{ "Event": { "published": true, "date": "2026-06-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-27", "timestamp": 1782604981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e8a27843-f796-4d32-b72a-c3e57cc526f1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09a2606-7254-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584375, "uuid": "a34f973f-0062-4cc5-97ce-54b905bc2c6d", "comment": "Malware payload", "value": "0334ef82458e0e5bb82d6e12c3bf5914", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584375, "uuid": "6f10ccda-455a-48b4-b102-ee3c28b5937b", "comment": "Malware payload", "value": "0021ad2e28071688868bac8aff43e353007b52c04d4f46160cd064b247d25dc0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584375, "uuid": "e20293de-f1fb-40bf-8c61-f75742d21903", "comment": "Malware payload", "value": "2b04deb91832183c46d0b92452ac96f2443789df", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584375, "uuid": "737fe1c1-f5a3-4f5e-91a8-cd3156f425d6", "comment": "Malware payload", "value": "8caa7063961b5c7e7ead8dfb40c91766f11455c063965ea78a7eba123eee0ea6575a31ae5743be3a198679a2fd3499bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584375, "uuid": "1746168c-5f9a-4f40-96ac-ee6f68c653bc", "value": "T17B25338B3DE5B99CC18E17F1A07899E637D91FFFC83C864E99B66380291013A0B56572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584375, "uuid": "b67263e7-6f9b-4951-acc5-9f95c360773a", "value": "24576:jdQ0MLWZJReXr6nDtA6WNee3KUhDsccIzin:BQ3LgJRAr6nhEj3KU9szn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584375, "uuid": "b5828483-dafa-4f92-98ee-efd141dcd9fe", "value": 1005027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584375, "uuid": "e1bf2c81-f4e5-4e7e-b9e0-44f48d8efe2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584375, "uuid": "25ea63ad-408b-4703-9c16-1d946887a07f", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaee173-71d7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782530762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782530762, "uuid": "67b3860a-25a2-4682-81c0-83b88ce30f37", "comment": "Malware payload (Prometei)", "value": "2c035dfee417886ff4bc24d35ff531f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782530762, "uuid": "ae88123f-d39b-4752-9f0e-4797492b6586", "comment": "Malware payload (Prometei)", "value": "00a99866c7a6525cee1a3ca03c4f6362c5c94af5e52494a95f27beb2523fc6e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782530762, "uuid": "59ec2acb-c594-4729-b43e-de1cc40a9704", "comment": "Malware payload (Prometei)", "value": "dd8e134f7f2ce639fa617de49eb299f165b45f6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782530762, "uuid": "7d1d7170-c66b-42c0-b8a2-849a74f36c4f", "comment": "Malware payload (Prometei)", "value": "94b4442ada6cd686eda18f0da8e1369669bcc8e271edc42924bf2241470beb730ae59209398111d2467f15de30bdb867", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782530762, "uuid": "438674e2-77ae-4c14-9abc-0463c74c329a", "value": "T13727CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782530762, "uuid": "582649cd-11c9-41ed-aa76-b7512d88c9c0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ2:cqYUQuVDt0TZEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782530762, "uuid": "301cd0f0-2971-45ae-a208-e7151cbb4400", "value": 21266432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782530762, "uuid": "23de3e74-0876-4180-9a21-bb57e7ff8aad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782530762, "uuid": "f7dc85b1-1fef-4119-a6b5-1af8316f3882", "value": "00a99866c7a6525cee1a3ca03c4f6362c5c94af5e52494a95f27beb2523fc6e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afba039a-71e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782536673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536673, "uuid": "fc0b3edc-c53e-48af-aff4-55bab76f8bc9", "comment": "Malware payload (Mirai)", "value": "9580b5c9aabae2fd18c26c8078fb2e79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536673, "uuid": "aa07488c-a89b-43a6-b507-78344eb04114", "comment": "Malware payload (Mirai)", "value": "0116035ec7b3089b35231c75dc558547337e99bb99319c52241905a2c968f341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536673, "uuid": "7e991600-7e14-45e8-baaa-2c2ed3cbb664", "comment": "Malware payload (Mirai)", "value": "8e7db0169b58588c69c555f598fb96ec9c850460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536673, "uuid": "165a9d6b-48e1-464d-a192-8c231ceb026b", "comment": "Malware payload (Mirai)", "value": "12f752268c6d476df0838a1ef158d046ab2cb94ceeedc0e111a30b6edb2e474497d63ef9af6715e6e133f3acdde8ed18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536673, "uuid": "c41edf5d-793c-44a9-b670-dc3adddb3f18", "value": "T146F34B01771C0947E1632EF43A3F27E1C3EF999125F4B644294FAB8A9272E325585ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536673, "uuid": "4366ec7e-84c8-4b3c-b5b8-b6b34d88c397", "value": "1536:hpgYTGUQRLZ6lt+I6sOseSOY2rgs/vC6jCxeJnflvZW5U1PCJq472S44J4yMUePl:L+L0r+25O7/CxgfWGQFJJ41Ub4dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782536673, "uuid": "11be4bd0-7020-4a0a-b735-b99f2ca9be48", "value": 170000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782536673, "uuid": "75c28086-cdcb-4844-b7a7-e4eb7c189609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536673, "uuid": "7054d486-2685-4d8f-97a1-8f84f2868ad5", "value": "rebirth.