirai)", "value": "17811a90f750accd5e9211c8251c267cf22f6a77b7a79325a01ee33259a9587c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086896, "uuid": "5ef1e795-534b-497f-9dd0-50c10dfc6b5b", "comment": "Malware payload (Mirai)", "value": "abbf2f179af7c5341c6b5407510a7c311f59ce23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086896, "uuid": "502d4cba-0a03-4830-9eaa-6f49d36c1213", "comment": "Malware payload (Mirai)", "value": "69742601dd8632a6c4d8bf0d1f1526a04ae039d4b8e87170d249332a173d56038de184037c8f13265b1383e33da3fb95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086896, "uuid": "f3b53128-d735-4a85-b021-d6193a117c6d", "value": "T13AE318D7F800DEFAF80AE33B48530805B130BBA245925F372257796BED3A1991577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086896, "uuid": "e19fc4ef-c5f9-40d8-8ea6-fd9f2d9ccade", "value": "3072:FnMaMwaSjLGtJfBYyDxAaJHGc+EVrjbinLN2asCyAwdcE:5MCM5z1AMGcsLN2EyA8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086896, "uuid": "970cfe79-e097-481b-a519-e9e01299b118", "value": 143744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086896, "uuid": "e96e965a-35f9-44fe-a5a9-542ec7a2ab75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086896, "uuid": "d0c1c6e6-78c4-4e7d-b236-d2fd6e7dbfa4", "value": "e5f7414e9244f8dc20158e5e41f96aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d2f7a9-441e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693060784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060784, "uuid": "e7e0d681-237a-4a5c-bda4-ee7c264f18a7", "comment": "Malware payload (AgentTesla)", "value": "5d1ffd7f5279de7cf624f23f89e8b32b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060784, "uuid": "f9f620d3-c513-40a4-83d2-72b31254b634", "comment": "Malware payload (AgentTesla)", "value": "17a097e7721e0542fb64dc7dd250c63b5ad3ed0a9ca2e23cb6df95e5a26f528d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060784, "uuid": "eaca1b1a-87e9-4e67-b140-29d590103dd0", "comment": "Malware payload (AgentTesla)", "value": "d0de4a7831b470c90d4f1c79df64a70c890d8b26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060784, "uuid": "d9c5602b-3510-4f7d-8cde-1173b3bb3f8b", "comment": "Malware payload (AgentTesla)", "value": "eeac430c81fd9fd4329cd4b8c04212c7e09479bedf13c684de82a88c23fc872228ce90524b5fd9b90dc01e9ed424fd81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060784, "uuid": "1cd5658b-e0ef-4564-bf11-9a4469e08152", "value": "T1B3E4121032BDCE87C5A081FE9136549103B2F6281A51EBCA6CD5AB8F3DF3F554628B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060784, "uuid": "fb33ca91-04de-4349-8094-3faf49edab19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060784, "uuid": "01d1826d-0abf-4095-b422-3290934a5f62", "value": "12288:1Ap0WJp0HHe3MhGjWBHspqb5uUuuJS3LbebUlmO1Fyear:1LFxM0BbgLSbiHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693060784, "uuid": "144fe062-c35e-4bad-abf1-15067a9abb11", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693060784, "uuid": "7bd84db4-494f-474d-b2b7-929eab9a63f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060784, "uuid": "ba1ea176-02c2-4e5c-9a08-d9cbb273fa41", "value": "SecuriteInfo.com.Win32.PWSX-gen.9063.32664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b53cc07-4428-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693065007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065007, "uuid": "0b76422e-f1e0-46c6-b3ce-95e9b01aed6b", "comment": "Malware payload (Mirai)", "value": "6a2cc40f082afa40cb6c271d69812c38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065007, "uuid": "bc07689a-0dc7-400e-8fff-1da44751c426", "comment": "Malware payload (Mirai)", "value": "17d71e7a6d2dc2a4db0ef14f8b6230b235316614f73e4f4cb7ff9836425507c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065007, "uuid": "dd0c32fb-71f7-422f-a619-953eeecda503", "comment": "Malware payload (Mirai)", "value": "6f1be242f037ce5e8913cf9f6d8f2443c2017289", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065007, "uuid": "f8e3620a-13b1-4f89-876d-aabcca1f5c8f", "comment": "Malware payload (Mirai)", "value": "eb40dcc408cf5f0cdcec23594656af151c07823ae28ffcdd34416ea89d86bd53de318e97b5733f168137f3782b13f451", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065007, "uuid": "65c5284b-e249-4490-8981-75327291c84b", "value": "T105A2E11572932D66E3EC1C3DC96A8367BDA70BFC80F6327679415620C94D24A2E2CA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065007, "uuid": "c591b8ae-2fba-4dee-8852-6cfb925adc10", "value": "384:xvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjiE5hymdGUop5h/:xvQn4j+ZO5fKAlxNs3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693065007, "uuid": "9ef207c7-d5b9-40b1-8b50-e7886141c1a2", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693065007, "uuid": "8a21a790-8498-4e17-b547-8bb2a55d77ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065007, "uuid": "969da6c2-034a-47fa-a11e-3c38bbc239d8", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14976ea-43b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693014605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014605, "uuid": "839821ec-779f-42d7-b615-ed17e19338a1", "comment": "Malware payload (Mirai)", "value": "5bc8f151a1e08fffe92f98457eeca541", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014605, "uuid": "2409eab7-2b4c-4b85-81fc-4e2b16742331", "comment": "Malware payload (Mirai)", "value": "1994afa4d4cf0b91df8ff8be5e3bd724106f420b944fdde720e66117cb7ce82c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014605, "uuid": "ff564322-a8fb-43d8-a3f8-3ba0f21c1188", "comment": "Malware payload (Mirai)", "value": "e7a706bd13560e842a5409516ac371252e68b26e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014605, "uuid": "3dbd3cbf-f46b-4e09-8d5a-c905be1c060c", "comment": "Malware payload (Mirai)", "value": "610b8558c118b40495825a9d0d279e56c52021e2522ccb15d602634eb1a84519642eb72b235beb9fc00b2ea8f0e67254", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014605, "uuid": "1c54bffd-842f-4c4b-b20a-ae5a48f0e6a9", "value": "T139C2E0FC7EBB6E83CD1B00355898EE3386B069A5C39BB297B24541026D131E1BE27CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014605, "uuid": "376fb3e1-1d3c-45dc-9243-6f8200ef85dd", "value": "384:M21DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjLyUN:vMw4DZdFbBy6x3K/KdWnH5KybV0Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693014605, "uuid": "f80f8010-04ea-4b6e-9051-5c2d2021f0e7", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693014605, "uuid": "f7482bef-0a18-4a1c-858d-ff0adf27b54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014605, "uuid": "08dfa41d-997c-4bfd-94c9-69c855d53884", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049221dd-442c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066634, "uuid": "ada47024-4cf3-4df4-92e0-10ef06cd257d", "comment": "Malware payload (Mirai)", "value": "d48a900f75bad753d9acbc94c2a738eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066634, "uuid": "3692aa66-63f6-43fa-b3a1-ec04674f3fcf", "comment": "Malware payload (Mirai)", "value": "1b5a720ff44c861d8c6ddcc4c2ba624e6046d3ee830ce72c948b3336732fef25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066634, "uuid": "96a4e1ec-257d-4534-95ff-46bf999e2b0a", "comment": "Malware payload (Mirai)", "value": "743313af6fb3d68c9c18e192bb9a0f495389cb87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066634, "uuid": "c18f60a1-71ab-4155-8c54-ee99ffdbff2d", "comment": "Malware payload (Mirai)", "value": "a4b0426bed00c6f8c45af4bf959b26d0a7be5c79c0b6f07683bcd417bca8e5130a5e6439cc161ee8dfe0fe2f51f1cd71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066634, "uuid": "378d4a6d-074b-44b8-8dc4-f9489614abf7", "value": "T116336C36E029DED0C6960134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066634, "uuid": "d9e72092-bbaa-4b15-8754-4d773868c430", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066634, "uuid": "1ea0d2bd-15ee-453c-aa3c-9ed402041fbf", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066634, "uuid": "977b1215-e326-4514-b34b-4ea1eea67bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066634, "uuid": "67dbfb6a-c8bd-41ba-95ce-c83e9491c03c", "value": "d48a900f75bad753d9acbc94c2a738eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d941218-4454-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693084043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084043, "uuid": "670ca04b-f2ec-4dba-808c-2781a3f94aee", "comment": "Malware payload", "value": "8cb1b9e491307e6ed1369cf89142bc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084043, "uuid": "42345fe9-698d-4e13-822a-57c61e7cc718", "comment": "Malware payload", "value": "1c2738106c4605d33852f46af101d1a9389829ead15b75fa0ba05012c4037eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084043, "uuid": "8f1ccb24-10c2-4aab-ae21-24c4709fb27c", "comment": "Malware payload", "value": "95b07dffd6a8d76c51e97353959efbb32eeb9375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084043, "uuid": "a82cdfd5-9916-4b95-be43-62e081bba063", "comment": "Malware payload", "value": "cc59f7170e5505e955636f86d53c142d5e28b4009dc826a1af7f410ecd89ce24a6d579d59ded8c02aba2f67512ce4671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084043, "uuid": "f2e5f883-7bde-4bdb-8afe-149b9d8c8950", "value": "T16B6633EEFB26F01DD5452DBCB60A2089C5A84805FA6B7185B23EDB165F433E4F21A3D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084043, "uuid": "e1cf2ef4-7a7d-465f-8b13-2f18638c96d5", "value": "7972ce6c674527bb9c502674ccaa92c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084043, "uuid": "a5d38d91-6008-4629-b465-0ef6f5168448", "value": "196608:A4q3LHDo8nIePqDLuUTlEThIhV1swKuVZB:A4GbU8nITLuUPudQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084043, "uuid": "f2ce1fea-093b-4466-a5c5-9559813a3d66", "value": 6955968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084043, "uuid": "447c760b-ea07-413f-a765-572e3b61086b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084043, "uuid": "557b525c-6c7e-45d5-a797-c7961dc637d7", "value": "Silverlight5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdb74eb-4439-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693072499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072499, "uuid": "5020f99d-088d-461a-9ccd-5f1a4cbfd99d", "comment": "Malware payload (RedLineStealer)", "value": "6753541e2a5abc08e636d40900248f16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072499, "uuid": "3ba25a29-e82c-4eb2-bf25-596fcc4f75c7", "comment": "Malware payload (RedLineStealer)", "value": "1cc3e5054e02af0040c49264a4cb64a5e4c60a8d9e80099c3114fbf5e6295df7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072499, "uuid": "52d1e80e-0422-4ccb-8dc5-2eda415dee57", "comment": "Malware payload (RedLineStealer)", "value": "623aedfcfb83ff764e3c48b7180a5bda60fabc79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072499, "uuid": "14d65732-2298-4438-b71c-f32a1f75cf3f", "comment": "Malware payload (RedLineStealer)", "value": "ff22191cec04680003aca7c55e57090fcb4edf28c2e00c395ddd2bf71f29d1df58a193f8e9064dc87e6e9f883e9928a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072499, "uuid": "a2f5aab2-0239-4762-b2d9-2928f5d3ef2f", "value": "T12495592038B791F3DEE220BE87ECB5A7C27CD4B0032649DB52C516EF9A509D16E315E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072499, "uuid": "cfc78885-d1f7-42ba-8324-265260064897", "value": "f0221ec6ef9cb59f5c583bbd4406d50f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072499, "uuid": "ba722225-3150-4c6d-a683-7934ef01b12d", "value": "12288:jvaD6nUtHQfER5pruv5I6nnKIj9eiw3U6DCpS+qZ8vybTuOHSp/xh2isY883eM+M:zznUtwcR5pruhM3U3E+Dybi2isb0e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693072499, "uuid": "8f8d5869-db9e-4cd5-8f20-2c894db6991f", "value": 1939968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693072499, "uuid": "92be727c-b504-4071-880a-fbe9f2dbdcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072499, "uuid": "01091706-f3fe-477a-aa61-0ad1d6bbe68e", "value": "6753541e2a5abc08e636d40900248f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad691ce4-442c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066917, "uuid": "85b36327-3918-4f0c-9b4c-0904a4983848", "comment": "Malware payload (Mirai)", "value": "f3fa0cd32982377f6ee196f09d2c3a57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066917, "uuid": "20b5e5f3-9c21-466f-85c6-196b1ba20598", "comment": "Malware payload (Mirai)", "value": "1dd1e4496f2df1276d3ce09176203f45333c6ac16388600e7a21c04fb585448a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066917, "uuid": "5069d9b2-3858-4a62-bb19-55542a48a3af", "comment": "Malware payload (Mirai)", "value": "d21f1051deacda7f1838fcc67d17f92d2b494d9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066917, "uuid": "fed48ac6-795d-4f77-9c27-8bc70053943f", "comment": "Malware payload (Mirai)", "value": "bfa5829c02b2ebb480fd7107f8a43862508a158d129902856561eb94277116a4a21853530a08dd87b34d8b9428261705", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066917, "uuid": "ae79d8fe-b774-46b5-a621-424a166b8918", "value": "T18AB2D0CC61943084CA8D7C7D678D4A664F6CA0D0BAED9B15E350CD98B3BEA8F385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066917, "uuid": "5df32cb0-c128-4fb7-a9ca-33ddef539656", "value": "768:otrQlS07dEv0UXqUhvQE+CXQKMQKCXBpRV1ZqqWv5:iQlS07FUXqIYSXQKquR5qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066917, "uuid": "ba5e9e79-3a03-46f8-a16e-209b537dec6b", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066917, "uuid": "4d06db91-afd3-4e30-baba-3e3bcd3ef6c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066917, "uuid": "2e5b08b5-008d-44f4-9177-6e90454a97c2", "value": "f3fa0cd32982377f6ee196f09d2c3a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4313daa2-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046123, "uuid": "8f80b713-70db-428e-bd29-dea061875332", "comment": "Malware payload", "value": "0ca8da9998bd87f611e2c4ce1397901e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046123, "uuid": "8203b2d8-ce63-44de-b3b9-5d86fc50198e", "comment": "Malware payload", "value": "1ddc1619f6b53fb1aacc5b7807c0f1f6616aa43b1ba952df123aca1f0b6e75da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046123, "uuid": "5e780e23-edfa-4c85-9ee0-19323232ed5e", "comment": "Malware payload", "value": "231452127080618df7ae9a1243470b1deaa8b903", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046123, "uuid": "6e33fcb1-9836-4f01-9202-bbe10bc3c818", "comment": "Malware payload", "value": "99eb03486a84245e6684ce8b4a64cd0bc38223719bb31d59cd090c0e8922b22bc00e0bd4bc8f4403702e550909bd19bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046123, "uuid": "17b481ca-e55f-44cb-9468-6e29ea1493cd", "value": "T1A0448D2239808477C6BF0B308D79F6A916FDF5600F74C6DBA7D80A1D5E722C0BA2556B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046123, "uuid": "3db60219-c21e-49c8-9b07-ab62b095a08c", "value": "fd84bb494c3f039130300d41edc8fe81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046123, "uuid": "d786d06a-8240-422d-b0a6-995f1c8f593c", "value": "6144:zkoergAp7FC+VmK38REaq7ABn+mScZ0kyb25aRFx56yDrjMi87TH6u2cEoEin:z9erNpzV/38QABQZI5QFGyDrQZHlooE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046123, "uuid": "e43866f9-beeb-4dea-a8a1-fe1492da58aa", "value": 277408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046123, "uuid": "2719a701-3d85-4a9d-a229-679517a72786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046123, "uuid": "68563cf0-804c-425e-b937-e99378ec2390", "value": "SecuriteInfo.com.Program.Kuaizip.1.22360.4883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c567713c-4403-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693049348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049348, "uuid": "fb70fd77-edf9-4498-a348-5b91cbb21979", "comment": "Malware payload", "value": "91b86f9bdb7b47f377fc670ba141e5f2", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049348, "uuid": "c705e11d-1589-4e69-88f3-eb565b4b78c5", "comment": "Malware payload", "value": "1e512af2d4bc9aec5ead05d077c523a2eb88d29f58f96eab17f207c01e6dab54", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049348, "uuid": "02f95949-3414-487d-be2d-ba010ecd6a25", "comment": "Malware payload", "value": "4d2147980d301d5786b2c7c3f265d492aa808246", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049348, "uuid": "d42f28c7-44ca-46fb-b84c-1a0f2bd24e72", "comment": "Malware payload", "value": "cf0b4567b9f49c2f9ee1eac950e8daa9a25916fc831a0e595f0e3c0e14578c49beaae2757c1dfd7a431125f02d08bb1c", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049348, "uuid": "41cb9ede-c154-4c59-b8cd-dae3cf15f313", "value": "T1A6632871F7D7E389874B49AE86BD3C3B870078C401D49057983B8CD5A5AAF3689876BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049348, "uuid": "02889423-35f7-43e4-a404-7e0ed5b9090f", "value": "768:6LfVsEuFTvFxctbf1pppppppppppppppnHiI:OdsTFTsF9pppppppppppppppnH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049348, "uuid": "1581e6c8-01e3-460a-9cef-3dce42e8aff1", "value": 67628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049348, "uuid": "f1daa514-7f5b-4522-95d1-0e7fff1f919f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049348, "uuid": "30d3ba3d-14a5-4a02-a327-548b60c763ce", "value": "lnvoice-1445616796.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b31270-445a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (N-W0rm)", "timestamp": 1693086414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086414, "uuid": "9cdadd90-6a5b-4e2f-91bb-c8d1657e578d", "comment": "Malware payload (N-W0rm)", "value": "2a9ee298bd7fbacb20a2e873ceae0937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086414, "uuid": "8d07deed-5b65-4b72-8735-38bddb56469b", "comment": "Malware payload (N-W0rm)", "value": "1eae8264ef6827178364adbe9650d4eec1e791ec327f803aea1ea32fb502133e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086414, "uuid": "baf9b2ea-5e97-44a9-b5be-7d095f01e25d", "comment": "Malware payload (N-W0rm)", "value": "72e4fff345eb72ed849f85781cede959f0844740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086414, "uuid": "e06286fb-4233-4b47-b1eb-c24cba6fca8e", "comment": "Malware payload (N-W0rm)", "value": "6d7fac28762b2125a7c2546fb775932d2857797deb07f724d7f4c02a410916244729cf37394f0d802eacc96ba901d490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086414, "uuid": "626d4261-f7e3-47b7-b76b-3ab72e9ad255", "value": "T13DA59C020F12D702EB49F2F55C527A47E110FAAC6FE5ED513C94266E00F17E96ABE24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086414, "uuid": "83f8a5fc-2f72-40ad-8eb6-d72fa7b07d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086414, "uuid": "0256aa70-5ad6-465f-9db5-8c9c336e8654", "value": "49152:+qiIET4dQEYRT/8DpnTDsJQnkT3tyaiNJ:+fBMyT8NcnEaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086414, "uuid": "d09b869c-2adf-43b1-8e9f-fb7a736c31dc", "value": 2217472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086414, "uuid": "6934e131-9368-4d89-9a02-0e157ebb3572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086414, "uuid": "0009abf2-0811-43ae-99ab-9aad380c071d", "value": "Rrobknnz-TPB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1610471a-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085561, "uuid": "80be962d-d49f-4970-928c-8f74213a2e76", "comment": "Malware payload", "value": "3790e03c51a7e0ff46d67dc1674bd93f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085561, "uuid": "a59f5c16-c6ab-401e-8515-a5d155c958d2", "comment": "Malware payload", "value": "217705e345870eac9bb3796154d1601e90a42b4d674dc8d6e7257b2bbadaee6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085561, "uuid": "8531b266-d833-4a06-9e56-f81b42864d8a", "comment": "Malware payload", "value": "37f3dad5dd5682ae3e1645e3a7c3229023b4db20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085561, "uuid": "cf903222-458c-49ae-b4a3-5e232fd32750", "comment": "Malware payload", "value": "42b961c3f6a828fed74c52386d0ed9337233de09e017297779247c0ad452ecc35566a0c867f63bd9f80166316fa85e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085561, "uuid": "78d44839-b53f-4a06-987f-bc9eba5157bb", "value": "T1CA1623D33385AC36C8FB02BA723697DDFC70C0112B61F650F46D987BA5E49598277A88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085561, "uuid": "b28eb877-2d00-4c50-9734-3664c26cc503", "value": "76c906522f16bb660115c4004157473b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085561, "uuid": "0cf56041-daa0-4bcd-938a-bc0214d9338c", "value": "98304:ebKKq8JMmqTY5bRIEtL2ws0ze3Xci+S+9ut2bewUoLrMDqe:En6mqAtI0un3MF5Y2bewHsDqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085561, "uuid": "c1b3ad3b-251d-4931-9236-aa92dc7f70ac", "value": 4156018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085561, "uuid": "8801a976-7abe-4dad-89b0-423e7a354b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085561, "uuid": "522ebbb3-3497-42fd-b696-42662751ca8a", "value": "vid1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189960e8-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693079123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079123, "uuid": "af9d9592-7821-44ef-b9ac-ce8ef80e2213", "comment": "Malware payload (RedLineStealer)", "value": "0ca8c09b84e38dad6f585f0a937d4296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079123, "uuid": "d380c7b5-4917-47e9-8ad3-d9606fd6434b", "comment": "Malware payload (RedLineStealer)", "value": "21c16c4ece7acb14119e33f2bdd5ee40197fc43d0e93d9841c9a6c281a739cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079123, "uuid": "b1e44189-3af0-44db-8a89-ada050500a0d", "comment": "Malware payload (RedLineStealer)", "value": "dbcbd75a8fb11b967536848e3e9cec60bc96e6d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079123, "uuid": "a87352fb-dd32-4fa3-aec0-311d81d8471c", "comment": "Malware payload (RedLineStealer)", "value": "32f8bc67f72b6166fef7d90ad247c97877f804945933b41aba5b9e2927b27d8c24e910de5a31c51b82cdb9f181922faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079123, "uuid": "7726d2e3-360e-431f-8691-456270447e3d", "value": "T10A35BE0E26685785D8A7263C4CEF8970027FBF56F7F6878A29C0FD9D4CB86416912F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079123, "uuid": "49abc4a0-cc7b-41fb-988a-d63804d54484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079123, "uuid": "5af9823c-cc55-476e-9da3-e4bd72e7f688", "value": "24576:xcGgfxzMKbINYujaYr/NJZ2R34/K+Nt1aO:dgfl0Ym92p4/KY1aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079123, "uuid": "1bbea062-c26f-4b39-9114-9ed65f1c80c4", "value": 1132632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079123, "uuid": "0e8bfc82-c3a2-422b-bd5d-416f057dccba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079123, "uuid": "0726685a-25f6-4aeb-8d82-1fe3dd173a59", "value": "0ca8c09b84e38dad6f585f0a937d4296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4b789e-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046115, "uuid": "a5c42769-16e4-438b-91ef-dc4b95a3f59e", "comment": "Malware payload", "value": "95452bc9da5e63c3c07047a785f5048c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046115, "uuid": "003b2ed0-8fe4-43f5-8add-b7b95f77b4b9", "comment": "Malware payload", "value": "22a9771f43bad1a884ff2205992466bcfc93dff0f7af331edf8afce84f00447c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046115, "uuid": "823feeeb-fd34-4df8-acc8-f8ed6d400e53", "comment": "Malware payload", "value": "8e740bbba6d8865d03c13feeceaa04451b2998d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046115, "uuid": "70ea322f-4bb3-4626-8329-bbd66b08b3c5", "comment": "Malware payload", "value": "e46425f62a42207069608a60f3652e8a92d79fe32388d132a8eb7599ca2c6c41fce446d6ea434a9cb42db0a32bfca494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046115, "uuid": "97257e01-c403-4faa-97ec-32afbff17914", "value": "T1A783D27D9E20A01EC000E57107A02774E3DB1E3218F95DEE9B653EAE3BB1D9A16417E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046115, "uuid": "701ec7fb-fc22-4d22-a0ef-9330c5701824", "value": "beeed81e1037e72e2bb3878a044e5e55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046115, "uuid": "c011a93e-3691-468a-b9e3-c5a1a9a8503b", "value": "1536:z7a8Axv2n7jdvjf4iDt0ZBSpoAxD/QmJScwm:3JdCAx7QmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046115, "uuid": "7e8de813-3f76-43ab-922c-f8c4b0197955", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046115, "uuid": "2c2ac435-e04b-406a-a46e-8585495bf0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046115, "uuid": "17b26126-4e9d-40a1-bd64-647a761c6bf5", "value": "SecuriteInfo.com.Win32.Yabector.20851.19086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f7024b-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015423, "uuid": "ee1ffba8-fbf9-4930-ae81-ecfd63b74b4e", "comment": "Malware payload (Mirai)", "value": "2603e728445b512902f4611bf9e01513", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015423, "uuid": "5f6e9d07-0dda-44f3-a6a3-51ffa62ba218", "comment": "Malware payload (Mirai)", "value": "236085cdf10d2de36f0e98ee2ddf3a6c092dad074af9b1a6aecade8f48b858d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015423, "uuid": "1d28522c-1690-40b0-aeed-1f257fbf452f", "comment": "Malware payload (Mirai)", "value": "39003aabec68a38d7c38704147e1570cef9b9fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015423, "uuid": "15cea9ce-e8b3-498e-b7ed-dd56ec7c92fb", "comment": "Malware payload (Mirai)", "value": "cf1e90570ae921478649ff0b4e25e2b5c5fa01a3ecbc35d785d688c4203deff7bf3403a256ddd09882315342ebc1c117", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015423, "uuid": "826571fc-7130-486f-9f24-92ff924bdfca", "value": "T177B2D0A48B915706C6B07435A27CCF522B3B15E4D5F639262B2083FCDA8546633FCACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015423, "uuid": "e3deeccc-69f0-4ab0-8c2b-2e66d5606872", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BwoThymdGUop5hu7x:4GaKQFH0rs3zWoDDRsjt7LB9U+BFs3UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015423, "uuid": "c7033bbb-5030-4185-8126-58521d59d604", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015423, "uuid": "ced09278-a578-4a95-b34e-22037fcc8d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015423, "uuid": "b7739c44-2bc3-4864-a82a-673b3c5c971c", "value": "2603e728445b512902f4611bf9e01513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786f38f3-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693085726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085726, "uuid": "040fffcd-1349-4142-992a-c9be459170ae", "comment": "Malware payload (Fabookie)", "value": "f36efe2b971c544e1ef1916596786160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085726, "uuid": "f0366dba-80b5-4355-b510-72af23a032b8", "comment": "Malware payload (Fabookie)", "value": "2446a9cb83a1ed64d738b638a4f62cb3709c92f9002425ebb7cc8639f17a1994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085726, "uuid": "075744c5-1bd6-47c8-bc30-c3576c30cefd", "comment": "Malware payload (Fabookie)", "value": "9ff8104e488940b8b3be262ff74d0d7984ceebbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085726, "uuid": "418cc33e-19ec-4cad-90af-d04ad5be9b0d", "comment": "Malware payload (Fabookie)", "value": "fb0befa89b4edb2d605cc29333c178c1089d3a8393e1be825c3d4a64bd9d97c7170862a7167265a294bc2486c7e2c26d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085726, "uuid": "5114ba90-bc10-4b79-b5f4-c261b4d5749c", "value": "T1870602DE5244336CC41A84749533FD09F2B6466E0AE9D4AE72DB76D037BB824DA02F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085726, "uuid": "cd6e1294-93a3-4501-815a-91b60724ce27", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085726, "uuid": "3dfeb981-c69b-4ebd-a19e-334db7491b3f", "value": "98304:FiaD/zTILv7rcbnoXssvlXi4SJ8hJimd:3D/zeEzoXsshiDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085726, "uuid": "c3e53f05-a3e9-4103-be9d-26c22f99eaeb", "value": 3660800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085726, "uuid": "a79c3cc7-0769-4932-80b9-a31f017e2db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085726, "uuid": "bf62e037-1dd1-4db8-bdf6-055f00c29548", "value": "pb1103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bf8172-43ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693047708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047708, "uuid": "3d560da2-ae08-4428-99f0-ccb7321aaeac", "comment": "Malware payload (AgentTesla)", "value": "b3cb5f4c8451df035f5aeb925f07aae6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047708, "uuid": "7dbb141b-9a77-4a49-ab55-afb41adf4a49", "comment": "Malware payload (AgentTesla)", "value": "2542e321c7f17aeb4ed690b93d6b8e3d63e0057058fc826697700d557901493e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047708, "uuid": "a340e79c-b2da-43f6-b7af-ec313b11ecb8", "comment": "Malware payload (AgentTesla)", "value": "d072fe3009fb8ef90a5938ff2e1d88154afbd2ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047708, "uuid": "2f205fd8-f72f-45cc-b00c-f21eee8c6713", "comment": "Malware payload (AgentTesla)", "value": "160fea2daae2844c66be1e8da2f34e71170b6e6b99a150670a1b1cd926c5cbb42578064d1de47e7eef020b6ad7c19815", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047708, "uuid": "89cec3b2-5308-4c29-aab5-680693b3ea72", "value": "T12325D03532F84627D07A86F6042126418BF2562B223EE6D57CCE72EA5FE5F500A53F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047708, "uuid": "4be13fe9-2b83-4eef-8dee-b25202168e35", "value": "12288:GikVfqwi/iWsjdz9NrnrLJ6Y+I1OIQgzz6x6r7hx9aU+FYeAI4nqItyTKiB7:/qqwiiWenrEG5QwzGCf9+x4/tyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047708, "uuid": "a798c4a2-e53b-4f3d-89c4-5ce3c30dcc67", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047708, "uuid": "f31b8d80-ff37-4a5d-8458-2bc971a62e5d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047708, "uuid": "1f9134b9-ca36-4d27-9b9e-8d0010c93b6b", "value": "nfactura 099800.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6f8365-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693080817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080817, "uuid": "11abdbd7-97e0-4ba3-a13c-6773f74ef1ea", "comment": "Malware payload (Mirai)", "value": "81fa9860e3b214a5b1ce467756308f5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080817, "uuid": "8ff256f6-abc2-4d1f-a4eb-492fc464c7c1", "comment": "Malware payload (Mirai)", "value": "2562fecbc8d57c1aefe8198bcd0679424372d0a3c18dc92d4f7b81756d4da07d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080817, "uuid": "bda8e485-0e9d-452b-95ed-acbb749441b4", "comment": "Malware payload (Mirai)", "value": "307682d185c57771a55d87c6724c93839626f0c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080817, "uuid": "9b2067c4-a0fa-4f48-9d63-fbcaa85e9d4c", "comment": "Malware payload (Mirai)", "value": "af134f2963bd56cb8f9471e79eaee8d55d8c2319b5398cc85269a48ca595be0b70645d6ba7b404f80c9a529f8cd3a0b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693080817, "uuid": "65b1ada7-7cc3-4a9f-aefc-f04929fe7dad", "value": "T163733A8AF980AB25C6C1557BFE0F014E73134B6CE3DE731399285B64778786B0E2B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693080817, "uuid": "61a5236e-d55b-48ce-ab2f-09fb87ff9511", "value": "1536:ypnXTHlwR3aeNRa2LpaWn5sCpAddiJZrLao+nZU7ro54YU:aFw4e22LpaWZ5ruo+nZUHoiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693080817, "uuid": "1072a95d-d12f-49c4-a5cd-6cf74284d97a", "value": 79156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693080817, "uuid": "a2aeddab-377f-4f50-949e-534ad5976f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693080817, "uuid": "c7788250-b580-479f-91e4-9762dbbaa3a5", "value": "81fa9860e3b214a5b1ce467756308f5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4a0d52-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081112, "uuid": "2ffecb28-fdf4-48fc-811a-4e17ba26cf22", "comment": "Malware payload (Mirai)", "value": "9de40fe3947da3aa7fe971f23956d3c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081112, "uuid": "f468bbc1-423e-466f-bc65-b9704cb0650d", "comment": "Malware payload (Mirai)", "value": "26db322e2ecab7355a51adda6f774d3e7ffab0e6625cdfa061c174db1950aa97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081112, "uuid": "3adff620-cbd5-426b-b206-ecef99a143bb", "comment": "Malware payload (Mirai)", "value": "a0e47e497c0822851798ccdc7bd8cbc1cd7a6d53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081112, "uuid": "c8fb8d86-3182-4114-b312-30358124bb38", "comment": "Malware payload (Mirai)", "value": "f94a827a1b0e6d2804ba3ebdd86057a78c94f2b19f7cd48c09184216484a267c1e6bfe1c3f48d92dd7d95089b30f5213", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081112, "uuid": "b983fc0e-cff6-46d2-80b0-44eaff2ab18f", "value": "T1BC336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081112, "uuid": "3d410a81-66c0-4df2-8f1f-ac6c6b6a7f14", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081112, "uuid": "aaf81db5-1004-428d-aec5-593799cd6499", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081112, "uuid": "02bb1b11-0d2e-4de1-b9d9-b7c5d32deebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081112, "uuid": "35b04e2f-3dd5-4029-a1ac-21bbd91a124b", "value": "9de40fe3947da3aa7fe971f23956d3c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0ad404-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693038699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038699, "uuid": "cc59ebe6-6513-47b3-86da-f32945823ed9", "comment": "Malware payload (Smoke Loader)", "value": "111976e0eab6332579cce3afe4deec9d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038699, "uuid": "7c5b6468-95d2-46ba-ab98-82ca438f3910", "comment": "Malware payload (Smoke Loader)", "value": "2724ae5fde7b5139bac8e35df307b6504222fecbd8d6f6e67d063212696c7bac", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038699, "uuid": "02766a11-0546-4a9e-b404-9068fbf089de", "comment": "Malware payload (Smoke Loader)", "value": "ea1e672064e66c09c6750e3143bede52e57a7a7d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038699, "uuid": "f4e4dace-3ff1-497d-a2f9-bb5becd9a27e", "comment": "Malware payload (Smoke Loader)", "value": "55e70c0e3bcbadea5eeda198c032723ca0880cfa08aef222f297deb4d9364cec26a3ab8b178db0e4695453f4c27b30fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038699, "uuid": "07de16f5-5172-4180-a938-a0a38009d1de", "value": "T12754CF2D3692D472D49340349824D7F4697FF8739AA98A9337A83F6F3E71391A366301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038699, "uuid": "5584390e-2627-4d56-a0f6-91e1417f73b3", "value": "07ec39bd17621c40170951aff851e5bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038699, "uuid": "69bcf0a4-cdb4-4a0d-869b-0ca70fbe7cf9", "value": "6144:JjRFLLMI9lNpfpBm4TqGQs6H4fMTzR+l:JNFLXLpRBm4TqGOHU0zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038699, "uuid": "1f251dd6-3fea-428d-9659-eb71f1f230b4", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038699, "uuid": "e67b9a68-e951-4107-a90c-64707d3e4971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038699, "uuid": "7efa9174-7f20-4ffb-a497-106613c48e54", "value": "111976e0eab6332579cce3afe4deec9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496ae6c0-4426-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693064172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064172, "uuid": "71d451f8-cec0-49ee-9a54-23faa0e387fe", "comment": "Malware payload (Mirai)", "value": "43422e3e2c955658edaf92275f064cf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064172, "uuid": "701d5f14-9685-4e56-a96d-5d4a3b55325c", "comment": "Malware payload (Mirai)", "value": "2781318d9f033c133cd98e36a044336e5fc360ff56ba1a88c9a6823362242163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064172, "uuid": "db524435-f9fa-4c2e-b63f-327e9e91dba8", "comment": "Malware payload (Mirai)", "value": "d692aaf33ab3dbccb5a0dccf47fc72028b6a32ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064172, "uuid": "469a0462-01e4-460b-978a-7d4174395b26", "comment": "Malware payload (Mirai)", "value": "e17b3e5a546a0fdeafc40f3e80cbafb5e17e188c74467f4a6377b2b2ee0fab3a56d826edd13a2b78e7c143c1dd99faef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064172, "uuid": "3517f3a4-5b9e-4a12-8eeb-002a93823e1e", "value": "T131332A8A64112E6DE9DA5CB981764F0ADE541210B093171FB3BBFEC33933364FE66449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064172, "uuid": "c49e9e14-10b5-4afa-8ce6-1bd4a7d30a31", "value": "768:0aOTrZQlDVoueg2me2nPQCHEM/ArPwqLWH02TCmhPol7gSu9+f1prN4ni0ezi1:0alDoRg2mew4ChAVLB2Y7gSyg1ppWx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693064172, "uuid": "31ce4788-fd96-4457-a616-0486951ba907", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693064172, "uuid": "f5310b3f-1949-4604-b239-b816f669b1b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064172, "uuid": "b347b1b2-bcdf-4f78-a4f9-1aa26cf96f2e", "value": "43422e3e2c955658edaf92275f064cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7e0e14-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083609, "uuid": "c48a604d-9378-4709-81ca-f6630ee8a92a", "comment": "Malware payload", "value": "e6778b040cab5d6df449d94f1b15e6cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083609, "uuid": "505bcf5d-2fd5-412f-89a8-999f11d72fa4", "comment": "Malware payload", "value": "27bb29b64743ed53ed2882f08d8f37286f591ffa3b04a155df8aed9d9a9baaa5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083609, "uuid": "3ec92e67-a9d5-4d1e-a079-6edada6b8fd4", "comment": "Malware payload", "value": "d24a65495405925e9e3762521a3b216131af93a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083609, "uuid": "9da836a8-4d78-4128-8ecf-26f3c2b565b4", "comment": "Malware payload", "value": "649c3c61b8e81c82f5b19acb8b0c69ccba13566190b4a654a362828baf18bda0bb0040256539704320e7d12e81e914c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083609, "uuid": "0eb7e83b-31b1-4743-87cd-0b54ecfc5984", "value": "T182C2E172B00A4334EA7008366DA841C77AF09EBD48AB381701555CBCB9DBD952EF878F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083609, "uuid": "d654b366-5004-4431-882c-d05bfe946f4b", "value": "768:8tQspj+XlypIDN0s2jbu/g4FkHgNLNhi72s3UozbM:8tr+XlycN0s2u+Hg9rqbzbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083609, "uuid": "b12c6fe0-bb95-4f56-b4e8-a3df8e13bc69", "value": 27608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083609, "uuid": "4864d5bb-9219-4d5e-8070-d7cf7289994d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083609, "uuid": "950bc3db-cd60-48e0-a5b4-14b4f27665d3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af16563d-441b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693059618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059618, "uuid": "15deadff-891f-48ce-b563-c723a4d78741", "comment": "Malware payload (Smoke Loader)", "value": "ff133c15bee89627db6930d923d54481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059618, "uuid": "5dfaf56f-1974-45e4-bdc0-caa834ab302c", "comment": "Malware payload (Smoke Loader)", "value": "282cb3509b19bea02dc8f03645148756fca37c37feb5d256243b1dc3d2654311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059618, "uuid": "ce8e2738-398c-4fb2-b760-b91dc8b6711e", "comment": "Malware payload (Smoke Loader)", "value": "bc57f7bb8190ab0739cd3efaee0f6789a65048ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059618, "uuid": "dbbaf4a4-c651-451f-8212-d2cc36e496de", "comment": "Malware payload (Smoke Loader)", "value": "3f40c4e702125f15ce003d19ebfaa23f5118977ef6945f3c2d5da3ad0fac721c45e92e81207c43bb3cb6cdb41ff95be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059618, "uuid": "902421a0-ef7c-4254-b6b7-0f59a2dcfcc3", "value": "T18054B012FE90C872D996C17D8924C2F4E97FBC7289558A8737943F6E2D313939A2D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059618, "uuid": "d3181357-70f7-4cac-a6f4-a2c37f1fee1d", "value": "e9cacac7b73883427b68f7dd17217393", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059618, "uuid": "56241042-80e0-42f9-9323-be13e8d75bb3", "value": "3072:F6BuntpPAYZLg0Pnex5yLrhPnp2fG/TEUqkrg63dQrR8wFOV6a9TZuu7:njYYZLBP+An/8krg63diR8wFx+TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693059618, "uuid": "975f729f-71d6-4909-8f5a-8fb327e04902", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693059618, "uuid": "15c18ce5-04d6-4402-a293-1dba02344c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059618, "uuid": "63570182-e32a-4a28-b434-895a60d8f99f", "value": "ff133c15bee89627db6930d923d54481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc104c9-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693079403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "b04c8679-d6da-4629-aa2e-577cfecb8732", "comment": "Malware payload (Mirai)", "value": "2c3384c2ecf62f5a78afbb19de60261a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "5d98dc38-046d-44cc-a3bf-e4358abeb427", "comment": "Malware payload (Mirai)", "value": "2b7b5d1eacccb7615e915dff438a47bc0c7a9ef01479c88d54349bcdb608bfbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "41e876bc-a28f-4578-a539-ef4eaff72312", "comment": "Malware payload (Mirai)", "value": "ce5e5b761fe675e2e607f85cb3ec7c6933e2c4e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "40835bbb-3c60-4cc5-9593-6922ce56ed9b", "comment": "Malware payload (Mirai)", "value": "ca766803aa24f3d510a449f229664a8b8940a9e3ac938351b7236210ded4c5b23acc60c1f397116877d25498245a3a89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079403, "uuid": "b316a95b-aede-4378-8aaa-424ea4d1439c", "value": "T1BAA2E155BF1886CFC832293555D9EAD22256FC72F2ECDC092940C16FB4B33A95470F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079403, "uuid": "692f1ef1-e2d8-4722-9016-e5d7f89ccfaf", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKv:k98o08kxofBE+ZkXaqGbp2F2TWul0c56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079403, "uuid": "16deb024-aeb7-40da-a206-e77ffc3fd95b", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079403, "uuid": "bda94e7d-9207-4d7c-abcc-a8a8fc81fa48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079403, "uuid": "13b95e2e-997f-4f3e-aa1c-699ba30a61e7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c0dad2-4425-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693063876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063876, "uuid": "7ca57b40-042e-4b58-96de-8562e5f01743", "comment": "Malware payload (Amadey)", "value": "2c6e3a8508589c9574e1b174efbff225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063876, "uuid": "ca91790e-4b1a-4ac1-bc59-972cb7761947", "comment": "Malware payload (Amadey)", "value": "2e39b3498486b4438f31db90875f8ae884d2ec996b9ca08a4505f9f09c5a28aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063876, "uuid": "94d6018d-772f-4e05-a270-691fd1700c6c", "comment": "Malware payload (Amadey)", "value": "2d3cb2943d0108f090399cdd1012a9b8dd25c389", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063876, "uuid": "d8d961fc-ba57-4d6b-b53d-41ac549a6223", "comment": "Malware payload (Amadey)", "value": "fa2a7bbc89272a2ae22d577b7f79b8a4f164b7a980baca35973f0b2334dd1ec856af10d93fc533c6c8ddf82c6d76f570", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063876, "uuid": "2e900de4-c3a9-44dd-ba3f-3dfb3e5ba75b", "value": "T1E1652316FADD5412EDBA6BB159FB06530E34FDB0CCA4422727C5A81E1C71A80BA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063876, "uuid": "dd1b99b3-e6fd-4c73-9a82-8d49f9a6bd7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063876, "uuid": "af65f1d3-9cd8-4e31-b988-f22efc4b6049", "value": "24576:YyBHHzzAWQ8pvj4F02VIwLeikXOPKwj1Vff1N+Fbc0Nmb9TdW2gM16wYl/23zAgK:flnAWQ8p7vmeVKKwj1xf1cbPwTlgG6M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693063876, "uuid": "c8f959af-b0dd-44ce-8fcd-c4056773f51a", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693063876, "uuid": "b594e637-6928-411b-91ad-8db2425e1d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063876, "uuid": "4e67dc05-e544-46fe-8830-79d4221945ba", "value": "2c6e3a8508589c9574e1b174efbff225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b923a04-4430-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693068605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "0d7bc62e-c3da-4100-b425-a16714189ca0", "comment": "Malware payload (Mirai)", "value": "cc8f2266caecdbd22d3325685b105407", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "1e6eb4bf-c6a8-4d70-9104-9ecdcf13d15c", "comment": "Malware payload (Mirai)", "value": "2f88ddb1e9ee5831f7ff01f9058d0e6a26765c3f46628c80d246e6da8615d998", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "e8747956-f4ac-418e-beb2-50649cf2a023", "comment": "Malware payload (Mirai)", "value": "63799749ac084f2693738296539e9c3e55eba049", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "3eb110cb-7761-45af-b75d-b0629cfd1798", "comment": "Malware payload (Mirai)", "value": "8a4cc216d069ed4d72134fe590fea1df76cdbcf2b9256b13dbb7883ba0e56341000281cb22eb70fd725e1184e87e04d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068605, "uuid": "cc2b3314-23b2-40d5-989a-148edc168887", "value": "T12FC2F17FB6AA6A67FA5C1339E435810B0394F11C57AE6B5723800532DA5F81D7132CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068605, "uuid": "eea0b1e8-c7ef-4c07-bedb-ba7445732b41", "value": "384:MX1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHzVPnMP:qMwxdyoEUnDz+Y8tqHWXmTVPLays0Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068605, "uuid": "e75f5b5c-e5fa-4189-8de9-561b30679771", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068605, "uuid": "d84de6d5-d525-4a50-950d-df0a869831ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068605, "uuid": "be25306e-c28e-450f-a3e9-52bd6dc64148", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2887bab5-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084733, "uuid": "9bee9bc0-9c68-4717-9f0f-48167589c06a", "comment": "Malware payload (Mirai)", "value": "6d71dc64c694d8eb46c0cc4f3da796cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084733, "uuid": "b66b0791-1ca2-488b-8622-33326067d439", "comment": "Malware payload (Mirai)", "value": "30f8e1f8a2fd4291ba2cb01e648c090c1666e47bb6145b7eeefdb14a609f52d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084733, "uuid": "f9dab7a8-ca79-42dd-a4ff-b6b5c1b6f9eb", "comment": "Malware payload (Mirai)", "value": "267a9b5ec57b3664e6ed851bd373e7506c845be8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084733, "uuid": "d0a91eb8-910a-448b-9d76-e7fd9862b297", "comment": "Malware payload (Mirai)", "value": "36f311acfe3b5961d42d514135d37fb11dde0f6f98f4f5647a3df9b0f2a2489256c5b82d734485951c5846fe5dd5e297", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084733, "uuid": "d6735f1f-9a42-49e7-9880-3209e0c97250", "value": "T1E3F32A46EB408B13C0D62BB9FADF424533239B5497EB73059528AFB43F8779A4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084733, "uuid": "5e7f0bb9-aa99-4b00-9404-cb5b113c2a31", "value": "3072:p+OGqR4ukAabMVq7xYoJI0638k+/yR7ZkonM/RKT//Si:hGqOJAabMVq1Y6Gj+/sznM/RKT//R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084733, "uuid": "22161585-7eb4-4c42-bc59-77a38d3d5fbe", "value": 171922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084733, "uuid": "a5ebcebf-1e0c-4aba-88d3-5a2ec938357d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084733, "uuid": "d24d97ca-5182-424c-a254-527701ef6e42", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4083f6ca-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Poisonivy)", "timestamp": 1693046118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046118, "uuid": "4581c993-f83a-4599-9749-d4ead4456200", "comment": "Malware payload (Poisonivy)", "value": "0381f1ec675af63d8f23ebdf353d2bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046118, "uuid": "5886f47d-422d-47b1-ac71-4540ca678495", "comment": "Malware payload (Poisonivy)", "value": "3259e6cd69dd0acd2c2d257865859302f3910b077775490cd281ac09fe51338c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046118, "uuid": "77421963-ee0d-4d02-9d3a-e4f85f2d5b9d", "comment": "Malware payload (Poisonivy)", "value": "141156df6a59f9f90a26ccd04d73f339224b29df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046118, "uuid": "e16a0583-317b-4329-8653-a4a0882a522f", "comment": "Malware payload (Poisonivy)", "value": "350d14be1f713b9d39078555082766f75e8ce7693e98a84533225d22ae8977a46a2663ba2c3ec91f765daf5d73328520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046118, "uuid": "1f8dbe6a-7789-4395-a36c-2cb60ff85691", "value": "T1F2451D107CFB212DF1B3EFA14AD8BEFA965BF2B52E08987A044022871357951DD5783B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046118, "uuid": "dc10bea3-c440-4262-8316-e689c55e0590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046118, "uuid": "2d49ad03-8c17-4926-bad6-a7ced37d81df", "value": "12288:QgYm4WF8wl1d25axYAcg4nmDlz9WmgiHxZn6pLoPfZHlilIlahakI15c7ZJr7xRG:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046118, "uuid": "4b6aac2d-8b9e-4ec7-87e4-df7ac2ded19d", "value": 1176060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046118, "uuid": "135b2a68-2ef8-415e-b01b-634e4399ec0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046118, "uuid": "03ad8f6f-5fc7-4851-a910-d4a500f007e4", "value": "SecuriteInfo.com.Trojan.DownLoader14.22811.25335.22863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38dba40-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1693015468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015468, "uuid": "df99351e-9b47-4df4-af29-6da495a88998", "comment": "Malware payload (Glupteba)", "value": "8baf3a087399d0e0021ebbe699321333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015468, "uuid": "a140a430-44fa-42d2-832e-88d2def9a237", "comment": "Malware payload (Glupteba)", "value": "336e13cf278f9d39ac6d95cede295d3af1c903b5f0ca9c865f1a44f07683bcd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015468, "uuid": "97a62ac0-bfa1-4989-a2a0-9b5ab23e7f03", "comment": "Malware payload (Glupteba)", "value": "944889ec1d93a9a262dabc08063d4619a73e4271", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015468, "uuid": "4dae83e5-a5b6-4471-9d65-a444830624ed", "comment": "Malware payload (Glupteba)", "value": "51ae85b1216e16e47adfc6ed7917917e21ccef4428fc9eb2c705c4133026001775b96008f1111e9f22de4ec76f0ddf1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015468, "uuid": "c768445d-ebfa-42be-9953-e525508bd723", "value": "T10D1633326652D070DC9ED57B0620C3A4FA76ABBCA44A849772B17FEE6C34F423679305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015468, "uuid": "0b270b32-92ae-4f13-919e-1a87fdec19dc", "value": "478e1adb03a4046019e6832a1ee52bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015468, "uuid": "eadb286f-f1bd-4414-b3d4-d2b1e497eb24", "value": "98304:+mI+NaAmzLvDwc6u6/gLB9lGK0/NQKusV7d9EdiafHINegka:BB8G1/+gbEdVPINQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015468, "uuid": "21122a2b-2580-42bb-9251-8897ffd0d116", "value": 4356480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015468, "uuid": "55ec3a59-a6d7-46cc-a556-2820132bd75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015468, "uuid": "bb0ab74e-4436-4e06-9b32-7d3a0f9d0cdc", "value": "8baf3a087399d0e0021ebbe699321333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d393965a-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693038634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038634, "uuid": "56afa41e-02c4-4dc3-8d81-478fe205ae7d", "comment": "Malware payload (RedLineStealer)", "value": "8da3c7a54e7b86cea74a8ee2a7e6911b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038634, "uuid": "163e3bee-3d74-4919-be7e-bff685f7c705", "comment": "Malware payload (RedLineStealer)", "value": "3419df98f0bc55e52d75059723d401c3ebcf91e0da696205d9ecd5c0345b8093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038634, "uuid": "4f898acf-c9c4-4835-88b0-72797ae93542", "comment": "Malware payload (RedLineStealer)", "value": "687fed0acd03bf5758abbb2804a951da1c7f575c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038634, "uuid": "3cb15dc9-e223-4c6a-9c64-9ea0b1428c15", "comment": "Malware payload (RedLineStealer)", "value": "809d00c700df786e8cbec77addf78bf08a2a3ffe084697221ee6fff82f89ed4ea8e7142b0ba503bedd811088465d629e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038634, "uuid": "ffa58b37-8114-4911-a6f0-729792c30fac", "value": "T11EE41246EED88435DDF92B702CF617870B357C6168B687573B86889E08B3690BC3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038634, "uuid": "a6f983d9-3df6-4d20-b69b-95d38f410296", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038634, "uuid": "7ac826a2-6980-448b-a78b-c455eec8eaa3", "value": "12288:QMrFy90zvkXHfaQ3Kqx+aT+0iYQ06fZqOD/qJ7JTAdp9ux+fGosE:Fyovk3fD3KBaplQdxo7JujuAnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038634, "uuid": "06f2c9ff-4204-4995-8a26-0f767b1f9fe6", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038634, "uuid": "a93288a6-d8ff-4bed-ba69-16549407f659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038634, "uuid": "24758c4b-118b-42a8-b810-893b6b11bff1", "value": "8da3c7a54e7b86cea74a8ee2a7e6911b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da01498-43a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693009526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009526, "uuid": "2ba5fee5-ca70-4959-b32d-c201d803cea6", "comment": "Malware payload (Stealc)", "value": "1f7010fe4bdc68f8fa04d82047734dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009526, "uuid": "b69d301a-633c-44eb-a3fd-5e9ab54f7a5b", "comment": "Malware payload (Stealc)", "value": "35247f99dd8b8b69d8fa9b34ddb0fb709cbfbde8d7b8984baabc3512dcb3aa96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009526, "uuid": "3364c2d8-9caf-4dd0-b588-ea6ee95998ce", "comment": "Malware payload (Stealc)", "value": "9a352be85d559294878e18508386a1e32fe5f7f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009526, "uuid": "cd24927b-90e5-417b-86bc-a5939de89526", "comment": "Malware payload (Stealc)", "value": "25512cca3a2de8c0ccdf3e4950956a988413d860cc9f75bc104df2a11e473ccec479f29f4f35de6a6c2939dfb6bfaece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009526, "uuid": "aa31b8dc-b6ae-4483-8535-73c8a49c8e58", "value": "T18E96220D75D041B1E1BE5AF059B0F6905B79FF209E645EBAE38CCA191E30D40EE35BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009526, "uuid": "dbec7927-ab20-42ab-a4a6-271ba5a41199", "value": "7e2f200a9ecaa7ee1d0f7298f297d727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009526, "uuid": "ae209ea3-8569-47c2-b26a-c16f8350df97", "value": "24576:vJvKcN7MDBVaEJT84t6ve/K03KzStZdnQYwHFeP8x7PQhdrQdE2UWnTWviN7dL:lK67OVje7ve/HxQYwlWa7SRWd/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693009526, "uuid": "8ebfa059-cbc3-4fe9-94aa-97517aa345ef", "value": 8780328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693009526, "uuid": "c15c7a3f-3bd5-4287-a364-763c093734ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009526, "uuid": "0a0c9600-9aa0-4434-a533-36cb477538c5", "value": "1f7010fe4bdc68f8fa04d82047734dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9466e8dd-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085773, "uuid": "d327bd5b-0b89-419a-b6f4-d4f4f6a9d331", "comment": "Malware payload", "value": "2962a89c61c01b48849f8f5ad6b9e7e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085773, "uuid": "281f5ac0-51df-4c98-8f6f-caa261041715", "comment": "Malware payload", "value": "35bd3c96abbf9e4da9f7a4433d72f90bfe230e3e897a7aaf6f3d54e9ff66a05a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085773, "uuid": "5dd0798a-113a-4148-b4c8-e298a261003f", "comment": "Malware payload", "value": "d586a55723c12cce3687db31a59af69b2373198e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085773, "uuid": "41523bb6-4372-4605-a4ef-3dfd8a1a8053", "comment": "Malware payload", "value": "74e3e51f4795a67b0fefbdc307101895430a710adf89750d95661ae8bbf3196ad86e5325356f9c10cabcf92c292b78c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085773, "uuid": "9af5a656-768a-46cd-acc4-7a623d2f71d3", "value": "T179F53319B90082BDD1B218364865C53A42BCB8124F152553BBFC2DA325F17E26B7EBDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085773, "uuid": "d12ec3d5-d72c-4d75-9640-a9bb6b8fd199", "value": "b8d12c04de39a167757fe4a34efa01e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085773, "uuid": "e2d00c1b-b574-4edb-86c8-8b719a05e5ff", "value": "98304:5MTaYHAQlQERjpRdUfWkdHLut+aFNnpVyGHAeBLNduupm:5fYuERj/dw/dM+aFFplW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085773, "uuid": "dcff6ed3-0091-40e3-85b6-30ceb620568e", "value": 3601250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085773, "uuid": "c8811ade-8aad-4104-9278-7bce83d7e42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085773, "uuid": "4ac56f71-9f92-4612-afeb-614144d45df7", "value": "MS_17_010_Scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b8688c-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693046099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046099, "uuid": "d48b3632-497a-4acf-891f-f35a7ef5929b", "comment": "Malware payload (Smoke Loader)", "value": "2cfd6eae0f47d8bc0c5dbde9572d1d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046099, "uuid": "4405e488-5c40-4fc5-9961-f6e543e79cda", "comment": "Malware payload (Smoke Loader)", "value": "3800128c3f871b732f0d4f7f19a3b2ed9670bb61f8bf2445daf7f9eee6009b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046099, "uuid": "49c0475c-175a-419a-95b5-441bcd4729ac", "comment": "Malware payload (Smoke Loader)", "value": "9623303e715bf71042f294fced2d1bad231e5899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046099, "uuid": "b2fa1e64-3cc7-48ed-80e2-e1f4b9a07e0d", "comment": "Malware payload (Smoke Loader)", "value": "e03faa57f3818df93e32afcfeaf0a63cb24a59b962189025cb6e57ec507236b46e59ac2423545a71a288149eb41bef49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046099, "uuid": "7810f76f-bc8d-439f-b45c-b32e77e196e8", "value": "T11B44BE22B3D4A471E52306318A66C3F56B3FB8704F566ACB27985A3F0EB06D2CB75345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046099, "uuid": "2a4a14ac-2c80-4a8f-85d5-6aae5bd68e01", "value": "6888c0f5d48882b1d0e7ef2720df3ee5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046099, "uuid": "a3f2e386-434b-46c1-a250-dbb2df802f7a", "value": "3072:eF3ycG5juzSMXKxJtEIbE/8K1acd1kUZUvwgYxTYtx517onUKbYVJU:eAkHYJGIi8wd1CIHctxLgYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046099, "uuid": "12a670ae-d3ba-4f78-96f4-a8ca00449a84", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046099, "uuid": "36a371e1-dd4d-4f47-8879-738231897cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046099, "uuid": "d14762c7-7aba-44e7-a920-deed25ddab43", "value": "SecuriteInfo.com.Trojan.DownLoader46.1067.792.13825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840f8c20-445c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693087463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087463, "uuid": "a0397710-a018-456d-aad4-bdf46b3d05ba", "comment": "Malware payload", "value": "a20860b0893787cbd666fec64d5c3854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087463, "uuid": "eb62403e-9085-4670-88b0-1cc938dbf015", "comment": "Malware payload", "value": "392898ac647aaf067198b8596798e8496dab40e3f23e83f93d5a46601d951f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087463, "uuid": "f2e2fea2-3cd8-4bc0-a0e4-c6dff2a0b23e", "comment": "Malware payload", "value": "a4e21e371769c4cf302faa741838f6475287893c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087463, "uuid": "c13d441e-ec01-40f3-916c-307c1668f00a", "comment": "Malware payload", "value": "8b0a235980d687cb917ffe90edca20be727e753b5ad5db874227f9ea6e1b78967c916104c3a5ed9f394e4685f79190c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087463, "uuid": "f5f61ced-80a1-48c3-b86c-9b1ae0a58a11", "value": "T1B8A57D21764888A6C7130E32BD58F27CF2AD967007B540EF5296AF587D37983B624D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087463, "uuid": "9a07a3a1-fec2-4a66-92ba-22a86e3dd9cb", "value": "d93b87dda4f9983816147bbc6eff077e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087463, "uuid": "ca2b8597-d007-4676-9157-6085b77f458c", "value": "49152:5cfAGjjAgVZRIcuxyMeIRMJ2F9KD7aKHPicLkN9AjbOPBccZy:5cfAGvAA3QyMTmUPKDLHPicLkN+jbOPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693087463, "uuid": "325c0f79-01ed-40ce-9e2e-0e0213fa7baf", "value": 2075648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693087463, "uuid": "1701574e-218b-495e-8027-0eef7a6c7a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087463, "uuid": "6628b531-6985-4939-97da-23e04f3859be", "value": "newgoplus_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca517bb-443a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693072821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072821, "uuid": "6d383ad9-1a11-42b8-a3b9-c431313bd7dd", "comment": "Malware payload (RedLineStealer)", "value": "0c76ba08b70837d11abcbda7336470fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072821, "uuid": "f0a26135-dfa3-48ad-9975-539d69bef216", "comment": "Malware payload (RedLineStealer)", "value": "39e77d70430e037421232cd3d3362994144de53463905b2a16d3588a7e93a909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072821, "uuid": "4ff4de8a-d0de-4824-b9da-f010650a261f", "comment": "Malware payload (RedLineStealer)", "value": "9433d868aa7559b97beb4bf48208e7985f7dc288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693072821, "uuid": "5e141c6a-d617-42a9-9fc3-f513fd99bf5d", "comment": "Malware payload (RedLineStealer)", "value": "9cb6b71842ffa18324ebafe86ce87746768946845c3aa3f17f856ae4f97ccf8ffca272755fb38ab78d5d4f31ff37c3c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072821, "uuid": "bacc1347-3a2f-4bea-883b-790e73a83985", "value": "T183743AC03388A5CDCC4F8AF1512177748A70D442E257BB5B7C8BAEF7385AB58AE451E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072821, "uuid": "39a7623b-b144-4ad8-945d-70b2b6be0459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072821, "uuid": "7c40e25f-bcc2-42d9-8fa3-c2fd4f8c80f4", "value": "6144:gPsqVB7UyTt4TScPSHaV500Y8b+sQmTN1aDTi:gUqVau4NVY8b+sQmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693072821, "uuid": "6ea8358c-9885-403e-b55c-74fc3a63834c", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693072821, "uuid": "34e5d397-be73-453c-abe5-f50f67ed7642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693072821, "uuid": "3683e23e-d81b-4656-87cc-20c139258f25", "value": "0c76ba08b70837d11abcbda7336470fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c3bb7b-43ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693047681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047681, "uuid": "d3c25173-c02d-4cab-a565-f86d46b1bc52", "comment": "Malware payload (AgentTesla)", "value": "390975159a7996b5c99dbd9657294d7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047681, "uuid": "b30ff769-cf14-4694-9992-014150ba3ab5", "comment": "Malware payload (AgentTesla)", "value": "3aeabc80ae3a4da8f16cf5245610c1f342ba46c3d035c147c145e28ca96036aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047681, "uuid": "cb154b90-ecab-442d-bfe1-87e912de8d42", "comment": "Malware payload (AgentTesla)", "value": "e8188004901c766b3016020459c02f98b67ab337", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047681, "uuid": "bf03375c-6adc-4d98-9585-32f597e36bf9", "comment": "Malware payload (AgentTesla)", "value": "5c1ef127cde956881fb759da0aeb0df227aef7a6fca510765d80f7231b3f4b84b6da98c0687e56b5bf92d88a6d500684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047681, "uuid": "98526f6c-e5a2-4c82-9fd8-ca87c21408f9", "value": "T15A45ABE0317D93CFD1A28DB10F894AB0B9F135AC98C4160DB0FA9B2E93D6355589C5FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047681, "uuid": "dfc2f877-0c0a-4d78-9854-f0f424a6a147", "value": "3072:vRj7TobJ2dsw+4j/+9wqY+mhhhmitqOD:vRj7Tobuv+4j/Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047681, "uuid": "acfd2424-4d1b-4763-83e0-bf3a57bbd245", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047681, "uuid": "a746b258-de45-44dd-be4b-8e921bc4fdb5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047681, "uuid": "ff00258a-be59-4c48-988a-b4d2f08f00bb", "value": "nPayment Allowance.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554fbcc1-4426-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693064192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064192, "uuid": "440f977e-856f-43ed-8f98-87218e03b548", "comment": "Malware payload (Mirai)", "value": "01171d2c474f3e461696ba8b70ae2c5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064192, "uuid": "6a66d73e-a495-4841-bc49-5b27091e8caf", "comment": "Malware payload (Mirai)", "value": "3db393a5ff4a14e73cf1cf87517bf599e6055128fc03cd07aeeaac9a146570bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064192, "uuid": "7217f145-ce92-4691-ba21-da1fea07f75c", "comment": "Malware payload (Mirai)", "value": "342d1d41da7cf6059e3ab0192bc3c62f5ee3c07f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064192, "uuid": "5fadb729-0b18-40c1-b07f-b6fad8fe26d5", "comment": "Malware payload (Mirai)", "value": "23fcc7ca870365895f9b86b57ce93549e8badea4523c1bc2e0194ff32a35a7c5035752115fac73728a465fe7cdd794e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064192, "uuid": "dce914bd-0806-460a-874f-283aa9f3eee8", "value": "T10A539EB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064192, "uuid": "7e2cb59f-44b3-4444-90f5-c80d2ea41830", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJda:BjiBGFOdOT1Rhf+Kn1cY33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693064192, "uuid": "54944202-c5a4-4537-bdaf-5a2bff064797", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693064192, "uuid": "b325614f-1954-48da-8e0d-1cd51d1bb359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064192, "uuid": "46dddafa-0d57-483b-a12b-70efa278e960", "value": "01171d2c474f3e461696ba8b70ae2c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efdab29-4457-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085119, "uuid": "8068de92-59ea-4a83-9e77-7d70d3a74496", "comment": "Malware payload", "value": "53aa0c8429220348b51e743251721762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085119, "uuid": "3f464dc2-d9d5-4975-b292-dba4e35f60fa", "comment": "Malware payload", "value": "3e2703dc1b0f8d18c92f2ba85a99ffd5231362f7022646e84cb4d522b616884d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085119, "uuid": "044f5abc-a3a6-48b0-8970-b14be0a08280", "comment": "Malware payload", "value": "14a463ecd0d0951b400d96fd448269400821c034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085119, "uuid": "8ed1bd9a-3e46-4da9-bdc2-b9f20ff98f03", "comment": "Malware payload", "value": "2f0769e268c078782db84e5d8cf4e692d3e507f63506385ce024421ff95f2f4e872480b9eeb7f0472e2ced58ff1de787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085119, "uuid": "954fbbf0-c29a-4ba0-a5cb-8253bbcb875d", "value": "T179561213B500C0F6C5151A3211B65736EEB94F456A74CA93B798FE1EED3A342A33B70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085119, "uuid": "0e780c89-ea4a-40a2-bb9c-3c34e7f5596d", "value": "1921920d716cb0fce5f510380dcd9626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085119, "uuid": "13a15d36-e36d-41fc-8045-4dbe2742f3ee", "value": "98304:OZbhB+wK3lJZOHnISblHhl3XQgvDmmsTm0BT6CQZdNgx3UPH0lw/fkAqR015JrbO:OZbhI3Z65DlnQgem0T6CQZdahU/IpKN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085119, "uuid": "6a0b491d-6f2c-4e98-b162-4f3b8c18b223", "value": 6055504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085119, "uuid": "51419fe2-af9f-4205-ad86-7101e5068bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085119, "uuid": "1181be4a-9339-48b4-86ba-0f120eba4f97", "value": "fileren.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3018b283-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046091, "uuid": "3980a4b8-9561-4e8c-84d7-dfdaca90debb", "comment": "Malware payload", "value": "a8b403972053afe07ffc157f8fe8a68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046091, "uuid": "c945cfbc-ed2f-4a27-b04b-371555fd0236", "comment": "Malware payload", "value": "3eae6769c7f666d93915d97ceaa8233f4301922c8f4609090964c59990c2a58d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046091, "uuid": "acbb25b1-7199-4060-98be-a2f421e0b080", "comment": "Malware payload", "value": "4a8fcace2dae38dba67920faf7114c7d30d13c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046091, "uuid": "5aa4e0fa-1136-4c0e-8875-34470b462c60", "comment": "Malware payload", "value": "3369aa8b5871725bea4803b8d38c3b0c50676554ddc391b7f6c03d09f9facf37e0d70260520770ba252964dca3692d57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046091, "uuid": "4f77f9cd-fc89-4560-9b9f-d8b011dab502", "value": "T1F2558E9672A584B9D0E7D03CCA53D64BE7B2780407609FDF52A84B5E6F23BE0563E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046091, "uuid": "b342d4ae-f41a-4380-8ba8-1d45e7df0866", "value": "5052a66ffa21dc321d4a304783395c7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046091, "uuid": "6edca5a5-3514-4e9a-8bfd-d55a142b63df", "value": "24576:JJNmRqSFox0FCZD85P+xpyedC+CWgeIC4GT29OiR8rRk4s8P6+GU5FawqImwtW0K:JJrk+n2xvI6lU5F4yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046091, "uuid": "dcf1e68b-24d9-4401-a3c3-8818412cef63", "value": 1337808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046091, "uuid": "4ae188c0-e258-4dd3-a71d-cd272d457b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046091, "uuid": "a509c772-c254-4444-8bd9-bbd860935e45", "value": "SecuriteInfo.com.Program.Kuaizip.1.32583.21039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122fbfe5-4459-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085984, "uuid": "8f07c6f6-4763-4de1-9b0c-e084c0953807", "comment": "Malware payload", "value": "74054ac7026b814085d5ebd6c337c35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085984, "uuid": "1292fbff-c4c9-4430-b331-625fe8656792", "comment": "Malware payload", "value": "40e3510883e097bcb2b5b14ad79bf9f0659c9c4e828c759ee0967541579cc6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085984, "uuid": "c9ca5e21-a517-4136-a33c-0aad28a81b6b", "comment": "Malware payload", "value": "796bab665df964b16bd1b6b6da45c08dea1de2f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085984, "uuid": "86f1cd5c-9cf3-4ffa-8180-efc750544643", "comment": "Malware payload", "value": "b0e7d6695dcbb255e1b03d419dd8f05be4e673bda68ac080c5dfdba4c53bdcc0ed4da5834083971f18f16baf8d58e814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085984, "uuid": "8a396d77-6845-4eb5-92c0-dc2f5860b9b5", "value": "T14CD53352BBC4D072C68751314859CE32FA3CF4369916818A3BCA5F396E36689DB3F706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085984, "uuid": "2876b2d7-d2b1-4f7c-bf5e-3a86007838d3", "value": "9d1f0da408c33eebb70b9bfa17b7fddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085984, "uuid": "32e90e4e-7763-4277-a24a-04a8e3da7621", "value": "49152:toX3yq8XDY2Td2l+xysLqmiuUyKFAMkq9xraNSNzHznVxLgKGKhWzt:toHyq6d2UlcAcTrIS1TnV6B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085984, "uuid": "a790bdff-2f95-441b-9643-165023c6b75e", "value": 2946592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085984, "uuid": "9a35468a-6397-49b8-a30e-973e0352c9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085984, "uuid": "6053aa96-88e0-4405-8840-7e957fef5e85", "value": "7112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2076ae70-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046065, "uuid": "b87b6374-bb31-4351-a271-76072dae1126", "comment": "Malware payload", "value": "a6041709ed563172c79c285957e69dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046065, "uuid": "8ef1f503-ad1e-4747-91c5-4e51a02eb35f", "comment": "Malware payload", "value": "41110c4f924382d9d7269513fa16daf321ee85b55af3bf276a2cfb8b434991ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046065, "uuid": "9f7dbf26-29ef-48b6-9a8a-9c735976c34d", "comment": "Malware payload", "value": "3413ffe3c8f09925f0037a7da5ef8e3e69c779cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046065, "uuid": "92b030ba-d4bc-4eed-802e-1a3fa8386ee2", "comment": "Malware payload", "value": "42265a543c2c1bbed92730bef0592e494657e4afaffdd8ac37a0f8049630de0143201d76ed3407ff47cd5a033dc0f018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046065, "uuid": "f2579e25-b66b-467e-9bc0-b4214c90d60c", "value": "T1D5E4B102E6C1ECA3D5E101302BBA9695AF29BD700A5091DBF18C3D9E3B742C375767A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046065, "uuid": "95377e48-f66a-493b-9cfa-b7a6e20a63b8", "value": "fd3ae17d13056ce11027a1c5a2f157d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046065, "uuid": "b484e004-de65-462b-8e01-b1cf0ef1bc61", "value": "12288:VN+EUPR5ch+P5AnJ15sF42flWNY032nIEvs0xZ:VNjh55sF42ESIEEAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046065, "uuid": "20699b6d-24b1-479a-9239-08e2f8518284", "value": 680352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046065, "uuid": "c7b56c26-5e2c-45ed-9f59-1bd5b4a513b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046065, "uuid": "2cc70f48-6ef7-49d3-af95-86cb293a21c3", "value": "SecuriteInfo.com.Program.Kuaizip.1.304.10688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b739e2d3-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038587, "uuid": "7d551b0e-b7a3-4e79-b989-2febb9f541a8", "comment": "Malware payload", "value": "62f1095b7c9e1b4ce8c5264a19b9b0b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038587, "uuid": "708aa98e-fc7a-40c3-aa93-ddafd82b27ee", "comment": "Malware payload", "value": "429d9bd3929cafde3a6fcb7db922b070ca1b0e88e9602fb047e80415dc8cd62b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038587, "uuid": "dd1227d4-f74d-46eb-8c54-3a7cc8fb16a4", "comment": "Malware payload", "value": "630f6eb9e3c87d8cf2571e5ba11b23af6c718bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038587, "uuid": "ffbdbc52-1a0f-438f-8cfb-0612fa12015c", "comment": "Malware payload", "value": "4975f041c7bd6609e98005ffb03bbe0fd4e1b5f0cfc81bab006d000e5181c78097081584e5d82694971657cdf8a18fa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038587, "uuid": "b5f75345-ebb7-47f9-a7b0-d5191dc3f702", "value": "T19A561810A7415129DDB724F90AAD723DB10CEEE0171C51CB9188BAFEDEBA6E13D3419B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038587, "uuid": "fecb5457-3803-47b3-a809-149618618f63", "value": "821c19fcb5e682826280b04b4b59952e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038587, "uuid": "98294958-4810-4be3-8a80-b6d8f1450e0e", "value": "98304:rzC+CqfG2VcruFG2KAyVEDLvTQt9Hwd/vN:3vCUsEDLiZyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038587, "uuid": "ea5a8423-806d-4487-81b1-52a04eb0c6ef", "value": 6351674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038587, "uuid": "242304e9-1325-4b05-8e02-9936bfbc802b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038587, "uuid": "7f4377c7-7d1b-4b80-b333-9103c1c377da", "value": "62f1095b7c9e1b4ce8c5264a19b9b0b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab2461b-43bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693018406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018406, "uuid": "6290c980-c684-40fd-98f4-3568b89f878b", "comment": "Malware payload (Mirai)", "value": "82158d728bccf218ac422d47830da43f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018406, "uuid": "ebcb2468-1717-4c8c-9d43-32dec8e2a56f", "comment": "Malware payload (Mirai)", "value": "42c855c50ae38130ed4a2d0364829d9fc2b82531cc18c94fc51501db048d5412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018406, "uuid": "6ff179d4-71d3-4e7a-a7fe-a7dc86683e98", "comment": "Malware payload (Mirai)", "value": "2d11fd55e77f4118a82fd27437c3f92591ba5a44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018406, "uuid": "eb0624ac-b304-4724-95f6-8203bf6aa450", "comment": "Malware payload (Mirai)", "value": "41d6379cee46381102b0fd36021f59f4bc1ea02e5953eb7cb82787daf7973f9df3f56feb8d6a363acdbecd11d48ea180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018406, "uuid": "9bf2bf98-f2b1-4642-9d7f-77a57862cafe", "value": "T131735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018406, "uuid": "6724f872-e9b8-4627-820c-71cdec39612d", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8w:YwfdNu4cmZvFqI3w7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693018406, "uuid": "5daa1711-9c95-43de-8c6a-048a17b087a0", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693018406, "uuid": "4435c54a-0ee3-4dd0-bea9-9e06c205786c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018406, "uuid": "2838fd64-a221-4c4e-ac86-26ac2b60e321", "value": "82158d728bccf218ac422d47830da43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc28f333-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038622, "uuid": "6c9e0779-b617-43c2-9810-fc47adadf4fb", "comment": "Malware payload", "value": "1780f82ccf08409f2edcdfbd62f7ed0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038622, "uuid": "903b6cd1-fea3-4f01-8500-808579034509", "comment": "Malware payload", "value": "437a3b8b66f40850cba83c6badb1d7b7078c74e7aede6d4c8567d78f004babec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038622, "uuid": "745ea186-ec79-4ce6-b48f-93cd6d293af3", "comment": "Malware payload", "value": "7a827e04a891fe5ba87c7d8369873f1122977520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038622, "uuid": "fdc85736-2aa3-4b19-8001-084fbf251fe7", "comment": "Malware payload", "value": "15b570701202ed56aa897bd8dc93e9c03eb7ce091cb60a5982118d36648309cf00698f2508df527566346aa0bfb5ceaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038622, "uuid": "7646c8d0-02f2-4584-a14b-fffd98df9fa7", "value": "T1DBD4C610A7006369DCF775EA4BAE303DB10CEAD11304B1C745C99AFEDAAA6F53D3509A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038622, "uuid": "65ebc9e8-3bee-48d9-a651-b989a093d750", "value": "12288:Hh7yKwBpUVk1IvLlB9EUEurBuWdJsMLUWR24t:HBcO19SWdwWRht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038622, "uuid": "577ae260-8a39-4ff6-a969-9a6023c24ea3", "value": 626340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038622, "uuid": "642e4047-7b9a-4b96-95cc-cfa1f57eaaf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038622, "uuid": "a4817a53-95ad-4fb4-aa8b-a1e97f21cb03", "value": "1780f82ccf08409f2edcdfbd62f7ed0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662f042d-43af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693013110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693013110, "uuid": "770a4e15-3823-437f-8382-c4ecffd6a767", "comment": "Malware payload (RedLineStealer)", "value": "d45545569b24546395434b8cde877956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693013110, "uuid": "e7ce0569-acaa-4555-9988-cd97b7161018", "comment": "Malware payload (RedLineStealer)", "value": "43efccd5bf14c5354c174f80f210a8b074d8a66b1b288c64598251c711e560b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693013110, "uuid": "d5810a9b-16a9-4b7d-b1e3-4b63345af4ca", "comment": "Malware payload (RedLineStealer)", "value": "e07bbbcf74bbc31f6896609a05ba33891fe39346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693013110, "uuid": "62a51159-5efa-4619-890b-e6f0c823a900", "comment": "Malware payload (RedLineStealer)", "value": "4d19e53a1ff137fc7b3dced2c18bc0909f1deb41e2201789ea78646d3e1c46fbee8c2e3fe855ac8232ac784731ee3733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693013110, "uuid": "a8200241-7e38-4874-b37b-7d6af13b8dd1", "value": "T1B394F111BD91C472D882C075C821D6F4E9BEB872CA55B95737983F6B3DB0381A6AF342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693013110, "uuid": "3e3192fe-60fd-41ae-8c5c-0e72ae9764e3", "value": "be7b16ee5c7fab73c0fcf059c998ad38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693013110, "uuid": "dd88161d-f3f6-47c8-88ad-d01530215a2b", "value": "6144:dnXHfy5LNjURejTQxLsLpxuTxOWEMsN6XN7AtKDEIF1O5l5ZlyL8vfB8rYT9RV:dnX/y5iAjksLH6s+L+5l5Zc8vuI97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693013110, "uuid": "f7db0f98-cc8e-4992-9b0d-775dae7247e5", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693013110, "uuid": "5273c697-00ba-46de-9c3e-0721b437e109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693013110, "uuid": "ee708190-88c5-45fd-ab77-65339e1d5d8b", "value": "d45545569b24546395434b8cde877956.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654c09c8-4448-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693078822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078822, "uuid": "1fe7e62e-9e65-43d5-85c8-d21b1d008b00", "comment": "Malware payload (LummaStealer)", "value": "21e027f6b9ac8a75e11858285d5bf3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078822, "uuid": "a93e5f17-61a6-4ef1-af66-5e9a413ede3d", "comment": "Malware payload (LummaStealer)", "value": "44d775feeb97f7dd148f6e7360b0a13bda2bec2339f09b873d739832d59568fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078822, "uuid": "9a0d9769-4d44-4716-bf8a-f03f4156b80b", "comment": "Malware payload (LummaStealer)", "value": "f96c63a3856c581a51543449bf0a7ac7e9a0356f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078822, "uuid": "754311b7-39ac-4fa6-bcad-52872cbbbcd0", "comment": "Malware payload (LummaStealer)", "value": "bc7d7cb43a9a6e73f2ce4fc28d0538f19fb6daf9b0b043048e1fc27e6dcd939374c72994192e7e9566df867189631720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078822, "uuid": "28926380-8c5d-4e0a-b6d8-b128d3b23305", "value": "T1D884AD01B9C2C0F2C823113249A9E77A5F797A35C961CDCBFBD41D6DCA76280A31A75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078822, "uuid": "f990c2e0-35cf-440a-956a-8608a1374644", "value": "7e2df31d3619106ad25b94113e9b63d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078822, "uuid": "326afe43-150b-4280-9ae7-665cccaf7728", "value": "6144:/bPLF9Ocyp/5ci5NkcR3KT8MnIpwW1lSbxzlYK+bZxUn6erkA4uWSi711KTlgvVO:/rRUci5NB3EIblSbn6xWrk0WSi71zfDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693078822, "uuid": "7368f35c-769d-4642-b6c5-dbda54948cb4", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693078822, "uuid": "2ade48a4-00fa-40b3-b327-76dd3a49004b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078822, "uuid": "8719310a-c7f3-4e21-9e3f-2a3ebcc10318", "value": "21e027f6b9ac8a75e11858285d5bf3ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb823e8d-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081141, "uuid": "e81d4235-c371-413d-8713-69d0d826041a", "comment": "Malware payload (Mirai)", "value": "a8484ddb5f3dbc3e4596d23a929dc153", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081141, "uuid": "242b646d-b2f6-4279-9a4d-b2a74f926a60", "comment": "Malware payload (Mirai)", "value": "44e23d3e5e45b87821ad9534c6e7baf8d86453073700c0f542c647a0f7ca0e2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081141, "uuid": "c1e6d1b5-5aba-429c-8018-a1e97dfe62be", "comment": "Malware payload (Mirai)", "value": "48867213b0663e8f7781f1b46a4af90b30c1e2d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081141, "uuid": "8e9eb112-da1c-440d-bd32-19ba41c14a13", "comment": "Malware payload (Mirai)", "value": "39027811d4dfab543278f846c5ce1f4d620d8aa358f52f897965b35dc9049e5a021629731d488dbf1ce9049a65785678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081141, "uuid": "2a3b94a7-1414-465d-bb49-336ac56ed45c", "value": "T1CEA2D019E305AFF4DFAF9DA452C1D2C276F547C6278AC8E340EEAF022506042BB48D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081141, "uuid": "6681654d-ffcc-451c-b43f-f31304475dc5", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5HM4uVcqgw05VxJX:mRxsSVsMD6xiJJE5zRWNq4uVcqgw09p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081141, "uuid": "0d241015-90ba-4a3a-bc22-b6a6bc43c3cd", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081141, "uuid": "fc71cee9-05e5-41bd-8da6-7c58f9a1c24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081141, "uuid": "8c4231b2-59f1-418c-8c5a-c1bddd9a506d", "value": "a8484ddb5f3dbc3e4596d23a929dc153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefaa6e2-4446-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1693078221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078221, "uuid": "2c74b0f3-00b2-4129-87d3-0d49817b2acb", "comment": "Malware payload (Gh0stRAT)", "value": "20320bd328c8a9ab7ebacd0b7827c742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078221, "uuid": "39e26af3-5fb8-4cc2-b965-5bd3df738829", "comment": "Malware payload (Gh0stRAT)", "value": "46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078221, "uuid": "f12b8819-e7ea-4b60-953b-513de9a8fe2b", "comment": "Malware payload (Gh0stRAT)", "value": "8a66676b0a4926a9525630f6b4ec7a106db3e27f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693078221, "uuid": "1889baca-7337-417f-aad0-85d341874590", "comment": "Malware payload (Gh0stRAT)", "value": "9c8a0a9e7b1ccde0ce6dae3cd5fb941703fd7eed824a6c28efe838853fa97fafc23d62745002f0e2e1f3a525149aebd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078221, "uuid": "3165dd9c-aa7f-49ef-8ada-ee1737fd3eaf", "value": "T1F1B42F68EDE4145EE584F43E78460B4FBF4494A3CC8F660FADE53820DA9851F92BD8D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078221, "uuid": "cc83d085-b5d9-4e92-8073-ee509ea8a025", "value": "58ce3a912e7e1654872eb79db4b9b1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078221, "uuid": "8baf7757-00da-45eb-95e5-c3dc8a2c81aa", "value": "12288:KQb8e55GXwhEIGmcuRrv0CbU4j0ARGohKRjP7Kt+V7UB1ZSQCVmzdditQxL5NLlg:L5pKpOd/GTV5nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693078221, "uuid": "d6d06b1e-baa4-467c-9191-85b7a9a58e67", "value": 536633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693078221, "uuid": "cfc38f6c-99d4-440e-80db-7682359379e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693078221, "uuid": "02200a16-5c0d-4503-bd7c-5581e7305363", "value": "20320bd328c8a9ab7ebacd0b7827c742.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38aa2b16-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046105, "uuid": "4300ca39-4a69-4082-92ae-f190cecb5d79", "comment": "Malware payload", "value": "3c28255643dd5088198a42f13b36c2c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046105, "uuid": "a8742c10-f35d-4457-82e1-17835a8f6b3c", "comment": "Malware payload", "value": "4820c20fff437e3eac5ac91ea3d6afea08f7a8bc1d5e46eac34f589c69ce2b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046105, "uuid": "980f6945-f5f3-4e2c-b024-b516a84e2dc4", "comment": "Malware payload", "value": "9f3ecfc697c63122617654556595ad03f5d9768b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046105, "uuid": "2236360f-c895-458e-90af-3a9aeec7546e", "comment": "Malware payload", "value": "87f091f40d18c87685986400cd231110cfacb0ff9868e20a4a1b149785a05923d186d7d1056a6633018085467d2ac6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046105, "uuid": "b132979b-7568-4680-9c0c-56492a3666a1", "value": "T1CA244C5E77D0D413F6924AB14AA6B327F7BBF3163615251F3A004FFD71208928E29A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046105, "uuid": "37b2e045-1751-49de-8ab3-a6e08ea60b18", "value": "384:E9bE2i/G+0PcM07fQPt9QAXqni8t5QrqUJgyBfRQEr4vBsLijSSrG8C8:Ex5iTecMoQPPQuItWrqUJgyrY8lU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046105, "uuid": "b953adb5-d026-4bf7-a376-02a703421a06", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046105, "uuid": "77d48514-0c1e-484d-9965-e8fb12017a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046105, "uuid": "768e1ab0-223f-4aea-99c2-6f9134f9bc42", "value": "SecuriteInfo.com.Win32.Evo-gen.12148.15052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967126f9-4403-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1693049269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049269, "uuid": "134e650b-0687-4273-8060-e4ecc31baf8d", "comment": "Malware payload (PovertyStealer)", "value": "833a4c4844cc8de05d0338338088b5ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049269, "uuid": "71a84084-d6e5-435e-8cd9-dcba8d614f8f", "comment": "Malware payload (PovertyStealer)", "value": "48c8a4a6c7451ea92d81d9e61511709c9bb6dfbc5b3480f12e3013e83515d204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049269, "uuid": "762951d8-808b-4d0c-b4d1-3a2e8ddd0e29", "comment": "Malware payload (PovertyStealer)", "value": "745de3b02afb8169c3c464faf5a0ac2ecf49cebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049269, "uuid": "1524f196-59ff-4f39-9155-525e8fa5cc6e", "comment": "Malware payload (PovertyStealer)", "value": "5209041627cc771ea40c69cf3443fab6c96f061db897bc5163a1b31cd9c6b61cad5aee773e431db6a2a49d5f385defa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049269, "uuid": "c8dbbc2a-8cfc-4093-8f23-8e9adb9c80aa", "value": "T1692633AC92756911EBA3077056928B9A0797E0DF836FC707F492CD948B1FBD1BB42072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049269, "uuid": "39782fea-930e-4f44-a1fc-85676a201866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049269, "uuid": "f96b7b31-3442-4592-8906-8fe9e5488145", "value": "98304:8ZzmYBPOOWzq+io27lBfO8GUsiW8NJvJWZ3D4bcf/Qi:8ZzlBm+fo277bfN7WZ3ucfoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049269, "uuid": "5b57f7ec-9459-4a74-98b7-0065137b08be", "value": 4507648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049269, "uuid": "b0f92dfe-de98-40dd-b8eb-26842f345f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049269, "uuid": "2b702ddf-3a40-4d1c-a611-d3b34a285caf", "value": "Allergic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dab96e-43e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693037670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037670, "uuid": "c3f87a39-4895-4ed3-af10-dd375bdd7864", "comment": "Malware payload (SnakeKeylogger)", "value": "42e3d6016d145ae5bd157bd7dbd86963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037670, "uuid": "235f4c6f-e102-4863-b3e9-a82025b9a844", "comment": "Malware payload (SnakeKeylogger)", "value": "48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037670, "uuid": "a048d246-33b7-471d-9023-62ed4c6f9c7d", "comment": "Malware payload (SnakeKeylogger)", "value": "3728f467ff8026872de04f3ccef78a2d4a47df69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037670, "uuid": "eabea2fe-2c42-40c5-a700-6104473de8f9", "comment": "Malware payload (SnakeKeylogger)", "value": "909f158b4646708f0ea3318728d08f8c63fe0051ea946430fcce1cbe371e6f2db702c5eb67386e153eed9171ce1c01f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037670, "uuid": "1f697f6f-3c94-4cd1-99ee-9b9a99379734", "value": "T19CD41638197DA327D138C7F58FD18427F364992B3026EAE56DC367E64226B1129D323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037670, "uuid": "8866a4fc-0de0-4eb9-b858-923a6f0800e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037670, "uuid": "9039fd04-9c8d-43a6-99b4-d314d2e5c394", "value": "12288:3Vp0K8s6owoQCOahAbQ5hq+JJ8psQA5Uo6Bp83pazn7N3f0SHOy:3Vp0K8s6oworOahAIVJ8SQqUo6Ba3paV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693037670, "uuid": "0b31bc70-211e-4c6e-936d-eb3befbb1c51", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693037670, "uuid": "2477ef63-6762-4f91-b051-a2404c2b38a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037670, "uuid": "5eeec2fe-9ab8-4873-a0e0-5d9c95c55654", "value": "42e3d6016d145ae5bd157bd7dbd86963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ca0138-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693038671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038671, "uuid": "42c71e28-8cf6-4156-a2af-07e352861b00", "comment": "Malware payload (Fabookie)", "value": "427d7fa7985c51a913c88ac92a5df795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038671, "uuid": "f8fd95c4-f93e-4859-a7e0-90b8a7e3a0ed", "comment": "Malware payload (Fabookie)", "value": "48f42120cc5b3683db52663963704e8f0a7d935a2a24e3911e83079fb4f25ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038671, "uuid": "2d67e986-1d31-4eb4-9014-8950281aabda", "comment": "Malware payload (Fabookie)", "value": "712e154408f7c3c55b08120b1e729b8bedd29a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038671, "uuid": "638afe21-7f96-4041-b3ec-92cec218ad2e", "comment": "Malware payload (Fabookie)", "value": "1f212046253a5f27bb50a56e385435f8f24a9b78a1e30ce21cfff6fd78e4cf1c2681fb9820a7f80396687a06e0a64d32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038671, "uuid": "849880b8-8d72-4936-b18f-8017953598eb", "value": "T19CD4BF13FB6591EDCAF13930B5494296BD96C9EC638808690D2BDB520BCE43F9397CB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038671, "uuid": "768d89bf-bed2-407c-88e3-8bc89736f9cf", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038671, "uuid": "631ff47a-0ccb-4418-80d8-7275d7789f01", "value": "12288:ERivuoAtJ0Ej5FH3I95Q++qz+oFDtOOafqFAwCCys6+fGvaNB7ZXy+j3jMJW:ERntJPb4fQFvSt6iPyT+fGv6Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038671, "uuid": "56b30971-6ed1-44d1-80fb-e61eec6d1c54", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038671, "uuid": "e69a2db8-f41e-488f-829d-dccc970e48c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038671, "uuid": "b0a81d2a-6284-4b93-b9b9-6d4b1f774d9e", "value": "427d7fa7985c51a913c88ac92a5df795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5f1e0c-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693038679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038679, "uuid": "8f5333dd-c3f7-40c8-9739-ab4fd649299d", "comment": "Malware payload (Fabookie)", "value": "227b4cb6c4a4a6477dd18c6659c5f8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038679, "uuid": "493c5c16-fda3-4f23-a03f-be1f63a87ec6", "comment": "Malware payload (Fabookie)", "value": "493ebf087d0a960507abe4cc4872f4a4e8a36a84799e3c9c3559e4295f9baf21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038679, "uuid": "c65aa4f6-a543-49d4-aadc-6cd5f5a66056", "comment": "Malware payload (Fabookie)", "value": "d5ab18af347dd39e3bfdb92ed7bc4d2d21be35ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038679, "uuid": "8dbf401a-2cbf-4255-9df4-5d743045198a", "comment": "Malware payload (Fabookie)", "value": "44a806f93ecd2d6c5d56b12205f35dea8da84274bc6ca6f4b250706dac7c6e5a743a4c8dad0e6d58b21d1321d3d61dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038679, "uuid": "bf0c21cc-bee2-4ba8-bf00-752c30495cfb", "value": "T1D384DD64F0B2ECB3DA126B7039FCF91C91AD71551386869E365AF0B692D330031DDBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038679, "uuid": "b5a32a69-b8c9-4491-8b5d-27c764aca2ae", "value": "96cc98468ed325b3857363887597bc67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038679, "uuid": "f54de307-5d21-4e17-8ed9-ca98c162f8a8", "value": "1536:qyK9MV0CLSuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6uC1:qX9M1uuNnAYy4AZ6TvcgJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038679, "uuid": "d1398f47-27e8-42c2-b477-3d2ead7b3e30", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038679, "uuid": "86eb1457-3a6d-4dda-83bf-5fae17ac57a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038679, "uuid": "7e676bc7-a773-4ec5-a766-8c435b3099be", "value": "227b4cb6c4a4a6477dd18c6659c5f8ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3316ff27-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046096, "uuid": "51d59885-8287-4a49-b089-cc490bee6ecb", "comment": "Malware payload", "value": "67364e966eff382d8d2a413edca45728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046096, "uuid": "84495495-e8db-4802-b2b8-75e2e45de246", "comment": "Malware payload", "value": "4986e5fe8e7bfa80a557cd6e224d5119a51e5af08342e711bc18e75471af11c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046096, "uuid": "ceae3c5c-6866-4bb6-8357-5928e32b61a0", "comment": "Malware payload", "value": "bab138b4e3e1708ae89f085a8cb4d3b796ec9345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046096, "uuid": "47a21819-8a63-4e38-9523-bb1290b66499", "comment": "Malware payload", "value": "e8b7bde286b2a2673161cecc146c37a37d5f1c69c030b82491c54d95c548d187bb8ae854255013513718f21dfa10c5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046096, "uuid": "236c0081-8ad5-442a-a716-712e35d3802c", "value": "T15C76AD187D91C063E87303B18DF9A978216CBE3C0BD055E773D46B1A39B05E29E36A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046096, "uuid": "8ef606d0-7e63-45d8-b850-874bd811d62f", "value": "32a1b79d59001ed96edff2db96d4ea2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046096, "uuid": "75460a9c-487d-44a6-8998-4721562d88df", "value": "196608:RwPLBiOIDB4saDec4oGLfol/Vp5jLk23vNP+8:RwTBZvb5l/VpZDo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046096, "uuid": "0609291b-0bb7-4162-9855-15520abd5c7b", "value": 7170000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046096, "uuid": "cca2cbd4-831b-401f-b105-9d0f1ab4e7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046096, "uuid": "77607245-fda8-4d42-a03b-3159b090781e", "value": "SecuriteInfo.com.Program.Kuaizip.1.23810.6508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30dc4b6-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084938, "uuid": "7d13bb9e-7b24-4f92-a0b4-b1952dc4b13c", "comment": "Malware payload (Mirai)", "value": "6219aed75ee542fbaf803fb4e8c8e8ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084938, "uuid": "95c54d1f-02bc-4541-8060-367dd4eec1cc", "comment": "Malware payload (Mirai)", "value": "498828c14a6fe77ea57c332522b45822403c018accd304ae2b5bc663b3157742", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084938, "uuid": "d5250510-bee8-4ceb-8743-a509c656b301", "comment": "Malware payload (Mirai)", "value": "95871ef1e8796e40bda2379daf5ffeeef7298760", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084938, "uuid": "16269e7b-b97d-408a-86a2-3d48ff8647f2", "comment": "Malware payload (Mirai)", "value": "2579ea63580ebfe4acab5dce8d18d61e0010c77bb85d72e370e415967f86872ecb3968be4a4a0d88eee94a4bc752f0aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084938, "uuid": "7369faba-cda4-4f12-a708-49de8d81a348", "value": "T1F5D33917B4D080FEC8DAC1B44F9BE136DA73B42D2138B26A27D5AA271E4DE305F6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084938, "uuid": "a8b90747-ef73-4892-8801-6296a25f7d5b", "value": "3072:3UX5YWaDw/C1Ou+cbN/Aei5ZaogzY0oYz2I/bnjq6Mv:kpYWaDwi4qrfiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084938, "uuid": "bdbe385f-bdc8-4f8f-94f5-febdd1337e29", "value": 132536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084938, "uuid": "1231055f-f764-477d-830a-c3a54be0858f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084938, "uuid": "3bec4c6a-f4c4-491b-9cf9-f7a87b612bbe", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5309e9-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046113, "uuid": "0c86635e-a603-463e-9e01-2b64752d79c0", "comment": "Malware payload", "value": "72e9572ad1195c539adacedd12b303db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046113, "uuid": "82f83ac6-18c9-4a5b-841d-62195b37bf91", "comment": "Malware payload", "value": "4ae1d842216579c42a9cdca58091c830dfc8ba28389430d18d0a41ba2ecc4f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046113, "uuid": "f0b190b3-ed27-464a-aa82-55a4de7a693f", "comment": "Malware payload", "value": "fc3151697c57c41af7c6d3ea5830a54dde917c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046113, "uuid": "76db55c5-cc45-41fa-9780-b2a6b37438df", "comment": "Malware payload", "value": "d94fe4fe8476614a759f3cffa4ad4bf2624e018cc02af79117bdbab12f20929e4aa3e84008d3a4f5ee7429dc8f0ba1c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046113, "uuid": "cd8bee73-e4c0-46b7-8e92-cc832a5b4eed", "value": "T14FD4BF22B883C031D0B225B0457DEA6659BCAD350B3A49EBB3D41A2D0E745E17F36B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046113, "uuid": "50b4e185-fdfd-4efc-b112-43b3fc592004", "value": "d1087e0fde6be70fdddcfcb8eff46c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046113, "uuid": "70bc4b39-3960-4db9-91fe-398ba0d2e587", "value": "12288:+iax281+MZ1iWQHZ7QDdaP9A6+90i0rq3yqX4BKYZvb69mWrobdhUs+sVB6d:zaR1l90zJ69m+mfV+sV4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046113, "uuid": "2b0262c8-fcc1-473f-8931-0b5d2d36c519", "value": 602016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046113, "uuid": "18b0a115-9e6b-4d56-ae75-2e885de58a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046113, "uuid": "d61ea2e8-4c99-4078-8d8f-fa7dee664e79", "value": "SecuriteInfo.com.Program.Kuaizip.1.1784.29847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074fc6c1-442c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066638, "uuid": "72510f96-8ee8-40fe-9726-a5c23e7b8233", "comment": "Malware payload (Mirai)", "value": "47b052ae8513ade50be5608305c4be1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066638, "uuid": "2bb43661-8095-40b5-80fc-d81908e0006b", "comment": "Malware payload (Mirai)", "value": "4d78a30ea7448948a01b23d1640fb31ebc0d6d61876e91e068bf78948f16d5dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066638, "uuid": "0a559430-115a-4c24-b1ea-3d85962320a3", "comment": "Malware payload (Mirai)", "value": "0fd15ca5e803bacaf12c2d6d2a5d2d18ba36eee5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066638, "uuid": "2f38e8b2-cb6b-42cf-9ecf-1a762dead8ec", "comment": "Malware payload (Mirai)", "value": "de07e1d2e363f9285239958b14801895ce30d25b68b1499cbc8955a2adc080f14b5d901873c824eaab0b29dfdff84365", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066638, "uuid": "3f4a86a9-d625-42ef-859e-94ba2b899c92", "value": "T105A2D025E3456EF4DFEF9C9452C2C2C277F942C7279AC4E340EEAF016506046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066638, "uuid": "33a693b9-7d9d-42bb-a667-8caf70499e53", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5+M4uVcqgw05VxJV:MRxsSVsMD6xiJJE5zRWNP4uVcqgw097", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066638, "uuid": "00d7bc01-7efd-4beb-a3ec-969e83a75892", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066638, "uuid": "b71e34cc-eb45-419c-8a26-1e107ed5854f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066638, "uuid": "ee3bca3d-a49d-40bc-8349-bd25dd9d57ac", "value": "47b052ae8513ade50be5608305c4be1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a068c27-43e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1693035370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035370, "uuid": "29b223d6-5add-4a01-ac1a-fa2f2908bee4", "comment": "Malware payload (MarsStealer)", "value": "a1e617bddc833b00cf998f45803b12b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035370, "uuid": "9fdb6379-78f3-48c6-a379-eb5941c5e2e3", "comment": "Malware payload (MarsStealer)", "value": "4de0e01af7b62b03f15dd7b6b092fc1cc6d994ce9f4fd4e362e313cf8ffd192b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035370, "uuid": "d6a3c5df-6b92-4e47-b3e2-85d51e657cc7", "comment": "Malware payload (MarsStealer)", "value": "f2901b46f963c6ea5611b46406f20e7831902179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035370, "uuid": "1c1f85b1-f2f7-478b-990f-da576017e128", "comment": "Malware payload (MarsStealer)", "value": "428629a6220866c10ecf13801cc8ed6de639e9a497c75b0dd2b536372a8890dafc10bcdfd9c0b186f4ed033a7b77f90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035370, "uuid": "523cc2fa-6e4c-47ae-84e0-14f52c3920e4", "value": "T172F54184EB7F12E0CFA79D571557F92F4A142A30EE72EC8AC4691240241FAA6150E7FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035370, "uuid": "bf8e8bb2-cb0f-42c5-9b5c-220d27123611", "value": "07252edbe4090ee53d1788b81e1bf321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035370, "uuid": "a217c78e-5c7b-4d42-85bd-edb891bf9bdd", "value": "24576:ZUBAyV3ecM/l0sjBu5dDxaiZH1Urg63SmXsz0c02QqwMWPZgED:CM/wdDxtZH1Us63TczP02QqJWPOED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693035370, "uuid": "671b4dfd-19a5-4121-be17-f9289c8dbc77", "value": 3649192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693035370, "uuid": "73712b0f-812f-4c85-a9c1-d9f050b14b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035370, "uuid": "4763d344-9995-4293-9208-aa3376b4c978", "value": "o27e182ca89dbb10ccfb1c641d18b3186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d10477f-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693080821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080821, "uuid": "fb3df488-e3fc-4733-8adc-7bfcf8ae22c7", "comment": "Malware payload (Mirai)", "value": "18eb6227bec1cc5ed3410a628f60b664", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080821, "uuid": "18c2d8c1-da13-461b-b5df-091169b19f03", "comment": "Malware payload (Mirai)", "value": "4e4d90c5495406122612afa528db0aafef53fa6138ffad331e5d5167dea8a15c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080821, "uuid": "c0973022-b5f5-4e51-b4e9-6fb28b4393df", "comment": "Malware payload (Mirai)", "value": "3cde7f0cb3ba7e8fa6ff6b9399fa9ec66cae4db8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693080821, "uuid": "5d5d7ae8-f9e8-4e43-998c-3715436920a2", "comment": "Malware payload (Mirai)", "value": "a7261a1c8483a64388380b27c008458879cb0c56e00b0e36e3f369905ae64f4d96463a55382d73d431348e1a4da12ab1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693080821, "uuid": "b9c13583-5946-4d69-9d16-6315c0ced34b", "value": "T1A0C2D0E0B726FA31C4206C7DE52A4D8A3A51067C91FF393764258D358FC1A9B63F84B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693080821, "uuid": "8344e16a-7367-4b40-8ad7-dc5bfad636bc", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwr79q3UELuE:PKy4qfqoeJdXWgaL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693080821, "uuid": "67aea9cf-cbeb-43c1-b6d1-68d0139fe08f", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693080821, "uuid": "22bda7ae-7ced-4070-99ac-82fa936f3380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693080821, "uuid": "f4e60d42-84e9-4c9e-93a6-f131d98678e7", "value": "18eb6227bec1cc5ed3410a628f60b664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc17515-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693079403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "54611bcf-25fc-480f-8bd3-616f04819c3a", "comment": "Malware payload (Mirai)", "value": "481583febc66bb224dfbcf03832221ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "3d70055e-f820-4cab-8564-5499cea8275e", "comment": "Malware payload (Mirai)", "value": "5006bfc365c1fc2dd216c8cb22e1dbbada49239f51dec1089e3a7e51e24c420e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "d51fc30c-5cba-46f6-b156-14f98d328862", "comment": "Malware payload (Mirai)", "value": "1cc99e3a7b0147ca2af68d809b11e49e63cea2ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079403, "uuid": "cd4d143d-f491-4543-9db4-99f207b40edf", "comment": "Malware payload (Mirai)", "value": "bad01f684e859fc87c6540167a761dd22b7410cfd64771171ca752d82f22db1f76e571a06e3c3771697ab68b46a647f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079403, "uuid": "f9c2d021-ac2d-4c2e-8d0c-2fe086bd46bd", "value": "T1E193084AF941AF15D5C325BAFF8F41493303AFACE3E93212D9245FA423C799B0E66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079403, "uuid": "53d6864b-0f3c-4b2a-a775-18cae562277b", "value": "1536:eJnAlTfOy/VMD28anH8lSTV5jNlS7ikBxHJL57+DZ+YHjsEqv:ttfzE28anH8lSTahxHJL57+DsEslv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079403, "uuid": "f6540a16-c8a1-484a-a03a-12404e9a2ced", "value": 94732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079403, "uuid": "23242c27-3699-43cc-bb59-c9e91f2cbc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079403, "uuid": "8eaf697b-fe94-4dd4-b36b-ed4596d49078", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963fd6cc-443e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693074609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693074609, "uuid": "4592abeb-6cee-4941-b9b6-803f27d9b821", "comment": "Malware payload (AgentTesla)", "value": "356920606036ef8a954bbb852a50de00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693074609, "uuid": "c17e08c4-ad8c-4dd9-a0e7-6e767f1bfccf", "comment": "Malware payload (AgentTesla)", "value": "50cad31fae9c45dcdd778695df5c75eed96bec0262755cb259ef1970366777c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693074609, "uuid": "7bb47ec4-5702-420a-81da-bb12231ee0c9", "comment": "Malware payload (AgentTesla)", "value": "510cfc61892dc01f793f152cfef4e81faf687143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693074609, "uuid": "c9542e17-608c-4024-91cf-9c438d81d62e", "comment": "Malware payload (AgentTesla)", "value": "ed48716cfbeb22e21ce05efa80ddf053b3fa336b5f52dbb7e9c8b237027d2588ef9722cc5d28cbac31c1efcc5d9b30d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693074609, "uuid": "5bf6774a-52a3-4b58-9848-119a5054aaef", "value": "T18915D03532F84627D07A86F6042126418BF1562B223EE6D57CCEB2EA5FE5F500A53F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693074609, "uuid": "b7987c41-27ad-487f-9733-eb8359a01378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693074609, "uuid": "d5150b0e-417b-4769-8d58-7aa5f8363565", "value": "12288:4ikVfqwi/iWsjdz9NrnrLJ6Y+I1OIQgzz6x6r7hx9aU+FYeAI4nqItyTKiB7:9qqwiiWenrEG5QwzGCf9+x4/tyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693074609, "uuid": "644f0612-f7ec-416e-a9cb-77981a37c876", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693074609, "uuid": "5a903eba-719d-4df1-8b9e-0cede8a7fc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693074609, "uuid": "a03715a1-3c94-4c17-9720-abb01aa3e32b", "value": "Mensaje SwiftBo 20.897.64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d230663b-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015439, "uuid": "b562dc6e-c41f-4945-8dec-d32201ab7508", "comment": "Malware payload (Mirai)", "value": "31ea99e8471e5e0644a0a363c4fb225e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015439, "uuid": "950b49c5-e3f5-48f2-b584-7c924af5b4e6", "comment": "Malware payload (Mirai)", "value": "532db0c64227f944ea9e18f18f1e9cd42e3e9b320e3b2ac95cc1f5cf41433027", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015439, "uuid": "bdc9fceb-b1c4-40ed-8646-e9e34fe2c775", "comment": "Malware payload (Mirai)", "value": "b34a2dcaf03550f5211a0dc6a8a815237efa21aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015439, "uuid": "4ffe31e4-f088-43d8-854b-6dcf72cfd874", "comment": "Malware payload (Mirai)", "value": "d14068f9d4641682328800ea5cc120d1d2c43921feece8ba3368dac531e74bf7b66a9ce78d412d4f2fee8cc440b1d05a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015439, "uuid": "45d86426-36ed-43fd-9a95-6b0be865f987", "value": "T18DD2E18876D353FA8C8DC77EB61E403A30AA74DAB6B29323B305D5530776180FA51E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015439, "uuid": "395cc02f-856a-4f47-aedc-c79bf5e588bf", "value": "768:+lxKd21RhxEnsD16IHE4RlY990ewS//ne3:zd21/nDdHEw0axP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015439, "uuid": "1688cf7c-83b1-4552-84b7-9bbed5340dfb", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015439, "uuid": "4c2f01a8-7724-48ff-b6d5-3b6d3fc54c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015439, "uuid": "b84eb182-46e3-44ed-ad44-b2a6c3f0a58e", "value": "31ea99e8471e5e0644a0a363c4fb225e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b1f613-43cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693027014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027014, "uuid": "94371786-a517-4d3e-a20b-57b253fd1208", "comment": "Malware payload (AveMariaRAT)", "value": "5183a888f579862d261b57e51e13acc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027014, "uuid": "ffef514b-3213-47a6-81c5-c7624af60d5c", "comment": "Malware payload (AveMariaRAT)", "value": "539c9f4a1a79f5872d9e84d36a4612160bede79da376688f805fd80b9ae79eb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027014, "uuid": "f58b9796-a4be-4687-95d6-c22d9aa37e32", "comment": "Malware payload (AveMariaRAT)", "value": "6f8ceba3f8e3742a844fa113e48dab508979371f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027014, "uuid": "d226965f-106b-4b7e-80ec-cfc48ce43a85", "comment": "Malware payload (AveMariaRAT)", "value": "92db70a2bb71df848cc55723c2afaf04b39f54830f5db402cb9ec8c4ffa3b69949b4f086d1c64186ce5539e7e6927500", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027014, "uuid": "3dd527a2-5e9f-4a7d-8bc8-94ba33807756", "value": "T149654A4B767548B1E6479B3BC0DF1A004B9B9E5622A3EA0F354E325529323BFE707493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027014, "uuid": "59a816f2-fdfd-44bd-aa3e-7febfb07a8b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027014, "uuid": "e524fe57-d8b0-4e7c-b8b0-0c186ad1d53d", "value": "24576:s8wjJA7A7CTD/hS2UkUWxPym9Wq2EZabiigfh:s8s7sZUkUsz9cii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693027014, "uuid": "37cb718a-4e8a-4499-b1ba-a68ca4a97f23", "value": 1540096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693027014, "uuid": "f054e115-e43c-4b86-bff9-29e0b9c626bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027014, "uuid": "6a3503c7-8ed6-4700-96dd-917d178ffed3", "value": "5183a888f579862d261b57e51e13acc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28393098-43ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1693026321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693026321, "uuid": "c5e16ebf-aa90-455b-b00a-1e7a6f32b6b9", "comment": "Malware payload (QuasarRAT)", "value": "a22694ecc330877c14c622a338f099d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693026321, "uuid": "02116799-e10a-46e6-9d06-85c5fdc80421", "comment": "Malware payload (QuasarRAT)", "value": "53fe510daa3712b64c24d8f30658e1408929369735c50cc3bbb61e26c55d786e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693026321, "uuid": "3c351164-e176-4bdc-b8a1-01c7409a986c", "comment": "Malware payload (QuasarRAT)", "value": "c41f047be2b696dea3184b7ebffe647079f3954c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693026321, "uuid": "2eeb507e-e8c9-44cb-b7cf-1e0208c62cf5", "comment": "Malware payload (QuasarRAT)", "value": "bdd5844a86599b3ae53f764d4aa3aefae5492b9b7034b2e5a499f6c43ecad01da0d6f48f96a824a339b0515bcbfa0575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693026321, "uuid": "7fb5b80b-832f-4d25-8537-0807ef7d4cc8", "value": "T119065C13B64B85E1D0861B75C95A7C2803B0F68376F3FE19364E23944E47BB66A19E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693026321, "uuid": "871579fe-9231-4792-8b98-515f2f54a2ac", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693026321, "uuid": "72cb4991-a50e-43b8-8146-c79e6cb64bc0", "value": "24576:NSpM9XJSnFTGkzgB3uz60e5Lb1HCfLSovTaCqbvF+WKzQqW/pt64Y5v7QHuHOhHc:NgHny3COVb1HCfLpvKqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693026321, "uuid": "ec4b0688-f3dc-476d-9eef-9799696a529b", "value": 3713024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693026321, "uuid": "919cfb3b-fcc0-42d8-9c1a-b4c0f8209514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693026321, "uuid": "ec09b5b1-158b-4970-a75b-68bc59cf4a01", "value": "a22694ecc330877c14c622a338f099d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0982c8ac-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042590, "uuid": "88e15cea-0e4e-41ec-a8e8-bb451659bd2c", "comment": "Malware payload (Mirai)", "value": "1cf28567761b7d33668b7344f9f62193", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042590, "uuid": "648ce782-3425-4f36-92a0-1ece6715cc59", "comment": "Malware payload (Mirai)", "value": "54218a0d4f06a894d5b8b3e9ae5be6d560567d73146c5542ff8888dfc038dde6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042590, "uuid": "896de9a4-b9f3-476d-97b0-e9a896d793e0", "comment": "Malware payload (Mirai)", "value": "acc66f23a2b0e64d0a23ac3a63979ecaa5b8dd18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042590, "uuid": "829045b7-38c0-45ed-a0cb-397d9130aa9a", "comment": "Malware payload (Mirai)", "value": "7e05cc1ab539f3fdc6bdea31d644d0c9936af611f4239949d1b8a31f97a2b250d8fc8ab0eb937855e0ea26b989a31291", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042590, "uuid": "4945c9db-af14-4fc2-948a-c345f1cc358c", "value": "T1D3C30845FC415B13C6C212B7FB4E438D7B2A17A8E3EE720399256F61378B95B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042590, "uuid": "f1db7629-79a3-484f-966d-a93ef0f5a20f", "value": "1536:E0y9BEUy6e0lFIAuYS4VNADsTg5Zts1LM2/bNdLl6QVwywbF+24o+rtuawKKOxHk:E09PgFIH40wM5Zts5zNtgswLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042590, "uuid": "5ba2da00-5727-475e-ad43-91fcd08539b8", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042590, "uuid": "d34ac514-a5c0-4e74-92cd-8c1fbf567362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042590, "uuid": "2f5ad16a-f3b2-4516-a59f-71e646e73a42", "value": "concakhbtandhuy.arm-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53fff96-4432-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069614, "uuid": "720c80be-0e10-4f2a-8e28-a3949f24e375", "comment": "Malware payload (Mirai)", "value": "afe2ea3956f2e5f4210a7c9dc0511a6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069614, "uuid": "df7ff71b-6834-4646-8237-9e6780689546", "comment": "Malware payload (Mirai)", "value": "5497409eda2b2fdcd7b997d0fb27c92c48e09ec7df317afd0c85fe3fb39e1681", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069614, "uuid": "eb63a307-862b-464d-bbae-407a748ccb80", "comment": "Malware payload (Mirai)", "value": "496dc04d29b840d26a61a6ce5f28a2b5228da251", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069614, "uuid": "ff9d9b9e-6575-4ddd-995e-57a33a34ef8a", "comment": "Malware payload (Mirai)", "value": "61bfe89168228ae065a9ec5669fec887ee801c4105f2872cce278b30dafe0208f7b8a5d2063b2036fdeb75cab840197e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069614, "uuid": "7e08ed2f-997c-41bc-8194-7a319e2a3157", "value": "T1CA535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069614, "uuid": "aad746a7-9260-4fd1-8c06-28d3159b68b3", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8P:N1GjR8EVGOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069614, "uuid": "11e9f14f-87c3-48e7-8433-b6037445d748", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069614, "uuid": "d59cf5eb-14df-421a-9a92-a54019a7310a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069614, "uuid": "c9f98fa3-66cd-4936-aebc-967cc9fd1d42", "value": "afe2ea3956f2e5f4210a7c9dc0511a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a290a9e-442f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693068012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068012, "uuid": "056b1bc1-6cdf-4ee9-bebe-f7f8218f8582", "comment": "Malware payload", "value": "b562463c75e79de1585a9259e9dd3dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068012, "uuid": "3d685cf8-655b-46d4-8a7a-3f040f49cd75", "comment": "Malware payload", "value": "54c4d144e0a11fe8595746de8bc732299f536e72be19c8b1e592ef3ac5477b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068012, "uuid": "47cfa299-29aa-4b6a-8ef7-b2dcdcf4596a", "comment": "Malware payload", "value": "8816da25f784dd683cac72e39410952959ca1569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068012, "uuid": "ca63897d-2f93-4e6a-8682-199171a58eae", "comment": "Malware payload", "value": "023f6030fc0395c978dee7d72863b35d99663caa8d9c4fe0b69c16c30225fad85e2edecd7dc57f945478fa7963ec7ea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068012, "uuid": "4426ca3e-88b5-436b-bc5d-fd271b91bb0b", "value": "T175B523617AC19431E962193519E78760AF3DBD301BB28EEB87A16F2D8F300D16D38767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068012, "uuid": "a1803e82-bf85-4c4b-a66e-01a83d8ca8be", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068012, "uuid": "ccccf0fd-e95c-4529-bd29-08dedb384b73", "value": "49152:8cbi6+49NXuCgAxA1MaXDMySUl6uojpk3oQhUEaV0Ep7DUUGBXDke1DSadQGm:8cbVb/2MajAVk3phAlp7DmVDkeYadQGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068012, "uuid": "66191588-59ab-468b-90ac-1bff0a9cfe50", "value": 