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aaca04-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523258, "uuid": "288c9f72-e879-4712-8cbf-32254bfa1336", "comment": "Malware payload (Arsink)", "value": "333c3da130fc50a0ba6e2c06fb192be0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523258, "uuid": "34206cc8-66a6-4331-acfa-64ae2c010f2b", "comment": "Malware payload (Arsink)", "value": "01dcbe196953883b1da0d43f890892b77ae53adc74ebdca41d4b0a8b4ede44c0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523258, "uuid": "17173c45-f90c-4c32-a5e5-9b7f917eef69", "comment": "Malware payload (Arsink)", "value": "edd54e8af648537adb00c2a725ff929209d16b67", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523258, "uuid": "b822cbb4-3f03-4dee-9668-287a68dfeedf", "comment": "Malware payload (Arsink)", "value": "4be13c7f6f6b14e8e34a1da3c7db57afa2731e8fa152dfad8ab2d77a1f6ff2f366f81aafd500c7d69702eff77ae26337", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523258, "uuid": "a81c404b-f9a6-4b13-aaca-dea8d747a3a9", "value": "T19346F185F754AB2BC837913349EA5231558B4D4B8E82D7836918730C78B7AF41F9ABCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523258, "uuid": "e87da7ef-edc8-4c02-b773-7b042a4f3853", "value": "98304:H4IflWqd2Zr5WKgMPM1aLB49H42+WdCzyxkAi11t+9ehX6riBOQ7WHWSB:YqlkG1ay6cC1g4CiWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523258, "uuid": "f6322e7e-5e40-4591-aee1-d7eb59fa43ab", "value": 5610995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523258, "uuid": "10444421-6228-4cf5-b07c-62986c39170f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523258, "uuid": "466d7011-69d4-4f66-b446-d428fa01ed80", "value": "DeltaRBX(Fix53).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c684ee9-7205-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782550304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550304, "uuid": "1f94345c-36fc-4bef-b0df-90e7eb9095a8", "comment": "Malware payload (Vidar)", "value": "83286b40935dc23576b57950f1fe9e62", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550304, "uuid": "f1465b5b-7215-459f-b3d0-12e48a593ddc", "comment": "Malware payload (Vidar)", "value": "046ead5e49940d24ad2249ff10375d6d1a9057c08d00d1874a2669d7a7b57058", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550304, "uuid": "8864c95e-d8d1-420a-ab5d-d9051eb73326", "comment": "Malware payload (Vidar)", "value": "50619615547d3f65f46546f21c9935913bc5ec44", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550304, "uuid": "8a5cd56f-2049-45cb-860a-512563b7266c", "comment": "Malware payload (Vidar)", "value": "fd8c73d58de5dc1b515c1fb18d57ee18299b96bf5b764d94f4202faabe4997457cc2426145db5fe2cc5c26134ead8535", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550304, "uuid": "19db01d3-a91b-4e71-8eed-41cdb28cdc61", "value": "T16D268D46BEA169A8C0DED234A8BA42597B3DBC4D4F3537D72E50B2B52E373C10936B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550304, "uuid": "3ba45d4e-c0eb-4b79-8a29-2bd02cbd86c8", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550304, "uuid": "1f697f0e-432b-4b7b-8c3f-7b061c167198", "value": "49152:I609vKd2Q5DgwLaLBOowTAzYdCJ/THygD2s1EQ17QUVZLndR5w4d6OzS/uETIYR:ImokoNdxZzL5w4dNETIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782550304, "uuid": "f5722149-f5e1-4438-bd88-63ebc4e7b431", "value": 4712176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782550304, "uuid": "bd6320ef-192c-42e4-addd-7fd7141fe3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550304, "uuid": "8a344865-c0ee-4ac0-a9d1-bfdabdebdc65", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db10d82-7226-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782564533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564533, "uuid": "7502d6e0-9014-4ecd-97d1-0e369ccdb5d9", "comment": "Malware payload (Prometei)", "value": "4f7dd52d88d916b85afded7677dd319d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564533, "uuid": "3454b7fd-d149-4c6f-90c1-a3fff5bb7454", "comment": "Malware payload (Prometei)", "value": "0534c5c6d40ecb7b01e6e3844ffdd350cdc374cc8f0b265fe7b524f83c4a62a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564533, "uuid": "b80ad6d1-25ce-4adb-8e18-7ad281e9d20f", "comment": "Malware payload (Prometei)", "value": "a394387e2477e0394cd4f9639d0f32c899a03169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564533, "uuid": "6faeb6e2-6f65-45a6-9fc8-42cf883825c3", "comment": "Malware payload (Prometei)", "value": "f06476caa35acc923d3543906a037594f0e38f1879e57692fc565b31315f2dc98c2b3319bdb3615575390fa9f2c6bc90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564533, "uuid": "4d0cce9c-1dc2-4906-b698-78d71a1eec27", "value": "T1A2F69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564533, "uuid": "b17395d3-bdae-47d5-80ad-8383d52ed43d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQj:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782564533, "uuid": "f8988b9d-1058-4705-92e2-fb93ac88d785", "value": 15597568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782564533, "uuid": "2d898457-65c0-4672-b626-f59ed5d454bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564533, "uuid": "b8604804-b26e-44c0-9a06-ecfb46fe8fa8", "value": "0534c5c6d40ecb7b01e6e3844ffdd350cdc374cc8f0b265fe7b524f83c4a62a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1306b3-7200-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782548106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548106, "uuid": "86f656b3-ab30-4a87-b8de-40d29448803b", "comment": "Malware payload (WannaCry)", "value": "b0acf6bc9967cce7dda695f2ee520554", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548106, "uuid": "53fc937d-c78e-4dcf-9b02-65f4ad3cbb24", "comment": "Malware payload (WannaCry)", "value": "0647ab787a42dc90f6d3ed133e2fe365ad1e165763df5221d78805c5edfa5f8f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548106, "uuid": "9fb33114-bfad-4f54-89b1-05047a6a2dbe", "comment": "Malware payload (WannaCry)", "value": "d0248a6e7b36211fbba79206999d8e1e220110e8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548106, "uuid": "da2c5d99-1cee-4e45-adb2-aa23a2672383", "comment": "Malware payload (WannaCry)", "value": "faeaeb0ee60aacb9559a565db6a4900127424828a3db9611d0703be0a1636aff830f6f133fa0061928ebb81aa748d829", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548106, "uuid": "1bbe0e35-bd16-496c-9877-aa970dd456fd", "value": "T19136E042D2850EA4D9E10AF61169DB50A77F6F5582AFB23E2621402F1CB7F1C9DE4F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548106, "uuid": "05d2505c-ce0c-4e4b-96bb-6d0438e0d392", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548106, "uuid": "07b9a789-c634-41c8-b504-a9094fff6b0b", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8s3:DI8qPe1Cxcxk3ZAEUadzR8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782548106, "uuid": "58d7153a-d5e0-49f7-90fd-21beb325c49e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782548106, "uuid": "4b1c16e1-4c82-4fe3-9742-c05a3e92c8ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548106, "uuid": "25e19c0e-4526-46e7-bacb-a2c0d8f7c282", "value": "0647ab787a42dc90f6d3ed133e2fe365ad1e165763df5221d78805c5edfa5f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c93445f-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555512, "uuid": "50581037-812a-4bff-aca2-539f7a1c8a4a", "comment": "Malware payload (SilentNet)", "value": "8e01f97033b2409494ee5b1e0e46f113", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555512, "uuid": "896e6b82-fa30-495d-8514-b62e7c93712a", "comment": "Malware payload (SilentNet)", "value": "0758cec21b3efaa2b9dc4cc3837a18a321507e56cc7579408424d27d588f553a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555512, "uuid": "807ca3d6-d646-48c3-95d0-a3cb93995f7d", "comment": "Malware payload (SilentNet)", "value": "93adedcf4e04cb53962f99947bc535606589157b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555512, "uuid": "bdeae302-c9e6-4b18-ba7f-4f0099d38ce3", "comment": "Malware payload (SilentNet)", "value": "de1c09412d3fafda662b453974261a3b5ba3d8c9efb662cab18a184307526e717228f059476a48f270027c35b4098322", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555512, "uuid": "41594320-17ea-46a7-bb9b-9e2fffa41cfb", "value": "T14515235B0FE26258E0B355F3C3E6C2776F35E8902637B179DB980C8B92130BB68C5569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555512, "uuid": "e8bd9b95-8b48-45af-8bad-bed91a6412f8", "value": "24576:0AUQnBmnxUSIRtYhV+RjYGb+E94vKNK3gan5KeWNC1JKCAaFHig:0ADnBmnKXRtEQ13mvKNKwNe11423", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555512, "uuid": "7943555a-4948-4499-a2a0-df2115559be9", "value": 912505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555512, "uuid": "011bc506-7761-4818-8d00-fa0c96e3cdee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555512, "uuid": "dadf94b6-ebcf-48fc-94e9-8172ad64b42d", "value": "madebysap.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b2b67d-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782551494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551494, "uuid": "f6f9035f-32f6-48f4-9118-c05db1690b76", "comment": "Malware payload (Mirai)", "value": "63472016080615d21f13fa41841a3700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551494, "uuid": "56e10b9d-37ca-4988-b57f-eee43c063e74", "comment": "Malware payload (Mirai)", "value": "079db473d8b8243c2fa15521f690f9a2b2ecba762631498c6a73153eecdd7f08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551494, "uuid": "be0778d1-3a71-46c5-82ca-1d048