2432365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068012, "uuid": "97acb673-d428-4766-b2e6-48e179d0b672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068012, "uuid": "573d878d-8a1f-481c-ad68-a83eef17510b", "value": "SecuriteInfo.com.Trojan.Uztuby.4.22616.12962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b51d213-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046083, "uuid": "1b9ea3dc-694c-43ab-b4f0-5574738bc0a7", "comment": "Malware payload", "value": "1119648bcb0b52664a8c4b892d3d4571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046083, "uuid": "221dbd75-c884-4da3-bcad-c2cb2f428ce1", "comment": "Malware payload", "value": "55dc987544f814aed4f2f1f22e0553d48a844c993551fe7cd5f70c314f216ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046083, "uuid": "61d57c06-16b0-4bf9-b9c7-6df00b6f01b3", "comment": "Malware payload", "value": "53b39014b338a7684553cac40d10d406c3fc310e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046083, "uuid": "86dbb193-4ece-4e12-b86e-0d7adcab9e31", "comment": "Malware payload", "value": "3bdf262309a3b95b607c66e78bcde671d4d7ad752870e26934c479e35088673e502ca5ea1c7bf400da858bd1d1bfb18a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046083, "uuid": "dbef9a77-47e4-4d89-8def-c14cd9cb68d1", "value": "T18045C4DC3D08E033DD6103F159B85EA6243C692C07D453C3BAB8976A75E44D2DB3EA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046083, "uuid": "8bc64cce-1ae8-4672-ad9a-838878578d28", "value": "b2d627d0a93b7d3336adb40dd6bd5b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046083, "uuid": "dd5b2666-9a8a-4913-94eb-85513e641742", "value": "24576:cObaQ6B4PeevzJQCZR0ktEhVmEvOfbhP6v+GnfVFYK:HNPHz6YRDMVmRlivFfVFYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046083, "uuid": "d108dccf-65e1-43f9-b7a3-bef31e172e49", "value": 1200592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046083, "uuid": "4c120aed-989a-476e-90a9-698dfda89247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046083, "uuid": "58dbdb6d-da14-43a6-aba3-fab1f6d2f4f3", "value": "SecuriteInfo.com.Program.Kuaizip.1.16666.28881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f18aab-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693081126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081126, "uuid": "37877575-39e4-4cc6-bce3-6967970b8805", "comment": "Malware payload", "value": "119817511854230b03e25b01e95e0e78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081126, "uuid": "1a62c8fb-0b22-4d54-a8cc-5ac9d72a1db3", "comment": "Malware payload", "value": "5651b9074147cdb8564f0de722d97720ff2287301fc94fda65fda312f2f45624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081126, "uuid": "628ea54e-eea9-43e4-a8b1-b5e3639a72f9", "comment": "Malware payload", "value": "75bccaf998c8b2f2b08be520503df0d7effe6a7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081126, "uuid": "3346ab7d-5dc4-4c35-a62a-442ab9c6eca1", "comment": "Malware payload", "value": "32712a1dda8b3a8efb87546b5a68c96ad59b8082f3e786553dbe93901c873a6624fd6bc008474a6e07d03e4b4deaa6da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081126, "uuid": "5156e276-dd92-4625-a7d0-5b926d626f1f", "value": "T1F0438B63C8791E28D25959B1B4318FB95BE3B418928B0F9A6176C3ADE453ECCF5013F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081126, "uuid": "dc7c1fb2-ca85-4f40-aa55-a483280bcd13", "value": "768:dLLPm4Q58cJQSwnO26oKPvrNOd7haVo2HHD+BCzJcVl0hdjdfsbo1IpirAIK:dPTcS+WKPvra7sa6aBCzUx81IuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081126, "uuid": "965733e0-1b51-4084-b9bd-dcd62e5d731d", "value": 56552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081126, "uuid": "c1047c67-a1f1-4bb2-9dc9-0b3f6099bd09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081126, "uuid": "62eb7a18-03e3-4e1c-b796-e339f5334810", "value": "119817511854230b03e25b01e95e0e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ae1a88-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084728, "uuid": "e361f9aa-0b14-40a7-bf6f-498aef923954", "comment": "Malware payload (Mirai)", "value": "ef8d236779855ba126146054dc00abb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084728, "uuid": "e9a4981c-0c6c-4754-b131-4b536c55c6c3", "comment": "Malware payload (Mirai)", "value": "57b367dbd72742cec792b751a6621ebd6df1b416ee02499c77d970017dbbe634", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084728, "uuid": "3a2a3728-4cc2-469c-9817-28e8c9e2e59a", "comment": "Malware payload (Mirai)", "value": "68e1b462b2b73b43b76e6ea20a469761f14fa0b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084728, "uuid": "3e572ccd-0d72-4780-9eb3-70cd7e89a220", "comment": "Malware payload (Mirai)", "value": "ea80e4a2d3a10cf39a2de537525f0a79326e2dd018752ee9551bdd91a359bb50e6367c2b0d783d3f68461bfebae11fa3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084728, "uuid": "64258c38-052d-4a65-9699-b30413b93c21", "value": "T158C31945FC505B13C6C612BBFB5E428D3B2A1768D2EE32039D256F65378B96B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084728, "uuid": "fcc94c72-fe5b-48ad-a2d4-fb18c1ef8226", "value": "1536:A1UoI4eU6FV71MAhV+qVE4VSW4T2gX9DWAfrYA4ln3tVlwAwywVFbLr5tMqs1WMS:A17eVv71Mcc4R4qgNDWW4l3LGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084728, "uuid": "43053b33-49d1-4622-8776-e8e70821bcc5", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084728, "uuid": "ce3069f3-0fa7-4221-a403-1c03e34eb099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084728, "uuid": "67b91cf6-ec5a-480b-b622-3354cbfd6c96", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e565b002-43eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693039094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039094, "uuid": "98ce4335-7cc2-4d63-b311-91bb430a7cd2", "comment": "Malware payload", "value": "36598b3beb16c182950a9e7076c101f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039094, "uuid": "1ffd270c-42c5-405a-8cb6-386bbb1cbabe", "comment": "Malware payload", "value": "57d7528313c82e628b086a67dc9e76f5cad960f26fc5ada696eff1380a414fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039094, "uuid": "67efab38-6531-4b4c-ad92-b926344f065a", "comment": "Malware payload", "value": "d0ecfbf5a153ced965128d7506495fde8be3d593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039094, "uuid": "b9cce660-f490-4b7d-8462-c0a97485178f", "comment": "Malware payload", "value": "dbdba4b6ab71b232be6a909111e6230c1e37dc60ef8e24824451f0a32947d3261b7584be7ee86058f1eabd6d1504d6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039094, "uuid": "ad5061fe-b745-43d6-8d13-510864ece102", "value": "T15DF48D53B1B1443BE1B22A3D9C6B8764986B7E003D2468066BF41E8C7F7D68179742FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039094, "uuid": "8de52121-92c5-458a-b655-753de758ff6b", "value": "5226dd8dd6ea1301056e12f149c3e833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039094, "uuid": "13162f4a-00d5-414d-aff8-5d1a913e71cc", "value": "12288:o7uaqpynrgK7q74odTsxsS0facW/LzodMT6HTbJZKR44iHN24:PVk8j74cnSqQ6zVZKmpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693039094, "uuid": "6d248f84-804a-4732-bc15-412b48fe4173", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693039094, "uuid": "65a9307c-5f33-4bac-b3ca-7b1be9d692e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039094, "uuid": "1cad97dd-150e-45f4-8828-518a70d31f72", "value": "36598b3beb16c182950a9e7076c101f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c093d0-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038608, "uuid": "1bcb82a4-5a73-4279-9573-1a358d931590", "comment": "Malware payload", "value": "05e9344f0ad660827734a0451a297cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038608, "uuid": "8ae79e99-6e31-4a8c-972e-fcd5e8bb50e9", "comment": "Malware payload", "value": "583d6389fb487916e8952cad017d8f3848d1b9ca1e174992a93d6cee92f8ccf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038608, "uuid": "9fc9c96c-0c54-4127-896b-a3bed24e6d37", "comment": "Malware payload", "value": "07709c43f9528a1b50dde8d2585615bd7af42dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038608, "uuid": "c50798ac-26e0-4e82-bbdc-8c2eaf686823", "comment": "Malware payload", "value": "037ad76f81e94af87469113af1898cb9a6d6bb8b7f925fafd416aa7c7c50bf862550d536a58723d5f938f8062998d0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038608, "uuid": "8c3bd4db-2a1a-44af-9369-4d4f45a4de1d", "value": "T1BF267E375B094371F573147A8A34B455168C7FAB2F38A2C3CCF88A875C329E19578A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038608, "uuid": "1a947d9e-e476-4ec5-934e-5b9ddee8d786", "value": "c35d00c2af5b3fb76ae88ad1e7f25da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038608, "uuid": "6116f030-eb80-4491-aa2b-370cc777e3ab", "value": "49152:bfhcZaRkz7USRDfPk7bGgzU1KAi5Uko0j51qAqpsQ:j27Uk2GgzNA3knX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038608, "uuid": "b292954d-0621-40f1-a787-eb9a1d8965e3", "value": 4526080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038608, "uuid": "36359a13-7046-4779-a14c-d435117d6021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038608, "uuid": "2392fed1-a869-4361-8d5a-1f09d50137a7", "value": "05e9344f0ad660827734a0451a297cf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbe99b9-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085574, "uuid": "6d05df46-0eb2-4a7d-8d62-661f6acdb8d8", "comment": "Malware payload", "value": "51fea3a37bdaccb985ec91192d556699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085574, "uuid": "b6365c02-7ead-4bd4-a8ba-05d87f0c57a2", "comment": "Malware payload", "value": "58be057bed33029beb150ed0586f274f38e89b56158b89b3f2e383c74d5bf63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085574, "uuid": "55826332-95be-455e-b78a-d54093a6f382", "comment": "Malware payload", "value": "03d2378e2b2beb7d567d0e0fc1824495dbd597fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085574, "uuid": "485a7069-f7c7-4d91-bc19-6d7a8502a104", "comment": "Malware payload", "value": "2fc6377fc82eaaf5978b6d944bdaa9ec095702d6081fe3fb0b6a37b1d4b74b4d99b1c9c6b12d86f47d1d6634dfacd620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085574, "uuid": "fd7e2878-e23d-4bc1-b202-2cdccfc44cc4", "value": "T1C01623D33385AC36C8FB02BA723597DDFC70C0112B61F650F4AD987BA5E49598277A88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085574, "uuid": "67dac895-0130-406f-b7c8-7e630971f6eb", "value": "76c906522f16bb660115c4004157473b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085574, "uuid": "a1c0fd60-57b2-4df1-9f99-e1890133a760", "value": "98304:ebKKq8JMmqTY5bRIEtL2ws0ze3Xci+S+9ut2bewUoLrMDqV:En6mqAtI0un3MF5Y2bewHsDqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085574, "uuid": "ee74fa00-18b5-4083-ab49-84e55ec95159", "value": 4156014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085574, "uuid": "b94b1bb1-d9c1-4ee2-9bfa-ac496f7e7292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085574, "uuid": "8b5807f9-2392-4010-ac25-0c62ce6bf2ba", "value": "14721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a766f81-4400-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693047746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047746, "uuid": "a2f23b1d-e398-43c5-b803-6d62d5de351e", "comment": "Malware payload", "value": "6fdbe232ef39fc2b3e0c096b5e736785", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047746, "uuid": "94dbffda-4230-4287-899b-8235d56938d6", "comment": "Malware payload", "value": "590ddb5895586a7a3beda1fd5c5b5d70b38babb2a55a5a4e8b5bfdcd530faedc", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047746, "uuid": "e953a48e-760e-4659-af3d-904312333497", "comment": "Malware payload", "value": "542cffd17147bd1a83952649d6ad0a0e8c8d537a", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047746, "uuid": "8b0fdfc0-a7eb-4ba2-82c8-c72314994aff", "comment": "Malware payload", "value": "1f6859e84194d44779ad36aab872e64fa1f30eb1057f138a004ea3622dea341d464b5dd982f1a392b9d9133e57d68272", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047746, "uuid": "06016fc3-f935-4326-b99f-310ae4c6fec6", "value": "T15E75124B6F51900ADCC5897F938F837995BAF396E038D089043F1A614A875CDEF24BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047746, "uuid": "8f3dbe29-f256-45ae-9890-8c01d274640f", "value": "24576:KSc87f4Og0gngmgBgMgDg+Sc87f4cRk9WX3ZQegWQz/Z4CICu0:KScEfm3gFePM+ScEfh//gW/Iu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047746, "uuid": "0f4c60d6-f307-4e70-a982-517ca7373cf0", "value": 1584199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047746, "uuid": "fd96b801-59a3-45d9-a406-f152b380f1c0", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047746, "uuid": "d2e58cff-0c79-416f-84b2-c9e0b890a7a2", "value": "Confirmed_Quote_REQ_For_New_PO_s.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d4bf4d-4407-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693051147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051147, "uuid": "cca5bfb9-d032-4807-9edb-7b5d59428a0c", "comment": "Malware payload", "value": "6d30e3c40b56700201c0f9fbd915f0d8", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051147, "uuid": "d06c7241-ae93-4d76-80a1-92beabe4af57", "comment": "Malware payload", "value": "5a2acc32f8b1712d6750305d01a687c9561f6219064b41e497a7cb236d57fa55", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051147, "uuid": "dcc28891-68aa-4a0c-88af-74a976f0a8c7", "comment": "Malware payload", "value": "d4a33ae8812735972b96657e6db7bc5c5341dd29", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051147, "uuid": "f8c284c4-3e4a-4425-9fc5-5b4a2533430d", "comment": "Malware payload", "value": "4291857bdf7c8b92829d700b9acc1404b92e5c2595d4ec555babf56a41cd4ff6e0c3ed03d1859fad137972a7687bb891", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051147, "uuid": "2dc8d145-4bbb-4ad7-b888-3fb05da0dfc7", "value": "T1B31533385BB572001B583673411A5FE1CDAFFD39A29BB220D5B89F37A062C051BCE795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051147, "uuid": "8fcecde3-6ecd-4f2e-a2f0-2a35d2986de0", "value": "12288:GIq2zGFJz3AQRo2AJQlXVcQxMR54Ix8aiHvLDtVIYofIqpG660drMXKj+42LqeXr:GIq5VSJalBxe5tQH7kggdrMXKkLPg1vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693051147, "uuid": "3c74fb26-1de9-4bce-b40d-d3545182abed", "value": 875303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693051147, "uuid": "8079b482-c2d8-4c70-8fb6-b44719e0e528", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051147, "uuid": "6a88cbbb-7bfa-4cdc-9b00-fb52bed5bd98", "value": "nQUOTATION_AUG7FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b31d38f-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693086885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086885, "uuid": "cc1eba9d-f1cd-4376-bd9a-6d1423dffb78", "comment": "Malware payload (Mirai)", "value": "5caca5f6b2c98f92303de2b778ddd24f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086885, "uuid": "c23e3098-7d38-4914-8a06-384bf8d176c2", "comment": "Malware payload (Mirai)", "value": "5acb207ac5352c678c7278409dd2f2b55564834b24f30364e42ed4241b2fab2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086885, "uuid": "9e6cdcd7-65c8-41c2-93d6-2cb94127f834", "comment": "Malware payload (Mirai)", "value": "c7552f488620ab2894951e02e53341b83b856f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086885, "uuid": "7565560d-4241-44dd-bb78-3bf030febd0c", "comment": "Malware payload (Mirai)", "value": "8a53a4e26502f56c39bf3892da4d4faea818ca806bd3ebc7b89d33563f1e98db79e8affdc0580432f6bf5e45edd6b316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086885, "uuid": "481e38a6-e829-4a0a-b216-3a7bc685c700", "value": "T1C7B34A73CC296E58D564D1B4B0B08FB82B53A950818B5FBE15A7C2759083DCDF6853BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086885, "uuid": "2cd140d2-a8cf-4ee1-a85c-91046258c7ba", "value": "1536:ACFO2AMJAWxbnq3xVxE5DEkCQKowlm6X/8CgoAQWHHF7ED1ZC:AEz9pDEkGoe8CCQWnF7mZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086885, "uuid": "e25f7938-82e7-494d-b2a3-aa1c635990f6", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086885, "uuid": "a73458c9-79be-4632-8c91-b42507be63ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086885, "uuid": "368ec2a2-c3d6-4d63-877e-cc1c55ebcf41", "value": "5caca5f6b2c98f92303de2b778ddd24f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb342bca-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085945, "uuid": "98431b02-c2ce-4a5e-b72e-6f03ec2fdd7c", "comment": "Malware payload", "value": "64ade26925298902821ae1f5f40527aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085945, "uuid": "8b31e10e-e6a4-4b05-9d10-69468d90bb25", "comment": "Malware payload", "value": "5ae5c17ab942be5faa0588fe33ff5cf96c0575ec4767e66b12dff3cee531b325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085945, "uuid": "4e3e607a-35cc-41b7-9402-87108ff9eaf8", "comment": "Malware payload", "value": "b31579b17334438dcc2d3a314179a579468a7d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085945, "uuid": "d93591fe-5a07-4fc0-bb63-db15b1bafd01", "comment": "Malware payload", "value": "7c92aa8f75b49927338a0c2d5161401d528eb2de1e54d3a14d7ebe2edc7d5cc6734bcdd54cc928205c1cd6003f21ed8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085945, "uuid": "488e1934-eade-4ac0-bfc2-d9eafe179f78", "value": "T17AE533766562E593E064027CD28D3BF8ECEEACA1D258246B452C3DED7437A152CE831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085945, "uuid": "cc5cdd97-8d59-4599-b69a-efea74534862", "value": "900723d55a3647432e32796756f54971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085945, "uuid": "d7b5aed3-4835-412a-8d53-7fea22605181", "value": "49152:thjOyEG+HFoFgS9cOuLdvs+P6oKIYGlOlRx4D2WpW8UpombENDcm53cvkrh3meQQ:HVE3FoimcZ9zP5VlGaD2+8E95svE5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085945, "uuid": "ec1d2941-169d-4f5c-a10d-35906d7a32b4", "value": 3102720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085945, "uuid": "57ea79d5-c7a9-4750-b6e9-e08171bd85f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085945, "uuid": "e798bc33-7045-4e90-b8df-0501017e7a14", "value": "autovl2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0403034f-4404-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693049453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049453, "uuid": "fb995ed7-5cfd-41df-82ee-28ca37ba5dda", "comment": "Malware payload", "value": "8ccfbbf49d9af4d5db84f36ec0d33995", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049453, "uuid": "593029c3-fc0c-4391-8460-219640a4ad81", "comment": "Malware payload", "value": "5c2677d822a8c4e09e9044f4a75297a34f7544c5773e2b6fb93704bd68908595", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049453, "uuid": "9f5d5665-a6a0-4969-a767-39b55bb9f0bf", "comment": "Malware payload", "value": "d80459ac132f46f46c2ff32e58d81747207e45a8", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049453, "uuid": "744862c1-9a1a-4931-9227-f363888947b2", "comment": "Malware payload", "value": "8d754ec24350b3f1a0db536e7c04e65bf87d2c6491ed7de26d52e6cf60dfdadfe647661dc8ef015e96ef4b61aa9e2de1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049453, "uuid": "cbbc80c6-b8ed-4fd8-83d0-8d6871cf736c", "value": "T1065412281DE209BDF38C97B7A01EDC26CDAD3600B9F4A02689F7DB91D193365CB1980C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049453, "uuid": "0225115b-49aa-4732-b662-2f501ed7d294", "value": "6144:/2I4STSyF6xPAqlHVMnPcMGAtxJWs64N36KKY:/2tQSyF6hRVMRLxJWt66K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049453, "uuid": "6b2d5bfd-6de4-4f2d-b9f6-62d8f0e9abc4", "value": 285745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049453, "uuid": "28b3fc9a-55a9-4f98-beaf-03acbd4ccd2b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049453, "uuid": "d54953da-6bc5-4725-a81c-71c5691c75d3", "value": "nRFQ219000045327899498000000.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d963db-43dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693032417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032417, "uuid": "767ed920-ab09-4fa6-a06f-ed68e9f52976", "comment": "Malware payload (AgentTesla)", "value": "07926f7473fff4bb9d41b460cb71b550", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032417, "uuid": "53f16606-1539-49cd-a0bd-7f52e8d9637c", "comment": "Malware payload (AgentTesla)", "value": "5eafaa5f16cc37fad487678452867359480a85a78a82e7521aae029f426e69f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032417, "uuid": "83db5778-0591-4712-bcf5-23bc2326196a", "comment": "Malware payload (AgentTesla)", "value": "fb0edc87b5b710f76da29bdd5b5ec73285f7c1e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693032417, "uuid": "f30b1a20-1208-4a6e-9f33-e7853037fd3f", "comment": "Malware payload (AgentTesla)", "value": "1591c9957f1073b59c97314065c21b704a5602f6164a93f2ea858b8c0206cd2ff90fbd63359d4e8cb5a530590c2aa8d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032417, "uuid": "5e5fa8f0-5273-4520-ab8a-de7a8db6f3e8", "value": "T19305F100B2E88A16E4BEA7F545F406440B36791A6A33E75ECDD514DE1EB37C08E1AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032417, "uuid": "e05721cd-58a3-4cec-86cd-a5eca41d05dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032417, "uuid": "29d5d2c9-24d6-4f49-95e6-299ec3f82740", "value": "24576:8cagQESvORWys6JLfRGFyVnjo9i0T3I/NXQSXbHSp:8ZgQd6xZGF9KVAEbH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693032417, "uuid": "87c8ce3f-fadf-46a7-8c36-de5e6d041d52", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693032417, "uuid": "49bb9c34-2821-4662-b67f-0ef919f28d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693032417, "uuid": "4d3a0b56-1aa3-411c-a278-96aeb27b4ae4", "value": "07926f7473fff4bb9d41b460cb71b550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0faaf29-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083217, "uuid": "fbb9458b-0b2a-4e04-8dbb-258442b806db", "comment": "Malware payload", "value": "27b141aacc2777a82bb3fa9f6e5e5c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083217, "uuid": "aaec3297-ab1b-4e37-8e98-0544e3854406", "comment": "Malware payload", "value": "5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083217, "uuid": "b7f8ef09-5aa3-47aa-9e35-7c1e72761a2c", "comment": "Malware payload", "value": "3155cb0f146b927fcc30647c1a904cd162548c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083217, "uuid": "f36a6d47-f327-459c-aeac-d33f6a7f53eb", "comment": "Malware payload", "value": "b8bc7555444f1a66db722bd525158cd9bd37892a94a7a76d04a4aa38fd7800f4fda811b6e08ac95745d2f6dc7488fc67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083217, "uuid": "896c4a39-4951-4657-9db4-f24e6eb47205", "value": "T131E63332E6644227C6D30973ED65E2246EBCA22D7F108476C784AE1DBDAC4D393B7217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083217, "uuid": "6ee33d9d-e34b-43f1-bddc-6c7ce17e3a42", "value": "8e2588a9cf43886de3449dfff03137b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083217, "uuid": "c9f18702-a900-4b6a-9a62-1c5bd41cb57e", "value": "393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083217, "uuid": "7e71e5bb-eca8-4862-b1c8-3493fc4d4e02", "value": 14572000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083217, "uuid": "e2794d96-5f66-4763-9656-46a3a2d4ffa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083217, "uuid": "7f42e950-64ac-4992-a529-628d0516d667", "value": "vc_redist.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9d6d6a-4430-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693068605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "eb523e40-03f7-4618-8b59-faa504fba279", "comment": "Malware payload (Mirai)", "value": "bb9b8732b105b3fc82011542fce64972", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "41472603-8893-46ca-8c57-4c0447291136", "comment": "Malware payload (Mirai)", "value": "5ef0c177aa28ceb7698751213200a8cf1e34ada8270cc3ca5eb8f7bf0f445bb6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "df179d4c-d24b-4059-9fe2-36501301fce9", "comment": "Malware payload (Mirai)", "value": "6bb20f4936645c415d5ed7698a5186d71539db66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068605, "uuid": "63227b10-1db6-45ce-b379-3c448dc21fae", "comment": "Malware payload (Mirai)", "value": "a8e7c0748adf9330b4aa2165c2a354fcc3eb001c8bc64be32d985ad3d3992d028b764dc74ebd8e54de071e4982284ebe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068605, "uuid": "d25661a8-750d-4812-bba6-00cbca461ab9", "value": "T14A245C82ED409E13C5C62776BA6F014E3332A789E3EB7106CE185FB437C6A5E5E67205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068605, "uuid": "2fa0ca88-8933-4a02-bd77-e2fc2a6fd5fb", "value": "6144:U6fvj7XT07Ln9Oaabm4cJbMNg6vBM/9lup:U6D7XY7L4dbm4cJb+m/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068605, "uuid": "c57ad7d4-4fd8-475c-b51d-fe6d3ff880f3", "value": 209804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068605, "uuid": "d4e70294-030c-43bc-afff-7033fd5f2a53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068605, "uuid": "8b2ede7d-50b1-4600-839b-9b585f541b73", "value": "yourbiggestnightmare.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a206eec7-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083648, "uuid": "60f0a2c2-d3b8-46f2-8c5e-7d0ece654476", "comment": "Malware payload", "value": "22aa8b7d46ee857347bd21bdc5585ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083648, "uuid": "ccf36634-4f98-4f11-9360-4944487fb77c", "comment": "Malware payload", "value": "5f284c6511c4c3998afa21a6992f8a685bfb94221a130f8c99ce55fb7ffd4020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083648, "uuid": "5d033abb-9190-4ccd-9290-63b85667590e", "comment": "Malware payload", "value": "5b7f96b67320dabf1f307f5cda4deaa1c6747a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083648, "uuid": "e0e7cea4-1c40-47eb-8c87-d56fa8c26475", "comment": "Malware payload", "value": "fafa2594858cbb1281eead930755e6e4c3270e569010b6f232aaadc4673a8673d02febd5e5243e40fe2c9ce932006cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083648, "uuid": "fa2088e9-4422-4d50-842d-9f0699f82ce4", "value": "T1197633126BC26134DD7F983830A158760577BEB22EB4DE9AB1D467DC46304C0A73E7BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083648, "uuid": "e4353714-9c74-4b86-a54f-0061816b3347", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083648, "uuid": "f79f7037-b08a-4070-a788-fbcceb9c5a4f", "value": "196608:zrIWLrTNSgx+8AtpM2Y34M7ZepYU2YRkQ8O9:zrIWXTZPAfYoMteWU2YSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083648, "uuid": "f13e4910-9d56-45f1-966c-fd614e786f7d", "value": 7272912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083648, "uuid": "b25fa31e-7d2a-416a-bceb-7950db1a92ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083648, "uuid": "a7dd241d-97d4-458f-8e56-d52a620e2e2b", "value": "csaff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213108db-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046066, "uuid": "cac31de0-6eb6-4768-96aa-b4913a709d2d", "comment": "Malware payload", "value": "5ba60a76e80c0f8732ab6a94b666c25a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046066, "uuid": "d6299ec7-19b2-4cee-b23f-f471d41bd7ec", "comment": "Malware payload", "value": "6150e7c4511d11ed0adad752e82fd541877a2dd4d2232dc4ae16425b57e3d3bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046066, "uuid": "a0ef50a8-2ffe-462e-a04e-37a80925ebba", "comment": "Malware payload", "value": "04b6a7f13969a0fa380b620bae32b17376b5d784", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046066, "uuid": "b85f07ef-2aa9-4407-82f6-c9dd92ec3218", "comment": "Malware payload", "value": "003b6d04d7ad8725e814644aec12b00364d039f859c68a87c0e2eabf86342e5d062eef6f4ef1bef98306b40bd33c564e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046066, "uuid": "c18d8d45-0697-45e0-91b6-8984b3659851", "value": "T1FC55029E5C2F6402D2A95DBE454CEB651DBE23310F87313FBB6A10CB989B9917B4070E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046066, "uuid": "1b02ef03-c141-47f9-b53a-ee35b572ec87", "value": "e5eba25eaa62d922ec2a689e689f860a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046066, "uuid": "875e480f-1f03-4573-a014-e990897a93e3", "value": "24576:1Yocw/Wf1+bEWBUYVQRHpSdl5t0hdyE/RFM7zCaGhgChGeeGe/:+W/WswMUYVWc5eyE/07GKC1e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046066, "uuid": "bf20f0c5-4b10-4238-a903-edac957bf40a", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046066, "uuid": "542781d4-c59c-43df-8502-95580a309a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046066, "uuid": "7f716942-f7a3-4aef-80ad-ef50ea9f87c3", "value": "SecuriteInfo.com.Win32.InjectorX-gen.28155.15275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c48e70d-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046084, "uuid": "e1b770a3-7be9-48c9-a616-993b323cecd5", "comment": "Malware payload", "value": "d54ba176b4365017a514aa1710f85e0b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046084, "uuid": "76dbb1c1-22c8-4621-8f55-3cb2da3b909d", "comment": "Malware payload", "value": "61ef876e8ebed4a4726db59866fcbd283e215be8c5bf8a1674786d8a77bb46e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046084, "uuid": "980beb5f-3d19-4263-93b5-4bb7c28e7864", "comment": "Malware payload", "value": "69b06d75360cdba086d0d3370695c131cfd80569", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046084, "uuid": "30c8d430-55ee-4d3b-ba70-8d68015a461c", "comment": "Malware payload", "value": "333705ff49a62d608ceb61939e04057127e9f2918b200e17bb95c7090fb5293c978c1f976c1fdedbfad28c9859207656", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046084, "uuid": "ebfbafea-4fca-4e2f-934b-b83df6bfb7a2", "value": "T172448D2239808477C6AF0B308939E66916FDF9600F74C5DFA7D80A1D5F722C1BA3556B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046084, "uuid": "9273ac21-5bab-4e65-ba75-2d5cfd27e3d4", "value": "3acd9374f9c470917b4f7a970b7b6601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046084, "uuid": "033461d5-530c-47bb-b164-42a190728c54", "value": "6144:vhIwd/+XQfP6FZrKcwTopxJD9rlDyY7+fw5poySWTv4Nis7G36e2Moh:vf2X7FZGcEKxJX2Kz5Cy/v4I5lnoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046084, "uuid": "9e94ec02-579e-4af7-a24f-bc22f1579ce8", "value": 277456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046084, "uuid": "588e5b51-0d8a-4cca-bfa4-1cb254f87bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046084, "uuid": "23ae3f55-76d5-49c6-8176-2a4c1350449c", "value": "SecuriteInfo.com.Program.Kuaizip.1.24923.1227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f27cff-4433-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069642, "uuid": "39bae0e5-ac6f-4eae-8b2a-5ef14b45c098", "comment": "Malware payload (Mirai)", "value": "9b21b53c39289377d1d37d09b3ad39e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069642, "uuid": "5033e947-b95b-4bc5-bcf5-b00e114c312b", "comment": "Malware payload (Mirai)", "value": "62d5285f489220fc5ad12ec41ead1f338f3918b7f25c1bb3d3fe5936d988cb8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069642, "uuid": "6b77639d-e784-45e0-a215-bc195e6a360a", "comment": "Malware payload (Mirai)", "value": "c1305f4a4bc59fdce090d4f2c96cfeb42b0c7a12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069642, "uuid": "f1afd4f3-aaed-4183-90ab-db1a3750082e", "comment": "Malware payload (Mirai)", "value": "68fb91be28988aae00fce41b2d19ff2a129a71dfa9b714fcc9cb5e9347675904ab3ce5862af7d1824395fc9902bbc4ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069642, "uuid": "ae616bef-5855-435b-a6c0-eaae1ef491b5", "value": "T11CD2E08872D793FA8C8DCA7EB71E403A30AE74A5B7B19363B305C4534775280E691E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069642, "uuid": "2e3415ff-c949-429e-806c-49faac1503d2", "value": "384:MId/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKufXjhoNy7:blxKd29WcxEns+V6IHE4RlY990dfX77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069642, "uuid": "ed049cea-9aa4-426c-bca9-7bdb78782769", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069642, "uuid": "576548d1-db17-470f-8309-2823ac078271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069642, "uuid": "bf4cb92a-2927-4e34-a5ec-0a91d2ee898b", "value": "9b21b53c39289377d1d37d09b3ad39e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dc9022-442c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066908, "uuid": "97f207ec-86d7-4104-83c8-c90bcff392bf", "comment": "Malware payload (Mirai)", "value": "46a4ca30bcaf5476097364de16dd4b14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066908, "uuid": "e82f0ad3-83b2-48ff-ac1b-b4eef5b98c81", "comment": "Malware payload (Mirai)", "value": "6305ac5d9090eccdf35e726f0411a0443c6313a92beb9b591590b7b39cc1fbd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066908, "uuid": "7d92e052-ad22-4a62-a825-adb2588e976c", "comment": "Malware payload (Mirai)", "value": "6acca86f5f088c0b4d71a27aea91a5fcc16074a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066908, "uuid": "0e69d6fc-8a5e-4903-9745-3127488347b7", "comment": "Malware payload (Mirai)", "value": "97147bc063c535de2fac4a8a578c15889236dc2b9dc6629979c08f41094cfbd475439096bbe9b0349e58c303b891e48f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066908, "uuid": "39c89f7c-49df-4583-a0a5-a8a8f32d57a9", "value": "T156432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066908, "uuid": "dd0b409a-d1c0-44d8-8dbf-2f3f21a3d6db", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwO:RqtmZPuutfbltZFBSJsBcfDSTFI+BEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066908, "uuid": "3f62e93d-85d4-489b-a384-f2ce8f7fc6f1", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066908, "uuid": "55a7576b-a6ca-45e4-845e-11984f86fe84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066908, "uuid": "cd0fc941-b960-4439-ae82-b3953849dffb", "value": "46a4ca30bcaf5476097364de16dd4b14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca9d10a-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084713, "uuid": "4e28577e-e2a8-4bc4-82af-7bb63eaea1a5", "comment": "Malware payload (Mirai)", "value": "39d34c8e71515bc2c9ecbc0369609a15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084713, "uuid": "9935d9ca-18b4-4ef2-8a83-aa58e80c6be7", "comment": "Malware payload (Mirai)", "value": "639e140848a814a0fff93cb57a5f49014ac85ebfff4364fba2afb2c45a8cc7a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084713, "uuid": "06a16a08-6778-4546-b9e2-0b7f28c01e17", "comment": "Malware payload (Mirai)", "value": "3ca6db9965c4f76e646b79e3c7dff2f7ee7df7d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084713, "uuid": "cec3bde8-76e4-4d96-9bb7-2656560736a2", "comment": "Malware payload (Mirai)", "value": "eda6566488abc6a60eac655ad4b8aef833c65482e98f56ce7bf5724480c3bd00b47eca9af525de4350551d9649a0ed40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084713, "uuid": "d7afa837-040e-4094-bde1-b755e7b6867a", "value": "T163D33917B4D080FEC8DAC1B44F9BE136DA73B42D2138B26A27D5AA271E4DE305F6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084713, "uuid": "4a00c2ee-fdf7-400d-a4b1-86e2b33a562f", "value": "3072:3UX5YWaDw/l1Ou+cbN/Aei5ZaogzY0oYz2I/bnjn6mv:kpYWaDwx4qrfxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084713, "uuid": "e6cc6f7f-6088-4cd1-990a-a29591ffacde", "value": 132536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084713, "uuid": "da0fb479-7851-4620-96e2-a0c18d4a7657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084713, "uuid": "89eb2fe8-89a6-4246-a65f-fbc42b3954fc", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959a1cce-4454-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693084057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084057, "uuid": "e3c7df45-c00e-4ef7-a750-b3f1d170b71a", "comment": "Malware payload", "value": "3f9efa029373f78994ff5931925aee7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084057, "uuid": "b155ee1a-2910-4c03-90fe-3de6be09c147", "comment": "Malware payload", "value": "642ebca59dcce370c97de5403c0f45733262835f865feb726febc368abd3eb51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084057, "uuid": "f3922ffb-9dcf-44cc-8874-5a4601259799", "comment": "Malware payload", "value": "841625319664e4a285521d0ad060d7caa2e8e367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084057, "uuid": "c832cf0d-0452-44e9-9c34-0c1269a47543", "comment": "Malware payload", "value": "0460860208924c73ae2c45ef5365b797a7583fa975785ffc82875c61c898ceee697de766468863081512ca9b1a668148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084057, "uuid": "83c00a6b-1dc2-4826-8c82-bb92c13d0c81", "value": "T1AA6623FA15805A9FC87902B0A588C7F023DF6761E1B64E91E3EDB99F492598F58FD00C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084057, "uuid": "4ad0ad5b-b67c-4a5f-99cb-5c91bd81b3d8", "value": "1f7e570c88fa291eec915270055d3039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084057, "uuid": "466350fc-e24b-4e30-b441-d40209f0c278", "value": "196608:FROVcPGgHjx8YMpozHpOup1JRk6sOFKTcElvwEYnLD:FR3bFYup1HkpjZYnLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084057, "uuid": "763c3cb9-3c07-4df7-b465-fc84f41a95df", "value": 6865272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084057, "uuid": "fa8d7ae1-dbcf-4e94-9836-fa9719c1038e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084057, "uuid": "33173281-f916-4df6-801c-1234bd71fcd1", "value": "AUTOKEY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea5bc87-445c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693087642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087642, "uuid": "c4a00fc8-299e-42fe-8f04-0af8f1624eba", "comment": "Malware payload (RedLineStealer)", "value": "acf5d1a8f625d7d5b4d877dde28c613c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087642, "uuid": "0cc60b64-aa40-469a-93b7-69b45fcde6d9", "comment": "Malware payload (RedLineStealer)", "value": "653388cbb84b4a94bcc4370bffca1672fe96f2fe5e3506001e65c3697c7c4191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087642, "uuid": "5b91931f-5868-4729-b93e-355a5ea732e8", "comment": "Malware payload (RedLineStealer)", "value": "08cb78a12d8905e2d2e781e8f8c49fd4a5696773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087642, "uuid": "bf031949-7734-4bb6-8bce-d2ac39bef689", "comment": "Malware payload (RedLineStealer)", "value": "a561bc5bfb1ddd31117e18936bff721ea9aab9e823ab8ff927772eda09bcf7a8f0290df8524b9117d80f99b41e52dad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087642, "uuid": "604b2b6b-2437-4d91-9da7-65196fa688dc", "value": "T1A3959D46A191F354E0800AB5E187F0F78A922C28FC1AC95BF984BFDB73FD5E1259D41A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087642, "uuid": "9b222949-ce84-49b7-a02b-bb3095186582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087642, "uuid": "ac5e6cc5-416d-445b-add1-88c61d14ea92", "value": "24576:TVxdc2VqcvHrb/hyuDZipy6CSbF2MhKlgVE30s2PQ0iOa/tNbKTwB:B0evH3WYkUuFEElQ1tkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693087642, "uuid": "449eaa94-ab0a-4a9f-9d9d-658de80beab9", "value": 1896448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693087642, "uuid": "0c50c2e2-9ca1-45b9-8698-059f4c90a02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087642, "uuid": "bbefd6cf-2c54-40d8-a80a-5131d5d84572", "value": "Rrobknnz-FREEAPPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c4985f-4402-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693048619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693048619, "uuid": "aec4f52f-731b-4970-b393-149318b60770", "comment": "Malware payload (GuLoader)", "value": "2773ecdceba8051c6b7e2aff9b9f556c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693048619, "uuid": "3f4b5a6a-3b9a-4a16-b559-ab4a3291e3de", "comment": "Malware payload (GuLoader)", "value": "653ba26fcd52693148e084a5cbbdc818bea6a40bf6af4bb27098396db7db8070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693048619, "uuid": "a5219850-2181-435d-8190-2f85b042beae", "comment": "Malware payload (GuLoader)", "value": "f6d307426cd7f022c5d6ce57a23764839d89fe69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693048619, "uuid": "a8c30abf-e9ec-4e4d-8e01-63caebf817ef", "comment": "Malware payload (GuLoader)", "value": "adf750ed67920baacbe68a33e4bb81771d30b7d1db20e3e4b87d4734c87c18d2f4e7144779663e5f5e836729a05e555a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693048619, "uuid": "085d9a21-e8bd-4dff-a9d8-30c75565ea3d", "value": "T11BE4E0D27FC74E53C0B70A768AE69320F235DE446A1727036B51BABC6D726D16B032C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693048619, "uuid": "8c6bc75d-bd9d-44b9-b01d-077a6a99e307", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693048619, "uuid": "d1f7e62d-64d6-4e8a-9b03-c77d1a8f17ff", "value": "12288:8ZFpdY/Rmis7KLF+/85424hjfwtWNeh6+7TQbFrd:oas7KLsM4Xh4h6+7TQbFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693048619, "uuid": "fa531b41-9719-4186-ad3d-38ee5d8080ec", "value": 687686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693048619, "uuid": "3bad3f98-2884-4a0d-a305-f67c96255563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693048619, "uuid": "4083daed-4a4a-451b-8fb5-7602d5c2ec9e", "value": "rRFQ_6000398426_20230823_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c0dc90-43da-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693031437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031437, "uuid": "d57a1b98-16c6-40ab-b2f2-29caf02286c9", "comment": "Malware payload", "value": "848b847cd19805d19235b5acb8ef2bef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031437, "uuid": "3d712594-c474-4c0c-a732-9075baf7c036", "comment": "Malware payload", "value": "65e47578274d16be1be0f50767bad0af16930df43556dd23d7ad5e4adc2bcbe3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031437, "uuid": "089720da-49d3-43d4-b1d5-856a4f2630ed", "comment": "Malware payload", "value": "38100751a4ae45a143232cbacf9bb441b31fb211", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031437, "uuid": "605d8a77-f067-49c0-a1f7-529e5ce4b272", "comment": "Malware payload", "value": "0b9f81c6884647488baf356454ce6c1aeb70efbbfe68d7fb766e4e4fe7ff2939c21c59fec8de6114399237b4dce0882e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031437, "uuid": "d3f2f513-308d-4541-81b1-1da472fa0518", "value": "T12ED3D56A33D84F41CA9819B5C2E3893423E3AA877633D7453E441AC61F417E9DECA7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031437, "uuid": "0d8e4225-9c02-4436-8891-f0ba5fb76b3a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031437, "uuid": "efd3e2b1-d1bd-4df9-b4e3-043352dbe2c6", "value": "3072:l7bcaK96uK9RhZEGyASjdeqSwxqlqfrYNZIO7RJfMLpO:23N4ZE1ASjNfH+1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693031437, "uuid": "997ea1ac-06c6-4706-a914-c952f12712d1", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693031437, "uuid": "fab435f1-465b-472e-9d06-0951816dbb0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031437, "uuid": "d01300fc-5545-48df-8ab4-24f17ae09202", "value": "3rd_2.7_injector.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670f9ab0-4441-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1693075818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693075818, "uuid": "413ad7d9-7a31-4d54-930b-8ab2bf758515", "comment": "Malware payload (NanoCore)", "value": "27ab73da35675ffea1a84137c9442d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693075818, "uuid": "bea68ae6-8c85-4071-b360-6e3f76c67819", "comment": "Malware payload (NanoCore)", "value": "65fc2ead76389767b2892a83b7f826df060d3c5a6ae6983389681823b51a23cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693075818, "uuid": "715f4c48-cf55-497b-86f7-5c9a67e933a0", "comment": "Malware payload (NanoCore)", "value": "fe328b3993b84862e2c2b80b3953c03c9f1474a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693075818, "uuid": "c94b0e7d-2524-46b1-80f1-abd9de1735e3", "comment": "Malware payload (NanoCore)", "value": "6b12b28c1f779f528abbe78b91058da212e704f0255b2611ee95454642576ed0856628f88ceac46c63e91066a22f269b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693075818, "uuid": "2966ff76-113a-43d9-a63d-06caacd87573", "value": "T1A9D4F1897A50B6EFD81BC9B6DA681CA4A76164BB4707C313D05312ED9A0D6CBCF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693075818, "uuid": "8557dde6-e8e3-444c-8a64-e5cd2ae63545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693075818, "uuid": "885d9050-fdfa-482e-befe-78dd8c27949c", "value": "12288:YOU4PLPV/OSJj+qmIFBaCT1qIebw69R0+zzBguzm9GSYfVlxb2Wb:YaP8SJj+kFsC6n9R/hgu2Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693075818, "uuid": "7c7451ea-5aa8-4dc0-b10a-eabb5ae944e2", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693075818, "uuid": "35022ed8-a69c-4876-9f7d-f7872f5a77b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693075818, "uuid": "a2fbe2b0-10d9-4add-ac1b-2a4dd6a919c1", "value": "27ab73da35675ffea1a84137c9442d19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0381a5e-440d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693053634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053634, "uuid": "e009da2e-aa45-4ae9-9ec3-7612604cfafb", "comment": "Malware payload", "value": "4c1ad2fbee9ea9dcc5bd6b32d9c53e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053634, "uuid": "6f497656-f7ba-4057-9991-5c91ced38e49", "comment": "Malware payload", "value": "664f6d15f9e438c10f7ee9f7c257b1f26a40afef71773feae104d6d80cfa30ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053634, "uuid": "4179b7fc-7dd1-4292-abba-9768a67c2cf5", "comment": "Malware payload", "value": "70df3c1a7a43d1fa0918dde6bbe8ddc30b112b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053634, "uuid": "a2fc0d2c-c417-4a6c-9961-7fb2cc46df4f", "comment": "Malware payload", "value": "1b58adb01d1956aa2eb4fcbe32c9aaa2bde4e1a975315f716cde96d907333356b33cffef24b51e4e1d37454135d8cd36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053634, "uuid": "78123595-c06d-49d5-8494-fd3b0f954791", "value": "T1F4D53301B6D6D6F2E0A309362E299B21673DBDB05B31C9EB53C0B25DEA170C1A775732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053634, "uuid": "3b6caf30-adaf-48e4-98c1-66f51264bec6", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053634, "uuid": "d503ccd8-2a4b-4514-a780-33bcc26b9e5c", "value": "49152:rLLcZQrCPzysUwAhWXjjyZK/4J6qRys8V7RjCYLLoO6xMCUfdTfwfE:rUSCmsRA4XsNAq38V75CU4Uf28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693053634, "uuid": "6d399ca5-57ac-4848-9412-a63e715717ad", "value": 2858455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693053634, "uuid": "972c80b0-d1b3-4ea0-b7b9-64c6f20e3327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053634, "uuid": "7904c277-9757-4438-a9ff-fb61423f95c5", "value": "SecuriteInfo.com.Win32.InjectorX-gen.7339.2835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adcc296-442c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066644, "uuid": "2ecc997e-be6d-4502-b68d-60fe9ed15fde", "comment": "Malware payload (Mirai)", "value": "10449f565fa690f91c6ba62e9582596b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066644, "uuid": "a41fd3d3-56fe-4d3f-823d-e439d6196ec9", "comment": "Malware payload (Mirai)", "value": "6766026908b4c663022bd124b5de8d8b0a37f512ba75411d5ecf18223ba1772e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066644, "uuid": "94fa4342-39b0-4816-90b5-2a1e91d2a3a5", "comment": "Malware payload (Mirai)", "value": "c31ee635de9daab343535938dc11eb8b028d09b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066644, "uuid": "83901375-7f57-4117-86a1-aae9f6153629", "comment": "Malware payload (Mirai)", "value": "82846928d7f0c39d8f65c99e8ba755f37f1b0bc71a41cd0548e2476a72eb8d832f18f8a9f452630c29dced9a565dff93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066644, "uuid": "a3c462c4-ff53-4885-92d1-580ea9f68e91", "value": "T1DDC2D0E07726F931C4206C3EE52B4D893A510A7C81FF383764159C398FC1A9A63B84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066644, "uuid": "a8ec5803-45a0-4298-aa4b-0ce55bea6f23", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwrM9x9q3UELuq:oKy4qfqoeJdXWgCkLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066644, "uuid": "e51fc10d-81b0-48b4-917c-4e9b1625527e", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066644, "uuid": "785a68b4-dbf6-4ea1-acce-9f7054fa232a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066644, "uuid": "9622f6aa-e9bf-429e-a557-eb14ea49a493", "value": "10449f565fa690f91c6ba62e9582596b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfab23ee-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015435, "uuid": "927a9acd-af4f-475c-8dd7-ef616e0081a3", "comment": "Malware payload (Mirai)", "value": "63143e69728aaaacc2e30ce74938447b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015435, "uuid": "e28adbf4-ca30-4bb4-ad88-c425ac01c899", "comment": "Malware payload (Mirai)", "value": "67db8fdfd7debea59c4bbfed299a65716801f7cbed4ea1820f3b72d5b0714f3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015435, "uuid": "c230c4c0-44f4-45f2-9c20-972ec69d5f00", "comment": "Malware payload (Mirai)", "value": "ad932dab40f62f13a2f7002691cb216e373c7877", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015435, "uuid": "efb65282-440d-46a9-a871-04d69ff06bb2", "comment": "Malware payload (Mirai)", "value": "313a35a83bad3000605b6d0fe58278a3f1a94e14828ca3566a7278da2c1c08005061923264fc13fef4fd9570f6199413", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015435, "uuid": "5d25f8ed-2b31-46ae-a51f-3b89b6e9cb09", "value": "T197536DCAB8119E7DF5CBE77E84220D0EB821726150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015435, "uuid": "53709e26-91c0-4df5-82b3-05b66db57c5d", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E84:N1TjJ8EVGO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015435, "uuid": "30f1c729-f4ef-4410-b12c-4c9bc22942e3", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015435, "uuid": "a810e29f-0fa7-4d36-b843-68916ffea5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015435, "uuid": "cc89e531-ef8f-40c5-a68e-34ecbc56e7be", "value": "63143e69728aaaacc2e30ce74938447b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b74a261-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046110, "uuid": "327dc6e8-71f1-4080-a3ab-8e1c3eac1b5c", "comment": "Malware payload", "value": "247f5fbfe39478fd51d4371b60a79365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046110, "uuid": "66c65140-6f04-4fce-8b93-2485d10b84b2", "comment": "Malware payload", "value": "689db6ed834993cc8ee653f0c39e94aad817fa21f23f7216ae9826d102bb3046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046110, "uuid": "fc6d4dd8-5213-48ff-a2a3-9eee62d88e5f", "comment": "Malware payload", "value": "a75499ecc82a4e387f8ef14ecef1e9a3c6801f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046110, "uuid": "664499ea-03c0-4307-9b46-8cec34102e54", "comment": "Malware payload", "value": "f1b218ee269f52951cdd4d291efa3265404b5874c2f3ab7267e7f5d897ccb1bcaff051852dff342c9f5627f3b62ad11b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046110, "uuid": "70afb959-a877-47d0-8830-27df3dd287e0", "value": "T165657D22B8C380B3D5F202B0D66DAA7546EEBF31573251EBE3C8391C6B715D26A35217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046110, "uuid": "d761ce96-d9e5-4898-ae03-66daad7b3031", "value": "b7e5576f0e9eaa88ac127850c0e452b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046110, "uuid": "83a894cb-0328-4f56-97da-677014fa7776", "value": "24576:iBOhAkmQFrAb0+Fjo448XfLeILlwz3MTM3deT7/vA18w/0Qo4L05PTH+gvTr4mq4:f2QFrAb0+Fjo44RSwUTC0Qu5PTH+gQmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046110, "uuid": "91397adf-2c54-4b12-9ae8-ae878f84bc27", "value": 1447328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046110, "uuid": "c087f603-2c50-489e-a0be-8eb3449fe68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046110, "uuid": "8ca09cf9-ea1a-4d2d-89fe-5300f265fc45", "value": "SecuriteInfo.com.Program.Kuaizip.1.32420.3251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c37dd3-4400-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693047731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047731, "uuid": "6fd8fc6b-0b03-4fe4-8621-815d889987dd", "comment": "Malware payload (AgentTesla)", "value": "5632023035bb33557273fffb47cf484e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047731, "uuid": "36fb7ab8-8908-4903-8d87-d1a1d8504738", "comment": "Malware payload (AgentTesla)", "value": "68de9e3489ae10b2585b442b3cb29c33928e0e874c96d82a9ec16db2f2ecf83a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047731, "uuid": "38ae3ac7-b4a0-42a5-b527-2974c8d350d6", "comment": "Malware payload (AgentTesla)", "value": "3a9019e6d4b424ea0872962e4bdfe102454efb18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047731, "uuid": "1de3a97c-1f21-4154-b233-09c47ed84062", "comment": "Malware payload (AgentTesla)", "value": "1e28d511d5c4656a9e8e33ff37d0db59b197d5508a22ab2d7bd0ea91980b159c31a9a19ff685cd49826b297470c2b172", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047731, "uuid": "7103a580-954e-4db1-b433-eafa291c5697", "value": "T194F40213BB1ABF7AC57687F67C2450164B72ED1E9880E3494E87B1E49C32F024579E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047731, "uuid": "1ebc1099-0c1f-428e-8c8b-5b720d09b705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047731, "uuid": "da19e374-611f-4989-8cce-fa98cc9b92de", "value": "12288:8dfSRtR2lq3PagfabD3GFzj3wmGBlaU6eTT/wUu8/shLkf6uHu1VlK/0dKKgwxk+:8s2lq3ya+OzjRGBlh6MT/ww/+WruHl8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047731, "uuid": "b50295ce-e06b-4b11-9d8c-dc2eea1ac534", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047731, "uuid": "8f6ea8e8-09c5-4b85-8192-4f04cc6154d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047731, "uuid": "07be7706-6b75-4820-b972-f3556873fa15", "value": "z84iMKDVrJe47zuAdF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e202280-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046061, "uuid": "34cc4c94-3999-4318-800e-925a0944e2bd", "comment": "Malware payload", "value": "8345a6e36d4e873486973f060c3fb256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046061, "uuid": "1177fe08-af42-4789-996d-33bb6899f3be", "comment": "Malware payload", "value": "6980a98aaae80d608f1501e003dd3df7f8f73818f0603571ed0aab1440e4ac1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046061, "uuid": "5ba059d2-491f-466d-9151-c09aeecc735b", "comment": "Malware payload", "value": "c7e12e18440bf0649113bea0569941f7d698406d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046061, "uuid": "8048e446-b2e5-42fc-b128-f0506514519b", "comment": "Malware payload", "value": "fd5273fa179b9b1a2d455f0bc7284194d86ad1f139bc64da414b28f9bb4f18377ad90af35e2901bfd71bb23269f7e69a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046061, "uuid": "330f882e-e1f1-4482-96dc-fafd501c04bc", "value": "T136558D107981D432D6B310364979FA75186DAC202F345ACB73DC3A3EEF745D22EB16AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046061, "uuid": "43d50437-8957-4cbd-9489-4d2893e1685d", "value": "6488fff7752fd08ebf08ef38a0d8f6cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046061, "uuid": "d12e58af-4887-464b-9dc6-639daaa8aa20", "value": "24576:7lfQZmoVoRyUp89q4R5tPFoelSqkWmmAdml1/DBgDuxcktPhpu:WOCPBFoelSqkWmmAdW9VS2pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046061, "uuid": "ebb9f4b2-93cd-4bce-9939-3c7bcb7196c2", "value": 1396128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046061, "uuid": "56d1eccb-8b67-464f-a6fb-6e2b0ee0c044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046061, "uuid": "1373ee1a-b209-4806-82e5-99a40e571dce", "value": "SecuriteInfo.com.Program.Kuaizip.1.3423.8981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78e5c36-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LgoogLoader)", "timestamp": 1693038614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038614, "uuid": "b236a458-65d9-4cf4-8689-e317d8fe3db7", "comment": "Malware payload (LgoogLoader)", "value": "ed75cea904ef453eef6c9920ce3c93b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038614, "uuid": "0be0137c-9c2a-4ee6-bcc2-6d7c2768873c", "comment": "Malware payload (LgoogLoader)", "value": "698d902b9552dad46b248acb1c6674a53ac14d7e90764f7d0a70f02e636cebeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038614, "uuid": "682f4f89-c50d-4b5a-beed-8391da221a1a", "comment": "Malware payload (LgoogLoader)", "value": "c4413aa90f798fef7c178790599f9d3e64d6e614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038614, "uuid": "a3e794a7-0bb6-441d-8bc3-4840352783c2", "comment": "Malware payload (LgoogLoader)", "value": "2d9c3bf2948251ba90364ebda0edf0a639c0276b0889a41e26bc83df37f245d4f07d98b212b79e6ac9d0be4c508ad72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038614, "uuid": "02bdca23-4325-4dd0-a78d-1447b0205e91", "value": "T1EBC4124640ECD892FB64C07838B112FDEEF7FEC382A3EC5A559D8D7A9156B5C1B84221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038614, "uuid": "50cc3d7f-3c0e-4eca-addb-d261dfdc64fc", "value": "12288:NbXdzhaf9b+sDwHsI0Z/xPs0gKTD2160PKe+QZpBG:nVafZ+QQsI03Ps0XTD6rTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038614, "uuid": "c60d6517-b034-4187-b1fa-6e5106281a0e", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038614, "uuid": "ad757758-114b-4aa6-8c0a-2082f654d0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038614, "uuid": "9977cf1b-acca-431f-bc17-c3d200fc5f63", "value": "ed75cea904ef453eef6c9920ce3c93b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90984c5d-43e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1693037663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037663, "uuid": "2fe7b7cc-d044-4fc5-a074-b3a1c0d8bd52", "comment": "Malware payload (SystemBC)", "value": "0a34a2c61c6f84f178cfd035f218d79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037663, "uuid": "c8201a79-a92d-4364-b004-ca89781cff5f", "comment": "Malware payload (SystemBC)", "value": "6b56f6f96b33d0acefd9488561ce4c0b4a1684daf5dde9cc81e56403871939c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037663, "uuid": "10e21894-419f-40b4-b3a9-cc2892d8164e", "comment": "Malware payload (SystemBC)", "value": "c9d3db5fe8df034ee40703202630694997361dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037663, "uuid": "2cc99d3d-c28b-41bf-b1f6-7c0a0236c037", "comment": "Malware payload (SystemBC)", "value": "dc476ad36f0ebf4adfa5e616504c7d293cb0c0a5f152a2cfa53e09f348ba5e199f602bc76b1535d897d09e4eb82c078f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037663, "uuid": "0091d23d-120f-4c51-ae42-4e0c7efcb202", "value": "T17362F5667491CAB1C012C2F97B2EF311E1AE69325A30D03AEFE05E18377E693971160B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037663, "uuid": "8b09b923-9fad-4325-9bb7-974585c04e4c", "value": "3a0233c129f2514486a242d7d5874037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037663, "uuid": "75a3dfb0-4e75-4567-a8b4-29da10e82234", "value": "384:8/wK8VcHXC3pA/ZbdrJXNcQbvZWXhphZBZKICpo:se2XJBbxJXZchph5/CS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693037663, "uuid": "b65c93d3-3041-4bbc-9344-3f7ccc997bff", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693037663, "uuid": "b3b05b9b-ca12-4786-b3bf-83f63d3ae496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037663, "uuid": "ffe7f828-31c9-4a72-8d56-de33b1e25d05", "value": "0a34a2c61c6f84f178cfd035f218d79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf9b3ff-445d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693087693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087693, "uuid": "80f7c8ca-a739-40bd-ac65-fb24258e3980", "comment": "Malware payload", "value": "60b4a2edc8eeb3e27d97f151c59aa339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087693, "uuid": "621ea140-94a5-45ca-8205-26c129c962e2", "comment": "Malware payload", "value": "6be1ac954a1d22a0852f5b36bde914f5bb3c8b0e2e14d8e2ce45dcee665f8ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087693, "uuid": "e1314960-128e-4dc4-9973-9b54bcdc6841", "comment": "Malware payload", "value": "fdf7399f991e6cb4638934441f6d4b5170fbf110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087693, "uuid": "376437e5-5fd4-4754-90ba-aa1ea6904fdb", "comment": "Malware payload", "value": "04f8d88e126646484ae45bc0c945b6cecc07e71896722cd2d8e3110290afc6ffa2ff5a9de3b5a6a4625704e052bbb9b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087693, "uuid": "7e7655ba-670f-4344-a972-3ec6c9219de7", "value": "T10285E002B3D69036FFABA2739B6AB20596BD79250133852F13981D79BD701B1173E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087693, "uuid": "a0e75820-621f-4c15-bc23-aa42dd9383de", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087693, "uuid": "bd66471d-d291-4a9e-a312-6869d5aaef8e", "value": "49152:kh+ZkldoPK8Yaa05vYj5owiTpe0U+/C8Ilu3G:V2cPK8RvYOwiA0Vclu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693087693, "uuid": "c43070ec-8224-48c2-900c-f6aa7f63e57f", "value": 1859072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693087693, "uuid": "98b8ac72-0147-4b7f-8ded-0177a985d958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087693, "uuid": "8d769446-cb4a-412a-9bc2-42ad5a8db602", "value": "caidattevas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e44fab-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084735, "uuid": "f2925525-e0e2-4f01-a826-76920012ca18", "comment": "Malware payload (Mirai)", "value": "caf51a51d9af9469d9eb48b9adb943f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084735, "uuid": "686ed086-d5e2-4b13-8f6b-0f5d32463cce", "comment": "Malware payload (Mirai)", "value": "6d243d88fa9202136dd90eb25689b60dfbb3446a8a3b92031ca0ddd993bb0fd2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084735, "uuid": "7f32cde2-982b-4f22-addc-c6cd2ecfff20", "comment": "Malware payload (Mirai)", "value": "946fda572c985f9ad7707372a42f1e146e674db7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084735, "uuid": "3e6896eb-79aa-4ced-833b-a3798a43e7d5", "comment": "Malware payload (Mirai)", "value": "ec6e4d37894a1276923d422bcf789dbd51f25d09e5e58dedd6cff1860d6ffbf138705f5d90d825841dbf5adfb9c9d25d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084735, "uuid": "11023a79-7eb0-4d66-8f1a-2d005c827de7", "value": "T1F7D3F846F9819B12D5C111BAFE1E124E37131B3CE2DE7302AD246F647B8A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084735, "uuid": "55781ff3-0a08-4df6-9e85-bcdc4b104b4c", "value": "1536:nhnogaTnUhlDv71UlZ7us8pF+n/XyDtht/yEwya/y+M+igilwljpr5eCh2EYQ0mm:ZUbusqG/XAtKEwya/8wljhYCh2o8Ssh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084735, "uuid": "b294e99c-5d8e-49e7-bbe8-9859bf607349", "value": 135612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084735, "uuid": "0bc7151f-5c7c-49da-9829-7c67167013c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084735, "uuid": "b8bde0fe-fff6-4495-907c-3b0e68b63e2b", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4443732f-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046125, "uuid": "6094063e-af00-4876-a8e4-bf136fc58295", "comment": "Malware payload", "value": "e394e7e0bc1b94abb2eafe388a4fafce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046125, "uuid": "4bad64ae-38dc-4c7b-baf1-3110bcbc8410", "comment": "Malware payload", "value": "6de8cda75b1eebfbb5a6af6bcb1befc06fc4c252aff4194324bee37c55cf98f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046125, "uuid": "841920e2-7969-487c-a41d-c1eb18f13946", "comment": "Malware payload", "value": "7a3947b91bfd8753541c88cf95fff9df08d248ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046125, "uuid": "b3a0d962-41d6-4d1a-b410-9f453e87def0", "comment": "Malware payload", "value": "73b371e2172640cff14115f7ba3d102cd9c677ab208654f3d08bd287f50bd048b433e5a5954ebb4a3cb6fba564e6c8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046125, "uuid": "60363310-7672-4873-a2b8-1f1e59db8074", "value": "T17DF58C13A2C24121D1A531F056F89DF5942B7C6186F04CC7B29F78CFEF7C49229AAA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046125, "uuid": "c4541f5a-1d80-4a27-b40c-af118abbb283", "value": "00e4a0ce1590063f3d84fc26b6c6acc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046125, "uuid": "864500e1-567d-4e7e-97ad-1df84ab2aa48", "value": "49152:48jq/UJ6ksWn8ssLGTvDRqpRmMojA/yUW+92XbF0y5iB7EClh:Rq8fdn8Xa/RqpRmi75ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046125, "uuid": "d0b46265-a3b3-4d63-bad3-ceef83bec717", "value": 3577760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046125, "uuid": "2dce1841-fccb-41e2-82ff-f7e77d21144e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046125, "uuid": "c9a2dfd8-0e59-44d7-8e4f-284e2598f31f", "value": "SecuriteInfo.com.Program.Kuaizip.1.24300.16448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24094a5a-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046071, "uuid": "a572c5ba-5ce9-43be-9dd2-3699b99ebf01", "comment": "Malware payload", "value": "e14eb098227df2dc06e778de77551b9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046071, "uuid": "96c14a60-0653-45d8-86b9-4ae2489afa1a", "comment": "Malware payload", "value": "6e0c5c9725f32d0fcb03f77946eec6689fb48495d3613f90a0809c1504c77c82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046071, "uuid": "a25bfb22-3ddf-478f-98f4-d6e0607c6e19", "comment": "Malware payload", "value": "5f45d9ea8f64e41c3fa1ae3fd2625ddeb255cb65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046071, "uuid": "13116bc7-9dd8-4952-85d9-589bac3581d8", "comment": "Malware payload", "value": "67c1a39b5ea09061ae3fa86e10ec3b3eae1eac9a038dc434593e4b3fb1466daa0a9761f8d7a308b31abaf69ad3bf79a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046071, "uuid": "99077114-cb65-4cdc-9d2f-4954b668fb50", "value": "T190058E46EA13A87BDC5702754617F3DB0574DA709832CB8BEB881D69DEB3ED2160A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046071, "uuid": "b912fd3f-7859-429d-ac60-6366f1afd4f3", "value": "923aa130c21002b50b462e446b3be0d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046071, "uuid": "58751592-6fa9-44e9-b346-af3668fe4c09", "value": "12288:RpFFQV+FKJ37Dm+yY4pBkPr2v2meLaoHN/oBrZ3ixdnGVzpJXm/i1:RpnzFw37iDYIBkzuPcHNgrZ3uGVzm/i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046071, "uuid": "2821ff94-da3b-428f-878a-2cb32ed43dbf", "value": 868536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046071, "uuid": "725b0e8b-932a-4c27-8785-7d0ff8d4094a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046071, "uuid": "5b0e65a4-6eed-4f9e-88fc-33567a1e8117", "value": "SecuriteInfo.com.Program.Kuaizip.1.19350.25388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d089515e-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081149, "uuid": "6db479ad-5f73-4a7a-a5e2-1a53c347e6b5", "comment": "Malware payload (Mirai)", "value": "e2be81e04df667f6c475df521a3ec3cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081149, "uuid": "7520c7fc-6665-48b7-9141-47aa8262030c", "comment": "Malware payload (Mirai)", "value": "6f7db69162899601ffd2575c86ddbbf95a8dbfcaa0b7ecb1feab8f006819752a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081149, "uuid": "3049df92-454d-4e1d-9170-d94412f6c153", "comment": "Malware payload (Mirai)", "value": "37f4a5fc75f50fb37240c7ff14119bb4e648303e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081149, "uuid": "204176ca-f258-4c1e-9a16-b2d419b04cae", "comment": "Malware payload (Mirai)", "value": "f7bfe460454de460fb7ed7a86b7cd203e6003e03a0138f3f54881c3408fd84e0f809d54605b5b7e4e1b61336ae85383a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081149, "uuid": "7356a881-4f20-4d05-b66c-8e7d886e987f", "value": "T1F4731887F400DDBDF80DD37B4457061AB230E3660A921BB7A353B56BFDB51942826F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081149, "uuid": "239f59a6-8b5d-4680-aab5-02e542abf7b3", "value": "1536:HAnHLNoXS4n+UWn8O2cdGDrwSc5CrS6asG0luJgP1:H4sn+UWA7wV5E5luJgP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081149, "uuid": "8b2e1583-aabd-4a7c-a653-f1c4b806f0e9", "value": 74092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081149, "uuid": "511bdc49-24b5-423f-a5b8-cfda29288a37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081149, "uuid": "b7c410be-ed52-4eb5-96ec-0fd288373a66", "value": "e2be81e04df667f6c475df521a3ec3cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5d36a5-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046090, "uuid": "06a23181-bee5-4308-aae5-b651113f879f", "comment": "Malware payload", "value": "ca53a1c938413b44c08443bfecce5ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046090, "uuid": "94b086ac-6482-4968-b832-41090f2f9170", "comment": "Malware payload", "value": "6f9dfe7d378970f30c4a725d74175f324709ce52b47751aa12863f0d20839fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046090, "uuid": "46c21d64-4d28-472d-a83d-b25f456d76b7", "comment": "Malware payload", "value": "540d33e4e0e1820d127fd734ed057b3df11e6c77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046090, "uuid": "1fae966d-4dae-48d9-b6b5-175358eb3007", "comment": "Malware payload", "value": "8a0132aa70c82bca35953d015637d22af5eb7a2cce53f246cb4eec2b5c7a84226577c04e922b78205e1c393496f87434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046090, "uuid": "0602220f-5228-4c23-8637-a945a1147ffc", "value": "T18E55E5DD3C48E033DD6203F149B85E66243CA91C0BD413D7BAB4976A79E04D2D73EA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046090, "uuid": "8b4e948d-02ec-44a5-9c98-0085ed4ad290", "value": "80f63a05c1e77889609f473836be9f00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046090, "uuid": "886c29f2-7964-4cfb-bdbb-55303d9f0fa7", "value": "24576:cZCXGU0FEJJv2tBTBXlHbuq/CpLBJsUa2w67gVjk6cPUpcCFgP+VgUfGcsEnQN:JXsFQv2tBTBXlHbuq/Cls76gSPU1k+DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046090, "uuid": "46c92161-37d0-42da-86a9-d42a45ff7aad", "value": 1282000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046090, "uuid": "cba0f1f2-06df-4f05-9d50-1a93287f1a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046090, "uuid": "af331a32-725a-431a-9eb9-a77676e485ab", "value": "SecuriteInfo.com.Program.Kuaizip.1.30769.29211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a229245c-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084937, "uuid": "3bcf9a48-d061-44b8-ae2a-8b6daeaa6458", "comment": "Malware payload (Mirai)", "value": "d230eddbdbca80c6e7c614316586f990", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084937, "uuid": "d70965e6-cfae-46de-941c-137644be52b4", "comment": "Malware payload (Mirai)", "value": "727e5566ee3d683f2e3813db3abc2245816c417b6bf26a05a6d7f4d841226a37", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084937, "uuid": "17a6a316-d8a8-4c43-8d99-6e36648699f3", "comment": "Malware payload (Mirai)", "value": "41a90075f4c1e04b5e0d78ffed186c91dbf4caa3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084937, "uuid": "be07444e-1ae5-448c-b8f7-2d8fa07931ba", "comment": "Malware payload (Mirai)", "value": "b7c30ee0ec6b34f85205ddaf0df92e5332fad89b15743c6dc8b886e96a5c2ec08987e7b3f0bef9788d75d2652b20a1d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084937, "uuid": "d38e02d4-4acd-4c06-99e5-6aa66c2e06ca", "value": "T101C32A85FC505B13C6C212B7FB5E428D7B2A17A8D2EE72039D256F25378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084937, "uuid": "79359c10-16f1-45ea-9bee-30ac0cc8859e", "value": "1536:GJJcUqwyNl3kRFHAKqE4V6GWsTgVEthw1s2EzudrlUB6wywbFBCN8nOtZqPKKO9p:GJPuJUFHL45tMVEthyuuJMg35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084937, "uuid": "fb45cfa3-0639-4d40-aa54-da1b314c7b9f", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084937, "uuid": "5544ccab-86f9-42d9-a6e2-b95881b06b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084937, "uuid": "fd5b2b12-1d27-4242-8c8e-48c93ef66b9a", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1ceaf2-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085088, "uuid": "0dcf19fa-e389-4a5b-8c3a-b852eabd8d66", "comment": "Malware payload", "value": "8570d48a1291cc62a902b06b7429b2dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085088, "uuid": "7f237957-c9dd-4cc9-853b-4b82141dc82f", "comment": "Malware payload", "value": "729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085088, "uuid": "ec6edd52-2c72-4d0d-b34e-231cfda06d1f", "comment": "Malware payload", "value": "6f7de617e02b655c01e734e9ea30bfdfb4caaa24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085088, "uuid": "27e93028-59a4-4ccb-9c28-fa5fe91e15d1", "comment": "Malware payload", "value": "f32acee74417e930b3ca9764c3d3ea62aabf621c31c3bba1fc694bae2a24c786fc3fd4dc3d20cd2f5d272d62075e4e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085088, "uuid": "e3279fc5-bac5-416a-9af4-0eb32d5ccba8", "value": "T1B8564DA17645B2CFE48F25FCA823CE87B96D47F582104C06D8ADF97A6D73C4126CB924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085088, "uuid": "dc12c9c7-14bf-43ea-80d5-c1d5f6aaf010", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085088, "uuid": "4f53944a-6b5c-405a-b6dd-ef9ec9241c42", "value": "196608:1nXtfIhfnpg/2hk57yqx256vfOCv8q+M/VX:1nXtfIhfnpg/2hk57yqxvf1f+MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085088, "uuid": "4c5a92df-2221-4219-a78e-94e7374ff27d", "value": 6362624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085088, "uuid": "852d9fd0-2b36-4da3-8a05-3ff00b8101b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085088, "uuid": "3bd76ec0-7bc5-4716-a38f-68f163e6f9e4", "value": "avicap32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292e4ab9-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693046079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046079, "uuid": "16d9691f-761e-47f3-a0fa-3c4bf466ded1", "comment": "Malware payload (AgentTesla)", "value": "e4fc711c91f643b2ed06ede49007dc05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046079, "uuid": "04f1d9eb-0a19-4def-9e2d-69410f5b7a73", "comment": "Malware payload (AgentTesla)", "value": "73f2c732f584f07379245549827460ff099441ad426e648138154321a6ac375d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046079, "uuid": "8a8c7846-80e5-4dcd-a107-dff421ab2236", "comment": "Malware payload (AgentTesla)", "value": "255f6dbe839011d67c82de411e0ec66d76cb363e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046079, "uuid": "f79e7eba-f68c-410c-89ff-a608855e4ac7", "comment": "Malware payload (AgentTesla)", "value": "ef4d0e5935a5ed91ebd770cdbf93aef209a9b64ac65f8456dd1a39e5a38336a0504bf6c526dd46277c7188505f712127", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046079, "uuid": "19a6ae6d-2d1b-4ce3-8812-695c6db93e20", "value": "T11E25E0F067CC6925CD0E4FB8E9CE7942B3FE86D22913870D4E176A372D8335AD189196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046079, "uuid": "1cfb2748-85ea-4fcc-9558-ac3d557ef562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046079, "uuid": "6a476af5-954b-4c15-83e3-14cb51dface2", "value": "12288:3a+A7PIBcrN49cYkQTFS20ejE2rVoZrCjP5swAwj3FOD/3aBBImIxsDi7YNyM8G:q+xMYIQJSAUAszwjVOD6ImIxsDRhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046079, "uuid": "3782c782-1d23-43d2-90b6-740be29d6859", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046079, "uuid": "5779eeaa-e9e8-428c-80fb-557205dacc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046079, "uuid": "3d1e68d7-04a4-49e7-909e-96508ee94471", "value": "SecuriteInfo.com.Win32.PWSX-gen.18069.23216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c04efc-446b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693093806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093806, "uuid": "a11637d1-9264-4477-9ac3-72ca4309c5fb", "comment": "Malware payload", "value": "5c42860b174f449120221a1d52ece02c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093806, "uuid": "7af2bcd0-0086-4c03-900d-b51ae6726932", "comment": "Malware payload", "value": "74cc8371cbb59cfad30fa4f97199b2b90c0115454145bb5514a3bdc60c2ee0c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093806, "uuid": "51c15545-af8d-487a-88f6-f184f22e7f9d", "comment": "Malware payload", "value": "2c1f8d9b66c803a94c8ac8e346954b2fdec5dcc8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093806, "uuid": "a7dfe996-9b7f-422b-be78-d6fa5f0e7aba", "comment": "Malware payload", "value": "22d6046ff6cce307ca66786207c3d9a9d18c67de181885f10f21dfd4ed8db92808c2eade64498db9ef8220505c79b624", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093806, "uuid": "ad3d016b-e440-4f78-b7b6-3df4f60e0d1e", "value": "T17DE2F151524568F2D5D00C76F7781EC2237D0C7666CBB3492A24213C98CB0DEB6BAB83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093806, "uuid": "6430497b-43bd-4224-9af4-cac2fefad73f", "value": "768:sbSlsLzKRVIexti/B1DbY4DvdVyrmC++YafkR3Uc:OwsiMexti/BdDVM6C2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693093806, "uuid": "671b1a1a-1869-4782-b70b-f02b211d483c", "value": 31888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693093806, "uuid": "d3c72b64-0880-45b0-87c7-6a9f1f28a518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093806, "uuid": "e737d53a-b9e5-4736-9fb0-9ca0c9d3814d", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb840be-4408-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693051189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051189, "uuid": "f2add263-eb43-4677-827b-9203fbbb9a78", "comment": "Malware payload", "value": "f0875b278cfe4dea497c50404f11c396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051189, "uuid": "bf29b887-8223-41e6-9b35-256ff3fab43c", "comment": "Malware payload", "value": "756afd16aa00343a3cd53b92041422c6d18872c1879dbe8fee1e9114ab2b30d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051189, "uuid": "5a753c4f-807f-4103-bb9e-3c83bb534771", "comment": "Malware payload", "value": "a5c98530209a5aec167fcb2dab4fb89462a70218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051189, "uuid": "3d833cce-b98c-484f-8201-33033972addc", "comment": "Malware payload", "value": "f7e0a9b15726a8c1f7832328664d0d66b197b1c5aeeca186dce82b2264689a6374b3a1ecb55e3a72a81ab3b97a28aedb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051189, "uuid": "18553e13-6186-49f2-b63b-2c49796468ca", "value": "T14235291C6D2FCDB4EAE352F9B10A63AA4252B44F98CEE0C9673B7B44C4C9D064F52D52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051189, "uuid": "1fc87aad-39e3-442f-8843-1437ebb3ca97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051189, "uuid": "39d2c27c-0872-4432-ae9d-7f77a3ed447c", "value": "12288:uj/djSWrvKEmLBSBwPoME4gfITFJU7MX8Ac9KtrhxkNkkvt:uxO6wLBkwgME4gfITFJU7w8A66kvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693051189, "uuid": "adb5a619-b2e8-47f7-9b7a-f4fec257f16a", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693051189, "uuid": "6b79926e-b21f-4d54-a044-2e3d3e861c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051189, "uuid": "4e8ddbd6-900d-4436-b0ec-fcc8c3342cd9", "value": "rPO-P230800345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe0cce4-4443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693076719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693076719, "uuid": "e6acf6fb-da62-4636-abcb-05e238063542", "comment": "Malware payload (njrat)", "value": "05efee5c22fd9c1ffedb916768a3efbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693076719, "uuid": "8e53287c-4a21-47e4-a09a-2f686a2e31e9", "comment": "Malware payload (njrat)", "value": "75e66d1a9b9429065ba0731975b3306d4710f3ce239a1a08d000eb5260053fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693076719, "uuid": "28d2c344-1df5-474b-8651-c1bc1f2b32c9", "comment": "Malware payload (njrat)", "value": "7f14924cd5d2551e45fae5496d17de2659d09f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693076719, "uuid": "457333eb-674b-4992-89cf-c3fa93990faa", "comment": "Malware payload (njrat)", "value": "0d87e60a9fd296607bb82fa98246e7611d4b2c5f22bfa6e9e55aa4561c1ae8fb1afc786626e9af442b46d76b6eb28ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693076719, "uuid": "53bbd25e-423a-4fe7-b062-923cff87d1d0", "value": "T17EF21B8CBFE24194C2FD6E734671D2220776F10B1A13DA6DCEF844B65AA36848E58FD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693076719, "uuid": "2aa99b8a-0b0a-4e8a-9ec5-4bdbe5871302", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693076719, "uuid": "cdf6c8c1-3490-426b-b8f7-5d0c31f64b92", "value": "768:4yS6yB4a3hbvOAlsUWURa30PsEhq5lxOBcmZPtjgjC:4yS6Kr5vOAlsUWUY3f5lxOWm7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693076719, "uuid": "2a83a503-594b-4d1d-88dd-58084a6f2ccc", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693076719, "uuid": "fa93d284-de6a-4147-ae8b-af1cdfb4a02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693076719, "uuid": "6b63019e-22ff-4b20-b6dd-839e4425d21e", "value": "05efee5c22fd9c1ffedb916768a3efbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9132ea-4430-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693068603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "699d744a-ebee-4a0f-baef-ae353b26fddc", "comment": "Malware payload (Mirai)", "value": "be8bfcf0d4d0e44835784aa03fd25dcb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "a13e198b-895b-466d-919d-a55c773633e0", "comment": "Malware payload (Mirai)", "value": "77ec6022c32393f1c648b3cde53ef7b882b785db0c42d56ee1f8009776575400", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "238ce1bc-a9b5-41da-8d24-ca601d649045", "comment": "Malware payload (Mirai)", "value": "40340988f01a1344e164f2e8ac26057587a518f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "4e618cc8-8118-4f0c-8fa4-54a33485c30f", "comment": "Malware payload (Mirai)", "value": "08ee3413ce6fdc90974af6ed62719e6b8e3319d8befb6a6c9093041edf2c8e9ba9fd29b15622f55902965616be697745", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068603, "uuid": "bfa3d79f-9553-47f4-866a-90bfd18c5364", "value": "T1A6330262276E2AE151B05377FC33AC1A66DC17B95D67309B2CF0561A77C58024FF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068603, "uuid": "4ac420a9-2af3-4cdc-9e78-3e5e2c60cc88", "value": "1536:d9O/ZMAXIxNUk09GLcPqF1aBexo4opKZbZ:d9O/ZNKyJGLGqFUFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068603, "uuid": "55419e0d-f719-4601-a450-5efffb5e425d", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068603, "uuid": "5f50906c-b7f6-4985-a89e-1e5d5fd95c02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068603, "uuid": "04623d91-f410-4e77-a3ea-ec3cc524d06f", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c55d77-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046094, "uuid": "279a707b-ac55-435c-8da6-862fe71ed295", "comment": "Malware payload", "value": "49cdd9cea445a17e123ce2c6f63b0b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046094, "uuid": "7ee71cce-70f1-4f39-9224-865dee4ee837", "comment": "Malware payload", "value": "786ed122b195b4e666363fa4af98fd53b0efdb6eb22ee2d0a9616883c54f7fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046094, "uuid": "f341cf01-565d-4cf0-be69-32c5e7e0f9c6", "comment": "Malware payload", "value": "4a2f746e52d34fd8301d1c08b8dfeacf0eb31295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046094, "uuid": "edfbc579-9850-41cd-94e4-11ad1351ed42", "comment": "Malware payload", "value": "db72495fab173f100324879f0a8ebcef5c8ce101873e993be5b55631a6ef8b86a52357fda0fe0e4dc530fb521604b63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046094, "uuid": "7b277edf-936c-4357-b921-ca06d7132402", "value": "T1AFF5AE31BDE17573C5A303718A7EF639747DB664073580DF62D44A282E206E26B3A63B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046094, "uuid": "247f1cb8-4b87-4227-8da3-541ee3f55e82", "value": "9ade5f455f725ad5a41e60e6a1249b39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046094, "uuid": "90c1c73c-6a87-40ef-a14d-fd7df579c800", "value": "98304:naXIRz7MGl12p6LrOQLWVDhfqLNh4BDwzvS:naXkzFlLOQcfqLNh4BcTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046094, "uuid": "012e7f05-d11b-447f-8051-13364def58a4", "value": 3361232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046094, "uuid": "ca61e6f6-e112-4a7a-96b5-d8592fbe2c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046094, "uuid": "a186b3b3-41bd-429a-8fa4-5300f34ddad3", "value": "SecuriteInfo.com.Program.Kuaizip.1.13932.28992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0cd2a0-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046059, "uuid": "ed91d749-ee48-49a6-bacc-818bbb58d079", "comment": "Malware payload", "value": "09d24ed5da28c9983169aa33b1f94d11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046059, "uuid": "b73fec87-f407-4594-baa6-55055dd486c8", "comment": "Malware payload", "value": "7884aa1d524e0430df8255920e373bcc17fd40d1aac6d9724cfdea3fe3f7fe0b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046059, "uuid": "751722ab-dbcc-48c8-9b72-7984b6d2f388", "comment": "Malware payload", "value": "54419bc0124672cb3fa1664e4c3e401cf17160e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046059, "uuid": "c336b457-4514-400d-a779-167957ea00c0", "comment": "Malware payload", "value": "576f24c1fe065740d0730d336a431ebe0d43ed09cbf7f06961b6652570f879badb383c996b3cc4316b867299866d4a44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046059, "uuid": "952615db-a5c4-4e9e-804d-58268424f645", "value": "T1DA5502E9E5331733E0A26D3F9479572C1CB98A70CD05720FB629128794AFA404BEA7DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046059, "uuid": "77fcd267-84ab-4929-874e-4ad1179cda07", "value": "6a1e99f55e2eaa0bd39031bba57126cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046059, "uuid": "220b157d-16f9-419e-864d-02574dde115d", "value": "24576:LkY4COwlk33UgF2lfGiVjZ72fA8POHccVzZgpgUDXswtRvdEJy5YGrB:LKtVNEzVtafA8WHccBZ2g2JIxGrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046059, "uuid": "3c8e6d43-bf0d-47ab-8b5b-68918dae6216", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046059, "uuid": "7e5b74be-5d42-46e9-a768-cab537536884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046059, "uuid": "57f41bf9-b550-4e4f-a5fd-4f998cc6783b", "value": "SecuriteInfo.com.Win32.InjectorX-gen.14983.3548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a72290-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046102, "uuid": "971e5ac6-b822-4bb3-a436-32691ef102be", "comment": "Malware payload", "value": "208d859ea222f4af6f57ffeb51f3c2c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046102, "uuid": "61a1c8e7-673c-4b68-bb3d-ce056ba8b161", "comment": "Malware payload", "value": "78d0b71582f6071ab569e83bfe814939d1500a953fc40dfac27d4a78696b02b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046102, "uuid": "4e719be8-6a45-4e14-8854-be8b776a7f34", "comment": "Malware payload", "value": "4dc3f2f12a6568ffaace362f23f00b2e50f7f277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046102, "uuid": "50464dd5-56f1-4e31-be4f-a5e941d0da0e", "comment": "Malware payload", "value": "193c7efc6e684239192f4b163d1953d0b2ea650764e33b80a0a720daa174efa7d55dc5e3f536320d405b2a1c27fc9fa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046102, "uuid": "59cd0c95-980e-48b4-9f2f-3e071cb06279", "value": "T1F7359D5A77A800B9D577C178C9678607E3B2B49A1B2197CF07F0936A2F237D11A3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046102, "uuid": "c2af145d-388b-4872-a6f6-637528cc8577", "value": "212133ce5253e0170272bd132c286e76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046102, "uuid": "33b62dfd-16fa-4960-ab5f-1c96e1b7e7d8", "value": "24576:mpyUWchlVf9A42Wi632Axu760iSupJofAe3Yow4RId:4CchlVq42WlRq60uOjbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046102, "uuid": "35d675cf-5fd1-418b-89aa-76cebc23b128", "value": 1124256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046102, "uuid": "96454710-2c61-4501-91cd-2f215fdb02f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046102, "uuid": "aa5757fd-0142-40c7-8c4a-9a66368b5177", "value": "SecuriteInfo.com.Program.Kuaizip.1.12631.22997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f21055-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085851, "uuid": "b9e085aa-65ab-43cb-905e-16994682afef", "comment": "Malware payload", "value": "8e980b37910ba07bac25e966dbdbf894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085851, "uuid": "81c17ddc-2fee-41a0-a6c7-3587d1eb382e", "comment": "Malware payload", "value": "7916c7ba0d0692678168ab2bb2c7fa6d12b5bddf931a85b107b2616a936ccc42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085851, "uuid": "e26f53f4-214c-457c-a2f4-6485973caece", "comment": "Malware payload", "value": "f95e7bdad85e3147402b86effba9a23fc0de17db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085851, "uuid": "11e77d55-13e0-4684-baf6-d2d987a11488", "comment": "Malware payload", "value": "63865dd50627167eafe567356d2cea2ab8b1315bcf8882c55369afba61050dc1d8685e6a9f041aca197809cf49ce53d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085851, "uuid": "a91360a9-404c-4535-8302-d95cb4376403", "value": "T19FE533A269FB0B03CBDC6A74E5164B1C0F32DEB15397D24AACCAD49B5C6F3855E11328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085851, "uuid": "f8bab409-6643-4ca2-8b24-50781739235a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085851, "uuid": "d7fdf1d8-4a33-469a-a6c0-e4ea42ba482c", "value": "98304:RoJfoRv7exDg1vjVVb5Nyn/B+WdzThSF:RWfaepg1LVl5Nap+Wdz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085851, "uuid": "1cf6bc78-f538-46e5-b860-58cb8298531d", "value": 3240448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085851, "uuid": "009cf250-728e-4c6a-bf93-021813204c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085851, "uuid": "dc1d3f8a-f234-4a53-8438-d7383ab7ee08", "value": "NBYS AH.NETe712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959d62c4-43ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693039819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039819, "uuid": "b968f78a-52ac-45c5-a110-5c3227efe6d2", "comment": "Malware payload", "value": "f0f103d126a2ae11c5277eceefda52bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039819, "uuid": "1f4b176f-7484-498e-a10a-368ba17808b8", "comment": "Malware payload", "value": "79e1baf6bfb79716966beccdefcb43ffd384c5053bfe9f98b7084ea03adc4ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039819, "uuid": "f89c46ee-5277-4ff7-a9e7-af999d07b390", "comment": "Malware payload", "value": "b3ba4951ae413627d5e524cb11f787201ae19b5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693039819, "uuid": "57bf4a28-8c55-4aa1-92d6-e0a69fadc376", "comment": "Malware payload", "value": "b8622bae341a87744627ae5bd0462badbdf24f0e22b69475cf76d9da730b1c820ecea1fb345f0eb9b2d193c6f7c77f27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039819, "uuid": "a57bb667-378b-4f9a-b2ca-026a82b39892", "value": "T1FC75BF3FF268A13EC56A1B3245B38310997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039819, "uuid": "48c19785-be9a-4fb8-a03c-614ca7728dcf", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039819, "uuid": "209ffdea-caa8-439e-8df3-14aabdd33de0", "value": "24576:s7FUDowAyrTVE3U5F//tOKic6QL3E2vVsjECUAQT45deRV9Rn:sBuZrEUkKIy029s4C1eH91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693039819, "uuid": "f8edc69c-9daf-4fa0-bbef-480a33f47fef", "value": 1673278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693039819, "uuid": "c3f5a822-2cc6-497c-98cb-86dfc637f484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693039819, "uuid": "84306ab1-2664-42a7-b1f8-c6c513a23cbe", "value": "F0F103D126A2AE11C5277ECEEFDA52BB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1edf34-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046081, "uuid": "abeac20a-5429-4dd0-805a-d915271e5e79", "comment": "Malware payload", "value": "6d173ffb1bf60ba6cb347c8aadaa9c58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046081, "uuid": "74bff507-8d22-4e8e-a824-bfcb5d2b258e", "comment": "Malware payload", "value": "7a31a4211e45a4de7fff6a96032d209d9ce62fd5b57e443c4812048a922a8b44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046081, "uuid": "540791eb-b72e-4896-a943-93a7d6070e55", "comment": "Malware payload", "value": "1aa4ca99598a71da810cf8cafa9f0a0758eb9fe5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046081, "uuid": "0b2ec0ea-ef64-4768-9687-d44ce604295f", "comment": "Malware payload", "value": "6773e28b8d323d2f6884e8e47ff1cb4e9b9a050c87ddb620f8ca4bcbe62549c17b45d40ab512a289d0b8b409670c7273", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046081, "uuid": "3c4401be-d67d-48f7-806c-f8473d8d7b2d", "value": "T192C38C83B1D1C4B2D0AF597D4A65E6189B6F3EA0DEF0986F2F54065E0E702C05F2DE26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046081, "uuid": "c46718db-a25b-428f-834c-ce3876e6fdd0", "value": "eb18bbe48b887968a213dfcf809c82a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046081, "uuid": "09bd9e10-3f48-4f96-956f-f01eb291759d", "value": "1536:g1NXQmzZWNKkE55S5+sa3E82pIufm5Bxn39teg7KQIDjHisWGgcdi8wHRaroUM8p:MdQUSEtr2p9O9nr7KVn7BiF8MZuM/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046081, "uuid": "9fc2a614-6533-4e0a-bd90-dc8b09bb03ca", "value": 129952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046081, "uuid": "3f1b47e5-4b00-477a-8965-eb3adbda93da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046081, "uuid": "aedf0ed0-b5dd-4fa4-84e4-10327970b5d3", "value": "SecuriteInfo.com.Program.Kuaizip.1.18260.19250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4e07cb-441e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693060926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060926, "uuid": "c2db379c-229c-41f2-a2e0-e0b686727b4e", "comment": "Malware payload (RedLineStealer)", "value": "2d4895c540a0aa7fa8cbabf988012529", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060926, "uuid": "30f00337-86d0-4950-bc80-e0699cb0d30f", "comment": "Malware payload (RedLineStealer)", "value": "7afea41b774550799aed30528419b5a0475bb1033d0d45da0201c759af9d8a50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060926, "uuid": "fe5b5f74-f3a7-4504-a261-ed8d3edc8f5e", "comment": "Malware payload (RedLineStealer)", "value": "0fbebfe3e62fa84967e95bef4b77410093437626", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060926, "uuid": "d96d7a40-2902-464a-afa6-52dad344a9b3", "comment": "Malware payload (RedLineStealer)", "value": "a9a8591f7c43bf458d97ae5bf9b303dc5dc587b9f56ac4bff0eefefa1fe3fa9cf868a2b8e8419663bc09976e8c1d462f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060926, "uuid": "7845b767-48ad-41f1-943f-1364d8fe43df", "value": "T113E41243B6F88167D97137B168F203831A39BC719DB4929F3782F94E49B2590A471B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060926, "uuid": "89d41b12-8468-42dc-b683-3def3864b61c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060926, "uuid": "d3997a3b-b4c4-4b59-8b97-c42bab2c816c", "value": "12288:bMrVy900WxlIDe7hGXM16YFD03LNmQ85KM4L12rMuodLaUQ2BnOqwjgPmDPxvZV:mytWxqe7wT9NWN4L1yno9c2nOqwjTdhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693060926, "uuid": "6d6f92fc-097a-4065-9ba4-b4944ef57333", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693060926, "uuid": "61b3f041-cb0e-4fe7-8040-d7a807e7b16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060926, "uuid": "88851c30-65ef-43be-9b6d-c3432d358e92", "value": "2d4895c540a0aa7fa8cbabf988012529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cc4dc1-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046092, "uuid": "8dda71ce-fc10-4bf7-9937-db9bc955500e", "comment": "Malware payload", "value": "0f6ffc2e70d312972d592fd43d49b10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046092, "uuid": "b67c16ed-5d0a-455c-896a-735dd2ce4e84", "comment": "Malware payload", "value": "7bcde76356cbd428ffd4fd3288f1f07d49db7d3d772b9671bfa2bb1f98a3ae17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046092, "uuid": "0a72ecf6-fe70-4b72-96cb-1d9a6349cae0", "comment": "Malware payload", "value": "1be29b9bf2da79e428f3e2ed95b25880b72cbc0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046092, "uuid": "32dc176a-9aa8-4b3d-9f5a-8f322be03442", "comment": "Malware payload", "value": "7977f9a7a39faef22bcd145ab70ce550532c0c06c75e9fcedad1e6468994bb4a30621b30149736cef3ad3b8c54fe0f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046092, "uuid": "2e5126ff-2925-4702-9e9e-aaca956d807b", "value": "T1B6052308B74E6692C3BC9E78C5D56601437A7FB77A02C6078DD12B198C53FD99D82AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046092, "uuid": "d8197642-e1d5-46bb-b2fc-db75b5394493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046092, "uuid": "13857dac-fb38-4dc0-8609-1e492dd2c0dd", "value": "12288:nByKFBp5YVGAVUOJNcTUW91MPSNZm6wZUkmLB7j/QFU0u0cql03za+9rSdfDG:EKrp5YoOJ41MCzwZU3LG9/2DayufD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046092, "uuid": "b983dfe8-866c-48b1-8b31-df94aea7a867", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046092, "uuid": "eacb35ad-5770-40ce-98ac-e39f917374d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046092, "uuid": "c228fc70-b287-4472-82c7-eb68d8e11bc4", "value": "SecuriteInfo.com.Trojan.PackedNET.2224.11828.2302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e4fd79-4432-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693069610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069610, "uuid": "cff57fea-983c-414d-8598-9078c8cd4fb5", "comment": "Malware payload (RedLineStealer)", "value": "b08319b4cda292dc1cbe771226fa7ac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069610, "uuid": "cded1b15-1b33-4b35-90cd-3b70fabd3cf6", "comment": "Malware payload (RedLineStealer)", "value": "7ccebb35a6047b4f54b86986f3c18a6676a242e6eb11ebba584dace0a1f18f7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069610, "uuid": "e762a6bb-3e9b-49ef-bfe6-18842860acd4", "comment": "Malware payload (RedLineStealer)", "value": "c4773ce6aab98c020488ffa7ac9f7e17e560f804", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069610, "uuid": "c83126ac-3465-4d3f-bbb3-a2524cf20d37", "comment": "Malware payload (RedLineStealer)", "value": "9c7148defcbfc543341e8e2feb87804761ca131429f16346dcd29ca9a949209513ae09667d2f9cd792e1f210cc0bb546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069610, "uuid": "c503c503-3f4e-4358-a57a-2a2cd42b83c1", "value": "T10E847B1D3CCD40B3CCED12B58AE15AF57CEE6E10899E5F6F23989F3E2E300A4A915585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069610, "uuid": "1149a329-dcb1-42a8-adaf-2e796be9084d", "value": "a8d556a81f264cbf87707551d1515c69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069610, "uuid": "2d69aebf-c6b4-4636-98bc-330201479bae", "value": "6144:GINmsOm/xvfHaU4+ewAONNviHIPp8iDpNPmN3IgNteXQju0hdvRUNwLw:Z0sOm/93HNaHIPp8iDpeNkXQ7dZpLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069610, "uuid": "7fdd8e5d-835c-4f73-949e-03b9e53668f9", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069610, "uuid": "aafb2354-d9d8-4c6d-9abc-cfc4a69b437f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069610, "uuid": "95896f10-3c1f-4cd1-af03-8a6234140647", "value": "b08319b4cda292dc1cbe771226fa7ac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c132b0-4459-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1693086250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086250, "uuid": "ce7f2d35-3d81-4a56-88f9-4987520cacc9", "comment": "Malware payload (Rhadamanthys)", "value": "143e1132bbb49d0de9d15e9d66cd210f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086250, "uuid": "a6756bd4-a401-4d68-b7dc-95d7367ec453", "comment": "Malware payload (Rhadamanthys)", "value": "7d64c0f845c06eaa305582902806bcdda2a63370ec425128dc85469b2c388b6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086250, "uuid": "1facee7e-30a2-434c-806e-af4538df6f2e", "comment": "Malware payload (Rhadamanthys)", "value": "3b207925ed1abffba67c4d2fb676a086d998ab8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086250, "uuid": "2d896af1-b782-4825-85b8-4768a97f8c3d", "comment": "Malware payload (Rhadamanthys)", "value": "4eeeedadd75d320914af0985f42fb979b3336f63991ef5a0a84dda740d21e6411f3e14a0b57a6775c1c5cb9a9585427b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086250, "uuid": "881d06e1-c8b5-4ba7-8adc-86bf241f27c7", "value": "T136B59DF18FA1FE91D3AF1E70D0EC09C05DAC6B8792698349BC881556EDA1750AFCC6B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086250, "uuid": "869bc66e-ee5f-48e5-9a8a-42d41f3bc525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086250, "uuid": "4899f77d-dd70-4898-8c96-a69ab4dcc7cd", "value": "49152:ExumC8c+cbucGjh2J6ttnNrMPL0cFOjG:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086250, "uuid": "f02362f7-5ac7-4fee-a46b-1fd675843385", "value": 2473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086250, "uuid": "0960d9e9-3920-4cf8-82cb-16c53de0efda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086250, "uuid": "00cb5a4e-ccac-42bc-8ef4-eef936a5c024", "value": "ppi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cb3499-43ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1693047689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047689, "uuid": "c520835d-3e04-4788-879e-8b9ee8871552", "comment": "Malware payload (DarkTortilla)", "value": "c4f9137955152e0a07b3f010e92bb07f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047689, "uuid": "5b8feace-641b-429d-9d7a-7a79b7883093", "comment": "Malware payload (DarkTortilla)", "value": "7db89fab4e6cafc168e02ae9030edcfd16f057f2168830f286a295aa135e92df", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047689, "uuid": "cd127dee-4287-4a17-a581-8cf2933fe59c", "comment": "Malware payload (DarkTortilla)", "value": "a52e455d23d3fc7524742bdebc808d2fe0d58d82", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047689, "uuid": "2a48fa40-80d0-4083-aaec-627037bb931b", "comment": "Malware payload (DarkTortilla)", "value": "b25baeb0a487a613fb624fb4a49e11e6da5c6596f96a95a5f288675c9f14b7ec7af04ca2043e89f5d3b112192095d3f5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047689, "uuid": "aa2c3d14-e5f3-4bc8-bfb2-90cf81a90063", "value": "T198A4120BB7DB4056C9B908B79B5B55A41371C2C36052F36E34CC3AE48F9F69A9A02773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047689, "uuid": "94c1c6b5-c655-4fb7-a5db-66a49b593a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047689, "uuid": "dc71102c-e0db-45ea-a59c-89824b2e54d1", "value": "6144:ubqPouQ7u0a0Lgb2mzHy2ZkFlq2hOXsG0UL19s18EETdO98EGWQCUwOOt:4qQRayLk3zHtkFlxOp0UHUpIPEGWQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047689, "uuid": "ffa81f0f-17da-4b3a-adb9-30942e73b3ac", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047689, "uuid": "67ccdab0-3354-4e5a-bc80-e7e25698d998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047689, "uuid": "365370a0-72fd-40b9-9e04-1be5f99851fd", "value": "z17Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e0ea5e-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693086906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086906, "uuid": "c7f3f7f0-5c2f-4489-b71a-72a8d5e500f5", "comment": "Malware payload (Mirai)", "value": "463eceede778c8630ea16de78cb4cf1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086906, "uuid": "9f6efc69-7b22-418b-86c5-4fc4b1ba0487", "comment": "Malware payload (Mirai)", "value": "7dd7b3a03a781f523f9aefd139c5ecac41389de160028eba14b46662cdeae7c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086906, "uuid": "12fa07c1-ffd3-49ce-94a6-7c87fbe1cc07", "comment": "Malware payload (Mirai)", "value": "4d35a2c87ed812ad29051357f4488640cbfbdbfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086906, "uuid": "8969a5a2-4b28-4368-bb56-009fa37558e2", "comment": "Malware payload (Mirai)", "value": "54f04dc9b899aa1a232b4b4e0d54747b3270b6c51f58697ad667bd538d9ddb98d93fa1f3b12e17337d5120f391eb20b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086906, "uuid": "4afb3552-325c-4619-9b86-e7cefc82e28b", "value": "T1AFC32A06B31C0947D2632EF03B3B67E1D3EFEA8121E4FA40255FAA899171E325585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086906, "uuid": "47ae9091-218d-4330-b658-78ed03c875f6", "value": "1536:Manp0Z31X04gOIGeFv+q1xpjvTPNyrRms+gq4/MrgvAcIoHuHq7XHq+oPkCQ39:B00G3q1xV7P0igl/M5cPCQ39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086906, "uuid": "696bb386-ee39-452b-b3c6-e072e2bf0ce1", "value": 125240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086906, "uuid": "f2681eb3-08f5-485b-acd7-970e291d82bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086906, "uuid": "d885bd00-3f2d-46bf-ba3d-6cd4071703a2", "value": "463eceede778c8630ea16de78cb4cf1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ec394c-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693079405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "d7211b4f-2830-4acd-af14-b5b4f72c640d", "comment": "Malware payload (Mirai)", "value": "61b642facb5a2e7f7cd8ad877dc16f23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "4b5c1d20-9651-40fb-becf-f4be6bcaffe6", "comment": "Malware payload (Mirai)", "value": "7e8ce4cdcd7c167cb110e6486f00b44a578cbe732db3efb93954f7db915b35c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "245611fe-5830-4b38-bb6c-616761714ce6", "comment": "Malware payload (Mirai)", "value": "1a8d772a7544fa24545410b8c4499fd07c139fbf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "fa7454dc-7483-450e-9115-207b7607ddfe", "comment": "Malware payload (Mirai)", "value": "b582aea2747ec1e48c70eba5eeb261137db080f095428ba3d503fdf99046013dfbe09297fb93b9b3b4b63c1863745578", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079405, "uuid": "f3ecf60b-024a-485a-809f-648377d7cf7f", "value": "T138230271890E8EB225303C76DB9997937AF129B1C6673023DA2C0A3C6F65B131D57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079405, "uuid": "477fdfa6-621e-4773-a91d-eb478288718c", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3D9q3UELbUXfi6nVMQHI4vcGpvy:DECFd+A6YHAxCLRQZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079405, "uuid": "c8e2b51e-169d-4173-a7b3-e721db4e1b16", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079405, "uuid": "31103d91-75e3-4ae1-917c-0f8e8d27e050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079405, "uuid": "8e5401fd-dae1-49cc-98e5-bba8b29c5ddb", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03af0d62-43eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693038715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038715, "uuid": "985f4f99-4e47-4e8a-bb91-8062e7a271bb", "comment": "Malware payload (Stealc)", "value": "2be8d53b5f87f23de5c11a61fc6b4e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038715, "uuid": "f92501c9-666a-4127-8512-db55584d8a50", "comment": "Malware payload (Stealc)", "value": "7f175ae66302a4dcf074319d0d89220570a8963d43395d3cf61b3faaab3fe0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038715, "uuid": "bcabbfef-649e-4093-bc9d-0e9d04de4519", "comment": "Malware payload (Stealc)", "value": "766191f876d52eec94f74adc6d07ad08deb7aa64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038715, "uuid": "c2a777da-df3c-44b1-9278-b627124e2ef4", "comment": "Malware payload (Stealc)", "value": "c54d59ee1a367ef31aa9f1d69a30886d9fac858cb80151c05036cc4db55bb57157f7c043ece02105b1f79497aa8b5be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038715, "uuid": "8970e912-e801-4ea3-b943-2935fa4c4705", "value": "T12B44AE1373D0A872E12346319E6AC6F56B2EB8704F567ACB17985A3F1E702E2C775306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038715, "uuid": "fffba6db-ff76-4bd2-aab6-c1bc651e896f", "value": "e8efd3820cdf4c9ba34d84c41ef2dab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038715, "uuid": "bb85db8c-5781-42c9-9bbb-965e582b25c7", "value": "3072:sPPmWfZRARwjkLUzw4QdyBAXjvZEGFaMQc+upoVs5V7ac2nd1:otoRksUzWsBASGM/XupHV7aRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038715, "uuid": "110f6067-24e4-4aa7-a74b-cc17ec6e3ad0", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038715, "uuid": "7086950a-9d9f-4eb7-8489-337e552c3c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038715, "uuid": "0ffcdd7a-27aa-453c-a5ad-07590c3acfbb", "value": "2be8d53b5f87f23de5c11a61fc6b4e25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7626e6-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084932, "uuid": "e169a0c1-0228-4910-bccc-9909d3fe095e", "comment": "Malware payload (Mirai)", "value": "94681feb13fa698bab5138ed368bf70e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084932, "uuid": "2e9adb65-6382-454e-963d-fa8de5060709", "comment": "Malware payload (Mirai)", "value": "7f2d3a614dc6a1946fa17b5d1ce1299236970e1e470c23a54d3031f295045a48", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084932, "uuid": "ab491e59-4263-4a27-a1d6-283e37b440e0", "comment": "Malware payload (Mirai)", "value": "265a60676956abb83b553b9d5236982e3a018307", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084932, "uuid": "a3237438-58e9-40f3-9d67-4fade06c2409", "comment": "Malware payload (Mirai)", "value": "526d82a1114b6a48e677d1f619360b0eb0724831489574ac360600bb9651114d1b160d6bc431ec7d9e5aef835c89fdf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084932, "uuid": "a1cb65fb-650d-43e6-8106-97acbcfdc51f", "value": "T1B9D30946F9819B12D5C111BAFE1E128E37131B38E2DE73129D246F647B8B8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084932, "uuid": "bc3cc5ae-2162-48fd-83c7-b58d38836e53", "value": "1536:fpnCqGMzNoWTjkNuUlxykfxfrqXyPtvRlmIYBasr8lvigisF3TEE5fCpVEOE0m0O:TUCkZTqXeRwIYBasIF3TLJCpVWus1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084932, "uuid": "f86aee58-a143-4999-b041-f2d38e148711", "value": 135580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084932, "uuid": "67706531-56a7-46d6-aef1-9fa77f9813a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084932, "uuid": "4575d8ca-fd2a-4bff-9b39-65e5c183de6c", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df9c20a-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084715, "uuid": "80472f73-b48b-45e6-ad65-ff625b039df7", "comment": "Malware payload (Mirai)", "value": "0f3cafe5c364e949d2b290821c19f064", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084715, "uuid": "de83171b-1799-4235-a0ea-14255d58af59", "comment": "Malware payload (Mirai)", "value": "81226130c99470d5ae4b0663477337100ef3c4ceb175fa078755543ee77e4dd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084715, "uuid": "8d97f8ce-fd88-4c75-b871-b2731b806c38", "comment": "Malware payload (Mirai)", "value": "ef447ffa0e77278a21c2f54d5b6422f9f37839d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084715, "uuid": "6503f447-3f17-47b6-8e2a-7d8623312f64", "comment": "Malware payload (Mirai)", "value": "45650f823c25a7bdeacfd4f8e5183b67b0e4d31fcafc2bdeeb968b211b111752279b0482b0595981b8669a56aec4ad20", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084715, "uuid": "481197ef-634c-4e6f-af2f-337b5b6216b6", "value": "T1EF835BC5B6C3D4F6EC5305B2607B97768B33F43A102AEB43C7299936C852950E6177AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084715, "uuid": "4010456e-4677-4417-8d39-9acaef62f011", "value": "1536:JuBj0SLUbDq71Oomq1TisuYLwwPnCgPmCRyTSQtUq:JuBIlbe785qZzuw/DPhU+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084715, "uuid": "8e18a0b4-ef81-41b9-94ee-4940580dd12c", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084715, "uuid": "74258ba2-a32c-42bf-a522-f1d7eb86ac31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084715, "uuid": "f242c74b-e605-4ae8-b3de-d28e31b0f9f8", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f79a1d-446b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693093803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093803, "uuid": "ecf35b7b-7e2f-4b49-8c69-7e499792291f", "comment": "Malware payload (Mirai)", "value": "bf816ca2bed6b1fb0558743cc6848d7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093803, "uuid": "8200fa02-12fe-4973-b577-9e9c539ee65b", "comment": "Malware payload (Mirai)", "value": "814db7e183afc30e59891c13c3cbe1b1022aa93935b2ea72cb6c979783f99f4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093803, "uuid": "a4f8aa9d-b8e9-4107-afa6-d27387fba06a", "comment": "Malware payload (Mirai)", "value": "87fbe8405620e10b2f6b75cca17043f6847cdbab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693093803, "uuid": "3655422c-3927-42bb-8a15-a75f05db3cec", "comment": "Malware payload (Mirai)", "value": "aa5d3571771ffce94027cce69aa51841c733429f20adc9c90713cb32b920d100a1fabe4ebe20b62dbaa85543df200443", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093803, "uuid": "42ef58f3-1c97-46f2-b51a-1a640a8ee1f7", "value": "T147E2F1670A5B0A16EE89B3F3A48C71D20CF26E2123BF4FA21E19047162171D852D6AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093803, "uuid": "700354bb-4523-4cca-b412-33889006ba8c", "value": "768:Qq3yhi2rg98FdmvPyQw7NABkcEfpVyVVtXJPYumcScSHkqKb:biFdmvPgACcEfpVOZabDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693093803, "uuid": "24470556-296b-493a-acc7-b8b2f0474eb9", "value": 31328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693093803, "uuid": "30d2f680-8a6e-42ab-a0dd-e839ac67c40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693093803, "uuid": "51ff2e2c-a9ac-4c84-bd43-a419720bffd1", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee88046-43cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (zgRAT)", "timestamp": 1693027003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027003, "uuid": "c5f449a2-619b-44dc-962e-e653879cc33a", "comment": "Malware payload (zgRAT)", "value": "b2f1ba65b5e4d49ff785247fc553bd94", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027003, "uuid": "ebe513ad-acc8-4ab7-a996-33bd303b7294", "comment": "Malware payload (zgRAT)", "value": "8162b6759eae7bebade19b3e7a0f0a208546675189c7e79c26dddfc258c5c653", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027003, "uuid": "812d9bf2-9c28-48a3-8f07-2d85392220a7", "comment": "Malware payload (zgRAT)", "value": "95c954ddd69078b6bb4548b0f47b111696ccf54b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693027003, "uuid": "c0bf2f6a-b80f-452d-9d31-448bfc43b4b1", "comment": "Malware payload (zgRAT)", "value": "f222f29f9b22eb5852028a3ffe3e121bff4cbee16e3c06ec4b274820b009484e31396103cc342d69b39e112dafa8f4ce", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027003, "uuid": "222c5da4-6319-41e6-ab15-b2ab539b26cd", "value": "T19F3533E45BE06515F6D9827DD8D6020A6C344722D3363BDC3A4CFAC64412EAB4F8A99F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027003, "uuid": "43294600-aa0b-4c8f-a93a-c5a655fdd21e", "value": "24576:qdNNhBQtDVSZgoc30ktNJWJuwcRdx1OBXg9/Dh8R39VYPkrj:uk330ktN4uwgdx1OdkLiR39VKkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693027003, "uuid": "5dcae414-d6b5-461b-9a59-c4eeeffe0b05", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693027003, "uuid": "bf26f80c-db70-4f56-90d8-522da8b89f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693027003, "uuid": "08426694-b242-4727-b89b-4040c4b52e8f", "value": "b2f1ba65b5e4d49ff785247fc553bd94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321663ce-4405-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693049960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049960, "uuid": "431dbf06-17b7-4af4-ae88-d19546f5a05c", "comment": "Malware payload (RedLineStealer)", "value": "d125619aa10b0f17836f633946ab6c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049960, "uuid": "4726a69e-63cd-4235-a9fd-2d61fb7f8edd", "comment": "Malware payload (RedLineStealer)", "value": "8222ee950ed5797be9775e4f663b77bcfd2cd167e3c507a64728f4caf01158cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049960, "uuid": "c49ecb93-4bb9-424a-bb6f-15262e3a7303", "comment": "Malware payload (RedLineStealer)", "value": "7d458e573e5fe259e5cb4d47cac42d3a535c3e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049960, "uuid": "5d708373-ef40-491a-a8b5-10ec2d125682", "comment": "Malware payload (RedLineStealer)", "value": "9e12b3927d7102e134893a126818106b998ef09e9d98da56b982ae829ed1b672420a82660a1481919b319e4587544d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049960, "uuid": "5ff647fb-290f-4a82-809e-46dcb89c62f5", "value": "T1CD847AB33E9A4C73F431C1BB8DC95BA8A5789C3689A18D677B90076B4E919D0C30D277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049960, "uuid": "532082ad-82e0-49bf-a497-8ded97fa2635", "value": "a8d556a81f264cbf87707551d1515c69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049960, "uuid": "b16cc255-3723-46f9-bcf3-0c0943e7b5b3", "value": "6144:W1pHJxrOP2KLFqPAHpAOLNZh5mP29zfzJ4/:W3HJxrerpZNj5IaTzJ4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049960, "uuid": "957a17fb-d08b-4884-a5eb-40919b7f58f2", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049960, "uuid": "f06c1676-24d3-42a4-bd05-df5a201d51be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049960, "uuid": "e2ec916c-e601-42f7-860b-c59595c59632", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6487f5-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084717, "uuid": "5108aae5-9824-4f3f-94b9-85e7d0e98837", "comment": "Malware payload (Mirai)", "value": "05c54df435b31fbe2176d4e06338a936", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084717, "uuid": "38896e7e-eb60-49a4-bfb2-4bedfaa2418e", "comment": "Malware payload (Mirai)", "value": "8277b507e209e119fcfcd332a3036aaf0e04b20774cf46bb6a79126a9f9fa8ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084717, "uuid": "8e2fe6cc-f0c4-4ae8-9f95-11743f6eed73", "comment": "Malware payload (Mirai)", "value": "d22f9bfa445bf474d92494667a53ba8f98e315f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084717, "uuid": "16d22159-578a-4be2-a6eb-a61f8f022f99", "comment": "Malware payload (Mirai)", "value": "780300db2c2ba18dc03712eaf4a414c341f7cc0e9a43b75c85cc9b61cadc4cb0238438da1ae76809a1213d52384eacca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084717, "uuid": "53751d23-c40e-4de2-a17f-ec0f91044f4e", "value": "T1C5F3995E6E228F6DF668873147F74925A75D23DA22E1D684D2ACC1102F2029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084717, "uuid": "9cb8f428-b035-4473-b8d8-9193c6d8c4a7", "value": "3072:JynVVZZYn+ge7FW4mPb5MPy3F5lPPpQ9J:JW/ZrpW3z5dFDny9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084717, "uuid": "a613974f-8380-463a-85c2-8d16f2ea2434", "value": 165528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084717, "uuid": "bb8f87b3-1cf0-4884-aeb1-31e1091a584d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084717, "uuid": "40e18cf5-fc0b-4629-badc-09714f4bf1fe", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287c9bc5-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046078, "uuid": "327cbd6a-9826-47db-af15-33f4cc387766", "comment": "Malware payload", "value": "5b6aecc6cad87d62be6fc23d76e51355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046078, "uuid": "b8f72a10-5a0a-48c0-8716-bebb018c28d0", "comment": "Malware payload", "value": "82be68e7f0d5a94085a5f22de4cbba5177a0115fb186304b0bbf068113a0a7f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046078, "uuid": "e0a64970-12ec-4e00-9cf4-d71431934ae9", "comment": "Malware payload", "value": "278c90f5dcc3c7be94aeb475875a987790644159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046078, "uuid": "04ddf77a-6ba0-45b0-8d70-1077d3c9fe2e", "comment": "Malware payload", "value": "3baf52c775c1264480a9a2642a85122fc1c3f0d8c282d5aa9c5a9453860da32e5f12fd6813a707aecd4afb2ba79639d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046078, "uuid": "6f9220e6-03f9-425d-a615-91dc810db7fb", "value": "T19015AF227DD28073D2B245304A29B76055FDFA726B3087CBA3C81A1D5DB85F26E353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046078, "uuid": "dce8b128-373e-4ba6-9103-c697a62eb8fd", "value": "37e8621b42fc62c47ff55bccaaf8f2a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046078, "uuid": "a66fc2f6-e3c2-442f-99b3-d16ba3282649", "value": "12288:vTcSWUrDcIxXN5lHTFAeWlCg0dgFfTLVPsqycVskhkLmUzzqQTZxHxc:vSIoCg0dcftfyCsejUfqQTzHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046078, "uuid": "e4d13ad5-a4b9-4210-9711-25ab79db6996", "value": 929184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046078, "uuid": "ae3e395f-c814-4ca6-a205-82239f5314dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046078, "uuid": "a790ec8a-0054-4c57-a651-dbb308aa1197", "value": "SecuriteInfo.com.Program.Kuaizip.1.21343.1078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3800ca13-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046104, "uuid": "6a35bfed-80d0-43da-8bc2-8954923b7782", "comment": "Malware payload", "value": "002dfc7b4676753e66f7221ec12623c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046104, "uuid": "e6532e4d-3fd3-47aa-9cdf-624e908fafa5", "comment": "Malware payload", "value": "83cb83958c420fb6572d5f22c04fd3118569819911dc22f644f0c45c4d3f9fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046104, "uuid": "9594b1fb-efe8-477e-9d71-6c73fcd7c735", "comment": "Malware payload", "value": "385488b0b198586708b40eb80cee296c978e630e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046104, "uuid": "7bb1f440-9a07-4500-a16d-76332d23703f", "comment": "Malware payload", "value": "25bde591ce6efff6d6c238b04e365d6bda44e692434a4cc1e3e9b464c5a14437ec6250149e635716888b19d1b64811f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046104, "uuid": "b104f308-233b-4262-85fc-32b763d944b0", "value": "T16CD45B21B4018076E7B223719669EBB6182D6D35071891DFE3A87E791E700E33E3766F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046104, "uuid": "54b3046b-6839-43cb-962e-185208e9b2d9", "value": "e19c327b6b43149ce074a839ddfdcd91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046104, "uuid": "279d5780-c63b-4213-85b3-62179ecaaef5", "value": "12288:AqqSwPfcCj7BCWS2K1t7jegp0LBvN+36zjM7HgMMwUCFs5tcLOGG9vK6yLvXbHPe:AqqSwPfjvBCn2Kq5yLs5to5vX7gTPClW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046104, "uuid": "9be504ff-dc44-4175-bf75-a96b834c5942", "value": 655312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046104, "uuid": "dd0c58de-02a4-4a0d-a60b-4882e7f1a1d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046104, "uuid": "8c29b34f-488c-451b-9b36-60e5e2a01edb", "value": "SecuriteInfo.com.Program.Kuaizip.1.27360.21328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b1d6be-4433-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069634, "uuid": "ebd94652-012e-40a8-aa1f-5b118f3ce7c6", "comment": "Malware payload (Mirai)", "value": "64953e4d3a6caf2ac282c4f3cf11b26b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069634, "uuid": "4657bf21-8bfe-4118-aafc-48e5a299aa1d", "comment": "Malware payload (Mirai)", "value": "847a8c7dffb4982af48fadc88f334acb36b3678c888c1d54e1b99ef26f81c525", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069634, "uuid": "07d7587f-ea09-43a6-af96-ed67515daf55", "comment": "Malware payload (Mirai)", "value": "9c543fb36c51c2c6b9379d27d7b2ec3cc85f03fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069634, "uuid": "05dba688-fb39-4628-b1c9-e3e688ccd20c", "comment": "Malware payload (Mirai)", "value": "5166adc26167d314422735d46871be6390cb3a2810fe6869346e333164673f02183c45239c2ecdd70429c4bf36a7455f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069634, "uuid": "9bb93e08-409c-48d0-af61-87eeeaf6cd72", "value": "T1A4E2F197E372A052CD7C2BF1F96E86CA6B7D076CC57B30A71A055628295A0136E3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069634, "uuid": "7ae2d916-5aec-4971-be5b-3632e622607e", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XUQ29q3UEL5Iz:Porm1vpALgUJFLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069634, "uuid": "13e4c351-a06f-4fac-b6ae-01b0c3b5b6b5", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069634, "uuid": "8a9c7e0a-0cbd-41ad-ae1f-51a9345425bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069634, "uuid": "bb59dc96-0ae4-48b4-a1e2-1b9f8a5e9017", "value": "64953e4d3a6caf2ac282c4f3cf11b26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c0790e-441e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693060920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060920, "uuid": "91e8418a-f5b3-4e7c-8d77-0bb616a846c4", "comment": "Malware payload (RedLineStealer)", "value": "fdb136986165fced720c033de7c4a12f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060920, "uuid": "a83ef7ef-e377-40da-9206-49d238f64be9", "comment": "Malware payload (RedLineStealer)", "value": "84d2e41a62f6c710bae88b5751a40f4642e6525949bc614fcaf1233f8f85912c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060920, "uuid": "2a7507c5-a487-4f8a-b357-99e075b5feae", "comment": "Malware payload (RedLineStealer)", "value": "c8cfbca21597225ee3016470224239de0ab08856", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060920, "uuid": "5b36dcea-a8cc-4240-8421-478d717b5c9d", "comment": "Malware payload (RedLineStealer)", "value": "f3c4b7066ce9718483b10d914c95eae633cab8f7c94d43cef720759539987b735a285ddad3c89e9d8d8ccab109de1afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060920, "uuid": "a433ecc2-ae38-4e0b-a84b-69abb112650b", "value": "T1BB652353F6E48963DDF4177058B6138316313DA04DB58ABB27CB98070DB72A868763BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060920, "uuid": "5ee49d1f-9693-40a6-91e5-e5512de4eca8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060920, "uuid": "46c157db-4f7c-4f73-a184-17572907bc14", "value": "24576:yymRGbKTdIaZK0ZCtvwmaV/oJfHZrKYp96gnk0R7vgYmj3L5G:Z+K0ZClwmaV/o9HZrKk9nJoRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693060920, "uuid": "1407207a-a20b-48b8-b98c-614c15939fe8", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693060920, "uuid": "998f4417-a453-42ad-a89e-92d2b06ec23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060920, "uuid": "20bd9374-71a1-481d-a938-ca8f99260de6", "value": "fdb136986165fced720c033de7c4a12f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a99cd19-4459-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693086052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086052, "uuid": "fa45ec15-023e-4791-9862-13d2c0268d72", "comment": "Malware payload", "value": "f37a3ef6dddbe82e7ff1bdd739bf64c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086052, "uuid": "a102803b-a1c4-484a-b2c4-e55ea313464b", "comment": "Malware payload", "value": "85b376369149c090a645fc20c6e35844c125b38b1b9a5698340de280819293d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086052, "uuid": "844643e0-2b1b-4607-a659-0b382a500b2a", "comment": "Malware payload", "value": "c6cc2597feb7c87ceaedf88926558802b1bb5171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086052, "uuid": "0a679002-359f-4137-86c8-1b32fdc5a564", "comment": "Malware payload", "value": "2e79aaaf0b4fd9a473f4768f48b045261f3e3e48b35bfde9fe4ba575d57bf513fe95d10e96e77ce3959cbe0678b776b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086052, "uuid": "e97282cc-cf68-4e3d-8ef7-873ddd1ce663", "value": "T19DD5335AE84F49DBD252607FE2AB848793DC34517EA94A605B0FC3ACD1B70E0917389F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086052, "uuid": "c0614e59-0cc5-41b9-9a44-fb2297c17f5a", "value": "0df223a54723d743e6ee9648d0ea7a12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086052, "uuid": "2be31fb7-8eda-4c34-aa10-13a779ce43dd", "value": "49152:XcPzDIJIZ6Pv8d8kIcB3aodiEaVWISiLgG+wQpRqYTdTj2Ey2I+f5P8DB3u0n4:XcLDIWkUPszsgb+wqqYBfR8Dtu44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086052, "uuid": "a2834a78-ad18-4822-b74e-b623292a5981", "value": 2816000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086052, "uuid": "2fb628b6-2c97-43db-950d-d90ff4c73f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086052, "uuid": "86d5bbc4-4f0e-4321-8e37-11d004ec19e2", "value": "ShellExperienceHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70b16d7-43bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693018400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018400, "uuid": "120b7a62-8d25-49b2-ba19-b67b88de62f6", "comment": "Malware payload", "value": "1a398c4bbdb28621bf417f8c9e7f47df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018400, "uuid": "8f746e52-5143-4456-9fd3-8e11d1ec670e", "comment": "Malware payload", "value": "86804b6c7161483e39bdf62715d02ed350437acc5a89e17fc828a13e6fb1053b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018400, "uuid": "0b83155c-3f5d-4016-ba84-8b0358b35224", "comment": "Malware payload", "value": "4f0f16649c04a67f5479f131758849b6d0bdeaff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018400, "uuid": "7f86be75-2806-422f-9060-89c141d598bd", "comment": "Malware payload", "value": "e47b93f5e75cf45397d6e3fa1640db4790be1864cc279f2a14d1670f24b36a878746be631662bde0fa2e48c0cb563347", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018400, "uuid": "49126a75-e3ab-4998-a8f8-8e954f720cf5", "value": "T1E3E533CB16E6474DE38047F4D9D19E3123A1850CBAA5E2ECB74FA30B952191EEF78858", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018400, "uuid": "da0b1eb8-a1fa-45e5-8bdf-27e7bfa1e12f", "value": "6270ce86f7c25933e0d156b24fca086a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018400, "uuid": "13bf2ee2-1a70-4129-816c-a6f44745d695", "value": "49152:WluTQYe5FZ5HC7o5nB2e2n547nVpLdBSJ8V5uaU+4j97TsLOAFOT7f98QwEpw1h9:Wlu0hLHC7Snr2n5apLd0WV9fe97YLORY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693018400, "uuid": "321fec73-f6f5-4fe7-a4c6-92403745e833", "value": 3069440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693018400, "uuid": "f17de5fb-bec1-434f-88a3-9a370981714f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018400, "uuid": "59a04fa7-755a-4411-8f37-e5ed77e9b60d", "value": "1a398c4bbdb28621bf417f8c9e7f47df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7f7e4d-43e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693035294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035294, "uuid": "0fc154f4-79a7-4c6f-b852-5a9174afda02", "comment": "Malware payload", "value": "70d02e692f264a782f5c6142d4804caa", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035294, "uuid": "fbcee857-d213-4570-9578-c2bf4adb2c55", "comment": "Malware payload", "value": "86ccacfe301ddffaf528117a28685039023fe84f413e31774f1d4663c45a7957", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035294, "uuid": "f31c343c-609e-4c78-9a19-b1df57fe9a7e", "comment": "Malware payload", "value": "3e5b6f873d41c322b9644e32b544870bc73418ba", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035294, "uuid": "cc85f888-2ebe-47d6-8cf4-04e5f86d7f63", "comment": "Malware payload", "value": "e76e301896edadc3f721c85c8bd0fb447831c177b6b6de6295989aed4a9cca75e03c86a07b10f32139335196ad82fee9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035294, "uuid": "f07021be-91b2-498f-ac73-8f7224998cf0", "value": "T1F745590E21A1FCA6DB29C0B76634C158B89D73F20E5D5B56C379872A27833A1F76B350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035294, "uuid": "b51df34d-4a7b-4c35-9787-67eb2231a51e", "value": "b62cce0d334b2b0ed01259bc4d8865fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035294, "uuid": "03370d14-1544-4a22-aa26-8e965642f724", "value": "12288:AL/3R9jW4jFKmOpO4ZIh2kygPE4q7nV45lipybeKBujPaU7wyagMMhcK8h8Jrn:+3zjWOYK7yB5Vyli8ZBu+U7JaVHqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693035294, "uuid": "8bd40673-b9ab-40a4-85ab-e5d7a63f6ca8", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693035294, "uuid": "725a1fd4-25ca-4373-935f-a8bc3bd374e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035294, "uuid": "ce482097-46d3-4f06-9ae3-988f09647ded", "value": "70d02e692f264a782f5c6142d4804caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df84d795-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015461, "uuid": "8d1c160d-2bb4-4a7f-a651-561040cb8c59", "comment": "Malware payload (Mirai)", "value": "2548e49b296fbeab7b93fb65710ace42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015461, "uuid": "afbdf3ea-b8b1-48dd-b57a-ae87119b8026", "comment": "Malware payload (Mirai)", "value": "884540e630ed39b5cfcd98787cf4b6d307bbfcc3536aadce9da0c635b56b14c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015461, "uuid": "6707362b-9756-4c93-9fe3-964332484de2", "comment": "Malware payload (Mirai)", "value": "e3c47f48a2457c61df72b193caaebd63e37d37dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015461, "uuid": "b3801b53-f735-4ebe-a032-9a64506b3f92", "comment": "Malware payload (Mirai)", "value": "3243a394e6a3433746ab9b9a9fe709c0c9ca646724d93222d6156977effd28a2130e0d18c9e31698db271882b87b90fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015461, "uuid": "716e9945-e664-4753-aaac-1bde14357b63", "value": "T1D9E2F1A7C371A051DE7C26F2F96D85CA6BBD4BACC67730B31A1163182E550434B3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015461, "uuid": "d253cb75-bef4-4c55-ae15-e580b7cde272", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XWtCW9h9q3UEL5It:Porm1vpALgUJWtCW+LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015461, "uuid": "4285c54a-bd59-4a1e-8c4a-7e8fcd00a84b", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015461, "uuid": "55d0023e-fa1c-41ad-a352-672939250558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015461, "uuid": "2e02e411-f944-47cd-a92a-51da33cbacac", "value": "2548e49b296fbeab7b93fb65710ace42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ddb998-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693086881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086881, "uuid": "852ef4ac-23cb-4b3d-b4fa-3f188dbb9dd1", "comment": "Malware payload (Mirai)", "value": "75f6402a93c54c6206962d0cebdda18c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086881, "uuid": "ecb3b7b5-2ee9-4b3d-8c86-8653444de8c7", "comment": "Malware payload (Mirai)", "value": "8854fcbe7dbe7015d74dc1a9a0ad3da1adad619f21e20a57c81e71d7429599b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086881, "uuid": "63eeff45-1f7a-410a-9f2f-084c5c13ad6e", "comment": "Malware payload (Mirai)", "value": "5f3db30eca375e4e58eaa33623ec288b3a5293b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086881, "uuid": "e9002c90-ab0b-4c01-90bb-b4d76e31e53a", "comment": "Malware payload (Mirai)", "value": "eef51d58a020a79d99759e1b6bc3478bc78ae92097fa776caae89005d5fe153475ac3faaba110824ae67206609220881", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086881, "uuid": "dc8c92cc-2960-46e3-aa1a-a3a18a370e13", "value": "T1AEE318D7F800DEFAF80AE33B48530805B130BBA245925B372257796BED3A1D91577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086881, "uuid": "2ce0a12c-3f30-4a97-a245-46286c96bc11", "value": "3072:1nMawT4SjLGpfLXY8DxAY/nGy3Vrjbi5LNqkCIy6exME:pMlQ7R1AMGygLNq2y6eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086881, "uuid": "ebd6daad-62e4-4510-b66e-64977573507d", "value": 143744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086881, "uuid": "b58f5d08-9bb1-4b68-a693-2979a5a5965b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086881, "uuid": "f7301f84-ae31-4d34-aff1-14dc5f4e6f48", "value": "75f6402a93c54c6206962d0cebdda18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007be525-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042575, "uuid": "a1b44c72-c91a-4487-8349-bf78d34b2c0e", "comment": "Malware payload (Mirai)", "value": "ba4912cd0203fed74db1b2ebb50dce54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042575, "uuid": "0f77fbfb-5723-4a62-a023-ea6c2c1a0308", "comment": "Malware payload (Mirai)", "value": "8991d27ccdb4f2d4346ef9b0b11a796d9c1288dfc9b73b8a00aecaa7acde9318", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042575, "uuid": "af949215-ec35-46fe-b3dc-d31dcaca2477", "comment": "Malware payload (Mirai)", "value": "ca8d599854f3e3b95db7a91b32d97b28f0799251", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042575, "uuid": "6865370c-9a3b-4627-a669-0f5060c35503", "comment": "Malware payload (Mirai)", "value": "c7f39d05ac832c3563f4a68842e759e64907450140fe050bff93bcadcdf38504b34d6002e1d8769aa501510154f37155", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042575, "uuid": "74124165-ae87-4008-bec8-9627e88c58bd", "value": "T184041A46EB404B13C09627B9FADF425133239B6497EB73069528AFF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042575, "uuid": "141edd2c-a37a-4129-886e-7c8096451714", "value": "3072:vM1DTMZOkta+TA5hRizfFuLQwB5w/K/gp+7oLM/RYH+:yDTcpta+TA5zijqBey/iXLM/RYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042575, "uuid": "a125fb00-f793-4cc1-88db-91ff779383b7", "value": 174538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042575, "uuid": "8f0c7ad1-1434-4a70-860c-bf01f31b66fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042575, "uuid": "17cb87e8-7d43-4798-9efe-ff96bb7a387b", "value": "concakhbtandhuy.arm7-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a059965b-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084934, "uuid": "c2af5560-ef8b-41f6-b688-4e0898bb5b1f", "comment": "Malware payload (Mirai)", "value": "9b349ea973cc6931e0bb77a138380029", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084934, "uuid": "55f29cf8-9418-478b-b989-f64242325042", "comment": "Malware payload (Mirai)", "value": "8b7f5bd163f6a9d0fead5030737d27e6c5c99f3bd7978737f5465cf293e831bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084934, "uuid": "dcdc1f41-1902-4fc9-a2f4-8d506c5c15f3", "comment": "Malware payload (Mirai)", "value": "143f5c9ae7149b85ed919f798abdf767d3edbf49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084934, "uuid": "2a3b2d34-8248-4b89-937f-c04cbf9e8d2b", "comment": "Malware payload (Mirai)", "value": "5171ca47ec74517ed22fbb17f02baa8ad1028af47a32bd27a7005b0299e2aac1ec2b1c3a56864a9db9329bedb8deae0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084934, "uuid": "ec4b4380-2de2-4a1a-a1d3-a7b55628019d", "value": "T1DDC31945FC505B13C6D622B7FB5E428D7B2A1768D2EE32039D256F65378B86B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084934, "uuid": "69854701-b0cb-4893-8f1b-922954159479", "value": "1536:fJuEU8I2l+8Ki1hAJeq9Y4V+WycTT3Z45M/HV1b9t0LulYMwywaFHHFibgTvOW3+:fJu2lx91hd41H/3Z45gb969XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084934, "uuid": "e6d774a8-b730-41a1-b4fb-e2ca2754782e", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084934, "uuid": "475b0c54-e9d5-412c-be86-51a10f2949dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084934, "uuid": "cee7ae36-55f8-42b6-8cd3-e543e1eceeec", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4888c2-4454-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693084127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084127, "uuid": "99378005-28c6-459f-9d66-0a6de368c754", "comment": "Malware payload", "value": "a427c02b441e53aac26be930c7e65717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084127, "uuid": "06772106-4255-4e37-bd54-94b40f8a1423", "comment": "Malware payload", "value": "8be3807394d0239150443691c8f527a5d6297f2ed31e8aab8e22d94120a44e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084127, "uuid": "4d28f3ba-3d54-4da3-98fa-db79241dabd7", "comment": "Malware payload", "value": "e79d7a251bea5d3f714683a2b188aa0ff0a565d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084127, "uuid": "ddd1bf05-055d-40c3-9849-c585ceec892e", "comment": "Malware payload", "value": "4861a6f5d254094a8103af53a32da6950e57b79237d6b76b3be5b2dd4806a93e9ab8b40936f23bcce7c2874d0f5fee72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084127, "uuid": "3f70f0d7-4d70-4313-a9e3-20ed29572d75", "value": "T1AA663393739D5678CA948E35CDD0C5142A223305696934B2B9BD72CDBEEF041EAF7B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084127, "uuid": "ee1b8f3d-2920-4e74-b154-4575a1d0ff1c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084127, "uuid": "348d97b9-e9bc-4b1f-86d5-687a1ef05e10", "value": "196608:mf9IVeNlrK1gFOWJ+/5YqMt2R1/LpKubKAol:69/lrbz+/D02L5bKAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084127, "uuid": "04666cd3-fd35-4226-9750-5a4fb61eb930", "value": 6729707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084127, "uuid": "78506b54-4a66-4d8a-b1f0-6ed81d561580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084127, "uuid": "f5c0e2c5-0c27-4200-b908-248ddb30ad79", "value": "\u4efb\u6211\u884c\u6253\u5370\u7ba1\u7406\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e224399-4426-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693064180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064180, "uuid": "75a0010c-addb-482f-8fea-3c6e654fe811", "comment": "Malware payload (Mirai)", "value": "aa52ed1b0792a6e132af38fa55079f83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064180, "uuid": "25b6c207-50fc-4342-b49c-33b4c23ab119", "comment": "Malware payload (Mirai)", "value": "8c3b8615722dcbb30a9c0e17e0c7d72c8868f7daf7b8ede9a99130954e9be280", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064180, "uuid": "dd24a83a-822b-4a97-a02b-bdee6492bace", "comment": "Malware payload (Mirai)", "value": "f0d168a741ec422f8098d88b8a6387b3134ca990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064180, "uuid": "b07f9def-83ac-4d6b-8cc0-d04f63a6d5ef", "comment": "Malware payload (Mirai)", "value": "939444644aa28f2c7995046c36865915e4d4d863773acdb728314dc5487f5e90f1d1718442a2184fb2c67b15452978a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064180, "uuid": "c227d4a8-554d-4d9b-9ea3-d25954cd122b", "value": "T128D2E170969738E1C1F00131EAAC5BE6064B1EB4D0FF7277762114A6BDFB1C93AA11E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064180, "uuid": "ffb6579b-1d64-4e1a-90e2-6e63f1e29fe6", "value": "768:wA4uBc0T/nVvqV072G+IFYoXHZCx3GJzaes3UozO:wPuB7/nVMYn+Kf5kzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693064180, "uuid": "44afa0eb-4a35-4da9-b84f-90190c795ba6", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693064180, "uuid": "71756593-61fd-42ae-99b7-91197532f0a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064180, "uuid": "6e3129bd-a466-4e11-91c0-2275c7856255", "value": "aa52ed1b0792a6e132af38fa55079f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae75471e-43e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693038142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038142, "uuid": "54aa453b-4f6b-49b7-810e-4ef33ed5b64a", "comment": "Malware payload (AgentTesla)", "value": "7bba0f1e8224ca144ddec627bfb93a88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038142, "uuid": "2d7ee5d2-7a80-4ead-b4e3-6f4809074dc0", "comment": "Malware payload (AgentTesla)", "value": "8c8fe2b645a20fbc47b3664fc17653956c24a389d262e646a4ade7c068140fe0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038142, "uuid": "9bf949f5-5050-48bc-a0a0-0e8f83e99e96", "comment": "Malware payload (AgentTesla)", "value": "343f261135b7be5b29329fa2a22743ee89317ea7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038142, "uuid": "43b2a551-9bd9-4eb4-ab96-7c87ff972044", "comment": "Malware payload (AgentTesla)", "value": "0c8c867f49daad7cb7f91ed4cb47a14793f85d6950e60b2c3eea4b8603bcb8d5e99255ad5e8b146492908764e26df9c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038142, "uuid": "04ed9a4b-205e-4cbf-a4dc-11435e38aa43", "value": "T171E42376146621E4F72D55369B050494B7A27EA820333DEE3C56FF0D46C91F28E5EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038142, "uuid": "3850b53c-f8ce-4e8e-8561-92b7c34cbef8", "value": "12288:1XnWLeBrIG2GzTI7xoFI1Lx8j+9vYynr4eFVeHi6bB6uDeMhqIghOmzsED1lzaVG:1T5zQx0k9K+9vdrDFVmP68qVhOCsEDPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038142, "uuid": "95de2927-c2a4-4276-a5b3-ffaa2217b2f6", "value": 698937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038142, "uuid": "03ef6a63-bf0d-484f-b86a-af46f7f80bb3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038142, "uuid": "f296183e-25e0-42c4-b9c3-5f749edd5263", "value": "PO.230345.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c91c915-4430-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693068607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "e00b5d21-a546-4535-9166-3f8b8a3156e9", "comment": "Malware payload (Mirai)", "value": "ef59fc890d616c709d3e432f9d084480", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "95d351f9-f04d-4503-af15-a3aac30b4ac9", "comment": "Malware payload (Mirai)", "value": "8d3840829982494b3d0b4875c94120a6a3c568bae17811bd75d83673f79497e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "b797b3cd-7068-4eff-bdbb-33d180a88fa0", "comment": "Malware payload (Mirai)", "value": "e6bb1db314ef89161541548f6498e6e0751a7755", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "827b6150-705c-40d0-8fb2-3ed81c0eda84", "comment": "Malware payload (Mirai)", "value": "a8c02601e73c5dbaa2d1e440c0450783b94a26a83183842903db360fea310484403f6c4097371040dcffc0568f3edd14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068607, "uuid": "bd39ce45-6973-4d33-a87a-ceb8cdca57fb", "value": "T196C2D17092BD2CF1C6500672F6F866C97A520F7DFAFE3880124097BA394194529DB9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068607, "uuid": "5d068ff3-9eab-4bb5-b546-c7a972b42c69", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEwkgfchymdGUop5hj:AWsoTAZ3alkXLvFh8nNEwTfcs3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068607, "uuid": "65831712-eca5-4050-97d9-4e69871b86e5", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068607, "uuid": "1d9628b2-dec7-4b15-8ec9-7c90b555721e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068607, "uuid": "1499bda0-1a8f-4630-aafa-c5dcb584e569", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5be957-43e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693038137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038137, "uuid": "6c7154cb-81c3-42c8-af72-e4a83a1c4b0e", "comment": "Malware payload (AgentTesla)", "value": "838c3c96ac0d78f598b90dfa57f4a2a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038137, "uuid": "4f7ab2ab-1065-4219-b8fb-dcdf4a24ca31", "comment": "Malware payload (AgentTesla)", "value": "8e54c73e5b94b6d30bcf214dc7dfa9b695b7c5d46d62cd7b0e07acd6a7f1f691", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038137, "uuid": "e40e1e67-9aee-42b1-99df-389f54104e08", "comment": "Malware payload (AgentTesla)", "value": "5b976bee3db6f4739ca685f53a98af359b13e3dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038137, "uuid": "c0d65772-3bfd-4c3a-a4aa-5da180b7eea3", "comment": "Malware payload (AgentTesla)", "value": "aa2276ed0115bb97ef0cf82d4adb7d859d6619524d2712d759e53ef56c8b4b8d96c69813354da0c0f3b8716ab143fe68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038137, "uuid": "c6a4eebc-cbb5-4c88-a6cd-fc703571ff17", "value": "T11DF423D831DF278BCB6F5439919A7CF8BE12FA6497360D2705207D3A9CAD187A1B0706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038137, "uuid": "ad158e52-bedf-47f5-8a1d-61389b47c378", "value": "12288:v3nWjkjHGU1S7D6cBlG3S8Vss+J6RoUJbLMI0wy6ORFEH7tI0KXoQgW/7dYZX02k:P9mIS36qw3S8z+gog0wy6ORFII0KX5W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038137, "uuid": "50726e39-9bff-4438-b53f-65839d52031e", "value": 740674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038137, "uuid": "47a9827b-6e3b-4997-bad5-aa4efcd751ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038137, "uuid": "eb3ded56-f7d2-477b-b15d-181f63651aa7", "value": "New Order#2788654.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7feba61-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693079417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "eb2e7194-0444-49db-91be-54f444bcb732", "comment": "Malware payload (Mirai)", "value": "3b37c0efff8fd0fcc15e7a60deabc979", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "ae703ceb-9e3a-4c4d-a57c-4ab0a0256782", "comment": "Malware payload (Mirai)", "value": "929443f579608add5881af73739bd33d3a9aac9d9b4f8ea1885c385d9f89bd97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "72dec3bd-ebba-47b3-b3ac-3eda46b36fd8", "comment": "Malware payload (Mirai)", "value": "c71d65d96ce8091b8db80c50d5d23dd7ea4524e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "08c962a3-366a-4ee6-b5c5-481488f0b6d7", "comment": "Malware payload (Mirai)", "value": "ac7f8436fa0a9a4807323d22e259e26a58231ca76fdc964f7d3e7d0284876148c60df4e1212863f251151330026b995d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079417, "uuid": "0dabecdf-ef91-45bb-8c9d-e537437eba23", "value": "T1C1A2D01572632D66F3ED1C3DC96A835BFD660BFC80B5327669405A20C94D24B3E28B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079417, "uuid": "fd84f5bb-1e53-4192-8457-fcdc81271cfc", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj2jYwhymdGUop5hc:TvQn4j+ZO5fKAlxiEws3Uoz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079417, "uuid": "b9b64f20-51e3-44bd-ada9-5e050b0d9fcc", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079417, "uuid": "a53387ec-1bf6-4e8b-a0f5-4a26d11f9171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079417, "uuid": "66ff9af1-3bc9-41fa-8f2d-5bd0904d8ec0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fd9f53-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081153, "uuid": "caf03570-49f0-4584-8f59-40c8be90bf29", "comment": "Malware payload (Mirai)", "value": "eb7ae971bcad620ef018f618a8196fb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081153, "uuid": "d75d5781-ab7e-46b4-86ea-ead6d2b538b0", "comment": "Malware payload (Mirai)", "value": "937fb7485a4eb2b1c913af4c8544b6a738fb3e01452792411797e1887c217162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081153, "uuid": "5b5ed604-2dba-4a0e-b6a3-392ff91a39bb", "comment": "Malware payload (Mirai)", "value": "7dd049fcb30a58adade584cb5c5fb8510ed79897", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081153, "uuid": "3a6b29b7-21a1-4f4f-ae01-d0858583edf4", "comment": "Malware payload (Mirai)", "value": "17634155cfe45841769a2bfa0f58e8052693ea2ae4e96553e234ec6c4971551565ad5c9fbca5d2b781ace13d637ee92e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081153, "uuid": "ce22c2b7-c60d-4d26-b74b-1841ffcdb67e", "value": "T1B382CF30619B74E5DBF10031EAED8EC6972A0BF8D1FC36D327586F78898250651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081153, "uuid": "9c4a15bf-8a03-46c9-94cf-cf26e774eb94", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaMKhymdGUop5h5lj:6GV0P6+kom0tVAoNvm+to1MKs3Uoznlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081153, "uuid": "eb62c77c-a59a-4cf3-a8d4-2df10ad3cf84", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081153, "uuid": "9b6b89c4-2fd5-4874-9192-d2b8bd943366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081153, "uuid": "801c266c-6d80-4b86-8f8f-4af137a3965d", "value": "eb7ae971bcad620ef018f618a8196fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19f7b83-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038577, "uuid": "b728a36e-a84c-43f6-a4a6-c6dabf583486", "comment": "Malware payload", "value": "3a56ae3d8bad4274ac44a9a6ca4d62fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038577, "uuid": "ec7dec85-041a-4bfe-bf8e-8433dcf06a8c", "comment": "Malware payload", "value": "94caef5c48b9877b75c7bd41188288e206628cf31b34b2de2c6dbf22a051d2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038577, "uuid": "9a45d5ae-3d97-4d79-ad92-d661946565f4", "comment": "Malware payload", "value": "389e2cadf97b89ba490f45c42079a31d4a4feffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038577, "uuid": "1f6e930f-3654-4901-8580-0f52c3d250ce", "comment": "Malware payload", "value": "7966b7e4f570b45e0abadbbdb5bd7ff68c50d8a47b87214c38ec9e8afa3d0adbc19c0568c9794f4cb0dfd242f6e3509a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038577, "uuid": "5c2706a4-58cd-415c-a186-729f0351d238", "value": "T13526D700D601561ADDBB24F54BAD313EB14C9FE0131864D782C86AFADBBA6F13E3519B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038577, "uuid": "98d95990-783f-4350-af3e-66a929c4a34d", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBB7fQbA6qbC6I:rzC+CqfG2VcruFG2KAyVEDLvTQtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038577, "uuid": "977c3c3f-e682-4dca-8105-2ef6852d892f", "value": 4623618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038577, "uuid": "901776ec-260a-45f1-a89b-df89a4f2f6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038577, "uuid": "1e77ca12-aa98-4c9e-8ce0-2bbf48088840", "value": "3a56ae3d8bad4274ac44a9a6ca4d62fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a209b5c-4428-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693065005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065005, "uuid": "6b164c3a-5d68-479c-b1ea-daf90afb972d", "comment": "Malware payload (Mirai)", "value": "b238fa5edca6ab0d6228aa73dcb2bcc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065005, "uuid": "905171e6-8894-421f-a00f-bd04bb8fe233", "comment": "Malware payload (Mirai)", "value": "94d19158410b48b10fd6b9a782ea78bc0b8b55dd581e1cd51a0adaeeceed7287", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065005, "uuid": "10c8e8aa-fee6-424a-a904-77c5a4fff134", "comment": "Malware payload (Mirai)", "value": "7ed2d43a6d97517ca6526fdecdc3ab5040dab3d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065005, "uuid": "167c3f5b-4a14-4408-9c88-e6965428e758", "comment": "Malware payload (Mirai)", "value": "eded93be7a2b5df6cbcf7d9f6125c91dd3fbd1e66fc330c148766613117c7c345c515389b52ece21f246be59bd288b75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065005, "uuid": "37d8f02d-ebaf-4779-af77-673abeeb0ee8", "value": "T18EA2D0257F1DE88FCC37A27887E5E5C25390BD60D3DCC9866741C11FABA36846834E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065005, "uuid": "504266bc-c0e0-4a60-a9f7-9903768cd793", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtalSyo:798o08kxofBE+ZkXaT47C2Epitgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693065005, "uuid": "635d84c4-527b-4d91-b99b-04a9e551f511", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693065005, "uuid": "ce26fb28-3c5c-4afd-bbb6-b5c2acc5b8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065005, "uuid": "2104bc72-645e-4480-b222-7c3d9a17362f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc4a6af-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046063, "uuid": "fe65f2b3-a062-4ecd-b9e5-9ddfe31c7c38", "comment": "Malware payload", "value": "c167ff8529ac3c5e4bac89cc1dcb8b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046063, "uuid": "0807d3d2-6cca-458b-aa5e-e39970310493", "comment": "Malware payload", "value": "9555fb07c7b76f4b2e07ce8277cd34eef8a3b0451747c5847433be3b213eefc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046063, "uuid": "72f01e43-bf90-48d8-8a98-1f4b369f55de", "comment": "Malware payload", "value": "8c43ed588e67e7858c32596f5bb926d7567051b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046063, "uuid": "7be5c518-17d8-4040-bc12-9664a759b930", "comment": "Malware payload", "value": "0a4f17de838ed244214a11a73cbc33187e2bac26de4b5e0e035f9678f0c66c939411ff41702d45492e67e252cd027554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046063, "uuid": "feade248-91e5-4556-8a14-78e6ee410c13", "value": "T157D523113AC28672D4B3183619279F60A63CBC201FA6D6C7D3D469AEEE315C0D535FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046063, "uuid": "d416f7dd-83d3-4ae5-b190-2de79a2178b1", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046063, "uuid": "189690e4-a486-470e-a4b0-a58632dcb51e", "value": "49152:HdgazZza/5roQUx7thcfFCLTDcE95ud5k3CSX0eNg3ZB9jwlQTY2eJF:HHHx73cf655ud52zM75m2eJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046063, "uuid": "4a0a873f-f5cc-4048-b6ed-f2fc11f132f0", "value": 2845752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046063, "uuid": "66a1f050-6af3-43d9-adfb-8354ab1c6474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046063, "uuid": "67f459b7-37c2-4048-9481-daf1bccfe7a5", "value": "SecuriteInfo.com.Trojan.Uztuby.4.2981.828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf9f5c4-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084928, "uuid": "ae14a5a1-06e8-4d99-9166-e5e0f70c186a", "comment": "Malware payload (Mirai)", "value": "c15ff9837257c0269728d149fe3f5ab5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084928, "uuid": "49d320e0-17b9-40fe-b67a-d5f93fc6061d", "comment": "Malware payload (Mirai)", "value": "9700371f18ac9889f460fa491065d42ddc8cad3a1bce7fdfb31480094d04836f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084928, "uuid": "17411b76-1363-4450-a51b-d34caf09be4e", "comment": "Malware payload (Mirai)", "value": "7be8b8ae1b9fcebd8bd57231bb69b4214b06a792", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084928, "uuid": "8f21ba08-b4be-4230-aea3-241a445dea11", "comment": "Malware payload (Mirai)", "value": "0f14c2b6b054297563759a4535de52dabecb2a0bf06e0661971b808564034f8481e59d22264f9ddd61ba98573be6a50e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084928, "uuid": "dde036c7-8c1a-4a65-8427-b804d3e3bbd4", "value": "T117835BC5B6C3D4F6EC5305B2607B97768B33F43A102AEB43C7299936C852950E6177AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084928, "uuid": "26d7d8f4-901a-48d6-b0d7-58d6e2fc9c94", "value": "1536:JuBj0SLUbDqq1Oomq1TisuYLwwPnCgPmCRyTSQtU0:JuBIlbeq85qZzuw/DPhU+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084928, "uuid": "12c5ec00-6e6d-4469-bf52-17f967ee37a2", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084928, "uuid": "a00aa49f-83a6-4792-8b77-85af5cc7802e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084928, "uuid": "68907c96-8a35-4729-9faf-45e74a08c785", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb72897-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038596, "uuid": "53c42ab5-0178-4726-b274-f9cfa8b5bc5e", "comment": "Malware payload", "value": "0d1aad2cb3543e601a2309659e85d3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038596, "uuid": "e53260b4-735e-46af-bbfe-de6e044b900b", "comment": "Malware payload", "value": "9c5953f007fd661d81aab475f0f5d9f087454cf4324b5f32ab318a9bf55c4cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038596, "uuid": "3f790054-9b9c-4e43-b91a-a262ae3216bb", "comment": "Malware payload", "value": "8048dbeaf5b0d4e646c5bafa966a2d19cf17b79d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038596, "uuid": "2be263eb-1b7b-449c-9696-022e403b42e2", "comment": "Malware payload", "value": "6f6b05f026db8a24bdce1b33056a9a005fa95445773bad8349467ddd82b2ae129f9293b3f3ee238f13b1de08bc89d095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038596, "uuid": "372089e1-4ba2-4b5f-a1ad-5a5b4de81714", "value": "T166363304115009DDF5A2DDBF7A62CB3F41DEDBA8E501C6E2D9A40EB8740928F1F1E7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038596, "uuid": "3e03244a-3497-433e-aab3-fb354205c806", "value": "98304:iBT5sOCBT5sO557xGpVkonsxpv1QK1sWb2dVwIAnZsAGGsJNkqH/CadHd20:Q5sT5so57UnkJbSK1sWb2dSIaZUGsJNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038596, "uuid": "37ce1fb8-1a6c-412b-aadc-3fc07c5dc660", "value": 4879573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038596, "uuid": "f75a2f5b-86cd-4f4d-abd8-887f0748d6a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038596, "uuid": "9c969f03-6b5e-4aec-95e6-5a27557f977c", "value": "0d1aad2cb3543e601a2309659e85d3b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba84032e-445c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693087555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087555, "uuid": "915ed7ef-43f8-42b6-bf8d-f558fba25f7e", "comment": "Malware payload", "value": "81df021fd7a1275df23a861bb0dd436a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087555, "uuid": "c3b2d393-e0ee-4138-83cb-9c26a7da73b0", "comment": "Malware payload", "value": "9ca94f1c18262ad64ee1e51d395d74b76377619f5589c20102a0e593e78e39d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087555, "uuid": "b4610b2d-b412-4856-be68-c28a2016b88e", "comment": "Malware payload", "value": "75249d4b46a38a8678aecb6ce054f4b05cf30b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087555, "uuid": "fdb30833-5d4c-4ed2-8636-5c1af3d93cc6", "comment": "Malware payload", "value": "a6725a16de1be425205f89f63720c308b201b454ab396de1ea1104eb9d504250391ad7a837092b7b501448b45ffeaf4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087555, "uuid": "ffdf4716-e614-4f88-aa2d-4aeaffd8dbda", "value": "T1CF952386D8641277D17A59B00803D9FCF5B58CC12B69C27B43E1AFC37E7227A617A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087555, "uuid": "ca1f1d40-07fc-42ac-ac1b-a18dce36ee35", "value": "09dce4c0468af4dfd0932b9a46511d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087555, "uuid": "4071851f-94f2-4951-8c6a-809db19bb389", "value": "49152:X+q1dc9mJkFLmtKbz+UcURvXDVN20wdkwVufr77fGrg5y:X+q1UmuYtKb5cERN2necX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693087555, "uuid": "eda2435d-9bf8-4246-9b1d-6a16223f5b87", "value": 1998848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693087555, "uuid": "72d90d2f-c23b-4bc6-b448-6e4a7c545645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087555, "uuid": "6e8fd40e-8dbb-48ac-89a3-32463aff5900", "value": "\u5929\u964d\u6fc0\u5149\u70ae-\u56fe\u50cf\u754c\u9762\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244fd054-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084726, "uuid": "0a09524d-3420-4dcb-98d0-99ab36abf11b", "comment": "Malware payload (Mirai)", "value": "f036c632cb4b6d8472c0bcaa3b32b3b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084726, "uuid": "c1d0f665-64f0-41b0-9f58-69a3b3d864ac", "comment": "Malware payload (Mirai)", "value": "9d6e08bf6ac2ce66b96166299cedf40a1dcce6a4325924a9a5cd2c84dcb21409", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084726, "uuid": "5921011e-0e2c-4f4b-b6e5-b4e6c5e0f469", "comment": "Malware payload (Mirai)", "value": "2e69bac8651f5e04078fd4d732de65e693eacfb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084726, "uuid": "d441593e-5c33-4cb4-b54b-1d62cce47a5d", "comment": "Malware payload (Mirai)", "value": "311744e8b7b2fdf5ff5947cdfc07b17cf0ef6d3d6476daadb9365edc759ec8439099d86770eb0fc72cfc6cdbab52674e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084726, "uuid": "5287fcb3-3456-46e7-97bd-ee63ce16ada1", "value": "T11DC31A45FC505B13C6C612BBFB5E428D7B2A17A8D2EE72039D256F21378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084726, "uuid": "56ab24ed-48cf-4cfb-be3c-a8988182a160", "value": "1536:nJucUqozzZ/00FIACQk4V+Gz4/TZVgeNW+aHk8bHBYlIVd4wywOF5YNjB83ts1lD:nJM3ZJFIJ4l8lVgeNhOH49MZ3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084726, "uuid": "0ae38614-6270-42c5-b4b0-ec634c528831", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084726, "uuid": "ccbfdb3c-87cf-439b-b3c0-5fc124042c37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084726, "uuid": "9df260e4-8936-466a-8ad8-b63674454c42", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f622d243-43e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038263, "uuid": "5b437bcc-1f11-4e1f-80fa-69a95c0e7009", "comment": "Malware payload", "value": "3e69ba0d45a779f9001a58c5fedec4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038263, "uuid": "b193507a-3014-4b99-a49c-d478bf6a542d", "comment": "Malware payload", "value": "9e606d877e7189f841ed2b66b7de6cfd73422fd46f7eab478b962a11d2f1dfdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038263, "uuid": "f9ff6e87-ab67-4f99-8b2a-301fbbd9736e", "comment": "Malware payload", "value": "0b597c469e7320c276a35cc1e15eaf60c129922a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038263, "uuid": "5ddd09b4-f2bf-40ce-9fd2-880a7b4c7344", "comment": "Malware payload", "value": "7bdeda78f42dd42c0b7ef7b3d9e32097f91508989a856a84e8f6056f49e68c706b8a296eb49f4e11171c40e29388b4cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038263, "uuid": "776a435f-5814-4062-96ce-0f9321f0cc3f", "value": "T192B52322BBD4A870D5B519360A9197703B7C7C711F398ECF57443A6E8B308E1A939B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038263, "uuid": "ece86b1a-6249-4d44-b78d-c8bf7ab0b100", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038263, "uuid": "094d3233-48f9-412f-bf2f-d35c5b7c7630", "value": "49152:8cbi6Ent44JswziFZ6r3wce1rbKV5FtafR8Fs7MX:8cbKne4JsTFZ6rkmDK72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038263, "uuid": "455eb226-dce5-4378-836c-900bcd956470", "value": 2444495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038263, "uuid": "d751810e-9312-40de-b48f-8edd4f171021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038263, "uuid": "87a9ad08-4a2e-4683-8a4f-7e416d7fc211", "value": "3e69ba0d45a779f9001a58c5fedec4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07181bb-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1693038683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038683, "uuid": "e0904e51-61ad-46ce-954b-b411c2b6e4e1", "comment": "Malware payload (MarsStealer)", "value": "02f3ad26fa28a969c9533b8c1967f208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038683, "uuid": "55e154b4-9d3a-4843-b778-6be2e8cee614", "comment": "Malware payload (MarsStealer)", "value": "9e9898215c57e4dd2d5e9e34e6bd3eef1f1594ccb17ef2f1e4c6f90481044a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038683, "uuid": "664416e6-a933-44b9-b7b8-2eaca86094db", "comment": "Malware payload (MarsStealer)", "value": "03d032648c26ae127344486894a99ef0ad07daeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038683, "uuid": "9f92f7ee-9fb9-4594-b1f1-1f3b097f67b9", "comment": "Malware payload (MarsStealer)", "value": "bfceb00d1705fb136673e699cdd37c97413ffbc4eb21874edeaca7630a34e4debd33edbec355219b7e84ea8eccefdf00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038683, "uuid": "9c0fa6e1-83a0-42c1-94bd-58cfb05f7561", "value": "T17A44AE2372C0E871E5634A319E6AC7F52B6AB8704F5A66CF23941A3F1E712E1C775342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038683, "uuid": "d3d385cc-d38e-4314-bee2-2578837b3a19", "value": "afcff5561bc6ac3d233799d21416a52a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038683, "uuid": "edfc2e56-76e0-4e65-b470-2f654ee6f24c", "value": "3072:K05NgBZSPeM60G6BnVoftvr46HZcldltX1XOn/fx/0WSxnqWzdWpCfXV:L69V0PBnqD46HUN0nnoxqGEC/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038683, "uuid": "637c7e69-a320-4eff-965d-cf62db38f78c", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038683, "uuid": "efbfb63c-1776-4af7-93e7-f7c8cd4e6674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038683, "uuid": "20f794b0-11ec-4351-90d7-a795b25ecdc9", "value": "02f3ad26fa28a969c9533b8c1967f208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9577f19-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015451, "uuid": "f3e27a81-aa99-4640-8d81-8512ab644611", "comment": "Malware payload (Mirai)", "value": "a00cbc61f702b78419c2e28fe9828f49", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015451, "uuid": "18b9fe11-d2fd-43bf-9018-9c351493f847", "comment": "Malware payload (Mirai)", "value": "9fd4549e3d0e037a87ec135b4dc8c9188d4558b8e383728915b2cf1041730a6b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015451, "uuid": "9af00be0-9da5-4087-b17b-fbfb645ff0ad", "comment": "Malware payload (Mirai)", "value": "a9d34e150af4d979f5c463240bdcefa0b329c449", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015451, "uuid": "5b5618de-bfc8-4178-a9a4-fdf10f685da4", "comment": "Malware payload (Mirai)", "value": "ddf8f822dcdeb690e33e321e2c3e0aa351b3c7d2bc5e731ba76c47ba81432122fe3f5d7efca61d7e8dead1f4e00af1a4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015451, "uuid": "b84af449-e7a5-40a4-8163-48335865bd9d", "value": "T13DD2E1EB54BFF273C0366874346415C4FA3D3A17E31D972B0CEAAEAC65B66812B50D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015451, "uuid": "003aa1d5-a30e-45db-8528-e5a388c287b3", "value": "768:9YSoXdJZ5U05VxmHSSc+H2c+lPaUmSx0su:9YJdJZ5UQVH/+KaGtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015451, "uuid": "73954d00-4fdd-4b33-b204-c245a35eda00", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015451, "uuid": "44f45a4b-5388-4787-a625-a0e6da56c04f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015451, "uuid": "3b2edab5-963f-4334-8d62-b07fcdd32fd8", "value": "a00cbc61f702b78419c2e28fe9828f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3348c26-43ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693012810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693012810, "uuid": "00f834d3-191b-4e28-b88f-6cc8d80c0796", "comment": "Malware payload (RedLineStealer)", "value": "1d853c6c7e47692a38a22a0946a49c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693012810, "uuid": "119aac0a-9417-4c10-9b90-1d467a328d8d", "comment": "Malware payload (RedLineStealer)", "value": "a0bfed52ae17bd9673d3ad3f17a1550f27f8602c3d8da7cedc1012c81c1fed9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693012810, "uuid": "dbb4e818-0d6d-4dcb-9b13-7c035564f75f", "comment": "Malware payload (RedLineStealer)", "value": "ee18ae6dffd51ede14f0180a81df1da30b7660cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693012810, "uuid": "0cf02032-42a3-4e3d-bd14-94d4b133835c", "comment": "Malware payload (RedLineStealer)", "value": "333e248bec32ba449468fb8c640b1635bf5f48a4da41e4e1f70d23691b6d4b75ef0dfce2a47fe9ead52df6e5d51b0350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693012810, "uuid": "1bbfa792-ea81-464a-99b6-8f914df49036", "value": "T1A694F102B691C472C89F41359824D6F0657FB87399A5798733983FAF3F72282A7A2315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693012810, "uuid": "bc183dd6-47e7-4271-befc-b741ab03bbbf", "value": "07ec39bd17621c40170951aff851e5bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693012810, "uuid": "82900dc6-c596-4cc4-958e-4e5b661e0ab5", "value": "6144:h1vTvy5Lw+g5etSqfs/fYY65NKCXclbEI8ADb+K5FEnZHz+YT9RN:h1v7y5cIQ/n6eBodADrYnBl9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693012810, "uuid": "e54b557d-5dfa-4342-bb52-25680b63ed5d", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693012810, "uuid": "fb2ce9f3-e3bd-4506-b2b3-6b84382aac86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693012810, "uuid": "f331799d-bf2b-4a99-951a-54574302d6be", "value": "1d853c6c7e47692a38a22a0946a49c70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c95e8a2-4430-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693068607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "6ef79652-b59a-4259-827d-ed78128479ca", "comment": "Malware payload (Mirai)", "value": "df6f3a4b90f48018361d9f814ba142c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "cefcfd34-fdcc-47bd-b040-2a5bfdcd8ccf", "comment": "Malware payload (Mirai)", "value": "a168a5a6e5bc1f80e4bf6fc047949cda6368dc24e799b2873e40d3c6c1833c08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "c947b9bb-ffd0-409d-a234-52c77f0a64b9", "comment": "Malware payload (Mirai)", "value": "4393cbc00941a4c52c9ab6b8a63f4a9882bbbb01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068607, "uuid": "434aaf12-615d-459f-a3b5-33d0f3154f16", "comment": "Malware payload (Mirai)", "value": "4a241a10390fc627dc11be37ea5f96f821019ef3469312ec4756d002bc0330ed253827beee29e3acf3c89372a8d90adb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068607, "uuid": "388c44c8-07d8-4898-b1b6-3246935037fe", "value": "T1FED32A82EC51EA16CBD117B7BE2F208D330167DDE2D97102AD141F647ACE95B0E3BA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068607, "uuid": "5a236dad-1604-427e-89d3-b790e6218505", "value": "3072:HJujjGOFAVgfV0S7nI3DEdO84l/p4+KKHT:pWjMiI3o2pbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068607, "uuid": "cc459145-ec9e-4c31-b7f0-f655ae8d4938", "value": 136268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068607, "uuid": "d59853a1-433f-49e6-93dd-09d31b8838d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068607, "uuid": "15519d05-513f-45b8-9a0c-6813571dd6c2", "value": "yourbiggestnightmare.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab6c492-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046109, "uuid": "f412d4d5-8502-4aab-8c95-78b32c2b3098", "comment": "Malware payload", "value": "b379a96420aea6c709fcfb0b187f0d34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046109, "uuid": "0fd5def3-c3ee-4951-b891-20b710b7143c", "comment": "Malware payload", "value": "a1de8306c7b0768a2b1867f17c3c6d5f246651314492bf9d5c73e07f8895b270", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046109, "uuid": "f56e55db-acec-4a53-8b3a-f38f177cd7f0", "comment": "Malware payload", "value": "0a514094450386e16afa69bb51e76b07498a4658", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046109, "uuid": "9e12bc3f-0a8a-4b87-a323-b9665fe1fee4", "comment": "Malware payload", "value": "5927edf949ddf4d76f75bd26c0fa0464d18b034fc321f2e9cf06df5fda1b29dc4ed18b2869483491bebf0f14d2408046", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046109, "uuid": "24525477-1456-427b-991a-478c5a136ec4", "value": "T168359DD179D240B2DA6783354F3DA93C78BD65602A35C34773CC0E3A4DA69E28A527B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046109, "uuid": "1e877060-2062-4c0e-80f3-3e8fc225c856", "value": "55322e5209935da4bd1e82c1004856e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046109, "uuid": "d412a7fd-1c9d-4036-8d53-58e33d02e3e7", "value": "12288:1v5T/niQNxHMI5sBcwyhR7xPWl4OMpkKoT/CsEjuTLRSN7XWveX:1v52oxyBcwrKA/Cs46LRc7XWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046109, "uuid": "a1184f78-610b-4b83-8d72-c5d6aa1a0bfc", "value": 1101776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046109, "uuid": "fe5a69be-a2c1-4dd9-8dc2-58363040c3ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046109, "uuid": "12672ccb-a5c8-44d1-b2b3-7e2d86d01406", "value": "SecuriteInfo.com.Program.Kuaizip.1.1285.13027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d676e1de-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693038639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038639, "uuid": "cdfb89d8-0281-4ec6-8b8a-28803c2a4373", "comment": "Malware payload (Fabookie)", "value": "3e9f00f903bc41789ab1226d8bf9fb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038639, "uuid": "6c44058a-285f-4de8-9e16-cd21e77ce677", "comment": "Malware payload (Fabookie)", "value": "a42831b03ad18828fc341801d56895a08642bbf6b40430b6d2b91885aa6b0ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038639, "uuid": "38d445ce-8a25-4f5c-9526-428474ac46fb", "comment": "Malware payload (Fabookie)", "value": "3167259f6cd4400efe25099b123ff66b8a13909d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038639, "uuid": "cbf9547f-e1dc-4a38-9509-983043507b67", "comment": "Malware payload (Fabookie)", "value": "d53f1ebb45d61c20116db21335b5e7c915f8bd24aba7bcb20f981a65f59e6575863550e873988b5c4dd8509fe521eb1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038639, "uuid": "bc49daca-6177-4fd7-b80c-8b879268219d", "value": "T158544912AB25DFB8F0C7C8B6BD70410218E8B4097758B57E96CDCC751A3BC51ADB1AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038639, "uuid": "6289ec61-8e4b-432a-b284-823174f6ee1b", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038639, "uuid": "2ad82eab-cd46-4545-af05-60850cb9941f", "value": "6144:kXMoxMujmCE2kWCZ3j9Z0CIOiNmpxyN90vE:MMoxM6EVBkCIhWy90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038639, "uuid": "4af9bb18-fd15-491f-8fff-92a75d2c20ec", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038639, "uuid": "9615612a-e389-4145-bcbe-5363d315e65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038639, "uuid": "0235a6fa-ec09-4b32-a535-ae33100224f4", "value": "3e9f00f903bc41789ab1226d8bf9fb36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eb5aad-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046069, "uuid": "2d25925b-c196-435f-92b9-52371d5f2a00", "comment": "Malware payload", "value": "8f3c5da88279d2fb73ac9a4332c64ebb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046069, "uuid": "2c9c1dbd-b896-46d8-afc3-031ecfa9d98d", "comment": "Malware payload", "value": "a43d8f4046c6793d0dbecfc90e9f3aadfcd4cfab07de11d7634f7f31a6096d88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046069, "uuid": "765d461a-8d81-4853-b31e-ad8f03711f28", "comment": "Malware payload", "value": "4cb280dc7936c951b48e29b28991b8c536a0e519", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046069, "uuid": "e02e5370-ac89-4036-a47f-266671704953", "comment": "Malware payload", "value": "d0fb7b50476e232e129f2b2175edb34b66648c1efb130e6bc31fcad89fa78e2c7321e021a26ac1f7cb11fb8bedf1de60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046069, "uuid": "b5526454-02f3-4c2b-9ae7-d3d5b2bcfafa", "value": "T176457D01E602D535EDAB40B2CFFE567D96286631072510C7B3C89D7EAF66AE13E32607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046069, "uuid": "45df9f8c-920c-4330-9ae3-6c64e35b1c42", "value": "bffc494b4621d662e762bbf5307b74ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046069, "uuid": "316c092c-a476-4639-880d-ad33a85ec84a", "value": "24576:QLNFYZoKXNIL/JGVYYyxognFdcFWPcDaxZer:Q5FYZdKL8+xogniWIaxZer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046069, "uuid": "fea6e0e5-3588-40aa-bfdb-36b2ba88f9ea", "value": 1268176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046069, "uuid": "64b3ad41-1fbe-4afe-9cb1-70893b3a955d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046069, "uuid": "4f8afb5b-a2a6-485f-8f5d-eae33eb3b5da", "value": "SecuriteInfo.com.Program.Kuaizip.1.10118.24409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6801d1-440d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693053633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053633, "uuid": "dbddd095-d41e-48bf-b747-f1619da2f3ac", "comment": "Malware payload (AgentTesla)", "value": "90d75030c38fdb970fcb658060b925bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053633, "uuid": "5136585d-b3da-4c6f-91c6-a31b89a4dd71", "comment": "Malware payload (AgentTesla)", "value": "a784865ec8f567e6d1b1fc2ae9c81efcdf80a7f3e0cd76b50a7493ba73c0041e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053633, "uuid": "a98d3204-147b-4108-abe8-45d560755883", "comment": "Malware payload (AgentTesla)", "value": "48fb8228f634ec7dfc6c63f285fa1e74dd494aad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053633, "uuid": "1ad28567-cfe0-4d9f-944e-534bd955d71a", "comment": "Malware payload (AgentTesla)", "value": "a423c2bcfd70cc3f9c44b9091228bbdd9e1525b22c8de907b306a67c469d760de256aecf89a180603a8367c8c74ff154", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053633, "uuid": "e018a147-bee1-423a-aa3a-5425b714fe50", "value": "T163D4E0381B6B9F9AD2BE0375D021161493F6E013D334EA8BBFF101D55D62BD48673A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053633, "uuid": "9830b8e8-b3ba-4bb6-b057-dead103d9c85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053633, "uuid": "4698499f-7ab0-4490-9a0f-65179886c13b", "value": "12288:L0FAynMGlK0V2iTCDa7Ea+7hesOIC/EJJcikZUibTNpd:LGbPK0dMmOt/JQZUibT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693053633, "uuid": "9a0637b0-8a72-43b7-8368-58a90e8f1bad", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693053633, "uuid": "6dfae43b-8453-4d1e-a8ca-fc1ad7be9cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053633, "uuid": "fa3833b6-c3aa-439b-bc9f-40c59a2d3761", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.FQW.gen.Eldorado.27468.19439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442a6201-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083061, "uuid": "47a46a4b-bf37-45bf-a436-4ec8d620679d", "comment": "Malware payload", "value": "7334b48708be6c603594f600439edb16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083061, "uuid": "7b679ccf-8023-4b5b-a046-2a9aedbc1411", "comment": "Malware payload", "value": "a8cc0f4f31c5e74c159242b02876dd5fd60220081f05adb79992b82646f40341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083061, "uuid": "b8e67e3c-705a-4f4a-8efd-c48d969b352e", "comment": "Malware payload", "value": "436fa48e4f96b12b0220ece4f3e2580938e341a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083061, "uuid": "5cd6f2c5-ff05-48c3-b93f-9f5ace166e57", "comment": "Malware payload", "value": "22845c5ad9943d4046e35a0d4e8d1dce12a1830abd78f7013a7f317390030e1f923248eadb575cea3040bbd582e6877f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083061, "uuid": "5595491c-0ebb-4a42-8058-39883ef08081", "value": "T1113733BC25A06EA8F2DFA271045E3F7BD10035A85A510CDEF82515DD30E3A358FBCA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083061, "uuid": "c45dc06c-bb4a-48ed-9f27-c0cdc14f9ee8", "value": "9369b8cbf820fedf4c7837b944ee2543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083061, "uuid": "8abbdf98-8770-49f5-bba6-ed68df6b8d9b", "value": "393216:s8ny2QOlx8ObReD7lx0Er/I8yxcMxQe9BYwZk/D6h+WDMpGFyuU0:siyKlN1eD7lx0AvyQABHZGDeMpPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083061, "uuid": "5a329f18-2d79-4dd5-a2ca-f2b2511ce3d7", "value": 24243532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083061, "uuid": "081f31e8-d305-4091-96a4-5bb1fa9e156e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083061, "uuid": "e041b083-674d-43c3-8439-c03dcdc7b298", "value": "Setup2010u32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6030a0-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1693038701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038701, "uuid": "fe2df673-13e4-4e17-80e3-59385f85baaf", "comment": "Malware payload (RustyStealer)", "value": "43bd8e05bca198bc13c81998383c9e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038701, "uuid": "8783b5e8-8c79-47df-ad31-260efaa7e2bb", "comment": "Malware payload (RustyStealer)", "value": "aaa5b4f149f8aa7e8af776ec6d2de0be3bd69d17bd9263809cf40b5571fc3d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038701, "uuid": "377e18d4-eb2f-4c9c-8e9b-41515c6b9e01", "comment": "Malware payload (RustyStealer)", "value": "ff7159e3723035bf0ab5411fd6f9023c1fda2a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038701, "uuid": "04567eb4-75f0-49a9-a545-043e1ed5734d", "comment": "Malware payload (RustyStealer)", "value": "96129559a851d70e4501038c4f16b44dd275ca74091d4cf516132b22d7b39827a882bfdfafeddff6d0e3b95e2ffeaa70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038701, "uuid": "a53af23a-b121-4b0b-8993-d48ef1faa31d", "value": "T16F645A12FA4624F9E05BC474879245267A727CCA0B31BBEF179921793E77BF06E38244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038701, "uuid": "0d9994f7-8193-42a3-844a-10c546336766", "value": "7cd0bbb42d4b316f99f5cabd76b4bcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038701, "uuid": "1f6b67dc-1563-4d08-95e4-138459f7d4cf", "value": "6144:UozwV64DhKsBDXpVNwactIfA1uGf+rgn:9w/D9rJwIAMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038701, "uuid": "e6589a42-5a0c-48c1-9881-52a76baa421e", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038701, "uuid": "7d27dc5d-60b8-4a7a-8730-a3068d07a2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038701, "uuid": "995fd9ff-4d4b-4d5b-8825-269f0fdb34ec", "value": "43bd8e05bca198bc13c81998383c9e4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1fcb93-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693038677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038677, "uuid": "4720434d-2be5-4fd4-a8db-37659ce39184", "comment": "Malware payload (Fabookie)", "value": "99d945e592dab344b6fb09f5f4504021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038677, "uuid": "16c2149a-273d-4446-9f82-f71410dfa27b", "comment": "Malware payload (Fabookie)", "value": "ab42e26fb1fc29280a6b4315686409d50f0fadbac6bef2c7245afdb4aaa66fc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038677, "uuid": "9b718075-a500-453a-8064-8d940be18d1a", "comment": "Malware payload (Fabookie)", "value": "45d4d1eae3d5fda73fc6c4340e8be2e16f94d687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038677, "uuid": "d55e8e34-ea02-4c22-9531-1e2c42c25f8f", "comment": "Malware payload (Fabookie)", "value": "b1bf63ca2f57a5de8090dc30088120b46973b91e4c0f4dad4cf717e3ca3073fa4e9904551e24e1f027ede774c9bb21cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038677, "uuid": "d3fc6c10-1ee8-40fd-b030-ffdfbe09cb44", "value": "T1E3544912AB25DFB8F0C7C8B6BD70410218E8B4097758B57E96CDCC751A3BC51ADB1AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038677, "uuid": "33833364-280d-46ab-8c67-932b13c7ca38", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038677, "uuid": "d2cf3798-c262-45d2-b1fe-6e9ebe1ad2bf", "value": "6144:kXMoxMujmCE2kWCZ3j9Z0CIOiNOpxyN90vE:MMoxM6EVBkCIh+y90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038677, "uuid": "16e6b2e0-8b54-48b3-985b-425eb88262c8", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038677, "uuid": "6963998c-a365-4fff-ab69-74476f2a84e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038677, "uuid": "173b3db1-bf8a-4265-9330-e68ea27a2b99", "value": "99d945e592dab344b6fb09f5f4504021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2208e6e3-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046067, "uuid": "bfed26e5-9f73-4b2a-8463-e0817151aabf", "comment": "Malware payload", "value": "260ef00f8674c26caada85c301599711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046067, "uuid": "06dc09a4-90f7-4ca9-94a2-bd8d9ed7909b", "comment": "Malware payload", "value": "ab783cb270b77b55fc9669ff96fd938382fb4c6b1313f59a053deeb1b31aae28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046067, "uuid": "82547cd8-f1bc-4ff3-9118-e4301020c61c", "comment": "Malware payload", "value": "1065adb0ecba869928f08325f55d098702e8c0fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046067, "uuid": "3a79f7b2-087a-464e-b1ee-c03f84fcacb3", "comment": "Malware payload", "value": "6dcda168c18225b9e7a14c9c85e62a2a449ec7aaa74d269e57f02a56fb553dc22b33ad3f1ba8341f80f56f4e783c5b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046067, "uuid": "2f6a4d93-dc0c-454e-bab0-02494734ebb0", "value": "T10EE40661F741A236E2E113749B698EA2F82B7D31C719C1D7A3983C653A300E33AF5756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046067, "uuid": "fdcac995-4828-4dcc-b574-70e8bea5a7d6", "value": "35713985b1fcf7dbb7157c36708c5f11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046067, "uuid": "8765f124-1914-4fa3-bc53-9b4f7812c2a2", "value": "12288:/0PVus9iZdmAGzFUXuBVWhHK0dEz99Wl2ndLfS4MR94Eu5CZUiQdwBi77+4u4nqC:oVucojXuW9v0CZUTLa4rnqIiFopoYdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046067, "uuid": "5135a181-61d1-43e4-83b2-9c9a7d3f584f", "value": 721824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046067, "uuid": "fc8e5ea9-7c5a-401c-aeb0-ba865aac5558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046067, "uuid": "271c8056-3229-4579-aea0-60cf72014c91", "value": "SecuriteInfo.com.Program.Kuaizip.1.8919.24760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a653b7-4404-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693049486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049486, "uuid": "dbc320e3-5662-479e-aac5-44966c7d9c74", "comment": "Malware payload (AgentTesla)", "value": "d71827cf1ad8e2e2259072ccebe8d3ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049486, "uuid": "6fd43e15-8b43-446e-afee-02eb9a399758", "comment": "Malware payload (AgentTesla)", "value": "ac3cd179681e4adb9275878fc688bd47554c835526a1560dd642371b12ed2ff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049486, "uuid": "db83949c-635d-466d-b5b9-62e85cadc297", "comment": "Malware payload (AgentTesla)", "value": "257dad72d87a143db3527ef36a99d4789d3aa22a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049486, "uuid": "cb4fa800-b6a6-4774-880d-1e1e42d2dba8", "comment": "Malware payload (AgentTesla)", "value": "3cc6b8d842ee07659fb7a4f936418afaeb20606aad7421f894696d2c6b2e575c2c49f79da6147cc44caeaf7deb42928c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049486, "uuid": "a591e119-3ea8-418e-8fc6-228c1e062072", "value": "T17515D03131F94527D07986FA042122419BB1A66B727EE6D4BCCEA1EB4FE5F400A63F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049486, "uuid": "d6f74b88-59cb-41d0-a4b9-fadfa29b80d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049486, "uuid": "6f1f342f-0e67-4919-90a0-88937ddc3d42", "value": "12288:NJMbUqwi/iWsjdzFq+zlhe6LN1y4YjlbQiCN3r8L3+46:P3qwiiWDclh5BrilbQiCWD+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049486, "uuid": "0cfce326-4858-4836-8ded-d6c45d6698de", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049486, "uuid": "501cf02d-42b3-4e01-90db-51befcc99c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049486, "uuid": "c32e689b-9bbc-459a-8c9a-2500b9566674", "value": "rMensajeSwiftUSD20.897.64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265d9094-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693086877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086877, "uuid": "6f5c8686-8371-4a02-b660-7ea09f2e3100", "comment": "Malware payload (Mirai)", "value": "b87608c0f59f293d244103ca27f5ebde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086877, "uuid": "3a7ec4db-5e00-47ca-a23f-cfaac04f7d55", "comment": "Malware payload (Mirai)", "value": "aeaab1a908f54d21d58f484917880c53b5ba4a5fd32973919c59ef35f1ba8b26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086877, "uuid": "589408e6-8702-4859-b456-2be14e629b2e", "comment": "Malware payload (Mirai)", "value": "d8bb0c6da2da9a7f7ef43b3f7a4c6425049ee53d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086877, "uuid": "de6cedaa-5cb1-45c6-bff4-59889a7afceb", "comment": "Malware payload (Mirai)", "value": "e731426698a1b84b32a27778ec35b1a17f4462f89f5b7e7168a5c92a922415446723d6387f3ddd53ff9896d43037b7ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086877, "uuid": "657d264f-e821-47d0-972b-4f06eee4629a", "value": "T157C32A06B30C0947D2632EF03B3B67E1D3EFEA8121E4F644255FAA899172E325585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086877, "uuid": "9cef02fd-de20-4a87-86b1-a1f72e14c83a", "value": "1536:Eanp0Z31XI4gOI5Upv+q1xpjvTPNqP1qoCgu4/MjwvAcIIHuH6rXHqGMHkaDC9:Z0I5tq1xV7PoSgZ/MxcjaDC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086877, "uuid": "5d1e7e6d-a826-46de-9c3b-3f3424433b14", "value": 125240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086877, "uuid": "2a39f5af-9a0b-418a-a4eb-27896eebbe20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086877, "uuid": "503bbea6-30d5-4d7e-84e4-c33177f38d3b", "value": "b87608c0f59f293d244103ca27f5ebde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b3997b-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081108, "uuid": "21b5645a-7bbc-43c3-96ae-17441b1966ba", "comment": "Malware payload (Mirai)", "value": "fedb6e8adc6f1a1e79ee6c94565e0e21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081108, "uuid": "2b458ffd-5e93-4d45-948c-65e57a6343b2", "comment": "Malware payload (Mirai)", "value": "af036819e5ab0703099912425534f85809d644874e70b89db36ec19510f0f408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081108, "uuid": "505fc97c-f344-441a-94ea-98f8914e04ae", "comment": "Malware payload (Mirai)", "value": "c454c4434e6122566c3848bcb79e610eb923b520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081108, "uuid": "eb31f736-88d8-4a36-b590-9a7eb387d099", "comment": "Malware payload (Mirai)", "value": "d8d8e025efcd64fbc256797822a2d81e3ec17cab2ab6b4a4f7154947e2cb6827456ed2c9157fa39e6eaced5b360baa3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081108, "uuid": "76be6e59-76c1-4c0a-bd70-f33277d7ade4", "value": "T10793A54A2E319FBEF66CC23447B74A35A75923C623F5C685D29CD6001F6038E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081108, "uuid": "4979486a-fc82-488a-af74-2e107913c8bb", "value": "1536:x3iSFLaIB5yUURThEAgHwk1seh8nuYKba:x3nbHgRThEfQkTYKba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081108, "uuid": "17ccdca6-8565-4e69-a4c6-95f7b5c89b2f", "value": 89948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081108, "uuid": "48a276f4-e98e-45cc-a746-3300922b4b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081108, "uuid": "a1f2156b-ccc2-4d65-85ea-886792872349", "value": "fedb6e8adc6f1a1e79ee6c94565e0e21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fb9758-4459-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693086183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086183, "uuid": "025419b3-df19-487c-b02e-14fa09f15ac4", "comment": "Malware payload", "value": "7384eb7cc0c53a5b1f1633270ad40248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086183, "uuid": "393191ae-7bc1-4d1a-ac21-7898bc88a9d8", "comment": "Malware payload", "value": "afa216bf217b0e8a618ca168f67e280fa55a8de00472f7af3c1b05ddba154a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086183, "uuid": "c40458cb-2266-4d74-8a27-c244762b7168", "comment": "Malware payload", "value": "baa4768ca91fa3ca8f26f825de63d657c6a17206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086183, "uuid": "d2ce70a5-010b-43f5-ab5f-8474ff8ffac7", "comment": "Malware payload", "value": "c6da36f9116f2a29f622ad234f9f8fc94391ea5e6de8c307714c78aab02fb28bbf8164b4ba8da516fd88bb3eb1b3a857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086183, "uuid": "f443cfeb-3425-4949-8018-a9c16045c333", "value": "T1BEC50B135A8B0E75DDD23BB4A1CB633AA734ED30CA3A9B7BF608C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086183, "uuid": "3c1c5b8f-4c0b-41d1-863f-f2092620fbc8", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086183, "uuid": "a8002e81-16f8-49be-b235-a0f0457add22", "value": "24576:Ic9ExaRbfXRhzYiY+u7MmfYM3BdoWZ/LZWG5HXX3GKAc3dsLt8zkOjnHl3RuQ55u:IcaufXfxy/LMGlnGKAc3dsZ8IOjnHl36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086183, "uuid": "bccab224-d937-434c-ab88-e998c1a9b58f", "value": 2590932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086183, "uuid": "ac6bfb0f-b4b1-4d25-abfc-0df251f3237a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086183, "uuid": "8ec3a66f-cb29-4ffe-b35c-8f33878da6bb", "value": "259_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc21259-43bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693018146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018146, "uuid": "bfdccfaf-9471-4501-ad7f-793a0d497d01", "comment": "Malware payload (Smoke Loader)", "value": "40ed5277666f0368b19a847d05fdd1f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018146, "uuid": "a296a22a-bfc9-43d5-82ea-3f4b84af50b5", "comment": "Malware payload (Smoke Loader)", "value": "b1e4aecc6fa5f38ad4c3f016ea1d789ba210c5fa63dfb3c0ceb9ebd9bf390e50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018146, "uuid": "669e4691-2f5c-45ba-ae07-72f5df223306", "comment": "Malware payload (Smoke Loader)", "value": "e930bda16e57783c03a7a21df886a152e285466c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693018146, "uuid": "96b6f085-aeef-41f4-b859-0837e2ee83fc", "comment": "Malware payload (Smoke Loader)", "value": "13222edb02b65b1933ab65cf6de05816371350ff8cc14fcdc10edbd10b40fe910a8d497b8715fe94d10953d30e241e4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018146, "uuid": "9b9cdb2f-9575-40b0-b9e7-7e538b8046a3", "value": "T1F944BE1275F2D472C89741309824C6F86A7EB8328B598987335B3FEB3DF1391A6663D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018146, "uuid": "64fb2e68-7143-4c7a-b4c7-416a9632e94f", "value": "478e1adb03a4046019e6832a1ee52bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018146, "uuid": "d6f63016-b683-41bb-804e-c0ce1bc1c1eb", "value": "6144:kBlzTZLdSNOxSURqXZTHsZnxk+Ebz7tmZ4T9R:kBlzTZRSgxSdpTMdy+EjF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693018146, "uuid": "1e0de047-4c83-44da-8e63-cae36aa33806", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693018146, "uuid": "fcafc54a-cfb5-4395-b0b1-6e48429aad69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693018146, "uuid": "76e96dbb-ddfa-4246-af9a-bad8a14b59ea", "value": "40ed5277666f0368b19a847d05fdd1f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0d0bb9-4432-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069629, "uuid": "12ec1797-6fc6-4a65-a675-fb2724c680b4", "comment": "Malware payload (Mirai)", "value": "c61e55acbd1228e74b10e23765c2fac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069629, "uuid": "e27e36c9-ddf5-4b18-9fcd-90248cdcd3c3", "comment": "Malware payload (Mirai)", "value": "b26e8d221ee2d81744edb82720e2d96aa4eb2eee865c4b253e859fa8aedf57f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069629, "uuid": "535d044b-0dee-4dc6-aa8c-bc6eaf470d67", "comment": "Malware payload (Mirai)", "value": "c16d15a023ef51e1007ead2e19fa43548dafb7b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069629, "uuid": "05fe5cf6-2ff7-4a78-a6a6-12f8f2a60b74", "comment": "Malware payload (Mirai)", "value": "dfcfb99306736346fd4fdf7f7ee1f8c4c8f9da866b25915ac9097c11a39391f076a848edde1688b22e979e899151d1f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069629, "uuid": "8630f96a-324f-48dc-bfaa-58fdd5afe6a6", "value": "T17CC2D044F041CE41DEFA69F43D54DADAFBA06F1EBA568E9066A063826B5C3A34305DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069629, "uuid": "b9b12165-ba84-4dad-866e-4c3debb1e65b", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7Pm4uVcqgw09O:tam+AnKehPRa9ae4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069629, "uuid": "8d77b71c-ecd4-41e5-86dc-c1342b703b9a", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069629, "uuid": "2be631b5-ffcf-4669-a69a-9c0dce5aabe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069629, "uuid": "65f0683c-496a-49a0-be82-71b79e23c4b7", "value": "c61e55acbd1228e74b10e23765c2fac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a9ce16-4403-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1693049352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049352, "uuid": "24ee73d3-cd1e-46a6-9dd5-a393dbda6e2d", "comment": "Malware payload (RemoteManipulator)", "value": "5c741260de0def82970d80d62dfb9aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049352, "uuid": "94103b26-5a24-4a50-8793-9d6ca890556f", "comment": "Malware payload (RemoteManipulator)", "value": "b30969a56c7b749f40af7ddbcdefa92721bd0bfa5973ebf112f42c75b11bfb93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049352, "uuid": "60e8ab53-1aed-4ecb-a359-77e90e8cebbb", "comment": "Malware payload (RemoteManipulator)", "value": "6ba16f0ce72bab23600a4be9e9646df7c6bc8b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049352, "uuid": "7ab31199-cec0-4759-8906-59c1ce6d8e68", "comment": "Malware payload (RemoteManipulator)", "value": "ec05fd4f561d366697b3c9d7c2bd341e2925da716fcc4d61f1f84678053ecd05adc323bba3f69f4c9fe1add82486862b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049352, "uuid": "842a1124-dbcf-454d-bf92-2fb30ad9ab7d", "value": "T176763356D5C120D0E1660B7828F4A5423BB4F8A87F3A47B713744DBAEF309E15ABB642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049352, "uuid": "cec8fc27-91bd-4e25-8722-d93bdd4d93fc", "value": "b83464d8132ecd9f810820e192566e15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049352, "uuid": "7704b7ba-e47d-4767-b841-f6c107e5d5b6", "value": "196608:aQd3w3j1CopjwS48IVxwUE/iqoG0wLUOHYG1:vw1CCG8ACQGrz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049352, "uuid": "5ad2029a-4276-401f-8d60-562fcfba2d32", "value": 7373024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049352, "uuid": "ec614703-6442-4c2c-a27b-433955c8c53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049352, "uuid": "f3d7d9ef-6266-47e3-bbff-e611d6efe15a", "value": "BUILD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4384df5-445c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693087571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087571, "uuid": "9864139e-eedc-405a-8c56-8d59333de53d", "comment": "Malware payload", "value": "f6a1e9c8d6de22178fecb003dc2c9a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087571, "uuid": "51a5ad0e-c10f-477c-bc78-df88cd350d37", "comment": "Malware payload", "value": "b3875c0f1508da3ad52096ad6753328dd273649d0816b7f084e72a20520f07c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087571, "uuid": "31c7b423-97f5-4c31-ab26-986d745e8a04", "comment": "Malware payload", "value": "7dbf49af9a55b9dd43e8d9c8b7be0baa218fc91c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693087571, "uuid": "1c6c604d-4d86-4ab2-aea7-ade9f6556e8f", "comment": "Malware payload", "value": "bf3606319315c065d30a3678840fbee7f2643b57f292f53dd86a9c75dd9dc081b1e541ccca82c33a5278e3991ba23842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087571, "uuid": "bb9b8e32-9455-4166-aca0-ad460e710896", "value": "T1E795B49D766072EFC867D4729EA82CA8FA5174BB831F5203902715ADEE4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087571, "uuid": "25095883-734b-48b0-84a9-da9ff963ba42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087571, "uuid": "93ced47a-ef18-422a-85a5-09142fd2e947", "value": "24576:n+8Yg/bgH8knDCdlYefP/PyJme4AmpeoLPcHANyLjaNiIPUfGOWMLvBCOA2:+4/b8GdeQ/PR7bIANCjaYIsGOTLZCOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693087571, "uuid": "5963bff0-64cc-435d-901d-8cbbdc0faf9b", "value": 1978368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693087571, "uuid": "b8bcbf95-a2e1-423d-ae3b-4ce2ad577ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693087571, "uuid": "3e54cbd1-4f71-402e-a59f-aec5c7ae4c8e", "value": "VLTKTanthuTN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2423bc9-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083300, "uuid": "7ae3e377-efb2-4f01-b9ba-2103380026e0", "comment": "Malware payload", "value": "b42de6d0f1051aac0a7cc0b246ccc5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083300, "uuid": "cbe661c2-d627-4e83-be39-d507cdb701b9", "comment": "Malware payload", "value": "b3b873cb92b3855d1a72f9543c3237897f2c75f6482e839854b8710ab06b36e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083300, "uuid": "a42d93b6-9013-49a9-9706-9c955e1b8050", "comment": "Malware payload", "value": "be8a4d562794d3b57a2d47a6cb3a655ec998fffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083300, "uuid": "4cc5b95f-d461-477e-80c5-7ce331ac2da0", "comment": "Malware payload", "value": "369dcf12648de37fa75a11e766a6035866b68631318498e71659302133747e3f4fbe817ea966fd79c3655f168c6ef516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083300, "uuid": "4a0d662a-1e81-436d-a9ff-046328063a34", "value": "T10FC6F122BA518532E4930131C23FBFF631BC6F24072B94E763D16EA83D715E2653666B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083300, "uuid": "b518cb6f-560a-4a0b-8d61-2027aad5b0a2", "value": "675038e986e753174d0c2df86e506cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083300, "uuid": "c2be9673-c8ed-491f-9e37-782f268dfd14", "value": "196608:Z215dW6RqolH3H5KYuGkGGAaYhv4ehJTbiQw0OTZ3H1H:ZUUaruN3Xq4ehJc0ONV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083300, "uuid": "8e757254-d312-4926-a1f1-b65416ce6242", "value": 12204032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083300, "uuid": "ddcc3a36-4406-4f0b-b533-04ebb3bcff49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083300, "uuid": "7e47c6a0-50d5-44d9-bdaa-60acc814d402", "value": "BenzMonster.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f33597e-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693086918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086918, "uuid": "a6d494ee-1f2f-4901-b283-7857fcdf63bd", "comment": "Malware payload", "value": "aa36c446e2ba06202d5384bb8ad6137f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086918, "uuid": "49c8224a-2374-41ee-8720-825d15d76c9b", "comment": "Malware payload", "value": "b3eb88e68a28925ff35d869aa4c236264d1be6a8a2b40b0d0ec51d2517ab0408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086918, "uuid": "cce297b6-ec0d-460d-9b45-3e33b6f424fa", "comment": "Malware payload", "value": "3be8f31855bde46aaab47186ed9ab474e5a515e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086918, "uuid": "dfb308eb-cbaf-4c61-b967-40211f489dd5", "comment": "Malware payload", "value": "acd80c770fc3c4ba2e76ff6a3e527b5deb108426ea70a3a998e99fdf2a8fc1be9a23aba8e8b233d6cb4de3b2d1a088c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086918, "uuid": "6aa45768-9ec9-470b-9347-0c52e89ef9f4", "value": "T112A523623AD2D071E523683187ED9774E578F52203B68457FB880FBCBB69992F223711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086918, "uuid": "68c4c730-9285-417e-92bd-0efd081a7d03", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086918, "uuid": "1e81317e-ca02-4520-9651-0b59e36c382d", "value": "49152:JrA7v2LPKPjt98HhNIPPue2+0UK0JoAWv/uZurFLY4GDYv9:Jr+APKPz8BuHuGzK1/uobIY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086918, "uuid": "9d381e7b-69f8-433e-b082-03f47954eea7", "value": 2215252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086918, "uuid": "f975b011-8236-44c4-a0e4-fcb4691bc779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086918, "uuid": "48b9d7a7-832c-427c-bd66-4e85eb26b155", "value": "jewel.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92783cf-444a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693079929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079929, "uuid": "c9e7d302-6088-40f4-b2ba-c3819750b5ba", "comment": "Malware payload (Mirai)", "value": "87a38014ac2a66ec776cd8515cf475a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079929, "uuid": "44cb1659-6f15-4095-bf50-1ac872c5b28f", "comment": "Malware payload (Mirai)", "value": "b412e6342b787818f4e4c098cb4362f7319c8509a61527a34f475c03b1192f2d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079929, "uuid": "0de22601-b0a0-45d4-a7a2-51dddd7a1549", "comment": "Malware payload (Mirai)", "value": "9ffb9d60931c2fef28a557dfd288043fcc2fa8ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079929, "uuid": "c22579fa-659b-43da-9eb1-1f7ede34b188", "comment": "Malware payload (Mirai)", "value": "679b6ee100f5cd96b58e93b4587b8abcc7953ac60d7922e890cb0aecacef5ae800bd40e3f52fdb39d51728b236b7b060", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079929, "uuid": "07e10b68-a099-4ec8-838c-cc76c7e456f7", "value": "T13AD2D0B91A0B4B8BDD6BC8FAC3E013A019650E126903FD47B0ACD3479B575D4E047ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079929, "uuid": "21a70c94-2e3a-4fcd-9475-69fa889de42f", "value": "768:/xMWBhAHuLegF1aF4NscfOl8liVA1IFJgGlzDpbuR1Jz:/xdBGuLea19acfjliq1I/VJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079929, "uuid": "892cea4e-cb0e-45a3-8a96-58186822aab7", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079929, "uuid": "2d257b9d-aab9-42b5-b463-46547c317cc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079929, "uuid": "eab61ca2-d0a1-4d04-a380-e895db1d2f54", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14224884-4408-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693051198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051198, "uuid": "57aca194-64fa-4234-830f-e01afc3b0cda", "comment": "Malware payload (GuLoader)", "value": "237ae9c41e2c59267fd4292a92d253fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051198, "uuid": "9b493a2a-04a6-4884-82c5-7cdf5e26e51b", "comment": "Malware payload (GuLoader)", "value": "b4d2e40296ddd8f6127f9d2ba3703b134fee350602ee9c90f6d73737a2186a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051198, "uuid": "0a9f5689-3e0b-4ee6-8f48-6910dfcba46b", "comment": "Malware payload (GuLoader)", "value": "e5f07157885a949ee3079ff373c5c194fef68b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051198, "uuid": "8f99a856-3ba4-40ca-8c4d-fee6c3a8ff2a", "comment": "Malware payload (GuLoader)", "value": "86808071400ad3b547d7c383c97681df9e1337434866683005df3f72dc9ade6dc15e0979a19745a171180ca681702d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051198, "uuid": "2aded09c-af7d-4dde-92c4-fa2c6ee681f2", "value": "T193C423517380E92FC9254376C26659F1EBB55E02D2229D470713BE887EF71A28E3F293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051198, "uuid": "1e35923d-91da-4e2b-8f0a-98aa7023cf18", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051198, "uuid": "a13400ea-d1ea-4897-8675-d5e10e0fbcea", "value": "12288:f+u5SE/1IOWcV5SwtLp8d1uLIWFmvySIeWp+PuXE9MI7SuE4jXn:xcEdzhSwtLpU1iIySc09MDL4jXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693051198, "uuid": "4c923265-7cf6-4c4f-9c82-9aa87863f74f", "value": 575847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693051198, "uuid": "c26cfe87-7269-4cea-9485-7004543eea04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051198, "uuid": "b818d78f-47e9-4ffc-940f-307a9980998e", "value": "rOrder_1520570_xlxs_z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948e5b46-4425-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693063869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063869, "uuid": "2f3a3be3-9952-4449-a485-75543cd93b0e", "comment": "Malware payload (Amadey)", "value": "d7e8675e5cd989a90c4278b0a6a1faae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063869, "uuid": "3ffa7477-0da7-492e-b450-c0c82204ace6", "comment": "Malware payload (Amadey)", "value": "b70a5acd230b0b281e7e375b1d2fd79a1fbbc00c9dd0efe79d3e7d40258e7a84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063869, "uuid": "979a846c-c7fc-4cf9-874b-379b7388c78d", "comment": "Malware payload (Amadey)", "value": "01081dc01860e42f791f8a5c1973db90dc887aa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693063869, "uuid": "6ec36caa-1b15-469e-82f9-b0a87f301a11", "comment": "Malware payload (Amadey)", "value": "f41646cce7cff78c71928c4aa70c3eaf6fcfd1464973f776f61929dcd951bd68d9f4b538e75a4be95fdf7f0f9eb5537c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063869, "uuid": "0dbf785a-98cd-4c9b-9c96-49609478fd01", "value": "T109E4130767DCD072D6B427301DFA07C31A35BCA26A78975A2392AC4F0D72AA5E53172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063869, "uuid": "8c635f9d-5cc4-40e1-9deb-a58ab76847ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063869, "uuid": "7fc471f5-3f94-4a05-a77c-196b128ee3c5", "value": "12288:+MrQy90VOnomoFeQX5CMt87sfU6yuEJZmSL6jvw:Gyd2wMKIfYuEJGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693063869, "uuid": "8aea5429-790b-4911-ba6e-a1dfbf2c39fb", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693063869, "uuid": "a91e6405-3ee1-41b2-999a-7893e3b628f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693063869, "uuid": "f2c547ed-b888-49a4-b142-6abbddefe301", "value": "d7e8675e5cd989a90c4278b0a6a1faae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2db6c6e-441e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693060913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060913, "uuid": "5b2d50a9-36c5-49ee-94a2-996b7035e7a5", "comment": "Malware payload (Mirai)", "value": "2d61a4fccf6ba101976e8ca5a06e28ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060913, "uuid": "2b6def86-c5cc-4bfa-9fff-189da9a9512b", "comment": "Malware payload (Mirai)", "value": "b7db7da5b2176397f9fee3c9f056a07f219de24d977b4e3637b676a69ffd4204", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060913, "uuid": "939015ca-4484-4d37-b378-599b8978d3ee", "comment": "Malware payload (Mirai)", "value": "1d6054b7684b98548bcded885004e94c5838ba80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060913, "uuid": "c87daa29-1137-4e3c-8825-9f4e081408e3", "comment": "Malware payload (Mirai)", "value": "fe4786ed5360e030f6384f38924942fd87a9b17b1c3049cd4ffafbecac5366e67f796f4a072c2c886c9b6a3197b934f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060913, "uuid": "a4c4dcae-6048-4fbe-9a1b-9d9a6074df32", "value": "T138D2F1B5EEBB474EE8CA673C5E9ECC89256CBC301EB9864606410E6731395E1E3D8CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060913, "uuid": "ad78497e-f1e7-4292-a574-4ab04b28241b", "value": "768:+N8fWlfoQmQAXV7EmQciiRcLprDKb9J5pq5:uMNXFl7zN4Pcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693060913, "uuid": "cc78b4d3-546e-4387-b38a-1272a45ebcd9", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693060913, "uuid": "eeafbe21-87ef-4161-bbb2-36bc4315774d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060913, "uuid": "3f2bccb3-4480-4503-9070-2b6792767d73", "value": "2d61a4fccf6ba101976e8ca5a06e28ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd88b95-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081116, "uuid": "29d8e6dd-60a5-4064-ade4-5069027dc250", "comment": "Malware payload (Mirai)", "value": "3f9139f98b7534296847a227b7df5e0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081116, "uuid": "823fe814-0b9a-446b-b253-68300738077f", "comment": "Malware payload (Mirai)", "value": "b8142aeea761dabf3f32d757561c0a0d674e8e3b7b72bcdd7e3d5102a02a6547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081116, "uuid": "37bbf452-542f-490a-85b1-d146c4c5c496", "comment": "Malware payload (Mirai)", "value": "2f8616c79d4187bf7f34c57c53f19461bc2c62a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081116, "uuid": "7edbcb40-7880-460b-adad-05b627d3f91e", "comment": "Malware payload (Mirai)", "value": "2b9a688237534bfcd40b99d757e403f2b341fb5da7c08702c007c521adcdce945ec704300fdaa641af9dd88e62a4c8f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081116, "uuid": "4b450e7c-88d6-41ac-9f06-cd57324546b9", "value": "T114B2C0CD61543088C98D7C7C278D4A565FACA180BAED9F26E350CD98B3BEA8F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081116, "uuid": "165bd158-ac91-486c-ba2d-94a097eb3807", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpWZqSWvQ:4QlS07FUXqIYSXQKqu6q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081116, "uuid": "c73ccbf3-635e-489d-82a8-484c8af1ee94", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081116, "uuid": "15071f31-18f5-46be-b007-42779e55f027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081116, "uuid": "f1598962-cfbf-4b42-b1dc-feb8a6181bd6", "value": "3f9139f98b7534296847a227b7df5e0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183f9ec0-4451-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693082558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693082558, "uuid": "6802468e-e7f2-4d9b-aed3-f970f328d22e", "comment": "Malware payload", "value": "57b26b6613c95039e7a19bcd3e7d3ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693082558, "uuid": "1393674e-0715-4263-86dd-78651951895b", "comment": "Malware payload", "value": "b9e30fe4109eb580d7ee90c45e093fb58358bf57403f7abafb31188210e3e502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693082558, "uuid": "e124517d-f84f-4cdd-878c-705d30aa52b4", "comment": "Malware payload", "value": "efbb3308d22ede9570bb45d6e3d1c904f4f49ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693082558, "uuid": "386fb621-1ac1-4da9-9e92-12ca95ab831f", "comment": "Malware payload", "value": "ea79d69b333fd3a26ab6fed1390bfefbda2f5ae66087767830cfd272c5fca68c35ec1b5eabae244d5ee3d6714cd823df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693082558, "uuid": "db75733d-8c12-4b0c-8cf9-f94190697c24", "value": "T1D9D523523BC5C8B1D472283099E5AA263B3D7D3067768ED767681B6E9F301C07A32367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693082558, "uuid": "4a037693-d698-4faa-9e61-5217b60178f6", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693082558, "uuid": "b5a1ba16-40f0-41cb-be6e-8244627adf54", "value": "49152:acbz6nBGx0OdomSyHdkxkXpjd9rfS81AyFTREuX86GfZXzAVE+:acbYBGxbdo6uG1S81dFTRBshZ0E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693082558, "uuid": "92664eaa-f1bd-43c9-b3ef-0fa1e9ed6a6b", "value": 2843872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693082558, "uuid": "f0a8d10c-336b-456b-921f-e71b9fbb4b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693082558, "uuid": "e1919d7c-1740-4771-aab6-b04064f04592", "value": "SecuriteInfo.com.Trojan.Uztuby.4.20089.11893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adb2a5b-442f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693068013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068013, "uuid": "1b2d0b8e-c723-4299-babd-d7f1e4ca7d31", "comment": "Malware payload (AgentTesla)", "value": "6b759dd3b56e37b453b00229107b3105", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068013, "uuid": "706da84d-70d3-4cd3-be42-2621f61496e1", "comment": "Malware payload (AgentTesla)", "value": "baa4551135a4dbbc278c41a556c90b8a67408ae52983ec657aa2f28462e6c44e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068013, "uuid": "98db2b68-d2cc-4d4d-af9e-a95db01ea81b", "comment": "Malware payload (AgentTesla)", "value": "94237954f20056a3b023daa22d17a0201bcc5f66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068013, "uuid": "2520519e-0d2f-45ae-a154-f390d7c9d97f", "comment": "Malware payload (AgentTesla)", "value": "363bbb4103b84944de803888d806febbb695323c460ae743737cf00113511ae96848aee3b6c002c290d214d28b73a99d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068013, "uuid": "bb70b400-5733-4f06-a90e-e1f4d45f081f", "value": "T18BE4230C2698CB31C8E55BB71591669307786CC6F906D3DD9CDE72DB237238AC828B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068013, "uuid": "3dc77de0-d9da-4992-8f06-26a4368bf32e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068013, "uuid": "bda10b90-7d65-4ee9-9ca3-59cda0b76767", "value": "12288:KIqALqaz8Ii0W2V03r76rARgE8GOCIsGjSt+FAD/XXlRVgj22:mqj5i4A+CQJ+Hnii2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068013, "uuid": "c549162f-04cf-41cf-b5d0-edf3dbee8278", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068013, "uuid": "ec08f6e7-d8fd-4f81-93e8-2c2604e30bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068013, "uuid": "af8eb00a-5131-4ca7-b9dc-9a0d3491bfc7", "value": "SecuriteInfo.com.Trojan.PackedNET.2300.25803.16011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec492834-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083343, "uuid": "5b8f2328-39e5-4f9d-b3b6-ae62d8770955", "comment": "Malware payload", "value": "26dbb8cdc46ecf186fe07605207bf622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083343, "uuid": "d373d24d-4f25-42ca-b9fc-84eb8b1c62d2", "comment": "Malware payload", "value": "badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083343, "uuid": "81180ca1-c151-4d98-b92f-129f3864e42a", "comment": "Malware payload", "value": "916e3e9f55205fbd45ec1fbb47db370d4f668d18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083343, "uuid": "06f1e0e7-136d-46d8-9c8f-4ca310079f43", "comment": "Malware payload", "value": "ab83eef08bfe6980ae9aefd385ce2ee37a62ae4dbe501616d9d48b24348055a36c5d31188e6d837e92f2776bea315ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083343, "uuid": "4b58e007-0164-452a-84b3-3627fa65a007", "value": "T1FEA6ADDBE9D4660AFE19C5FB5120FC2FEF1FB0390E31B68BA955A2F14D028417C19A94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083343, "uuid": "5e58017c-495e-4d40-81d4-f0d2ebe2ac53", "value": "d76b12140ab135b5fb6a84b9adf96260", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083343, "uuid": "7cc56e60-5d86-448b-b71b-2671e428cd5b", "value": "98304:zvw0Hotqx1pWuJ56DdIPqDyj/pCu03o8I6v+5/QGJbY9YAq+6FLiX:zY0Hotqx1EA56hLnr48IH/HK186", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083343, "uuid": "ee65c9f0-d9e1-4d54-83e3-df30a92e6d57", "value": 10174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083343, "uuid": "5ef7aa09-4dd0-46a6-b675-af983ff08865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083343, "uuid": "028daaa4-44c0-4ad8-8e87-480367277912", "value": "Clip1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaed9ef-4457-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085441, "uuid": "b5732f1a-8b12-4c72-a524-e8b8be8870ec", "comment": "Malware payload", "value": "43a2c7ba0ecd3a1b8ff0b82a0e82296d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085441, "uuid": "a96c0ea3-8b9d-4ac9-a3cf-8cd667d3838b", "comment": "Malware payload", "value": "bb623a98f1d61f13d2de4dee55b14f97956e8306aa66d945aab0b00538b95900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085441, "uuid": "a76e4cb4-4541-4a9a-aad1-1abfb37230b6", "comment": "Malware payload", "value": "9b106aa440085d1cf76889a186a4c0ece9f86b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085441, "uuid": "f34d0346-fa7f-4d2e-ad0e-ed1fa34f531c", "comment": "Malware payload", "value": "85b1c263669c77060e96207f2679682eeb5956431481aca6b3dc93a914c868cf595d0ddeb2b01e9cab3de8a3d666bcaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085441, "uuid": "afdbcdbd-8c61-45e0-b20b-26d4cb443ae2", "value": "T1BB26122223DDC271CB769173BF69B7007EBF78654630B85B2F880D7CA950261166DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085441, "uuid": "4929e2ff-6386-438c-b750-3162512c4347", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085441, "uuid": "69e75d99-6b27-42fe-8be9-3c34f5c6b6a1", "value": "98304:w8sjkaDkbFqE0DtuJFsEG/SxFEQGr7wgiMgaUP/XEXw5d1OFQ:yj3aqE0tubjTPgiFaUHEXgaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085441, "uuid": "1afe6204-e8d9-46b5-81c5-abcf16db1d07", "value": 4503552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085441, "uuid": "b8b545a1-a9c6-461b-8bad-14e43c36265f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085441, "uuid": "3499a645-1aa2-4320-9636-13c5930097cc", "value": "ransom_builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65231d4e-441e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693060783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060783, "uuid": "447de2c7-22af-4951-ae63-5792e9c6c292", "comment": "Malware payload (Loki)", "value": "09eee0754611a57302ad3b5f658871bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060783, "uuid": "d08b6b33-f82a-4bf6-ae9a-4c7b83e8abbe", "comment": "Malware payload (Loki)", "value": "bc7a49d6535396411ecac97005697ca903b2e866f8049e9ebe0fcf3627797ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060783, "uuid": "e18efc31-4056-4f9b-8dd2-e6f8ed2032a6", "comment": "Malware payload (Loki)", "value": "7a8406a4cf623cecf5cab7f59d85653070a60e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060783, "uuid": "be525da2-6bde-4e77-affe-05c6491ca58e", "comment": "Malware payload (Loki)", "value": "14421d08d44748c6287f47df5bbda6e55c04730608cff0ac23fe84749583ffc599497bfc0b511e609d4c2463fe7dbe3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060783, "uuid": "13b77ad2-0be3-40dd-83b6-25143d50b003", "value": "T10C044B5437D8CFA7DA8D1BB4E4822190D7B5C0B7262BDB5E1DC490F8A857348CA09BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060783, "uuid": "72ee647e-9096-4f0d-89aa-b657fd178ffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060783, "uuid": "709c205a-1405-4a26-8b8a-fed4f9c22d7c", "value": "3072:j1G94J/8O/DmV+8JhKXqWSIG219MAT1ZcdvzXUK3s8oF8Nbe:jA2D98Kv9MscFzXUK3s8G8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693060783, "uuid": "73569176-d65a-4369-8430-5540245a1690", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693060783, "uuid": "3040443c-1355-4898-8f9b-663cb0872f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060783, "uuid": "527e4be4-9849-41af-a35e-c1090d9f497c", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.734.6272.31175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06557c4-43b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693014604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014604, "uuid": "5c6b1ca1-0723-4e45-ace2-2bdab25f7060", "comment": "Malware payload (Mirai)", "value": "fcdb2d36647b1e6a21da8593883e6854", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014604, "uuid": "b8f5407c-f2a0-4e3f-848e-725fc63a4d2f", "comment": "Malware payload (Mirai)", "value": "bd4723dead226ccb1ade728fbd6ae2c8569f9b27167822e19a2840cf3b399d58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014604, "uuid": "520ee713-e20c-4494-a633-55b110d4dfc0", "comment": "Malware payload (Mirai)", "value": "79e5c1936f0d2449f38dd5f490fb61a9bbca8c33", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014604, "uuid": "90334a0c-19e8-40a7-814b-9161f978634a", "comment": "Malware payload (Mirai)", "value": "49112a1e11969a1b13c75505ebc9f80454ef415480ebdb63fe286041092465cb1eb4e076565561339da495afca9a3af2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014604, "uuid": "ea776707-976a-45bc-b74c-1c8cfac8d217", "value": "T12933F2A2676E2AE151B09777FC33EC5666DC07F8586730952CF0661673C58028EF36C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014604, "uuid": "8b18d8ed-a311-46ea-954e-366d6f333628", "value": "1536:69O/ZMAXIxNUk00qVeLcPqF1aBexo4opKZbX:69O/ZNKyAaeLGqFUFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693014604, "uuid": "ba3c5786-0cbc-4d81-a5de-4bd9cec3401b", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693014604, "uuid": "4d58e57f-2016-4dda-af57-e23937d23d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014604, "uuid": "a55966f8-f4f8-4d0d-8271-c07fb5e2e63a", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc370cf7-441a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1693059318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059318, "uuid": "858235e9-2a46-41f4-95a6-23da687d13d5", "comment": "Malware payload (TeamBot)", "value": "c29e4438712a9ed8a481c23f232ed171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059318, "uuid": "dd0a7450-3089-44a0-a559-ce703d7ca4df", "comment": "Malware payload (TeamBot)", "value": "bfbb4c61fd0d5b3b3de29f14929d7bacfd85a41450671acca10e8b5d69366cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059318, "uuid": "0845c533-a43f-4c8e-98db-8788dfa37a4d", "comment": "Malware payload (TeamBot)", "value": "93343d431386b0f7288e292da83362cf3b21fe63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693059318, "uuid": "ffcfea97-20be-4ad0-9d3b-91cbc941f8a3", "comment": "Malware payload (TeamBot)", "value": "4be82ea4f81ad273ffba6c6e2bf60d20778c9f35a18f76850fe2f44c93066e7c83f32ea8ebc2b0a6f30ca594835418d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059318, "uuid": "83c5212b-685b-4369-ac8c-5886a08f5cce", "value": "T1C054C021369ED8F2C49740348830D6F4697FB8B29AA5B94737983F6F3D71392A762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059318, "uuid": "41c4ed51-6742-443a-a7a0-fd5e077d1d25", "value": "c3cfc3ae364145c34d2985bd43d1d7c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059318, "uuid": "1036d6db-6e54-4330-9237-500ffd11c560", "value": "3072:WW/X/c3ubEx1KLo2eD+nU9rb4lDdaoko9CsLCYjDBX15iT/dx:z/uuE1KLo2nU9rUlDFkujZL5iTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693059318, "uuid": "09e1251d-ad32-4985-98dc-cddc7900045d", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693059318, "uuid": "baf02236-a9e2-4ee2-99bc-905335b5bf39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693059318, "uuid": "2a9b5df8-211f-4e91-bc04-f907cea6d731", "value": "c29e4438712a9ed8a481c23f232ed171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ab7666-4457-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085209, "uuid": "70a97fbc-6035-428f-8121-73f1707ab62b", "comment": "Malware payload", "value": "0f6c060088d4d16cebbbb9bf2868159b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085209, "uuid": "a2e06e9c-a74a-4df7-b978-f87751c33cdc", "comment": "Malware payload", "value": "c008d44fd597313fc86161b5b0448def20582cdb095e17dda6cfcb97228352cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085209, "uuid": "cb13f15b-b8b9-4aa5-82d8-16d4e2542392", "comment": "Malware payload", "value": "354f4f7788df17da33f0cd91a6315a9e3b492fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085209, "uuid": "9105e04d-7c81-4a78-b925-9a0976457b29", "comment": "Malware payload", "value": "fbb8a9833db47e3623294f69a7dceb3c530d6026ee3fdc6424f95ce7808a16a752025e937e2b8b57efbe2f89413cb93f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085209, "uuid": "c2de21c5-25b7-4904-ac09-61e849f024bd", "value": "T1213633BE778CC8CDEAD618F37F5E999E5124A0371D1EE8CCC8625024D3ACB6552DE812", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085209, "uuid": "d1287717-65d8-4a97-971a-f69ba9598e4b", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085209, "uuid": "343f8d7c-c5a8-451f-bebb-14bd98fa76d6", "value": "98304:edSIZAqS9BUwvbq9uNDR8ycV5BCLDUhXfXl5rd6+xlnip9hFfIsondg:eWqS9BUCwuczU8t5M+WDh1IsonC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085209, "uuid": "72ef013c-e0c1-4cfa-8e89-59ccb1cc9e46", "value": 5327872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085209, "uuid": "5a5b470b-4905-423c-a47a-06aab29360d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085209, "uuid": "7011830c-4060-4aad-876d-19d995b51cea", "value": "da4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4d0ddf-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046111, "uuid": "922ded63-dba7-46d0-9fad-65162ae2cc51", "comment": "Malware payload", "value": "bd20aef301f1eb77c52bf61e3c6ead7e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046111, "uuid": "5b10ec96-4360-4aff-af47-056cbd12c4ce", "comment": "Malware payload", "value": "c080edf6331a2b02275359a29f4b63a529f5a83dfaed7b1a8303a450a3cd7268", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046111, "uuid": "15cd01e9-9f0b-40cd-a024-f9d5873686bb", "comment": "Malware payload", "value": "85a5a51e91720890422d1766fe4ce7c75e12906f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046111, "uuid": "cb083c66-6c1d-4a8d-ad36-ff7b8d6c534d", "comment": "Malware payload", "value": "a08545487f902ea384b6ea2af315a3a0d99574576648e57b6b6c552ce86da964e34ea21f90a7e39c5ab429c9fedb7291", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046111, "uuid": "0ffeae23-d5ad-490a-931a-e32eef3b4bfd", "value": "T101357DF276728CB9C19FC2744D22711C77AAA5D2C9F9D30BE21C1A2549B0041EAFD76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046111, "uuid": "2454d7df-7223-4921-89fe-b72247131103", "value": "c8476bfe204eda7ee2b5b597c40ef709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046111, "uuid": "766c0a68-ae85-4c8b-a1ea-76d4eb771de1", "value": "12288:Gc9QLpVntpmBppaP8xM7jdaldGEmz/o5+kW7cWdY73Rk+VJGe5om0z3B6hVjv+t:Gc9kntAXTrkEmzNXcWQRkq5om0LqVjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046111, "uuid": "7a0c2a47-2397-4b81-9e3c-585f9c6b2f75", "value": 1066912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046111, "uuid": "17485da9-4f8e-4a5a-8863-24a2e37c2f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046111, "uuid": "cd34332f-a21a-4e45-a2c1-59e179e925dc", "value": "SecuriteInfo.com.Program.Kuaizip.1.6085.2970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3591362b-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046100, "uuid": "960cc836-ee9a-46c9-9e97-20e2293b788b", "comment": "Malware payload", "value": "a006340f4f7c166ad2d11f98ec56d622", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046100, "uuid": "f3aa22fe-018e-4398-be4d-32aa69b69092", "comment": "Malware payload", "value": "c102356456e183211e555e6fc1bc69dd1343b9cd74a407f2b929592b7d9709ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046100, "uuid": "0345ae60-89b0-4bf3-b59c-02bfa2acf3c2", "comment": "Malware payload", "value": "14c1563c11d0e99c9c4a6dc3f543684c95e72258", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046100, "uuid": "198f5a60-4cc4-4c5c-8627-64daf557031a", "comment": "Malware payload", "value": "9fdd9638331256c95f6766a9f7135ba5df3cd73aa9006e2d58c649e88d8a181c40fb9f1935e5a68760320a9f4ccb9ac9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046100, "uuid": "e9ecbbde-f993-40f1-b47d-7cd964fe37a9", "value": "T1F6349E717842CCB1D8AB53705919E22929FC78A05EF0979FE39C49245F742C0B73AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046100, "uuid": "d0db77f5-19c4-43fb-89b3-5df41158ada5", "value": "331547ca130a1b85cbc0f4dc1871c98c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046100, "uuid": "5361e64d-4b3b-41f3-9d0f-4cd7e93dc9e7", "value": "3072:EUYdEmpWQHiNWAXCJvzjLOC2KGTobKNuZr+92fEdRoZ/Gbz+hHOHCh3kgM/:EUYmmWQNeC9aXK8o2NuZrtZAih3kl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046100, "uuid": "00df4e5a-07cf-473e-8086-770d246f3b90", "value": 237984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046100, "uuid": "40cf3616-fc02-47f7-a5b4-8e6cba325bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046100, "uuid": "9812a42a-0411-4c3d-a206-cfceada25775", "value": "SecuriteInfo.com.Program.Kuaizip.1.25482.32358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d82ecb2-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693086889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086889, "uuid": "5317bef4-d803-4cc3-b5a7-5a11955f7a1d", "comment": "Malware payload (Mirai)", "value": "8d6a7d9fe2560ec1687fc7b03f52458d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086889, "uuid": "d888b91f-eb22-4b2f-b25c-c3b3288b1e72", "comment": "Malware payload (Mirai)", "value": "c26d9e37cf12ae422fbe062d7c95f9906417a023bfb41bc7472fb364fbb90ba5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086889, "uuid": "d45405c6-5f7a-41d5-96ff-b5733c2b4c7b", "comment": "Malware payload (Mirai)", "value": "21afad2bbfd0c8fb331b191e5466563a14a82e42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086889, "uuid": "78f93d74-5424-4405-888b-3a5d72418a2d", "comment": "Malware payload (Mirai)", "value": "ee8612753b0a3d23f63e5901f4a246154a701a4a43990cc5016c08fb9eab6a8f3a0da32afbe269ee7dc8126a9dbfa801", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086889, "uuid": "cb256fa4-1bc1-4357-8894-dd2cb0a609c6", "value": "T190B34A73CC296E58D564D1B0B0B08FB92B53A990818B5FBE15A7C2759083DCDF6893BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086889, "uuid": "1d5b0391-2f98-4462-a214-72d5f1720240", "value": "1536:oCFO2AMJUWxElq3xVxE5DEkC0K4wde6X/8qgUAQWn3h7Ev9UW:oE/e3DEky428qWQW3h7yUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086889, "uuid": "9deffc1d-6faf-42a5-ae7f-f087e91e869f", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086889, "uuid": "f279559e-6f7f-4ea8-a6c7-3fad08bcffb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086889, "uuid": "947e8866-2b7e-456f-9293-8b023fd87a08", "value": "8d6a7d9fe2560ec1687fc7b03f52458d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01def44c-442c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066629, "uuid": "ad8d7831-f020-4786-be4b-990b42b983a0", "comment": "Malware payload (Mirai)", "value": "3352b5ce0e9eeb8fb49649fb70e6b416", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066629, "uuid": "8ef2953e-2861-4009-88cd-401c007b72d3", "comment": "Malware payload (Mirai)", "value": "c384bd7f81a722fb08326d9d1b44b130ce68acc476eca59d1988ba98ea749c6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066629, "uuid": "c5c6e73c-08e2-4d8f-9f23-b4d9b7e6ccfe", "comment": "Malware payload (Mirai)", "value": "60f9190dd92981e65c635345ba560c28e48ca884", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066629, "uuid": "827ce47d-ecc3-4199-85cb-4aeecda8e9a7", "comment": "Malware payload (Mirai)", "value": "049b445f766610460371f15f7d9f795323533fd94bcc53cbcf988891dab4e469f32e55e9874103712e850d04fc7d518d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066629, "uuid": "9ce59464-1759-4540-8fcb-5ee4249413f3", "value": "T12682DF30519B35E5DBE14430EEADCEC6A71A0BFDD0FC36E227586B78894210611F83CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066629, "uuid": "137816b0-6917-43f2-8021-662207ca0fb7", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMagmVahymdGUop5h5lE:6/V0P6+kom0tVAoNvm+to1gGas3UoznC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066629, "uuid": "599b0c54-8977-46f6-9118-55f71515cc07", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066629, "uuid": "54fa8b80-adeb-49ae-bc63-38210c80b747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066629, "uuid": "5510238b-317e-4ab9-acbc-d444cac12f2e", "value": "3352b5ce0e9eeb8fb49649fb70e6b416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267223e8-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046075, "uuid": "531f0d45-edaa-4c23-86cd-56984d881454", "comment": "Malware payload", "value": "b5079906987a102c9ce03f12573af1f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046075, "uuid": "88b76c1e-a768-437d-8f1b-a4386e44bc9f", "comment": "Malware payload", "value": "c3a7dd78b3cd3d65eb52eed1329616b1ac4af6a032c7db4ccc01112da4a775c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046075, "uuid": "8ae2c8ac-3c6b-4c9e-8014-6c2d5784dfdb", "comment": "Malware payload", "value": "118111b71b374716668b9573199eb841391e59f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046075, "uuid": "33638ffe-aa56-4fc9-9e26-ad52f2e13969", "comment": "Malware payload", "value": "6d710ea862ecde141bdd1b9d98717696ba5edf58376cde7cda47b1c55ac1bba03e569f5f696f5ae67e3d291467abd116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046075, "uuid": "ddc3a7a2-a901-4c7c-a7c8-d1ca16753c63", "value": "T18C665C12F7A10DE6C4A38074C9A7AB12DBA6B8780BF007E7272146DE7D277D0353A759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046075, "uuid": "bceb0fe3-1858-4374-b1be-d6cd7ef115e3", "value": "83960ee223ffdc06443f1293e0ab5980", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046075, "uuid": "54920c98-0de5-457d-8b39-a8e179ee1715", "value": "49152:2zfm2GgERUfaWPK2p+C0AmOJZMoQaLVRn8OVKiOhjsCKkn/GQMjDbmlVONzZ0B/m:AcCOOJBsPUkn/lSngKgsGDChB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046075, "uuid": "5835896b-dba9-4743-b25b-d31bc189a5ea", "value": 6854560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046075, "uuid": "bc0d0926-bdc6-488b-9169-a95740def876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046075, "uuid": "a3fe6053-fe32-4c4c-9b50-580d8b61a44e", "value": "SecuriteInfo.com.Program.Kuaizip.1.15126.5623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02145301-43eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693038712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038712, "uuid": "72d6f79b-39a0-48a1-98d3-1e1e7ad8de8b", "comment": "Malware payload (Stealc)", "value": "61b1ffdc3e2cdbbb9d0586d46b56eb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038712, "uuid": "1651e0d4-1a72-4c05-bed4-73a48ad0eedf", "comment": "Malware payload (Stealc)", "value": "c4cc355c8e3bc52a53f43f85c606d824b607fd91ffff384393bc7f99823bb219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038712, "uuid": "05d16044-7be4-45b9-8fe9-18f38fff2e75", "comment": "Malware payload (Stealc)", "value": "35eb4e536d3423cc909cbe63ce04970ee800b90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038712, "uuid": "17b91e1d-06a3-4b6e-82ed-86f317e05ef8", "comment": "Malware payload (Stealc)", "value": "8d034215f375c5ab7a0f5a510e902484df889e6641002b6780ca2dca2a8572a3a43e82144c4c10792a2b270a1c3ce909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038712, "uuid": "ba13ad19-f6b4-419a-b8ff-b4467db2a4f0", "value": "T17C44BF2262C1A872E52347319E6AC7E56A2BF8704F5676DB23945E3F2E702E1C771306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038712, "uuid": "b96fb735-f8f8-49dc-aef9-6df3fd53cc14", "value": "afcff5561bc6ac3d233799d21416a52a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038712, "uuid": "a945e721-605b-419b-bfad-a8e846e064c2", "value": "3072:61DdkBbioUZl6GBHX5rgDFsAY3flGiFg4HNZeOh7YituvzXDGvV8Xd:M2QZlHBHJMFsn9GOIg7YitYzX62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038712, "uuid": "babd34df-862a-481a-81a5-efee82d75e89", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038712, "uuid": "573e40b2-2919-4261-9b67-fded393855d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038712, "uuid": "92847dbc-1160-4c57-bc7f-090534b93bab", "value": "61b1ffdc3e2cdbbb9d0586d46b56eb99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7088592-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085804, "uuid": "f9a32c5e-0bd9-424f-82c4-55d3ecbabaa3", "comment": "Malware payload", "value": "4c3567554928099e25e350e05d42fd77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085804, "uuid": "60b7eb22-6c05-45bc-9f93-1ff3aeef0266", "comment": "Malware payload", "value": "c880c82646266710ec7e0882c16b4f281219889646968aafbb754fd95bb9902b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085804, "uuid": "8cbdaa05-5387-4306-a1e0-a283d2e17257", "comment": "Malware payload", "value": "cf62e7568ae54ab3333aa46ae6ce270db674d7c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085804, "uuid": "35b5887c-3410-4a40-9055-6e69275c917a", "comment": "Malware payload", "value": "d825dbf10dd1f49068cb370391f8c5a1c153e99873ec23f37b3d58e2027fc634503abf2ad9cd10c662fe5748183829d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085804, "uuid": "abde8858-2a4a-4a28-9f33-7fe4655f0976", "value": "T1F3F57C70EA4B40E5CB1716304A7A77BDD625DE497B248BD36724FF1C9872281A93F03A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085804, "uuid": "4e48fda7-e159-40da-90cb-7d0858b5dfef", "value": "1af6f2553bad2b526e653d994d440a05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085804, "uuid": "f21ba148-15f8-4baa-beb3-c23fc934ce70", "value": "49152:c6tokbhvGb4DOkGU5Qu0OQbqRBhfWnTTqeQPlVBFWBQXM:c6dOkDQJmBhfWnpQPLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085804, "uuid": "53742de0-0633-4b11-995f-2993525ec4d0", "value": 3518464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085804, "uuid": "f518c642-30f9-4486-8697-0ec7c9fc308b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085804, "uuid": "c53d5b95-1db3-442d-8831-41967965ccf0", "value": "radbxnzdxbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840f2f85-43e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1693037642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037642, "uuid": "733060e5-93a9-4890-8d45-6e71ba549a70", "comment": "Malware payload (SystemBC)", "value": "563b5372c93c74f1e0268c079ece9d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037642, "uuid": "c817660b-c9c1-4fce-a7e9-35af7d5e8011", "comment": "Malware payload (SystemBC)", "value": "c96f8d4d1ee675c3cd1b1cf2670bb9bc2379a6b66f3029b2ffcfdd67c612c499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037642, "uuid": "033e851b-f28b-4f4b-bdf4-4a5167898ab6", "comment": "Malware payload (SystemBC)", "value": "2eb07fb4bdc826c2e865931113ed89c8bccd0042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693037642, "uuid": "e377ed14-9991-459a-a614-0b69ddf8d514", "comment": "Malware payload (SystemBC)", "value": "c4b404b1eb1e08c90259aa23144241676c25e637efd1034f81fb0e55b7410804434c2a8ba99abd794aa9cf04dda00d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037642, "uuid": "cbcc5e86-b481-46b8-ae73-34df6f58b0ae", "value": "T110549D8B9B8568D0C83E2B72FDE520A463B2D1EB5403FA5B04D454E0FBF79DD59428A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037642, "uuid": "5b701478-5d91-4728-ab0b-a405a17bf847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037642, "uuid": "cb99d693-d6e9-408c-9006-7abfdc6a63ac", "value": "3072:xzucLwe6w+whpp+I6oZoLHAyIDhrO9ZRbZ3qBIcZC1Nq4B/OZIPO/xxo+yjM98BM:0U89bSpMZRd3FcZQIZIPg4+yFDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693037642, "uuid": "36d54d13-06d9-446b-b017-a75b27084392", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693037642, "uuid": "11aecb91-7903-4937-b6c1-c58249b02514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693037642, "uuid": "4a2feded-fc38-4d36-9af3-db87ba49b20c", "value": "563b5372c93c74f1e0268c079ece9d43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b782af-4408-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693051167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051167, "uuid": "929fca6b-fdfb-4d5b-90ec-c9c9b27fe8ae", "comment": "Malware payload (Formbook)", "value": "05579b705197cc4ff3728af6d4d49f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051167, "uuid": "e48cbf77-6562-4871-8dcf-a29e8d67bce2", "comment": "Malware payload (Formbook)", "value": "cc0f366752ad8832bf26a387da04626c8db6f00a69d5a98ce5934d0db01c1329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051167, "uuid": "ca019b0d-678d-4b17-8e65-a9c659172099", "comment": "Malware payload (Formbook)", "value": "89fb958792780a68990427aa3d8dfc9262c05dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693051167, "uuid": "bee22e55-7407-40ac-b42e-c799d793bde3", "comment": "Malware payload (Formbook)", "value": "8e8cd6133e7600e0515b4479d74c6df7df23f96e46b8b7aeb19657e9d3df4059a60fdcefdfe2ab2b23c24a8cb86d2755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051167, "uuid": "eeeb6aa0-a627-41ed-a097-cfbd717215cb", "value": "T104D41324B3AC4B2DE87F47F71C60844A4BB617FB5411EA781EC1E4DB38897668A21F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051167, "uuid": "9bf0e855-138b-40d2-86e6-f93e5450b054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051167, "uuid": "fef83ee7-fc9b-4c26-bf82-edfcbdb4afb4", "value": "12288:fbqwi/iWsjKX/Covqtk1Nla6KU9HTk8WjssUD1hZfxgEqD:jqwiiW9CysDOg8fh9xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693051167, "uuid": "56bf27c5-5cb8-4175-b068-da6bc9456afe", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693051167, "uuid": "b1b217bf-ea12-4a56-bf8b-0308a47a3534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693051167, "uuid": "3a568684-767b-4db7-a5e7-7c5fb249e2c5", "value": "rProductSpecs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21eadfb-43b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693014607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014607, "uuid": "8bf4e485-7cf9-494d-8871-7a70988132f8", "comment": "Malware payload (Mirai)", "value": "cfb1ea209bf51337a476607930d1a4a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014607, "uuid": "d7f32e12-928b-4aa1-8c53-60546f876bac", "comment": "Malware payload (Mirai)", "value": "cc10044ed250428d8f88c0862bc4fb442575b09b665908a982a3be2b1940287e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014607, "uuid": "67c2ccff-37d8-4039-bbc2-6a86ef527f05", "comment": "Malware payload (Mirai)", "value": "19222d823df288cc08cec13d054fd1abeaacb995", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014607, "uuid": "d4ab0277-b178-43c8-a2cd-2a90fd38692f", "comment": "Malware payload (Mirai)", "value": "56ec1ddd6155e10c5e8e3ba5f7b39909d019aafdcf8c349c1f80b358482f3c78a584c426976dcccca46618e2f42cf8f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014607, "uuid": "16538e81-ecff-4a7c-8967-d5538a6126f5", "value": "T1DFC2E130A6EE1CB683500572F2B86AC5BE420F7DFAFE3890514147AB7D42D052ADA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014607, "uuid": "99e0debd-718c-4ff8-9953-02bbec2ca492", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEetLhymdGUop5hi:A7soTAZ3alkXLvFh8nNE+s3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693014607, "uuid": "feddffde-5aeb-45d3-a5e1-0a4fd8ed7092", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693014607, "uuid": "ece3cf24-e2c7-4860-94a5-efe025600e20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014607, "uuid": "8f313b78-033a-499a-a250-97a3be0d96c5", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3751def3-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046103, "uuid": "132bd63d-eea7-4da8-824f-312ae15ca6b4", "comment": "Malware payload", "value": "c1ae995806596697b44423238c869c45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046103, "uuid": "60115b93-feb7-4205-b851-d16ad0ec9a89", "comment": "Malware payload", "value": "cde62cb432ecd8b4f48036b7c23b5733018ffd8ce4772e8a2759381d89cbfbe4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046103, "uuid": "522bf6e9-6c7f-493d-9046-42393b49e683", "comment": "Malware payload", "value": "bea2b09a40c534367bcf2cd8e0e3fa02b7921bd1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046103, "uuid": "a51e2515-a04e-468d-8933-fe01ca5bc6bc", "comment": "Malware payload", "value": "235c3fb399774f2a2af5644063c7e8ec3f6c91a5f61326db85d6ead253c45d61da89593073951e73895c07cc6892d4d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046103, "uuid": "2eb3e086-231c-4151-8fda-8fa220d9fe87", "value": "T1FBB36B0175858071D5BE5A3501A5E1526F3C7960DFD48EAF2BA90EAD0FB82C0BF35E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046103, "uuid": "872755e7-b9d5-40b2-8a87-707b386975f1", "value": "2877c10590a8016945faaf399acf42aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046103, "uuid": "f37ff829-45d1-4d51-881b-d43b96064954", "value": "1536:Ehe2Kk+su0jDzhaBiZfYWgZT8nR5QnujsW1cdgHJauuCajpNSuw0UFNA2bws3hxg:0B4oZfh5j6BgHMjpNXw0qAyJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046103, "uuid": "ca100bf9-762a-4b60-979b-9ba4e779b0bd", "value": 108448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046103, "uuid": "9aebf538-a27d-4221-9a51-dd271b65ff92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046103, "uuid": "b1fa3c55-b813-4697-84fd-450d5cac70c1", "value": "SecuriteInfo.com.Program.Kuaizip.1.3351.12549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a959e17-4430-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693068603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "1fa1cd70-9067-453d-9a7a-963eeae73643", "comment": "Malware payload (Mirai)", "value": "5943402798a7b6b5afd3344a29d7489b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "23dc0772-c461-43c0-abde-94bcf6726610", "comment": "Malware payload (Mirai)", "value": "ce7e6df9356d711fb017add31791a813a89b0b8833a48f0825344ddc7853900d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "e4dd9b42-09dc-492a-92c9-cb23eeb5d2d8", "comment": "Malware payload (Mirai)", "value": "1dd1c720fc113323ff2498abaabc68106545ad11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693068603, "uuid": "3925b946-c1cb-4e6f-a4a5-e52a52fe8773", "comment": "Malware payload (Mirai)", "value": "6b26f30bbddf8479145bdb98f0d4cefbde6c0c5db12dbadcab7fd81583dfad434ead9da4b8cfad670d099d4c431d46e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068603, "uuid": "05c3ded6-f124-4928-91fc-06e89e1d08b8", "value": "T176C35B8AE5C3E5F6EC004A78346B9F31D977D4BF213ADAC6E7E86D326815541C1032AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068603, "uuid": "a88a3225-3a3b-413c-aa38-1beead8bb5a6", "value": "3072:a2asBpElV9cT2c4ZnFgJHwmDpSJ38CHL6b9jpL61ySm:9as3ElVmT2NFgCmpSjypI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693068603, "uuid": "ecbbd7da-cccc-4a55-a7a1-ed3f7c414a10", "value": 119696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693068603, "uuid": "88baec15-e519-48e3-8e66-26f4becc243d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693068603, "uuid": "bde15032-2237-424d-839e-bf9dcd2edff4", "value": "yourbiggestnightmare.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2f72d0-43f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042571, "uuid": "abd9ba33-7428-402e-95d4-249025d1c40b", "comment": "Malware payload (Mirai)", "value": "ee315cf55046958606f82826a97d76b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042571, "uuid": "76b71c9b-9690-455c-9ca3-4740986621ff", "comment": "Malware payload (Mirai)", "value": "d2525db372e2d062d7485efed3cb98ddc5d34e686f128da3a2af57f644b2ba2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042571, "uuid": "7f31b380-0405-450c-a961-124f73ce80f7", "comment": "Malware payload (Mirai)", "value": "553b0d553eb97518bbb4615cf0005a5ac8994ac0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042571, "uuid": "d481cd12-68cb-4d6f-bbc3-52cadd4f0db2", "comment": "Malware payload (Mirai)", "value": "60b8cea3d80f0fca9d3c625cc17b96864d0146b6e010ab6168fc0a97df2a2c8ef84884154cae8368063f8dda4d4ff19b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042571, "uuid": "354131e6-01e5-4a7f-9a7d-039d206d86f8", "value": "T1DFD33A1BB4C180FDC4EAC1B44B9FE536DD32B4AD2234B15B27D4AA221E9DE305F5DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042571, "uuid": "030303f9-f9bf-47ca-9d3c-9c8ed20ea89c", "value": "3072:Gw2qIWTADAob3EF+aogCVE2Mwf6cTOyYgVG:Gwb2/BXvVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042571, "uuid": "92484f81-cf51-4d2a-ad5f-6f1ab0054229", "value": 135480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042571, "uuid": "472751f6-ecc1-42a2-85a9-0cc5c408bad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042571, "uuid": "4bce260b-6120-43a3-a8ee-1770bb488063", "value": "concakhbtandhuy.x86_64-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf734eb-43a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693010489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693010489, "uuid": "6005ca47-c479-43d9-bfe7-599a7571b7c6", "comment": "Malware payload (AgentTesla)", "value": "33e8fb7aa9f005ccb2e9fb681f087366", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693010489, "uuid": "711abb9f-2368-4e5b-9517-5d8956b1d7c0", "comment": "Malware payload (AgentTesla)", "value": "d300bd3ed7461b1c05c983a03ab34d07e23f8233bebab33c52631303de624c1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693010489, "uuid": "6a9ec962-4789-4f61-a929-de86e28df025", "comment": "Malware payload (AgentTesla)", "value": "b45c204899eb12874dca86cc7b4e12af7dbe5dba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693010489, "uuid": "0f760b38-b2be-4693-9827-2b6bd6a4a425", "comment": "Malware payload (AgentTesla)", "value": "70bf4e3a65b3b6d42b882ffca6242569994ec0c2444af3e7ecf503893708f1d44f30ffcd718a327d8aa0c1d41ec014be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693010489, "uuid": "af5fc72c-bad7-474e-9ff7-ad2435e57cfe", "value": "T1DCE423B6008C8DB88F6D4979E667B250B1DB3EBE4795ED46DB710103F7A0633638B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693010489, "uuid": "66fc1c70-1e7b-403d-97de-a43803372604", "value": "12288:d0dNkjFUgZAurY/a93VUmy8GQxMi4T+0J852WWqoq7lHoyPm3MywDcTYIj1CsB:2Eb0mycMiY+yI2WWylHo0mhYW19B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693010489, "uuid": "8fa128b6-d5fa-46b3-95a4-095dc7b731a7", "value": 688484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693010489, "uuid": "d8bdffed-6cbd-4d90-89cc-61fcc498a91f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693010489, "uuid": "d999da06-d68f-4c7f-9ea0-0ec07f9b96c1", "value": "NEW PO LIST 02009 GREEN VALLEY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e96a85d-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046088, "uuid": "582c5d29-c2f9-46bc-be76-6b514b4c29a7", "comment": "Malware payload", "value": "0ee69c8abd82090a8bfa81b6de20f359", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046088, "uuid": "21617c87-ec52-403f-9433-c8fc6625e78e", "comment": "Malware payload", "value": "d45236fe9747bee119da154635ea4cc906f3b1b0439428ab5c0f1e12008d89ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046088, "uuid": "21965bd0-a755-4ad0-9e55-bf40672c7d5c", "comment": "Malware payload", "value": "6def7266eab99904088890ccdddf193d8869f82f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046088, "uuid": "d5c26e37-c973-48f2-b446-65ba68d6e762", "comment": "Malware payload", "value": "14e2e6713c6118b01d9215d0cfb059ffbd5e7abb4f74d1ab449c8083964236015c2ff00e889b3354e14b31607999e2c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046088, "uuid": "40b4fcd1-fcf9-4e6c-902d-c2fbc4ea9600", "value": "T160564C12EB920DF2C99740B0CC7B6B66CB6A9C780BF047F3A72159DDB4653C1353668A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046088, "uuid": "298c24fb-35b1-4074-bee3-a2a4ee369c67", "value": "6692ef274f14d7e36b3ef8cfa719c066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046088, "uuid": "59775c28-f562-455c-8979-ea8b58e21646", "value": "49152:tLFsQmVbXykVxdl7l2blCR3Slg0ofdnKeQfHpujD5aH3zK+UWgOfF49mB/cS+dTd:5FsvVzt5TQfJuJaHOQg6F2w2Kgs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046088, "uuid": "c28d1f2c-6ac2-47a3-9de1-b4ef1bf4e2d9", "value": 5935008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046088, "uuid": "7ed10201-dc85-4f98-a569-b710f7c84e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046088, "uuid": "e958fbf0-8c52-468d-8e2c-33a119545631", "value": "SecuriteInfo.com.Program.Kuaizip.1.13746.29673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8d48b1-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1693038619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038619, "uuid": "da40bb61-54f0-4bfb-b4c1-536681e4ea68", "comment": "Malware payload (AZORult)", "value": "d2c05cff3eb45ade3a801eef8a1a0b72", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038619, "uuid": "aecb5205-c152-47b4-9818-3d4e72ba1664", "comment": "Malware payload (AZORult)", "value": "d59eb1dd9476aedf586ac64b89b8f4f3ea357d0a16fa41231038b125a351d6b1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038619, "uuid": "e3f00e13-fa06-4864-bd68-bb2182b2eb9b", "comment": "Malware payload (AZORult)", "value": "28b52e0fbf6aabcd9b47f2c6807f256863e9d6af", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038619, "uuid": "c15e677c-6233-4119-89ca-161b0c304da2", "comment": "Malware payload (AZORult)", "value": "cb4eb2f040c31d135794651c373d7ed510c1909333ac3260c92a213e0dce7f334583f2b4324b761036692de10c869543", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038619, "uuid": "828741e8-e03e-4c34-a8bd-351060c779b2", "value": "T17E568E63B292CD37C4232E384C1B93D8A629BB203F3855877BF51E4C6F796913929197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038619, "uuid": "b0d2519e-8849-4db0-bb8a-b46c980d803f", "value": "6f363dc6cdcd5945ff1bac48b3d22639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038619, "uuid": "3f9e91eb-4d97-43ab-98bc-be3916a29857", "value": "98304:Z5gvnSLFVxpyOKqDyzMWDf9BZ4xC3u/Gwb:EYqOxDyj9BZ4w3jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038619, "uuid": "e0ca92c7-0ef3-4d80-91f9-8b87726e4d7b", "value": 6121000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038619, "uuid": "4c3d9fc8-6936-457e-9fed-7aed8c2df235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038619, "uuid": "c6a0b924-91af-4688-a32c-3e6a95abd7cd", "value": "d2c05cff3eb45ade3a801eef8a1a0b72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d17e39-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693038693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038693, "uuid": "b1315bf6-c0c8-4f88-94bd-3a992a4f4664", "comment": "Malware payload (Smoke Loader)", "value": "be8fcf160f765426678b822bd0f4eabe", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038693, "uuid": "a3403266-1542-4749-b439-f22e3077d8f6", "comment": "Malware payload (Smoke Loader)", "value": "d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038693, "uuid": "c82d42c1-23da-40bd-af73-1e5d711d68d9", "comment": "Malware payload (Smoke Loader)", "value": "f944d426fbdc22f3f2fd0105a9680085ab0f6823", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038693, "uuid": "3d02a45d-8d2c-435e-827b-2695d6a5ae98", "comment": "Malware payload (Smoke Loader)", "value": "0445fa4b995445ef3854823e63467f42dadbdd1ca3d24fac3c1a4e062f3a34238f87c7073b790afc165666549ea65884", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038693, "uuid": "ffed321d-2489-482b-bd58-ee8e2cbc5878", "value": "T1BD44BE127A92FC72C8924C349834C7F5297FB8729A984987739C3F6B2D7D391B662311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038693, "uuid": "307359b8-1743-4b35-b415-f6e85668e9b4", "value": "478e1adb03a4046019e6832a1ee52bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038693, "uuid": "e768ef0b-fa8d-4e09-8218-6d1fa48279b2", "value": "3072:iFXQ8Ig/TtqLe9W6rfZURjQsZZ6kCme7W6KlYMwZtqC+o15RTTAGRO:iB2CTMLeE6rfZ09eqBl2ZtqCzJTT9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038693, "uuid": "3efec757-8016-44dd-9f8b-b9247fa06c5f", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038693, "uuid": "35b70fce-619f-495c-8b2d-791b64238ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038693, "uuid": "9490afa0-0b98-40a9-9d48-bad730392fef", "value": "be8fcf160f765426678b822bd0f4eabe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6473c38c-441e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693060782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060782, "uuid": "5fb4eba0-31d5-4cce-89a3-dea53b2c3038", "comment": "Malware payload", "value": "4761123300515dabeef86c257dd17f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060782, "uuid": "db311e33-8450-4960-bb77-962a8e729183", "comment": "Malware payload", "value": "d64e540d1367a39e47c5c05b700defcd1f7bc3d791bcd88ac8f64e1bf0f432eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060782, "uuid": "3e61d6b7-cd52-441b-90d7-34328fbd7a01", "comment": "Malware payload", "value": "106bcfcccae54a016491b7f5acb28fb83f9fd6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693060782, "uuid": "42ef2aea-fc5d-4e99-ae09-4ef5a3fd2147", "comment": "Malware payload", "value": "66fc946ed43d749a7d075dd6e04c071276179d84a385ab820b019f71286439bb7c8df4d4286aa0ae4481780516f1d6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060782, "uuid": "05e0aeff-67b8-4066-8886-6d48d6873255", "value": "T194C523017BC599B2C47319738E7CAF21E67C7C201F7618DBD3642A8E8E360D19636B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060782, "uuid": "88e12f66-b687-45af-8b65-000352678dd8", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060782, "uuid": "d81cca44-d20b-4d89-9d38-9cffc0fa874a", "value": "49152:rLLPZlD6geRxOH8Hsw6rK/CRqyifA96wWuyaKXq++:rJlpEORBK/CRqk9g1Xq++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693060782, "uuid": "9a6bd8b1-2d5c-4675-b9f5-a0458b5c560e", "value": 2534963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693060782, "uuid": "d9dc3b63-b567-47d7-b0d0-88358b7c0961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693060782, "uuid": "bc6dfa11-b5ab-4f5a-af6b-14733e245dfd", "value": "SecuriteInfo.com.Trojan.Uztuby.4.3337.28589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3403e581-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046097, "uuid": "d46a9e08-f544-4344-a4aa-dea48fb39817", "comment": "Malware payload", "value": "6d37e9c7723ee1d590fe351490da88dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046097, "uuid": "bcb3397e-943e-4bd1-ad19-7499206f3f8c", "comment": "Malware payload", "value": "d666681550bc3f9f85c24da9198be35bccea2cc2823db57f368077f82fa12772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046097, "uuid": "b508da1d-338e-4a5e-8bb2-06eb5a86bddc", "comment": "Malware payload", "value": "8a81c324c60dc3e58f110d4efd150e7dd5092bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046097, "uuid": "a2ddfe4a-1ca9-4416-ad86-43934ef268c1", "comment": "Malware payload", "value": "36e2e5cd66167c57e6b7ed35df546f43a75f2638090954b82532b74fb24fb2e040453cd3b115d90a272c90ba5f8ca196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046097, "uuid": "6fca41fe-10ac-47dc-a89d-1307cdf1f61c", "value": "T166444C5E37D0D412F6924AB14AA6B327F7BBF3163615251F3A004FFD71218928E29A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046097, "uuid": "cbd7beb6-cf74-48fd-acf2-623e19148c58", "value": "384:99bE2i/G+0PcM07fQPt9QAXqni8t5QrqUJgyBfRQEr4vBsLijSSrG8C8:9x5iTecMoQPPQuItWrqUJgyrY8lU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046097, "uuid": "85618ece-e85c-4786-9b86-d666487bba58", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046097, "uuid": "d74f6d9c-2000-40ee-b9e0-4b1bcd5f20d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046097, "uuid": "94ee15c2-6b52-4ff4-97d4-4eba75e1ac3f", "value": "SecuriteInfo.com.Win32.Evo-gen.15195.17595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfbd745-43ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693047698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047698, "uuid": "2c5964cb-6e1b-47e3-9d9b-d863598155b7", "comment": "Malware payload (AgentTesla)", "value": "a4e70100be301e1a978e935d1ce11ed8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047698, "uuid": "4e971b84-df3c-41f2-bb6f-f28f57f98e49", "comment": "Malware payload (AgentTesla)", "value": "d8dc69405702bdb446b1ca4653c2c3900dc57018c29a81a152a2d3ac1b51c902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047698, "uuid": "6e41658b-2048-481f-9bef-8054a9c39f7e", "comment": "Malware payload (AgentTesla)", "value": "6fa70326f05f24582ac7dc062bd73484297c8a93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047698, "uuid": "92bcf968-4103-4962-b59d-acf263c6c768", "comment": "Malware payload (AgentTesla)", "value": "320992d8a7aca73e6f8882a839e553c6bc9ace8989f1ef1ea2e6c463800b1611aa04584d1b4db863267aff9b36f0fe98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047698, "uuid": "9f14ce5e-a7cb-4672-b1f5-9f2c6899776f", "value": "T196F3F8AC778CDE2ACB0C967544E59290232680B677A3E787BDDC52A41F133C58E15BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047698, "uuid": "b36333ef-7237-457e-af1a-617ccef5d957", "value": "1536:dsp7dWZiziYVSYF8icEQpzq+Mt/4PnWEFDiPQvW6mW3ZVIKvGaOLalr+FEGYViG7:+RcyCbzHu/2ca0W3ZVIZ2d2wVbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047698, "uuid": "034229b9-50f5-457f-af3f-53090d5cf6c0", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047698, "uuid": "91b5f2c9-d262-488c-8d96-8aa9968a25b2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047698, "uuid": "3f1577f9-ad17-445f-8413-5424ec119dea", "value": "rGptzjcsom.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bfb2b1-43eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693038710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038710, "uuid": "20d9cb4c-db23-4cf9-9aa5-5fe9cbb6c864", "comment": "Malware payload (Stealc)", "value": "4c7cfbe320729c6bb8a1ac1aa9ebf119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038710, "uuid": "834675f6-54e5-46c6-8067-b419092f66d1", "comment": "Malware payload (Stealc)", "value": "d8e82dd460b3e9538fcef64e56b5348fa777e5d73dc1d61d92fd49e7e7e7305b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038710, "uuid": "f4e203b0-55c2-4a19-be3b-d9020b00b54a", "comment": "Malware payload (Stealc)", "value": "a45bde8daebd2804b772aed1576ec48c45ba58d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038710, "uuid": "f237599f-8b63-4174-b45a-28e0af4ad56d", "comment": "Malware payload (Stealc)", "value": "e57e11ca3c6e87b66b804ad12b82acd6568bc34adb4e28b8a8630ea94e6e185071999779d81102b836947d6612eb1ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038710, "uuid": "31d591aa-c9dc-42e3-9e00-55e0208b77d9", "value": "T12F44BE21FE92D4B1C88243309824C6F42A7EBC729A99457B77583F6F2D31381967637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038710, "uuid": "55b194f5-6b41-4f93-967d-12afb6b3106f", "value": "d486cf0d009e476ba5dbcd1e658bee6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038710, "uuid": "91f2f59b-3238-464a-b272-602703a6bd04", "value": "6144:rQNTVL+lpsJRgDpLdVmFhR+JMLXTiRgN:rQNTVKluJyDpL3OR+J4jiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038710, "uuid": "5dfd0ea8-f714-47b7-afe4-78af2d22cf8c", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038710, "uuid": "8f6988b9-ad70-49f0-9dfa-6f20e5a05f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038710, "uuid": "7cdcd240-fdc5-48e1-bf99-2bfed863df3b", "value": "4c7cfbe320729c6bb8a1ac1aa9ebf119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbc2d8c-43d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1693029904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693029904, "uuid": "f35791c4-87e0-482a-948b-e8a51753201b", "comment": "Malware payload (Gh0stRAT)", "value": "a92ea7b48ace74e0dbb91a9cf01ab866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693029904, "uuid": "75ee8ece-2f24-4a4a-b78e-4e3176fa59a7", "comment": "Malware payload (Gh0stRAT)", "value": "d9c17024439eb223bf22e9275890ccb24f395702bc5fca12d072b565dfe66e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693029904, "uuid": "ab90d395-f981-4132-a4d6-1b2babd104be", "comment": "Malware payload (Gh0stRAT)", "value": "2673d765e86a39ff02472952b82562457f1c3797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693029904, "uuid": "e6328d9d-f7ce-4c1a-aeb8-14158fe78d97", "comment": "Malware payload (Gh0stRAT)", "value": "7a2ef35f5aedb59b3b61fa5ed7bb75cf85806fd7437853c66b86fde8669da985b92aad17df05edaffa77873a77fcc655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693029904, "uuid": "cac49752-1006-47e0-8822-d3bb414b7e89", "value": "T17CC4DF15FAC24026E09C05B0C1D38BF59BBCAE73771320DFD7A0B94A1A751D669329BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693029904, "uuid": "630e544d-8788-4cb3-b849-0c11a11a4e89", "value": "a0158c18d7c57554131cbbf4101b1cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693029904, "uuid": "4488d7d2-08c2-4710-9bcd-bc9b22cc12ce", "value": "12288:HruM9FNatyT3gNCpOdn/u/cZNJ7QD7HZ5rbx:K+atynpOd/tzJO7HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693029904, "uuid": "a9a23fc8-b944-45e0-a809-5c9297032a58", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693029904, "uuid": "848d607f-012e-48a5-9795-0addc4591232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693029904, "uuid": "f0eac346-b47f-4a76-8a51-d8560c0338bd", "value": "a92ea7b48ace74e0dbb91a9cf01ab866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e0ee3b-43e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693038131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038131, "uuid": "3c5dd79e-25cd-4749-9915-14b2f2257c26", "comment": "Malware payload (AgentTesla)", "value": "eb808a17e0725581086f3ec10ab4db45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038131, "uuid": "ae5ba74f-9c30-4ac3-a238-cb7ccce0296b", "comment": "Malware payload (AgentTesla)", "value": "da31b51512f6ca0238de861bc59bb06690b1e28003b8af4c071182c41138653b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038131, "uuid": "cf24e485-8346-47ad-a77a-ff7b144d78c6", "comment": "Malware payload (AgentTesla)", "value": "7e7ab590585fd6c42ef9026773a8aefefe82cc16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038131, "uuid": "10f62dac-a625-4a9b-950e-d1cbd7e75620", "comment": "Malware payload (AgentTesla)", "value": "65dd25afba33c5da5fec6325ad92bcafe42138aafbf4cc387c0e9c42d27162dedb0a43b9ca8f8cfc37515480cfca3151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038131, "uuid": "09cba1ca-e0da-4390-bbc5-a053ad5e6c4f", "value": "T131C4AE57F6D77A65E6AFC2BAC6B1C92D62B3309612B0C3CE774055492D22392483DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038131, "uuid": "5737770d-0b03-411f-893f-b04595e9bfa3", "value": "f20a8db3e4a8c03c1ab177b2660fdd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038131, "uuid": "f57b230e-7118-46cf-bb4d-ebbe877acaf8", "value": "12288:ezLjlZHAt+AZrkOCH8bzbBSre2Oi1uWD242S6+4:ezLhltAdkjcX11DWeS6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038131, "uuid": "fa3744da-7633-4d87-ac64-53e31389ccdd", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038131, "uuid": "91e883a3-1315-47a7-b6f2-a1c8106eefbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038131, "uuid": "cd5323fe-43bb-47f6-8570-e083ab7311e9", "value": "eme.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0ba1d-43a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693009670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009670, "uuid": "c9a65aa7-9613-44e2-9010-ffede713981d", "comment": "Malware payload (XWorm)", "value": "b3ce79f2f7d1202164eae8591a73e9b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009670, "uuid": "136ee490-39a2-4f32-b07f-2b3f8f0864d0", "comment": "Malware payload (XWorm)", "value": "dafef03b5ec0d8821003c6e823f7888179a90e2726b34e6242ab24449b37a4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009670, "uuid": "b9a134a0-299f-4b8a-a371-1c3b52a59263", "comment": "Malware payload (XWorm)", "value": "a0648f05f12eec8abc346204d66ee79533084a9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693009670, "uuid": "b0dc4893-4fce-4e39-bb74-34c2853cda79", "comment": "Malware payload (XWorm)", "value": "3062f499d685463d3cbfe6b66d1452588412a8637824b1bda920530671b49f7a67655b28705c8a52943ad72cccb8d72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009670, "uuid": "d821dd10-7fbe-44d1-9ea1-97ebf20bc888", "value": "T1CBB4D10463F89B29D5FA8FF0913441411FB63A1A2E62F31C4EC124EB1976B11DB66F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009670, "uuid": "4d700e8e-013c-43ca-8589-b050b9fd870b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009670, "uuid": "7c3bfac3-5c19-46a9-8e27-0e0690cad1ed", "value": "12288:ZRLIjJMfYX86o3UBTPY38po8xRk6tkzqWrSBcEypC:Z6cgvpg3EnTk6SlmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693009670, "uuid": "e2895957-69e8-46a2-ae81-2b69f0185781", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693009670, "uuid": "bcda9d23-1c83-46cc-81a5-394332837e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693009670, "uuid": "53a46e2d-a42b-4d4c-9621-085c22e76473", "value": "SecuriteInfo.com.Win32.TrojanX-gen.13090.14784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a153f6-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693079405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "d1e51cc8-e6ca-4482-b1e0-18db35d1c2ec", "comment": "Malware payload", "value": "9c02d1ad2842fe8fc35a3225d0ee4161", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "ed6fb943-8de3-4a16-b9b5-7c419aa97448", "comment": "Malware payload", "value": "dbbd4b113b87cb24e4b1b28f39c7dd55c1763a08225b36f06cff0011d1101303", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "d1082c63-851a-4771-ba65-31ee4adc5b13", "comment": "Malware payload", "value": "ab70dc6c436e6dae1efa002c31d0418456fc5378", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079405, "uuid": "1a825603-3172-444b-97dc-0b0fb94cf8a1", "comment": "Malware payload", "value": "e80c199010b0bc41d8c9a79863124895d8a9340572d1b94e97cbef6e91b17e8b691e452fdbf15c5da23f0d41309574d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079405, "uuid": "f2d23920-486c-4a39-bb89-8d1a7996a9d8", "value": "T1AD534A1BA48090BDC4E5E0B84A5B6216DD33F8782273F25933D0FA2B7E6DE112F9D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079405, "uuid": "83522645-427d-4d7a-b1f0-78b3398c514f", "value": "1536:aWZAa19n963PLRoyIrEWqf8SuipcJYfbTP7aI0:B/19n43DRo3EWy8Ap+YfbCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079405, "uuid": "028cc56b-4aec-469a-ac4e-55187e92e2a2", "value": 63280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079405, "uuid": "16f6db5c-06ad-49ad-8ed0-07eacee5f30b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079405, "uuid": "a812647f-9781-409f-8471-66cee24f8608", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcfc527-446c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693094134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693094134, "uuid": "2cb4eac0-aa9d-4e9f-a403-feb5ae866211", "comment": "Malware payload", "value": "e399856055e77fc07c41272a1db98f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693094134, "uuid": "0d64f3ed-b53e-493a-819b-471f1ce084f9", "comment": "Malware payload", "value": "dc0658740353576a11e2a57f0acc313dc46b995f9cf75b806b85a8c98a2c0aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693094134, "uuid": "10b41d64-b0be-4027-8b3b-48d51ef3f4a8", "comment": "Malware payload", "value": "d08f711b6bd4ac57a91aa4bbfc286fcbad0f0a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693094134, "uuid": "582aefb1-0ba7-4ae4-910f-75625a16898a", "comment": "Malware payload", "value": "b3d9d51492800aa797e575fab273b2e65be321af6a041055f8c211357876dae4e5882dd44e26b15af00848a26c278eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693094134, "uuid": "237a5490-8255-4949-aa12-10ea743b7c51", "value": "T1CFD533113BC5C472D863193459F5A735AB3DBC706B69CAEBA7202A1F5F328E16D30722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693094134, "uuid": "8c8cf5ef-36af-435e-8525-844534624e5d", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693094134, "uuid": "0dac73cb-54a6-45e3-8f46-9253b81e28f3", "value": "49152:8cbi6ou/KehWsJZ3KwmsYrmCMBTsgcZgbpgPTlGCmzrGy4CYzIqCOiUFNU:8cbZKeh7Z/msWgzbpgPTMCmGy43KMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693094134, "uuid": "630c7717-58de-436b-8870-792f60284a6a", "value": 2841997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693094134, "uuid": "3ada32c2-1aa9-43fb-aff8-1eef35b693b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693094134, "uuid": "48270fc9-5297-4eb5-8912-eeb1c6136bee", "value": "SecuriteInfo.com.Win32.InjectorX-gen.20581.26396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fdb8d6-4432-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069621, "uuid": "0e405f15-f6c0-42fb-a6d4-62702033d968", "comment": "Malware payload (Mirai)", "value": "41bea1e372c0290892bd31e52d84f1b4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069621, "uuid": "2f3cb084-4f38-434e-87e8-be0a62c8f455", "comment": "Malware payload (Mirai)", "value": "dc41545230a4d37188de898c577ce1ea74980bd53030a26261fc0dbe725c9a9d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069621, "uuid": "ae4f5723-f728-4780-a1a1-e11c4adbb007", "comment": "Malware payload (Mirai)", "value": "f7d73c3cc46c6ddf2aff0ee24fa9272830994852", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069621, "uuid": "f9f1fef0-7306-4b9d-9291-6905db2f9da1", "comment": "Malware payload (Mirai)", "value": "b5fec0d11b5e85b9f265936df86067225defb6744d7ef1d003644810a64952d5b1a80c3872ae4a9b82c017361ffd7548", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069621, "uuid": "3b54cf29-2923-471f-b432-0a8f7a8d7efe", "value": "T1E5D2D0D694E7F1B8D0EA65B5003D06C8EDB67216C12A07B708E9347ADF130D80E30EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069621, "uuid": "ab3afc3d-af97-459d-b37c-e41bd1d1515e", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBg2KSx0sV:NYJdJZiy1aBnQfTqBgStV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069621, "uuid": "48f6d4f2-eeb9-4764-a397-f7f243bdd38b", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069621, "uuid": "1cb49f5c-1524-40dd-939a-02cf63c9ea65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069621, "uuid": "4f0e2950-8f19-4232-81ce-6f888ae0ab5d", "value": "41bea1e372c0290892bd31e52d84f1b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fd0242-43c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1693020484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693020484, "uuid": "b67a8fa7-2cbd-4b30-98d4-1bf4d665db3f", "comment": "Malware payload (Spambot.Kelihos)", "value": "162164f804514756bb0727bc0ff70f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693020484, "uuid": "2c050419-f508-4716-8cb5-9530dbe5ae90", "comment": "Malware payload (Spambot.Kelihos)", "value": "dc8ce8ab78c6cdddfd1ccd40a3b8d4d177a9ab9de871bbf9e81c54b97e29a342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693020484, "uuid": "c772fa58-f426-4663-b26d-81b858e67a6f", "comment": "Malware payload (Spambot.Kelihos)", "value": "d188a80bbada3db531e3bf012a0193e5f4f36682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693020484, "uuid": "81e42391-9c68-40d0-bf79-5297cfd7f076", "comment": "Malware payload (Spambot.Kelihos)", "value": "58fc5924bb9f0c88dc0c8ffb0816d46d8355bf27a55d389a55677a45296f73b02d59a3b47d872ded5d6c88299cfec952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693020484, "uuid": "6dc7d33f-72e8-4f7b-b788-733894758053", "value": "T177A4DFB435451D1D5BAF0116EAF851039D7C6E2F8D2B1BE5AED654F03FBA263F80A280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693020484, "uuid": "63f43222-8f2c-4998-9079-11eff792eb39", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693020484, "uuid": "588b45cd-5362-40c8-8158-5b5d35cdab01", "value": "12288:BvWbXtHkNShJxoMwUJwPQEDk1wDcERdKncNoRWhrL:BveXtHVhJ6zUJ/E9RdKcNoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693020484, "uuid": "5771b0bc-eadb-4307-87ba-13b4ae96c1b6", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693020484, "uuid": "06d6f9bd-320b-41fb-b640-2edb7e8db95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693020484, "uuid": "2d8eaf8a-d57a-4c7b-8708-2c3b85af5af9", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.35404.19534.311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e3fdb4-4449-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693079417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "75500b65-dfda-4c50-88e8-d6ae16cf42af", "comment": "Malware payload (Mirai)", "value": "1dbb386828796d75173f647fd3171875", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "728b1ed2-233b-4983-ac42-7436a46f1870", "comment": "Malware payload (Mirai)", "value": "dca14593652b1a8d423d4e2eee36c6b73d73ceebdd73c320bd413ee8545be879", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "c8be323c-cc45-4963-8634-3ee9820e7550", "comment": "Malware payload (Mirai)", "value": "467a1240da8d8fe09bcef0262a2d33c568f5db86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693079417, "uuid": "1f893b65-c8c2-486d-bb67-0e084a847af1", "comment": "Malware payload (Mirai)", "value": "a0dc54cc27b947e091c71f853a67142ca6dac66ced18a631eb43a0c36a868eceace157ae860d9d93dee26bf8785ca683", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079417, "uuid": "8651e9c0-66e3-4585-bae1-7c28e8157c13", "value": "T1C7633AC5B980AA22C7C2567BFF0F024E7B158798D2EA7343D9296FA0378781B0D1B557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079417, "uuid": "55b37855-3237-4223-87b6-2cbf8dcd59f1", "value": "1536:RVatAKw4dsxg04AsuMdzppIym5MGTDOPBDEZOTYvdq:8AKw4dsn7+gymmGMhJ+dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693079417, "uuid": "5f77e53f-0cdd-47a7-a1cd-25e60e880a81", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693079417, "uuid": "ace3f81e-b638-46b8-bb85-93c096ca33de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693079417, "uuid": "d7f69e61-5f17-42bb-b426-b1cf7c7bb03f", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a13481b-43d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693031209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031209, "uuid": "574a6aca-2edc-4160-9a52-9efc706f5b1c", "comment": "Malware payload", "value": "16ef1f88f6d85b813f4aa7a83d5a0979", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031209, "uuid": "b428f329-98b5-4195-be65-643f6d71f7b3", "comment": "Malware payload", "value": "dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031209, "uuid": "abcfe104-4be0-46cc-a039-f163a4afb322", "comment": "Malware payload", "value": "074d572c72321d27bf55c5747902d8f94d6eaa19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693031209, "uuid": "af496c9e-3ab4-40f0-96a9-9810b8f0b42c", "comment": "Malware payload", "value": "855a69170fdf7eacb6947340895608705377c21eb66575657db42afb686967156a9a52ca92bcf5ba44846d8ccb54f674", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031209, "uuid": "cbb1c8ef-0e71-4adf-8075-ac455db30c95", "value": "T15FA402103BE82766DAB69BF259B420114BF571699961E50C0CD790CF2AB2F029F34FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031209, "uuid": "2eded000-f2d4-4af4-8570-9b5feebfb19c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031209, "uuid": "eaa58670-2c73-45ca-8231-75f2104d4e5e", "value": "12288:7B3UoNa7pLrsiarFx602ZEen8Yr4IFoTcQ6+MK:7B3U+wFsiyFc2eL4RTWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693031209, "uuid": "c6434c35-fba9-4855-ac00-fe5b0893e3b5", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693031209, "uuid": "b0fb6855-7c9d-40e2-874d-e9fa8f4a88a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693031209, "uuid": "0cb57eab-afeb-4953-95fc-5e0df84bc91a", "value": "2ndStage.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf255600-4415-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693057095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693057095, "uuid": "d33e8e09-065c-46a5-b806-2ff54f8c7ae5", "comment": "Malware payload", "value": "db5bc71786911c47e3243bea2ae65539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693057095, "uuid": "51fd39f0-26e7-438c-b4e8-e4a839d09322", "comment": "Malware payload", "value": "dd1b20db1eec582343bef9c326771f96f38b61850ad34e15e1f4bb29dbc98180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693057095, "uuid": "9a66c770-5493-45b8-afdd-09df196bb123", "comment": "Malware payload", "value": "646ec9cc90e92abac6841804eb97f00da320a79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693057095, "uuid": "65feeb48-a233-47a6-9702-7a388e172dd3", "comment": "Malware payload", "value": "07292dfe0aa2d194437dc54b00a2dd923685d6d7aca3d2e51340cc4c100837b7ca7aaecd1f042d198e190522e085c2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693057095, "uuid": "8a701ce3-9795-4817-9eab-1ff8f0f3ec0c", "value": "T1B6D52311718185F2C1B23A33152A9F20DA3DBD704B298DEF73545ACDAE366C0DA36FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693057095, "uuid": "356a0d89-8d39-48e1-a026-592e95e1e99d", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693057095, "uuid": "dede23b0-08c2-4d45-b95a-f5df981c066f", "value": "49152:HdgbSQNGrFQmYzN4c8QqpLdeSlGZbblbg83GeXeeSm2aVwhIeNfSqCmJW2aZ/+gL:HFGCQIG7Zbbtg83GveSmKmyKwJW/Z/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693057095, "uuid": "bb9a18e9-2f7a-4ce6-b3ec-ab4c0bef50c6", "value": 2840752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693057095, "uuid": "064b29b6-2ffb-41a9-b392-1604cccfdbd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693057095, "uuid": "3a254a80-42e0-40c7-b1a7-a55f377a0b35", "value": "SecuriteInfo.com.Win32.InjectorX-gen.12400.32040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee8ec00-43b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693014011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014011, "uuid": "32af7cee-0663-4cab-8f15-76d86fffdb88", "comment": "Malware payload (RedLineStealer)", "value": "e177b6b1a2203bc2c355a4748cca8f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014011, "uuid": "96d82eed-9190-4e32-9a07-be072933e663", "comment": "Malware payload (RedLineStealer)", "value": "de15779eb8b76c90fb43f42c36b266a80f6a0b214cfe4d18eefdfb9b168a057e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014011, "uuid": "f8936df2-eca8-433f-8f52-44890dc34f51", "comment": "Malware payload (RedLineStealer)", "value": "ae08e3e5000c8a581349e2094afe9b166c3f89b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693014011, "uuid": "d2ab1f88-6a06-4514-af7a-778ba7f0b5c5", "comment": "Malware payload (RedLineStealer)", "value": "9c30724ed362b861c37bc5d6d2b48a183c4a5d8740b7c9d901cce507f0d0601b57dfcb4cabb4b23d918bfad7c805f614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014011, "uuid": "3301676e-438f-4c1d-a122-182f84bb51b8", "value": "T1FF94F132BA91D431D9C24130C824F5E8797BF83295D9898733A83F6F2E7129A56E770D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014011, "uuid": "698292f6-8ad6-4647-81a5-4422c39dbdfc", "value": "07ec39bd17621c40170951aff851e5bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014011, "uuid": "eb405b98-f655-4ba0-833d-e86291372b67", "value": "6144:g+6ByvLgBGJeraTyMnQR+vGwlD179+fksA0zZ2b5BccYXjMKH5ZgT9R2l:g+0yvJY14BvGwx1cxA0N2b5BcdT7w9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693014011, "uuid": "8952d854-029e-4d4e-bd64-721a27d2f940", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693014011, "uuid": "ab48084a-5633-4216-a517-d4e883a72eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693014011, "uuid": "3c9435a4-03f8-4d42-8657-88f96fae96f0", "value": "e177b6b1a2203bc2c355a4748cca8f93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2144695f-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083432, "uuid": "0563ea88-15ba-4005-aaba-f21277db9502", "comment": "Malware payload", "value": "d151ec74b0a409363d9401eeb348efaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083432, "uuid": "73100053-66e3-450c-a9c9-1439a6709a89", "comment": "Malware payload", "value": "def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083432, "uuid": "e96d5b5e-5eda-4ac9-a1f1-06ec674545e0", "comment": "Malware payload", "value": "36aefe3ff9c3f0d0318288259b2b7473855972fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083432, "uuid": "b52102b3-04f6-4e30-9d35-3cfab6a286c3", "comment": "Malware payload", "value": "b596fdaa7eec3992a37c6b348c7cacb196a74a7002b4bcbffacb647641a8272edda5f2759fa417ba2b74bd130185849d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083432, "uuid": "868b332c-b85f-4253-a0a2-adbdbd6546e0", "value": "T1F786D011B5958C6BD5565238CAEFB33B223CF6600B23C7C367506A394E73AC13E66B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083432, "uuid": "a81d1bd3-7907-4eb5-8e54-d555da10f180", "value": "2b817dc1b1849c6a436f0647be7673e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083432, "uuid": "c9e099cc-f431-458c-9bce-3d019b6f7981", "value": "196608:LIRcbH4jSteTGvzxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfA:LdHsfuzxwZ6v1CPwDv3uFteg2EeJUO9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083432, "uuid": "b7ec4271-edf4-4421-81e9-7988ae437975", "value": 8177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083432, "uuid": "8523dd73-6636-4f77-afbf-abba44b6f1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083432, "uuid": "f0ad32a2-7482-4775-bd0f-d6e44a38624b", "value": "101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6d9746-43ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693047719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047719, "uuid": "4e0337d9-a0f2-4797-a41c-6681f52b3b08", "comment": "Malware payload (AgentTesla)", "value": "38e0e35ba0e89d9a14a5d765b39007e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047719, "uuid": "71a82853-4822-48d7-9c9b-ef772359fda6", "comment": "Malware payload (AgentTesla)", "value": "e0c00b4cc2a6881449bf25b4f4739805b65f189fcc8cf0aaac88e2d44d06fcde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047719, "uuid": "134901e8-3fe4-4300-a930-368313784547", "comment": "Malware payload (AgentTesla)", "value": "6c7f35f7e65940d9ffb570ffd3b7fb2789cab8d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693047719, "uuid": "136a5d26-0d54-4e93-b50c-de9ccf5a1871", "comment": "Malware payload (AgentTesla)", "value": "ed3a633b66cc267d644600db3d749ac3abe19a38cf5ec27758dc64bffc4adb862cc294130e1f4fba3285a28543e347f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047719, "uuid": "2b438595-a4af-4d1d-880b-ba7345180e68", "value": "T1E6F3F6AC634CAA06D61AD9BE40A16B85673794BB7723E343BDCD20A52F4B7D44801FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047719, "uuid": "31b1be9f-0ccf-4859-a5c8-075493dbfc84", "value": "3072:IIcgv0klbLsuZ+cBtLafVDvZsF7d0zA2MdU:IIcgvtlb7+AtLafVNsFJB2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693047719, "uuid": "a4fffb87-a1f7-469a-bc69-d93cb64c6f39", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693047719, "uuid": "891d82c5-7619-47a0-aaa2-ecf6be9c3968", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693047719, "uuid": "8b97c7d2-cd77-47c6-b568-ef178b7c8b2f", "value": "rLALI.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bfa87c-4426-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693064186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064186, "uuid": "def56b98-348d-403f-99de-b6c6708adbb4", "comment": "Malware payload (Mirai)", "value": "bc60c720f3e68febee603a3a7af05f26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064186, "uuid": "71dec6fa-9fd3-4815-8709-7e19d8ddec61", "comment": "Malware payload (Mirai)", "value": "e13026b234e56564eca99e0caff4825109f01652bda8c290a7f7da117d52eeab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064186, "uuid": "49b397db-718e-4789-ae53-93a4ff6dbe38", "comment": "Malware payload (Mirai)", "value": "ddddfe3cb7ad9f7e3b0c14de5ff6586537221941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693064186, "uuid": "dafe3214-1a11-4fbe-bef9-95f62003d68e", "comment": "Malware payload (Mirai)", "value": "b0683dc2fa82b1f5dc58b667e7c80791302a4330c804b9e2ccea8606683d46c0fe2cc3b8daf4870fdfc316270cc43be8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064186, "uuid": "7bbea011-a0ce-4fb9-8361-143bb9e9d9cf", "value": "T114F2E0214327E532CEB5DABB993182A8191B47F0F9BF74647794C59D88C1B02D1FE20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064186, "uuid": "1dc1c71b-a7a4-410c-98b7-fce85dd743c6", "value": "768:VYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjNo9q3UELCB:VYyAxdRH9zILLBBrodjNRLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693064186, "uuid": "db51d457-4f1d-4f5c-96bb-376402327668", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693064186, "uuid": "748f9aad-545e-4075-9dea-039aa18c4f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693064186, "uuid": "6071d96d-9c80-421a-bca5-48054016663d", "value": "bc60c720f3e68febee603a3a7af05f26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc5a84f-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046117, "uuid": "ffbc4f62-f799-45ac-84d8-9677858e3ffe", "comment": "Malware payload", "value": "ef0d8f35d242f0f0dcc096cf8b2b6191", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046117, "uuid": "e25df9fc-e0e3-41e5-977a-20468ad1ca73", "comment": "Malware payload", "value": "e138c23f8bbb7d205a612685ff07aca6d69b2fb5870b409b04d373dfa1702041", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046117, "uuid": "3a4efd8b-2790-47be-b90a-0ffe48b214f9", "comment": "Malware payload", "value": "e70415b6a6b34003faff61063238e37881c7677f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046117, "uuid": "a7ddd475-74ff-4bc3-bd60-c589ad68f2f3", "comment": "Malware payload", "value": "3207bbbf742ee45716b1fc6ecb17ea8d50a9defb83f53ac5bf3e2070e96cb1ac571c87d1f5167829cf5e51dd27fe322f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046117, "uuid": "d4df0f36-8dfb-43fa-9331-1a857fdd30c1", "value": "T1E4B39EC95944080AD54A0BBA35ABED068A77E7D083996D0CBDFD824F8F21F603D3775A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046117, "uuid": "d315edeb-4c68-4975-a92e-8c3f3a0024b3", "value": "768:4ylR5ro5ZeeFOd0AI8Sd4RPc932mY1rUNvGvUGwFf1Dk7+U35dxMZZ6n33UwAK1K:4YccNbN8FfC35XA0B+OVRbIz3hRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046117, "uuid": "1b0971ad-4f54-4169-a1da-971238a83153", "value": 113568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046117, "uuid": "7cc4e7e3-5d2b-4e97-af68-e83fe591d8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046117, "uuid": "157e6b85-bb47-4adb-9548-8be773cced18", "value": "SecuriteInfo.com.Program.Kuaizip.1.8488.24310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3904b2b4-4428-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693065004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065004, "uuid": "9b8960a5-1a6f-4900-9de0-45eed20e98c7", "comment": "Malware payload (Mirai)", "value": "5fa1ff1a1589a21ca946e6fc4e4eda7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065004, "uuid": "dcb6291c-549c-4709-b7e6-9f0aff378a7b", "comment": "Malware payload (Mirai)", "value": "e249a31dffc6d9183bfeb2e81331681135def4d5609c361f9831d0e566d9af4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065004, "uuid": "da116324-f2e4-484d-abcd-b621d3bf623b", "comment": "Malware payload (Mirai)", "value": "bc89d4c6b4f03424f113616504ad915f91490182", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693065004, "uuid": "3fa8d3f1-1056-426b-aadd-67e8a7f77ee9", "comment": "Malware payload (Mirai)", "value": "d1e1e56be921395e5105b88adfe3fbcdf76e5f6b3ab79620c76ef74d95d2a982e8de8e5d49f9f1836fe4911c2c0834d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065004, "uuid": "ebafe3bc-12f4-4cca-a7c9-0237b333d55d", "value": "T1D3230221890E9DB124303C76DAD5D79376E129B1C6673123DA280B3C2FB9B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065004, "uuid": "464d8acc-1b40-4b82-a55b-871ac6f383e3", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3/R9q3UELbUXfi6nVMQHI4vcGpvS:gECFd+A6YHAxcLRQZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693065004, "uuid": "fc6b4518-c62e-41f6-bf49-b65ab85ebdaa", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693065004, "uuid": "c4e2a2be-42b0-454c-ad2c-f2a267e400e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693065004, "uuid": "6b70e3a3-2f6c-4b0f-ba5b-ace86a260a70", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b24c22d-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083395, "uuid": "91e9c176-909f-42d2-b6d8-5ec1eb58afc5", "comment": "Malware payload", "value": "68759bcb28fc64a3fe6f883d6600572c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083395, "uuid": "3dc410d0-f571-4b8a-9673-9aaa6663ec73", "comment": "Malware payload", "value": "e293a21a392a484fdf2af01d6e3b02412ebc98dda8f996af9c8062e8a27506ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083395, "uuid": "3d9d585c-d9a9-409d-8d55-9d038faa4a4c", "comment": "Malware payload", "value": "5a61e545c3bc62d0b039f1cafe66460b675da077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083395, "uuid": "6194b4c0-75f8-4572-9759-82e2886fd200", "comment": "Malware payload", "value": "4ab2d8668adc1fdf7fad34f8251e3dc94585f63a39f9e6486283f44f093fe74e61cc9804e149cb68fe6c78045b96ec28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083395, "uuid": "3086afa2-19a1-480c-abb9-a05c0adb4c3f", "value": "T12796DF23BD4D4CE1F46A813AC526BF74A5BF7DA447624CE763A02ED6F8111D1CE22A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083395, "uuid": "98bcd086-8e5e-4ddf-92b9-c78b707c34cb", "value": "4f845ef8b7253e839a5005be2bd11e8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083395, "uuid": "778a31e7-57ed-43fb-b417-af2439f2e7ab", "value": "196608:RQwWMbuE0R5HtzBm7ns2VoY4BZCSuvKyo59Up7OX7K61Wf70:RQwWdX2VoY4BZCSuvcT8oG6UfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083395, "uuid": "a875c91b-e3ba-4c52-bc3b-2acd577ceb80", "value": 8918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083395, "uuid": "9f2eaf62-bea0-4764-ab74-13557fdd01ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083395, "uuid": "4dd96f04-7db4-4378-82f3-f531e52ac5c2", "value": "CG100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d8e406-43e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693038135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038135, "uuid": "f7045021-eeb5-4eab-b76d-55c9a838ee74", "comment": "Malware payload (AgentTesla)", "value": "255aef6de374c4d17411edd3f35daf6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038135, "uuid": "dc57ab5c-d7b0-40cd-93ff-620aba068b11", "comment": "Malware payload (AgentTesla)", "value": "e443689605b88939c8231a374f939a1cbe906c1b776213ee5a2951d86584e5b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038135, "uuid": "74d7fa21-1a70-481d-b220-cd0e799cf893", "comment": "Malware payload (AgentTesla)", "value": "c47e2a0fdb9017903312b81eb6bbf21281a15cf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038135, "uuid": "86c39a77-625c-4055-a0d7-9b2d69d6569b", "comment": "Malware payload (AgentTesla)", "value": "77595d1c4a803617a3d167b34de9a318dca38e35a5cce7e9864ff2cf3295b9ee44a3cc630035ffce360eae9a40e804c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038135, "uuid": "0e90530d-0b0a-4092-8531-30d8ca07eee3", "value": "T121F4238CA1D106B5D78BD53CE47E1AF03A2197AA80155FC2E3230DF21FB66F92758A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038135, "uuid": "9648f01d-da2f-46e3-b94c-b806d7ba3940", "value": "12288:a9nWm5glzaqa/EQcwmhXHjmy2rDib+6fvopbejobJhuRIkvhE5xbLjzUh5mhi+vh:yglXoIw6mEw5ejmoh6xbLUhQ0MDCcvOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038135, "uuid": "0bc54616-1583-46d9-8b00-908a8f78eca5", "value": 747881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038135, "uuid": "04c293bc-5c65-4927-8509-3b4e6f9d1cba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038135, "uuid": "7cde4fc7-95f4-409f-91d4-ffb73edb51e0", "value": "Ord.Nw0289WIN-3LA6 U.S.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2510c994-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046072, "uuid": "ef9f8d93-b8cc-4275-a84b-def88751adbb", "comment": "Malware payload", "value": "15223111ae1f4b87311bdd83502d9875", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046072, "uuid": "36665d89-0f4d-482d-a402-54a75c1c51fc", "comment": "Malware payload", "value": "e4914ba64cb89fdbdb8bd2bd72ef89b6d1d7895f738cc69952f00c531c68f6f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046072, "uuid": "b30a7c41-c4f1-40c1-a99b-36fb26ca08c5", "comment": "Malware payload", "value": "9e3e9ab1210d909ba20b5d208ad92cd29cb21320", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046072, "uuid": "7961b43d-6e5f-44af-866f-57c0cff86676", "comment": "Malware payload", "value": "8be948d411e6c6b0e0a316f95d01c62da572a3df37a5349c8134dae110ca62f48edcf9150d74686986234c74ac1d7de9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046072, "uuid": "3c7a678e-bf28-4c03-b988-54979e9ab509", "value": "T10A55129BF93772CAC376EE7B285857ACDC7E18302D49500F55A452D2CA35B4A0BC633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046072, "uuid": "fa37905f-d780-4694-845a-f4f1a18ad8ca", "value": "73133d56e79b2ac7c23a0f2cc77b92d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046072, "uuid": "7e66f676-d7d5-4858-b22d-2c47c253b82e", "value": "24576:7ZHtsW5ebJi1Ss4a6Dr3e7/U5UnkXtZQT1dJ/OLtO0hjAt0S0Zly:7ZHtsW5nePiCU6qrWxO0Kt01o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046072, "uuid": "a298b013-ef6c-4e09-8121-362879c2b59e", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046072, "uuid": "042c2768-4efb-42fa-b678-9aa0f95b27b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046072, "uuid": "d93b7b5d-ad5f-4f22-89a4-998e0ef47d6e", "value": "SecuriteInfo.com.Win32.InjectorX-gen.18283.9478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0959d7-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084927, "uuid": "e8ebdef4-d36f-4254-b86c-4889e47dbe83", "comment": "Malware payload (Mirai)", "value": "2b8bdc17122df9e3d021d90e203c76d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084927, "uuid": "1f5c95a3-6b17-4d60-a581-b7fe0d7411ad", "comment": "Malware payload (Mirai)", "value": "e543d68671c0e161f2f57d02468e15e43c99da7d3f87d422cad40fa5c09e0ab2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084927, "uuid": "8ec3ac77-26d5-49a8-b588-f2815d170e31", "comment": "Malware payload (Mirai)", "value": "c8dba896e049d4e2147cb997db34a75ef6778d55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084927, "uuid": "efee89bb-0b42-4c7d-b2c9-9855365c654d", "comment": "Malware payload (Mirai)", "value": "f6a160445c2993de85ad920bd19c7f01c04f51b0254bfc1c00f5eecc7efc4020a8575c800207850f53c61e9f68c77227", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084927, "uuid": "38bafc91-349a-4a25-8c2c-af4379fb8fb1", "value": "T13EF3995E6E228F6DF668873147F74925A75D33DA22E1D684D2ACC1102F2029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084927, "uuid": "61070822-4ce1-422b-920d-0e4049fec251", "value": "3072:JynVVwZYn+ge7FW4mPb5MPy3F5lPbpQ9J:JW/wrpW3z5dFDzy9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084927, "uuid": "cc58e2d5-4941-44fb-93cd-bb8b10343814", "value": 165528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084927, "uuid": "1e4c7a1a-d70c-4f7f-8943-fae39817ad6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084927, "uuid": "d3be1cb5-9ec0-4f9c-b9f2-1181d985fe96", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bf1474-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693083604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083604, "uuid": "e662195b-34c7-4255-945e-cbed630447a6", "comment": "Malware payload (Mirai)", "value": "953a5a2e8c29bb0bd859458ced4527aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083604, "uuid": "1b0872cc-fb0d-47e9-a8c6-830b57e35fae", "comment": "Malware payload (Mirai)", "value": "e54ab1e19716a3da301d5174c36ef4b3c36e2755ec7168e0660ec39202b04bf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083604, "uuid": "5400b468-0a8a-4ef8-b637-b5bf5245d950", "comment": "Malware payload (Mirai)", "value": "723105abb7e3e1e45ad4401d674a5f8b21a1dc87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083604, "uuid": "243bdbce-05b8-47dc-b502-adb8310e6e64", "comment": "Malware payload (Mirai)", "value": "c70ebc786f9e0075b2aa962f18ef472fac9296ca8f3f8445862f88af1121b97996a22c4ca9d88ed2c6636cdaf9977332", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083604, "uuid": "08f6c3ba-9874-4a8c-96d0-2d32f73f0ff3", "value": "T134330201A5D7569BCCF0383E9DE59147F8CC8A78E0EE61727ADC4651FB2325C0AF4896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083604, "uuid": "8ffc516d-feb8-4c30-8186-920325652847", "value": "768:dTT7+uLTnURcF1mwtMHkATgWNNwi1CwksIG9q3UEL420Dr5sg/38:dPqu/GA1jtmkUNNxCwk9LOpP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083604, "uuid": "2c588b45-9d74-4117-88ad-7c62ee756950", "value": 51548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083604, "uuid": "409bad4b-768c-4033-8e28-fe93cef295bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083604, "uuid": "0345f4a0-171f-4f68-bf36-4be87b7cf624", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13f00d8-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084935, "uuid": "2c6740a9-1140-4a27-b575-bb57c20e28d1", "comment": "Malware payload (Mirai)", "value": "5d7afd41a4df14387ad10bed458a84a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084935, "uuid": "36968a2c-2dd4-493a-884d-c62d293e5225", "comment": "Malware payload (Mirai)", "value": "e60f3744dbddc04a973d36cafca1592af0ccfec4a9a2285ebea184e548e016a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084935, "uuid": "033e0272-ed77-45f2-ac4f-ee373289465f", "comment": "Malware payload (Mirai)", "value": "bfa26fde0bf00026216861dd7118c45f7ff6e14f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084935, "uuid": "978ce484-a90a-47da-a1df-3a7f0d334183", "comment": "Malware payload (Mirai)", "value": "5efd97cb62aee56705ef4f741499f41270874ee7098c066e676ebe31554e117782e7d1d54721f47428d25d67e2b5faf6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084935, "uuid": "b9024124-b65c-4be7-9503-3ddc5053f3fe", "value": "T117F3D81A9F610FBBDCAFDD3706E9070239CCA41722A53B753674D528F54A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084935, "uuid": "c2881a8d-2772-4d67-853b-5f8e5db17ccc", "value": "3072:QlaBibfe0OMz7w9AIr/BOhnY8uVYKdkWN:Q4wfmMQ6IrZOhYhVGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084935, "uuid": "9f863ed6-39c3-49f1-a5b0-0e6fba1415f1", "value": 166328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084935, "uuid": "aeae0a8f-9a0a-457f-87dc-ec09e766fb02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084935, "uuid": "cb54f07f-fc99-47c1-95d2-64e732350f53", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423f0803-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046121, "uuid": "56e72520-70fb-4eb4-aef6-2dcd4f27a2fa", "comment": "Malware payload", "value": "572568fe90deff0baa45bbfc67886559", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046121, "uuid": "0da46fd4-2ba0-45bd-8005-e5f64cf6fde9", "comment": "Malware payload", "value": "e64645da2f8550b1b46aa6e1781736880bf1c59b36413b717599cd57d52e549e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046121, "uuid": "7a01ffef-36fb-4b21-851a-26dcaa6c267f", "comment": "Malware payload", "value": "293ed41cc4c186d2d51cb11f55243e8207caaf2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046121, "uuid": "27d54ffa-d124-472f-bc47-c5d0f3be9ebc", "comment": "Malware payload", "value": "c5e653d3ddd2adf89f2dda902a649d6d440ca9477adbdd048aa58e6c9141039d0fd96b7bcf56bfaeb9f877e4d5a850cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046121, "uuid": "3f0424bf-7f3a-44b9-b163-670ccc2bb883", "value": "T182E5BEA2B8637034CFE3C1735629F11AC6BB5EF002E5B5B677A80815CF6559BF286312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046121, "uuid": "b0eeb739-8887-44ec-97d0-c70b6053b7ce", "value": "befa59eea287a1daa439f40c48d6461b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046121, "uuid": "9ea63297-b914-42a4-be59-1d043bc8acf7", "value": "49152:+kjT/NBd5PgSrvfm+o2lAHS1pch6yPdWlcatwnyQwFCYCePV2xGyJS:JDPgSjRAHSbc9Pd0wnOFCYCeN2gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046121, "uuid": "28975cd8-0c14-48dd-865d-d05d040903be", "value": 3244448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046121, "uuid": "15b60678-4cd2-4a3e-ac9a-574616f3e178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046121, "uuid": "967325fa-7379-4150-a6a3-dfc41044be51", "value": "SecuriteInfo.com.Program.Kuaizip.1.18955.11082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e760756-445b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693086998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086998, "uuid": "c6a4c711-b905-4fb3-95ff-abbc218c1676", "comment": "Malware payload", "value": "1d60858462e0c388ab697ba7cfd35bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086998, "uuid": "afa2b93e-6481-4063-b5a4-c63800525c28", "comment": "Malware payload", "value": "e7698619d7e8e63420bcd8f396b631e9ac64fb226fbd965fea886fcedd2c7029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086998, "uuid": "c027859f-a5b8-402d-a52c-06734d544d44", "comment": "Malware payload", "value": "9a8dc1911a7d129fe0bdb8ec571f8b84982a6947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693086998, "uuid": "3f95145c-09cf-499f-aa78-67dda5044bad", "comment": "Malware payload", "value": "5094cf6b8b558f136f9e8e2b6e3728a7848b2788225e5a41f73b68224f45a207dc4cf8c301ff62b905a75db90a288d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086998, "uuid": "f6718b7f-43cf-4d8e-98b1-d90334200886", "value": "T1CDF533127AC0D5F1E67A3B315B69EB31E77D78300B24CDDF53A166ADA1B14C0A7322A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086998, "uuid": "e9173b24-b14e-4ede-86fb-603d81347ef0", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086998, "uuid": "c479c1a8-176a-4653-a8e9-c82d299b6b51", "value": "98304:wWhrPBfKEu54Ox0JchEJeHFfd7Nkdq3fCLdQ1epJxvxZq:YT2Jchqelf/eqKLa1ep3xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693086998, "uuid": "7443c516-df29-4d30-a928-dbbfc90237e8", "value": 3516370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693086998, "uuid": "4cf759de-abc8-4b8c-a6bb-fb8909d8fe20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693086998, "uuid": "36487666-7ab7-4872-86b3-e008380de6e4", "value": "SecuriteInfo.com.Trojan.Uztuby.4.5171.13647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0445f5c-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081122, "uuid": "ca61760b-b07c-4d9d-95e0-40543e2161ab", "comment": "Malware payload (Mirai)", "value": "a732db198f568a416c482be422874e42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081122, "uuid": "7a85bf1b-811a-423e-bc32-c10a1dd09173", "comment": "Malware payload (Mirai)", "value": "e934e46e503442664242153bc2a2f514d951aa304127158e6d16bf0ec9f2ec56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081122, "uuid": "ffe587c8-f8f7-49cc-8222-78dee2f92ccd", "comment": "Malware payload (Mirai)", "value": "933b96c4c99c0a01a72983df2d53e53fadff46a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081122, "uuid": "e8cad7ba-fade-4ae8-b012-770cf112365b", "comment": "Malware payload (Mirai)", "value": "9412467784bfd6fede0124e2b4e9a4bda097d6cf9eca348f9b3d5db6f8ec44c47b8433f81c0eb424b45572354459ab19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081122, "uuid": "671f242e-1fa8-4b88-9048-c03a1ea0fd45", "value": "T1E833FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081122, "uuid": "1d1efd54-d61c-4172-9c40-109d2f7d90be", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGk:r/hqaJMcjeqK806MHdMfQXoHuCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081122, "uuid": "ba88293d-d747-4aa3-afc0-ce3f87089131", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081122, "uuid": "4d2eb935-f4ac-42b0-a6b2-1b5b40ee0a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081122, "uuid": "8bfddbe2-a0af-488c-ad69-10e23df5fafb", "value": "a732db198f568a416c482be422874e42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe29c23-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015455, "uuid": "9e8baf73-d4d0-4b32-bb1f-ac0f2235d036", "comment": "Malware payload (Mirai)", "value": "6f319aaca5c17cb9d173c2c86f673562", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015455, "uuid": "f24cd9ab-a4b5-4ae3-8e4b-6cd7f73e2e68", "comment": "Malware payload (Mirai)", "value": "e93fa92433d9ba5d1124e1cfe5b762bc1974324997c6dabb0814f7fd930285f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015455, "uuid": "a3cd9bd0-21a9-4823-b7e7-c2f962fb797c", "comment": "Malware payload (Mirai)", "value": "70c3178d8fd187203e240aaf0455deade58aaa52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015455, "uuid": "c27d4284-4548-4203-9b43-ac5432dc2f8b", "comment": "Malware payload (Mirai)", "value": "bfefe5e652dd47e9e004bdda205622605336cdcb7bde7e821ac0ebdf20b056ed2d08885fad84c2e665f4c0269d0fcd36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015455, "uuid": "e58f5955-d049-4844-9b7e-cbd441352c61", "value": "T147C2D084F145DE01DFEA29B12E44CDDABBE06F2EA962CE8126A153D15E5D3A70306DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015455, "uuid": "8236fa25-4349-45bf-b70a-a6a8f75b0a44", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PDr4uVcqgw09t:mam+AnKehPRa9abr4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015455, "uuid": "9bbc2812-e078-4c2d-87e5-cc86f5e1e6da", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015455, "uuid": "564e78b8-e90d-45e8-af4a-51725023937e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015455, "uuid": "0a08d28c-24ac-402f-8ff9-8fe1ddebb84b", "value": "6f319aaca5c17cb9d173c2c86f673562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93b4e86-43ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693038644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038644, "uuid": "c8bf1966-8ae6-4bee-be6d-2b67e1ce2695", "comment": "Malware payload", "value": "5c3b48b9935ac2a2dc78704d0e1a8a90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038644, "uuid": "506859e2-ef69-43d0-b717-74030f9d9868", "comment": "Malware payload", "value": "e9669e9e0c1cfd456247be2feaf6685fbc623bfee100d6bf16a76f1c3771a7c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038644, "uuid": "48b06a8d-1ad4-4dfa-ae8a-8866422c5116", "comment": "Malware payload", "value": "dc4ab3d65a016595c28b0ae8cac2969d5453be44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693038644, "uuid": "8db8f520-f3a1-4c91-acc4-59c837d4cea7", "comment": "Malware payload", "value": "08e522bdc67d55d017bbfda42c134d7cc682d211e292c486fcbf21f605a56c283eec3c7886105393d2d6b4e14d403e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038644, "uuid": "ae828a40-7263-4f3d-8b05-4a596b7db289", "value": "T1716633232145114BC5E4C8B6A927FD80F3B71BBA8B836C79A7D96CC635714F9E282D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038644, "uuid": "e44c4043-327c-4788-bd40-9601112511f8", "value": "9ec60fe0c25ff3dd80e0febe2d275d41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038644, "uuid": "b2456b49-6049-4cb2-a4c9-4953a3ff51b4", "value": "98304:gYOpjnaDe7pEGzyiQDOuknu4TNPu5zGxDicRQwnwyNkuBY9pxvGVqMMjDngfBvb:gbJEeOGZPuknu4TNAzGx2tXuqIg1Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693038644, "uuid": "3b0f4d89-58b7-42b5-b032-9e585d8b10a0", "value": 6532192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693038644, "uuid": "34a548f7-6483-4fed-9d99-38715268ac85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693038644, "uuid": "09cc25db-ff88-4559-8cbe-1d140a39955a", "value": "5c3b48b9935ac2a2dc78704d0e1a8a90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d457df5-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085653, "uuid": "b875eeae-317c-4f33-9ca7-4a471e24c2f1", "comment": "Malware payload", "value": "f5c51e7760315ad0f0238d268c03c60e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085653, "uuid": "5526f8dd-e88b-470c-a6e5-1def47d4ac08", "comment": "Malware payload", "value": "ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085653, "uuid": "1be4b2e9-e4fc-4cd9-b449-d3269b098fd8", "comment": "Malware payload", "value": "85ebaaa9685634143a72bc82c6e7df87a78eed4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085653, "uuid": "7b48c192-56c0-494b-bb95-e82b0314ac17", "comment": "Malware payload", "value": "40777d05f1ac7b3840911f540af4478bc84b5c15fc9ccff96c27ff48e1e3b7ca3daabd253d31ec5cd98974bf6dff4ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085653, "uuid": "1b5e82fc-db46-4452-b16a-dfe62a1c27ca", "value": "T18506231149E301BDCC16EDB986B70C2D7092A8B0ABF0B9F46351CD99191EC2EFB59877", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085653, "uuid": "3facde80-2d73-4142-bc41-9e4cc779b948", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085653, "uuid": "30673d62-a1af-4e0c-b6ff-68038653d143", "value": "49152:igUZan/N8cnnhzkmNraFEZPEF/4mpeD178OgxjK5j4Ga6BGnCtMPBQKChwm/Xu7M:incbnZkmxaaHFrySDZBBa50wm/e7Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085653, "uuid": "4921bf60-a381-4d0e-88b2-c7be9b99449b", "value": 3904000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085653, "uuid": "1662e3b5-99d3-437a-8065-84f12e6af60b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085653, "uuid": "0978b115-02ac-41a4-986a-a042251cb4a0", "value": "SmartDefRun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d951f7e9-443b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693073433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693073433, "uuid": "d8d3fc51-9cb3-497c-a6b2-150b7dcfb90b", "comment": "Malware payload (Amadey)", "value": "10ec6b8232fdafc8a3eb15ffc9b703b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693073433, "uuid": "f9c3f618-0ba4-441e-9552-df97d0ab6fde", "comment": "Malware payload (Amadey)", "value": "ea4dd1c228cb08ccf42861763becf5912840722e1a6d30acc59bc158be5095dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693073433, "uuid": "c3c9ad90-6ac4-4626-8135-8302bff414ef", "comment": "Malware payload (Amadey)", "value": "0fc092bb276b8ff3e0c7565332a74fb79fb0f750", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693073433, "uuid": "9f281c3b-2b58-4bac-8b29-75e20972f20a", "comment": "Malware payload (Amadey)", "value": "b647d9880bb9aab2b5290795a16f0ccaaad60a973481fa9f70a0e5f835e0b6c70c2f7c39aa9194feb9b6b9e2190e3709", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693073433, "uuid": "d720f059-eee2-4f3e-8f77-271904a781e2", "value": "T11BB5D6203AEA1248D47167304D75A5C656BB7EFB3F15C62E169A064C8D339C38B12FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693073433, "uuid": "f340a3c1-bf97-4a05-9d1b-fe5cb135c57f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693073433, "uuid": "f86e61b7-863e-4739-b732-4ba99ecf2485", "value": "12288:j+kzj8BlSO2pkQE1oqPnyjD7JcpegeklmnnJqJx0I2lGvBU4zGPmgnCWSjLFaitm:83sExECxeH+6aICw0gC7KV79rUGaxzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693073433, "uuid": "681e4282-e1ae-4632-8c13-e51f484f80e1", "value": 2271232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693073433, "uuid": "e407032d-0757-43f9-9122-56e1059fc471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693073433, "uuid": "10b3870c-619b-4e6e-9771-123749f9fd6b", "value": "Blazerstreetavenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7831bb-442b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693066620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066620, "uuid": "b9107f39-cb66-46d8-91a3-f43532dd6a8d", "comment": "Malware payload (RedLineStealer)", "value": "3e1f0773f19a6f06fad6a10f44dc846b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066620, "uuid": "48e1ce3f-8d6f-4681-a2cf-12b355352b81", "comment": "Malware payload (RedLineStealer)", "value": "eb3d0d631eba885dfd0f9125726dc5722d778e84ff84674799f37e640ac7916f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066620, "uuid": "2082b6d1-8cd6-4ec7-8082-78d65e15f8fd", "comment": "Malware payload (RedLineStealer)", "value": "b22bb16158a88727dc239163ae1a067165c5112e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066620, "uuid": "7d631833-7970-41f3-869f-5c2364405741", "comment": "Malware payload (RedLineStealer)", "value": "d9075227dff3e463f53b58e1dca3ec9c0f8a9f66e7a93e821101e18e9a3c8896f476425cc117c22f4757ea865a9835b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066620, "uuid": "58eaf4ce-4527-484f-a661-d8138ce0488a", "value": "T17C847BE171E1CAB2E7A371310ED88AB4257FBA19065F489F5BBC1B1D0F2C1818572A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066620, "uuid": "e1b75069-eb9e-4ff3-ae79-4b4aee82b688", "value": "a8d556a81f264cbf87707551d1515c69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066620, "uuid": "1a5566d8-94a3-4f2c-9996-46ca9f4f29fd", "value": "6144:s2pHJxrOP2KLFqPAHpAO8NZl4UJo88onybFtoiAUn7kdV6aAk5F7GJp:ssHJxrerp2NE7kn/QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066620, "uuid": "05d087fd-c7dc-4ef0-a587-712bad20bb7a", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066620, "uuid": "ea6b9586-81ba-4cfb-b499-9bfc75c6a7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066620, "uuid": "7223ca64-9227-47b7-ba39-e27ce63a86e0", "value": "3e1f0773f19a6f06fad6a10f44dc846b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2c300c-440e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693053919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053919, "uuid": "8bd69a8b-9448-41d6-9c67-b06b81412840", "comment": "Malware payload (DCRat)", "value": "180806f8d78d49ab48d39e297865c72a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053919, "uuid": "cba19be8-cd67-4deb-b504-8030192f103d", "comment": "Malware payload (DCRat)", "value": "eb50f1549e55f943b73285db4c4e7edcb7f34a0f67f65b1dbed2b13a819bc962", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053919, "uuid": "2d3fe1c0-61fe-473d-aafb-29a99d27279e", "comment": "Malware payload (DCRat)", "value": "faf9d65012541db14028327c03a8a78a2a108b03", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693053919, "uuid": "d2de7409-c167-4ee0-978f-8b8b6f4bf55e", "comment": "Malware payload (DCRat)", "value": "c7d069eb1ae3686ea7fa1e8f47b219a4b44aaf24222c3da2a0cc0ef68e19e1bc5890918a66e6745a5aec579f65d62f77", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053919, "uuid": "dd4785ca-2e79-4dfc-b956-f3e1d9a03438", "value": "T17F656B027E4AED02C0292637C9DF552447A8FE497B67DB1A7E9F335D62123A70D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053919, "uuid": "092d0182-1663-4e4d-8e7b-52a7ed4c993d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053919, "uuid": "02646d56-294f-4012-afb2-2b18412a2cbe", "value": "24576:lyxYeTpUhC5vBS/oNHlnDXHp0wq3cFUNN/lvzUBC7N++4:lvhCRVFDXlqGw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693053919, "uuid": "7c398d5f-6054-4296-b259-7f25a0da3a8a", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693053919, "uuid": "7c594f1f-ec34-4a77-a2ae-2cb49a761ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693053919, "uuid": "c5d0b204-1c2e-492d-bda1-47d6ef3c66b3", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-eb50f1549e55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4feb2570-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1693046144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046144, "uuid": "22a920cf-b2d9-4730-a6e2-b2a01ec0eccc", "comment": "Malware payload (Arechclient2)", "value": "91519580ba491240ece3cf4daa8f2a79", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046144, "uuid": "673565ac-fb5d-451f-8d3a-bda8d07d7e33", "comment": "Malware payload (Arechclient2)", "value": "ecad64e2cb8dcc58e3666fbdb52a4455769878837b8559b48c74259a2094eb10", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046144, "uuid": "8310d259-6cb7-4131-88db-af9d11c64396", "comment": "Malware payload (Arechclient2)", "value": "fb73c136c0316f5607d374f5497121ff7b908768", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046144, "uuid": "f057379b-3137-4aff-a3cd-caadf5037959", "comment": "Malware payload (Arechclient2)", "value": "2a7c15117efb83173498455315f540735879d7880caa9729ccda3eb9be88633748ef8e825ce547901d15594dc4424660", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046144, "uuid": "9a813c4b-664b-4270-888e-0c9a216eb4f7", "value": "T174C5339CA974DE2FD02D187C06BBE0255EE41FF18D518816F6EBDE034F7AAA019A14F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046144, "uuid": "bfb58cb2-dc1a-40b2-805c-fb20346330d1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046144, "uuid": "8b2b9a17-55b6-43f4-a930-b3d0933a1ad8", "value": "49152:KtVha9KI9AkZPq7LwDzXajLOB4IvOkVJ+1CtmVVBpUD0sDTITKQz:iVQ9XykrwLOB4uOW8oUVoRtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046144, "uuid": "b19b2eec-214b-4a7c-822d-f020f2eef3f0", "value": 2673664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046144, "uuid": "c77618e8-5985-47d9-ac4a-ac33b9960f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046144, "uuid": "e7bd3759-1431-4ce7-a3d3-4194078abef7", "value": "91519580ba491240ece3cf4daa8f2a79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baef7d9f-4458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1693085837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085837, "uuid": "fe858bbc-638c-4e72-947d-843351ad560e", "comment": "Malware payload (Adware.QQpass)", "value": "1507563c31ecaaf29c4b168da58d27f7", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085837, "uuid": "dfb5e7f0-0181-47e7-92a6-c53b86f70346", "comment": "Malware payload (Adware.QQpass)", "value": "eef12d5811dd70782bf19cd787641dc8050a564aa9416588a7873f7a41f98dc6", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085837, "uuid": "3f255560-841c-4fdd-9ded-4149695a9450", "comment": "Malware payload (Adware.QQpass)", "value": "f0452a3e200c84a8c89ea2098d7a19047496ce26", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085837, "uuid": "b804afde-a7ca-4d92-8be8-cc1f6b71f2a0", "comment": "Malware payload (Adware.QQpass)", "value": "a38b5fc959bdb25b308d01988c972bf99b84bb850396211e0bc2126dd7ad229a9534ef4c0e5a6e85ce3c797447f99dd2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085837, "uuid": "218c8f54-b861-44a8-a678-1ba28b414a03", "value": "T1A8F5330554CB9BCBD29ED8769C79DEA4CD7E15183092161BDB834E86F8FE90E340A3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085837, "uuid": "d8649992-e669-4ed1-8731-365eb2ca3451", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085837, "uuid": "52d4aba3-a67e-49f0-bd0b-57cc336826de", "value": "49152:Krf/AYdsXtdKP5nhn7pXRSQASkKddT3jVbVkwqdgoZCkdAuAw8MkGTA1Q:Kr/AwsXDGnh7pXcAkU3/kqGdAJMkGSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085837, "uuid": "6462ffc3-fe5a-42b1-877a-7605a0c6bba4", "value": 3336150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085837, "uuid": "789a9c4b-ce8d-4a83-896b-f093da832286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085837, "uuid": "6b7a36bb-e879-4968-baeb-001c112c9d73", "value": "buding.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba7000c-43b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693015428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015428, "uuid": "eb6ea8bb-9d01-4a4e-ad1b-d3b00fb52676", "comment": "Malware payload (Mirai)", "value": "25eae2ad8465972ac0064440d50fb04f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015428, "uuid": "f9e56444-83a3-4153-bb5a-ab3899a1713f", "comment": "Malware payload (Mirai)", "value": "ef82cc6a6b1672785d78ad8101a2a2582df084816a06ad826446fde0aecd365b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015428, "uuid": "1dfa38d5-2ede-4e0e-9a35-fba3ad1050ba", "comment": "Malware payload (Mirai)", "value": "ec0e047d94c74abcaf4357b97879e722bc32bc5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693015428, "uuid": "49481560-1621-4635-a904-7fce9340a6b9", "comment": "Malware payload (Mirai)", "value": "7cc30879d8bd7658038439873de31247148747e24ae8d52a94dd7a09e9e69cbf974a45a319e354e8413cc769db9701a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015428, "uuid": "f23f7989-5454-4247-9083-8df143c8c8a1", "value": "T109D2E01CD95D7905DA9D3EBE51CE86B5388CB0C0539DEA8E07268418F627FCBAC470B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015428, "uuid": "0e5b4597-0be2-4003-9783-4621a68798dc", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNFU0XJbiWUH:1bDs06t4BEub4sU/MbUFU0XmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693015428, "uuid": "418e472b-7e8b-4542-b5f9-a9f67cda4536", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693015428, "uuid": "5c860446-d240-4401-b3a4-138db655758a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693015428, "uuid": "8991064e-3e12-4900-b650-5a93f05b9dca", "value": "25eae2ad8465972ac0064440d50fb04f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c904758d-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081137, "uuid": "3bbea06e-7e12-46d7-bbd7-2d44210e93e0", "comment": "Malware payload (Mirai)", "value": "46d67823707b6651f091c90224bb5b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081137, "uuid": "c8c3b05c-6e15-4567-9615-0459a4c1c78b", "comment": "Malware payload (Mirai)", "value": "efa1ebd10d6650ccd416be221e162915449e684df16b8ba8da658b7dc4e3d1fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081137, "uuid": "9e2ee241-432f-4b07-9ecc-4be38019e5ee", "comment": "Malware payload (Mirai)", "value": "e480834f053a745ed43e41d48a2d81cfe2d4f56e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081137, "uuid": "aa0341c9-871a-4ce9-b211-5dca65ab105d", "comment": "Malware payload (Mirai)", "value": "1d7c4d53e3633220ec35cb768d40c3c6465bf2bf740533d3bfd688c96da9290bbbf6a85b208e2d78e1c587ee00c0b491", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081137, "uuid": "c80d85c8-bf9d-45a0-80bf-2efbd9f64759", "value": "T1776329C5F980AA26C7C15577FF4F034A77268758D2EA3303E9295FA1378B85B0E1B606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081137, "uuid": "498d46c2-d03a-465d-bcfd-2fbc918b349c", "value": "1536:GZa7JKwgdsxgx4hgsuM9zpJRoTnY9ksHMY38XxEF:1JKwgdsOBO5oTY9fMT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081137, "uuid": "2171b0f5-4a82-45ce-acd9-feabeb909ebc", "value": 66876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081137, "uuid": "06aca864-088b-4650-885e-247f213a391b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081137, "uuid": "90e70053-a5eb-4933-9372-aae4af45963e", "value": "46d67823707b6651f091c90224bb5b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305f6d2e-43e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1693035354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035354, "uuid": "7e536926-3c71-419a-b5ad-3d5caa5c282c", "comment": "Malware payload (MarsStealer)", "value": "a62cc2d2912494efb1912c23121bd3f5", "object_relation": "md5", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035354, "uuid": "08e4a129-9e66-4d93-afab-d147b233a8c2", "comment": "Malware payload (MarsStealer)", "value": "f01a4bf442fac3c6a6c2feab8248b6ba95f3bf0c8d434ce01675454f4d50c79d", "object_relation": "sha256", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035354, "uuid": "38bb4dae-2563-42c0-8efd-6b4815b1ea0b", "comment": "Malware payload (MarsStealer)", "value": "966b2f1c777ce90d1d2612e978d95a6440641c7e", "object_relation": "sha1", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693035354, "uuid": "a70ff374-82c2-4563-88c2-9d0078812c86", "comment": "Malware payload (MarsStealer)", "value": "1840a4bd75cd923e27cee1e3a61b5850363be2c4e1c2feda670b0d907349b6fc45cf02d048d627ebcb801527163c5902", "object_relation": "sha3-384", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035354, "uuid": "aea174b7-c759-4bd8-916e-300990ab4cad", "value": "T136453380347D715517E3AE179A4C7E38D19EDB8F386833E9CC6A6BD311C60A9CC98789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035354, "uuid": "ede5003c-85ec-415e-87d1-9ced977f6483", "value": "24576:jgfDYUOSY5aRgHDmRnq73ryd53FnIZVqVl3hyMKi2rhWJx9:08Z7bSX/3hh72Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693035354, "uuid": "a35dae80-cf60-4eea-9ca2-64abf395d793", "value": 1273694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693035354, "uuid": "af860e17-ae8d-421a-8111-2699f1144816", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693035354, "uuid": "79bb1fa1-5bfc-4e40-9efa-bb5ac4d85e24", "value": "Booking information guest.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602dba54-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083538, "uuid": "faa65ab3-e1cc-45ff-9803-2271c2095f12", "comment": "Malware payload", "value": "364858f290675c0bfa0e4d0801a4cbdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083538, "uuid": "42ff2f9d-9d40-4848-986a-ae707c496f6f", "comment": "Malware payload", "value": "f1511c275f089120b3eae3ec28aa4627e4fe267861441417bc143d020c8bc4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083538, "uuid": "2796ecae-aabc-44f7-bf80-4c64e863113d", "comment": "Malware payload", "value": "34f10b8af99dc2b2d311a9f0afe13429b6a4d8fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083538, "uuid": "91f8e71f-f786-4ba2-aac6-562e35b1179f", "comment": "Malware payload", "value": "000553918d48a00c321c882b8d7f1702767056365521712f6f97589c844fe7cb817af6b5845c83aab422f5fa57bc022b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083538, "uuid": "98ba5843-7482-46a8-832a-e66976c3d850", "value": "T1F2766C45B703C11BE8A37AF1860AA9D11A79BF285A72C4D731DD2F9D2F72B413E19603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083538, "uuid": "c0bfacd1-e11c-4b7c-8b93-cb82d85bb6ff", "value": "9bac931047db84144fb36529b7ee6bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083538, "uuid": "b9978dbf-c708-49cb-a641-0c4bb5c766cd", "value": "196608:daw/SG01yln9fU+fRSshFAzOZdpa5KplJveXGJh7zDubJ:daQSG01ylnO+f4WAz6dpa5KplJveXGLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083538, "uuid": "93673abf-111f-4ff5-91d7-2a61d5bd7e78", "value": 7674387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083538, "uuid": "beb6760c-609e-44fd-a3ab-6ab2cb235891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083538, "uuid": "5422d728-a881-44aa-a819-352074ee4e65", "value": "VoidRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef0d3c6-43fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693046062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046062, "uuid": "d3048816-f11a-44e6-8f7f-4aa931db4bba", "comment": "Malware payload", "value": "fffcc4b56968815efedb2b4cf98252f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046062, "uuid": "c599c822-17f8-4805-899a-ad2d278b4d02", "comment": "Malware payload", "value": "f1c277336175143af274f230fef4ee9dbb75c9a04c0b43c66e824095e1240426", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046062, "uuid": "a1dd63e8-f97f-4e43-98a9-aa1f6a3f818f", "comment": "Malware payload", "value": "591590222b7161541bce348c3381caf0f7811132", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693046062, "uuid": "198368c3-4101-4cf0-9699-2972bbc480bb", "comment": "Malware payload", "value": "d7f787fad6eb4649e2b862f27d50ddb52bcafabeaf7a78d7ccf6d0426865580ea08df27fc24bc43ea3bde8a2945d5406", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046062, "uuid": "f7bca6da-b831-4d49-8b67-1031d9ccf695", "value": "T11715AE217C45C032E29E01319A7C9BB758BCA9710B7890EBF3E8D9795E701C2763A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046062, "uuid": "4f9ce5a7-c690-4611-a2d7-5a0fe7313d65", "value": "511c90a493b437b5b339df2f05b7a4fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046062, "uuid": "8c571235-668d-42c4-8d95-fd10948703c1", "value": "24576:GRZd3ixWHNk+4e0l4j+9k1uKivDIQUJ+UOkViY:wOFe7ck1uKshXciY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693046062, "uuid": "9059aac2-8a49-4d31-b03e-47cca935f923", "value": 882080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693046062, "uuid": "7ad33bc5-8e77-4b9d-a674-f2e5560aac73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693046062, "uuid": "11f64635-b9a9-4f4a-aaaf-0bd47d3b8f6a", "value": "SecuriteInfo.com.Program.Kuaizip.1.26064.20260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6faa75-442b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693066625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066625, "uuid": "e50f9ee3-fc47-4151-9985-91bb6c40abfe", "comment": "Malware payload (Mirai)", "value": "4c7c74f49a554f06dca0143b5d294416", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066625, "uuid": "efaf540f-4f75-4f3d-8af0-11a7df68b6e4", "comment": "Malware payload (Mirai)", "value": "f281e91c310a7afe805db5a54cdef9892789d54c3678475484b902b3557f4b43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066625, "uuid": "17bbeef9-0bc6-4410-b1d5-ecbd3a9b325d", "comment": "Malware payload (Mirai)", "value": "bfa7c21b576045c90089de3ef2b943fbbfa85172", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693066625, "uuid": "5b40a727-2207-4725-a9d9-dc6a18e0b39d", "comment": "Malware payload (Mirai)", "value": "846e2145eb4696deecc2ee51e5e9b70c5351d484c33de488ba8242a9ed2e2a8c7646092b59995694dcdc1af691ef1f46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066625, "uuid": "7039e31f-6954-415f-9d24-d3477ba07243", "value": "T1F7330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066625, "uuid": "ad62b73c-1406-4ba4-a501-dc82e0918d04", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGm:r/hqaJMeteqK806MHdkfQX6HuCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693066625, "uuid": "38a81389-5499-494b-8f93-6f6ed94c65c1", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693066625, "uuid": "e53064a1-510f-4307-98bc-45a0a0507805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693066625, "uuid": "a6276c22-0c9a-442d-97b0-436536a684b2", "value": "4c7c74f49a554f06dca0143b5d294416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b9eb18-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042577, "uuid": "564443c8-f9d1-43e3-b57b-7bf37b91bdd6", "comment": "Malware payload (Mirai)", "value": "63c24b61f19eaf8c2ca9391c78796fe7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042577, "uuid": "33842187-ebdd-4f92-91a7-d75aa720be9b", "comment": "Malware payload (Mirai)", "value": "f30d210691cf21079daf227462f68e78876fde59cab76c2fbf9c82254307e9b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042577, "uuid": "0a50e19b-6516-425d-b8bb-c80fb37e04f0", "comment": "Malware payload (Mirai)", "value": "ffc65b714e1054e6b934e7567553c9df11d5d5cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042577, "uuid": "73c29756-9371-435e-895e-1df8b65ea183", "comment": "Malware payload (Mirai)", "value": "e3b8967fc0d89103c617e7e2e201b6f4a3649e0d9217af02f1f6f6b10860f387fb68ffe5a0c7a0cde293ff16d67234d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042577, "uuid": "1406a6aa-b837-48d9-a804-b27708395a04", "value": "T18D837CC5F783C4F5EC9305B2503AEB369B33E0BA1069EB47C3699931DC52911E616BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042577, "uuid": "c76cbd27-3aac-466f-bc10-4dc6f06084cb", "value": "1536:w9dSNhOFTpZqwGLc2OXGmdxWxVYOAS3tghM:w9dWOFTpgvuX1PWDD9WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042577, "uuid": "a4bd66fb-644d-4147-969c-8c9d65fc6e99", "value": 88424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042577, "uuid": "ceb4123c-2f0b-404d-b878-3348442d52eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042577, "uuid": "78633d1c-23b7-4c72-b2ea-259e70afff95", "value": "concakhbtandhuy.x86-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa05d0bd-4403-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693049302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049302, "uuid": "5689c6b9-e109-44f0-8c0e-70fcb3e88350", "comment": "Malware payload (RedLineStealer)", "value": "a0e56ff3a05abbe36cac70c20c6d1873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049302, "uuid": "3f3230e0-93a1-46db-a559-7d0abc5c5e5a", "comment": "Malware payload (RedLineStealer)", "value": "f3bace4a8de08107caa48aac5a8b71f34c50239310a48e1ddc9e43a3657dafbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049302, "uuid": "e1f2ab34-db95-4978-adc6-e1ad41212e43", "comment": "Malware payload (RedLineStealer)", "value": "08f2e861cb346d019fc026d1055caf64550c82d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693049302, "uuid": "bba9018b-1523-4b56-b3ab-22a2a338c23d", "comment": "Malware payload (RedLineStealer)", "value": "b60ec5265164681dc20b3f01aad20ca752bb9207960c68f8e2f06375431c900de0adccd5260a27a86994d9a1fbf9a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049302, "uuid": "c8080078-23bc-41ea-b1d1-79197a9729d5", "value": "T1766633089B580901F6B887BD4C931E984366B842781FDB43EB45992ACFCD39E4D3779B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049302, "uuid": "c1af0637-2077-41ca-940e-47f5b66e16ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049302, "uuid": "0624206b-1835-424d-ba52-da32097263ff", "value": "196608:GIY/LOmtIsDc9q7/s6ZyaaXWnlSWLnUChV5CI:vY/qXs+Z/aAWnlSSn3hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693049302, "uuid": "89657d46-1f27-4aaf-a615-1fc2a780cf54", "value": 7076864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693049302, "uuid": "572a602c-4e17-4202-b1a1-c5722259fcdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693049302, "uuid": "3df246a7-62e3-4410-83ba-93164790bd1c", "value": "Allergies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35815477-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083466, "uuid": "c9e0562a-8db9-40f7-9552-268dfca8912e", "comment": "Malware payload", "value": "6239956292be3c742d7a539fe70522f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083466, "uuid": "7962266d-eba2-48b1-9236-d579c18c8cba", "comment": "Malware payload", "value": "f47d8735d6baffad1b8773cdaf20a5cd42f30e56d8327e012803cfda0c91809d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083466, "uuid": "51cf5801-7553-405e-a6c1-dafc432bbd96", "comment": "Malware payload", "value": "ff0e9509c3b8386056a42053604ae2d8fa19feb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083466, "uuid": "1133794c-de6f-48ef-8dc8-babd9fc03f7d", "comment": "Malware payload", "value": "29c4f4e6ee1a93b512577b498109b9fc65ef7ab03215bf658f7ee76106aed8662ac545d5bef2630a65cbebdb1f961a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083466, "uuid": "2f8f7f2c-8b79-49a4-a4dd-5b09cb18bb80", "value": "T19F86127322618021E1E9C8358527BEE572F916338B8198FBFBF579C52B315D1B622B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083466, "uuid": "94ce0bd0-851c-4037-b3fe-828b85f0b84b", "value": "f7505b4601b1ffe0bfd3596cbecb05d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083466, "uuid": "9bc14efa-ba59-4911-aea2-cdee491a5e68", "value": "196608:ASdYGciWKDtwMObcUpllthl2Unp7UyCN1fdpJCiCT9E:ASy4WyscUplnDIx7fMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083466, "uuid": "a5fbb514-ace7-41d0-b8d4-10736555407e", "value": 8096256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083466, "uuid": "a0b080cf-0c95-412a-8436-483d02428577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083466, "uuid": "2ebcda14-3dec-4227-9c3b-f5739ebbedeb", "value": "412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2241a42-4457-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085366, "uuid": "f642bcb0-98ee-4efd-88e0-3298db52b413", "comment": "Malware payload", "value": "f7b7ac48e768ff1a16291b9055c8b98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085366, "uuid": "d239b20d-d57a-429d-971f-8b07cfafd4e9", "comment": "Malware payload", "value": "f5c68240b5a613533e53476cd20561e57c79d9cf664c48bdbd9380886005a2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085366, "uuid": "a9e421e7-c840-43a9-92f5-bb04b42cca2a", "comment": "Malware payload", "value": "02e9be79f85c15866f5af5a2c2cc81ad225243a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085366, "uuid": "866bf8b1-77cf-4fa6-b3de-1fb83db99b6e", "comment": "Malware payload", "value": "61f84870307470d85bbde9d2780c9dfe8c4996540c755f2f5a1f200a02d86ea621cacc51b95da1d4de73402356a411c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085366, "uuid": "afda1d48-f746-43d3-a993-132bb5dc1e82", "value": "T1B736DF2AB70981B7DA7177F299AB65DE9430DC30D06940F8EE830B48E516E7743BA347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085366, "uuid": "1719e61c-cb3e-4485-b3d6-18352c8b16f0", "value": "8633c21d53abb23ade11e3b75e0f7040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085366, "uuid": "4b91ec8b-a232-42d7-9077-02b715a1f95e", "value": "98304:1W7IypKO+6PbFmS3VjVEOeTtJaAbLECnrZXJT7i:1W3bFmS3VjVEOeTtJHbdnrz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085366, "uuid": "6895fee3-d6d7-4684-9e15-38d710cc645b", "value": 4978176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085366, "uuid": "a8818071-5c11-4a42-9c4b-f7de7fa6a4f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085366, "uuid": "28f12144-b2cc-451f-9d4c-9da8395dc095", "value": "intersock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4596264f-4421-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693062018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693062018, "uuid": "b5441503-a274-4567-9080-eda34339da95", "comment": "Malware payload (DCRat)", "value": "69f7be16b8757bdabcba2ce9af0ceace", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693062018, "uuid": "ca9d6a8f-8193-49fc-9c86-c4186585ab8a", "comment": "Malware payload (DCRat)", "value": "f653378fd0d70ad1d3f3f86a34ad7b0031358612e8f9d08f692c486207a991e8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693062018, "uuid": "b3519e6b-d46c-4300-b529-963a87490ab5", "comment": "Malware payload (DCRat)", "value": "7b67fe6f6ae704009ebbdd0a86787a41832d8851", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693062018, "uuid": "f89c7bf3-a187-4a3d-ad70-491491104b15", "comment": "Malware payload (DCRat)", "value": "0588a411af63075947bb7f2377122ed88dafe32a478d9cdd84f48145981622c74d363130c21a72ebb002f78456f9e9e4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693062018, "uuid": "675c2c72-ecd1-4f70-9b62-c09009d3dd28", "value": "T19CA51701F945984EC83517F6C8BB57640FE8BA442A37C6DE6BDF37796633392080E58A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693062018, "uuid": "de252791-4353-4c90-94db-536f7b50a24f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693062018, "uuid": "e3e513ad-6864-4a25-bcab-79ac6cbf5ec8", "value": "24576:52G/nvxW3WS02yxYeTpUhC5vBS/oNHlnDXHp0wq3cFUNN/lvzUBC7N++44:5bA3y2vhCRVFDXlqGw5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693062018, "uuid": "1257f5c5-13d8-4a9a-b792-1a7acae711fd", "value": 2068220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693062018, "uuid": "e22dc678-76c5-43b4-a795-a1b663831bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693062018, "uuid": "72d375cb-d601-4498-8dba-de148fb8b972", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-f653378fd0d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d89582-4456-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693084720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084720, "uuid": "57c1f8bf-c553-41dd-974a-dc339c1caa2f", "comment": "Malware payload (Mirai)", "value": "fe8fb7c8657f2e778295bf27daca9d74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084720, "uuid": "ce7ffb7c-8894-4360-94d9-f175e6a880f4", "comment": "Malware payload (Mirai)", "value": "f83f22724849e8bad45cbca35a3b9db371baf6ea52206b15b8767dd94db0570c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084720, "uuid": "1b8da7e3-1b0b-4d21-98eb-dda80ea4f50e", "comment": "Malware payload (Mirai)", "value": "64afa1d2df14be22688253e2de54852c7fff64ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693084720, "uuid": "4bfbda7c-c2dd-49bd-a9ef-1dd9309eb39b", "comment": "Malware payload (Mirai)", "value": "7c9f6011071c2ae736aa0e8b0eefe18fda414919fa749e19915fb1759d91866f617917e850cbe951a3c379a0ebbe2d0d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084720, "uuid": "f0913060-3a76-4025-a827-341196305d80", "value": "T106F3D81A9F610FBBDCAFDD3706E9070239CCA41722A53B753674D528F54A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084720, "uuid": "76082270-95ec-4aa5-987e-036a5ba69136", "value": "3072:QlaBi8fe0OMz7w9AIr/BOhnY8uVYKdQWN:Q4TfmMQ6IrZOhYhVyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693084720, "uuid": "d09528be-9497-44b1-b3f0-fe7c677bc94e", "value": 166328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693084720, "uuid": "db59b3dc-502e-4f92-aee0-20d594354b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693084720, "uuid": "3800b88f-c01c-4604-996a-5b20b8b6e238", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a43e88-4457-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693085505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085505, "uuid": "c07afcef-6c86-46c3-9f62-dc017fb4e478", "comment": "Malware payload", "value": "7b72dee5dfb21608b1b2a632f04df5ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085505, "uuid": "202ea62a-e052-4310-b19d-2ec71e10b70e", "comment": "Malware payload", "value": "f85434a4361b2a76cf9dab29bf82afd465b866bd31c0da908743dd2c5df9dc1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085505, "uuid": "e5e91f5f-ffd7-43bb-ac44-d4c2cf611586", "comment": "Malware payload", "value": "a6ce90601513cc05a4f3a3cb0ff953672da6ad53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693085505, "uuid": "d2df8646-2262-435f-b32d-02327dbac813", "comment": "Malware payload", "value": "4255941a897becaa9895917d0e51d41b59b944863acb82e9d96adf47f655b9581f5aba764ce9c6dbeedb1c4122f5af0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085505, "uuid": "a11d52b3-d9d7-4c18-9826-98d823ec106e", "value": "T107167E12FCD384A7CBB9F23188A26771B6757474473177C32E940A3E2D2AAE16E2D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085505, "uuid": "62469e14-1ebf-41b5-8362-80ee6641b5f3", "value": "5af7b82c7152a3a8d13e70c21795bc7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085505, "uuid": "70df3d91-641a-431f-92c8-f8ec3f149b9d", "value": "49152:wCuWv3QpnH9UWA1KnePMprxqErx1GEskL5HFe6lD0zABwOGaJQssxx4g3KhbzQwZ:wGA1H9U+ePMprxPrxYEBRvTSOGaJnkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693085505, "uuid": "0879a9cf-25b6-4d02-b30e-f40941457b70", "value": 4283392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693085505, "uuid": "1ec8da69-648a-444d-9113-4f11842969cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693085505, "uuid": "b8e40c10-5b26-4bed-99ba-28a21779b549", "value": "\u7f51\u5b89\u6c38\u6052\u4e4b\u84dd\u68c0\u6d4b\u5de5\u5177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03555d43-4433-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693069638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069638, "uuid": "1499e1aa-1358-4a6e-95f6-8a842459805d", "comment": "Malware payload (Mirai)", "value": "2621c38b8f5fee3812b9d326eb3eb345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069638, "uuid": "a161faca-3ee1-4bb7-98d4-b4b1d57b634b", "comment": "Malware payload (Mirai)", "value": "fb1389a9dd548e961a9b39ff8a254185cb155e985ee0238ac9bd15887315e78c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069638, "uuid": "2aa8667c-42d7-4933-8784-38b2adfadb52", "comment": "Malware payload (Mirai)", "value": "c5083c43f2c72aead431969cf50f71faf7c37aaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693069638, "uuid": "1872c97e-2606-42f1-8c51-c2963604e339", "comment": "Malware payload (Mirai)", "value": "81ebe6406cc15d763344a5e02eb2149ddd5198bd0a80629f393b9091cb9305f7f0f288f75d1b5b5e44a880c6d010d7fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069638, "uuid": "495ad037-60e4-4361-914e-5129da6cbea7", "value": "T1A9B2D1A49B915707C3B0B476E2BC8F935A3B05A4C2F63936272096ACDA4149773FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069638, "uuid": "cd906bd9-35c5-4dac-8279-d058e696232d", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BKJruGuchymdGUop5hu7I:4C9KQFH0rs3zWoDDRsjt7LB9U+BKFuGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693069638, "uuid": "ee4cb7ef-b73a-466f-b778-efce6b11a235", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693069638, "uuid": "cbc1cf81-d9df-4261-98a0-5f25b406fcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693069638, "uuid": "dce71b95-4443-48fc-8903-4eec48259298", "value": "2621c38b8f5fee3812b9d326eb3eb345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55b3a01-444d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693081157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081157, "uuid": "e9906b3b-ab0e-4906-9c9d-2de04bbf7179", "comment": "Malware payload (Mirai)", "value": "f2d06056d5c7fc3275ecff75167b8c59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081157, "uuid": "8f1c8601-edd3-4695-88fd-91fb1da6c102", "comment": "Malware payload (Mirai)", "value": "fb31ea660b42408c5028f8e473f3e9b843d19a46d4dcb6c4bcdff5383811e31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081157, "uuid": "e4c4c270-cd74-4ff8-8413-221d8f59dc1a", "comment": "Malware payload (Mirai)", "value": "64da82335114169b50e7201f836005d2c88150f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693081157, "uuid": "62a44f56-200c-480b-8df0-20808767e193", "comment": "Malware payload (Mirai)", "value": "3bd5c5d77bbbc4ee4b66585a09ea3a8b2f61fdf89d0f10bb9094ab7a2ce405be8e1b2354e3b9dcc3ec6f4173fb5e97a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081157, "uuid": "5f23405d-57f8-44a4-91ca-20c73aeae8d3", "value": "T1BD634B02F30C0D47E6631DB03A3B27D6D3AFFA4122E4E6857A5FEA499271D325542EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081157, "uuid": "46d179ff-92f8-48d0-9adf-6cca6a739372", "value": "1536:/tRqDYKLvXCq6byny81TCj66ud3amwrx9E9G4ur/50u:/DqDXvXybyR+66udBwk6/50u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693081157, "uuid": "6638a373-92c5-4162-a763-f6bdd4adfc30", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693081157, "uuid": "091d0511-41d5-4b5f-b059-4e8dd85aaf3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693081157, "uuid": "6dcaeb93-e485-4088-a58d-9509f73c9856", "value": "f2d06056d5c7fc3275ecff75167b8c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0460eaf7-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042581, "uuid": "1d904b9a-7c1e-4d4a-b609-1d1d77b6b3b1", "comment": "Malware payload (Mirai)", "value": "9a6f92951c41d6214a5d7e044ce85541", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042581, "uuid": "a96d025a-a79f-4fc6-b2f5-3a052b5ee316", "comment": "Malware payload (Mirai)", "value": "fb4d2c001a48f4fcba31334d23b145ff3905ae1dc4eec2aa47faffcdf44db41d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042581, "uuid": "c2e2d5f3-2373-4894-b334-1ff603a6ed8f", "comment": "Malware payload (Mirai)", "value": "6292520897ce716ebb1e87fe86e87c42510705a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042581, "uuid": "90f56c79-7784-47a6-bf98-263582c91680", "comment": "Malware payload (Mirai)", "value": "b386c24262870ea85734175b5a5d99f1ecd01b76c043ac64ef58961b7cf7b86ae964230a86309384a4fd19c809cc787f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042581, "uuid": "da70e579-f217-4ea8-8d69-ff68cfecb465", "value": "T10AC30945FC415B13C6C612B7FB4E438D3B2A17A8D3EE720399256F61378B96B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042581, "uuid": "a45d9281-036f-43b9-bb07-f6797804fa62", "value": "1536:ZQ4hxpiA51GCh71VNA1IC44V1AmeT2Ijvne+7A46nktMlgDwywFFMPNV30xsAWMk:ZQe5UQ717Jt4s9qIjvnC46ku/LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042581, "uuid": "bad796e1-02b3-4c0f-a787-af158659b8d3", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042581, "uuid": "2f5fb236-d4d0-4370-be09-a7bcfa0f11ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042581, "uuid": "746b8cec-1b01-456f-a524-7940ac679d26", "value": "concakhbtandhuy.arm5-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc48b9e-4452-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693083156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083156, "uuid": "c95e3e29-9daa-4675-8ee5-a28ef6d0737d", "comment": "Malware payload", "value": "5bd08b57c11aa01211f824728b0ecf35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083156, "uuid": "baf3970b-c250-47b3-a627-bc333304dbb4", "comment": "Malware payload", "value": "fb54634d67edddb9a583bd2836dfd16b77b1462c801d029184860fd9b6d532e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083156, "uuid": "4244201a-8f1d-401b-989d-6aad6b767134", "comment": "Malware payload", "value": "d55eadc0705040fdbb204a69fa17dbc419aaadf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083156, "uuid": "1bcaf5f0-80e6-4f9d-ac06-bd48d0e4354a", "comment": "Malware payload", "value": "e70222b0ee644c2799ddfae89146a6470cbdc657bad8a4210c5fe45aa298fcf33a256e2242b49d0df14ea8b9a1baa161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083156, "uuid": "81fbf6b5-2aea-4b96-bd5d-c50af59ce491", "value": "T1C027335BEDA33EB0C28A0A324E46CA1944176B13BF145CFBF5B927EE2E4183457D3A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083156, "uuid": "fd9df372-6f78-4d14-be96-1a64079295e0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083156, "uuid": "017cb19f-ae28-4ec0-8eb6-d7c8c68e2516", "value": "393216:b4oE1XVGvH+8NPCwPPXenMRS15U7WapomovObsG5JAmz848HeOJxlC1gcwPmK:ko84eaPebwihvvGkX4SR+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083156, "uuid": "4bf84797-19a9-44d2-9360-87553147eb13", "value": 20738754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083156, "uuid": "1f94603f-5bd2-4de8-a012-7b3b0b03d1ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083156, "uuid": "749dc6fa-9ff9-4cde-b50d-14679d0f5321", "value": "\u4efb\u6211\u884c\u7ec8\u6781\u6253\u5370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e7565c-43f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693042584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042584, "uuid": "2c4e055e-0668-445d-9b99-052d491ff827", "comment": "Malware payload (Mirai)", "value": "732fa84f6b7ec82cdfa96e59a174f876", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042584, "uuid": "667e7c3f-a08c-493e-acc7-1173408c0a5d", "comment": "Malware payload (Mirai)", "value": "fd1ba72717470efe4bbc20d369968f83d3a7961fa7138032bcc8e0e306287029", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042584, "uuid": "f45a7277-6676-46d6-974a-58ab84fad8ad", "comment": "Malware payload (Mirai)", "value": "785cfc4a0ff8834ce30589c74acb2d047943e728", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693042584, "uuid": "fbbd2aef-1b86-4f9c-a75a-e6084ca897e2", "comment": "Malware payload (Mirai)", "value": "71fdf6df0503e8bc5d53a61e972ed09e186d3ebed4818935bc3cd0506139af8d26f3693467d4fd4a270e29d4acfb7806", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042584, "uuid": "5725c7e1-63b2-49ec-95d5-709a064d8a47", "value": "T1C7F3885E6E238F7EF668873047F74E25976823D623E1D684E1ACC1145F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042584, "uuid": "14eb357d-f498-4ebd-ae42-43ccbf039c11", "value": "1536:VXK9rpSAla7e1fHPOix3E4+0hIxQgAai67kUJSMqXGLeXv3/lwqgTPnKWWO306xO:VXKps7vAaiMkySPXG0v37oRW36xALks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693042584, "uuid": "f2e32185-be37-4281-9368-4d4a622d49ac", "value": 169648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693042584, "uuid": "b5f49d0a-eca4-4dad-82bb-561d40afb5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693042584, "uuid": "e1fdcae5-5155-4a5e-8949-7b60a2a3c8d7", "value": "concakhbtandhuy.mips-20230826-0936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890a9d70-4453-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693083606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083606, "uuid": "e6a7921f-707e-4639-a4a3-2345f35c67f3", "comment": "Malware payload (Mirai)", "value": "bd6518ef97d81bff61553dd68fc4322a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083606, "uuid": "e318c659-8027-4ee0-9e1e-2a3a43a0d9d6", "comment": "Malware payload (Mirai)", "value": "fe7a51df43422a79f113e73b0ffc1e6148fd7567251dbbd1c2b84dc01a0b1580", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083606, "uuid": "21c45f3c-d868-448b-8f6f-cf269fcbd987", "comment": "Malware payload (Mirai)", "value": "055931d1a7806b9e09771f88c0e4ad65aa3af113", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693083606, "uuid": "ea68ef5d-f9f7-4923-979a-f69c6973919d", "comment": "Malware payload (Mirai)", "value": "6ba2f32fd1421f156f4b81f7b8167ad7f1277a97da38e2d9be3500f4c3be05e501e7504360da448191ae5b5922f768b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083606, "uuid": "42d8a03e-8669-4159-b28d-7609712e4f26", "value": "T13FC2E129EAAB4DA3DB5096329BD5A78B8041499742FCE50693B285CF3D4243E04D0EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083606, "uuid": "62ba5c85-0a04-4a8e-833d-e51d73032322", "value": "768:f4A6w9obVEPSxA5jua8viVsVrl5k8tm917x:A5eobVEqxA5aOaVPmLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693083606, "uuid": "cb42f746-a023-4f55-b58e-bcb8ef161dd0", "value": 28096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693083606, "uuid": "51f54604-8cd8-4c03-9084-daab44693f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693083606, "uuid": "b7a6c826-f67f-4a0c-85dc-d5e8730283e6", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }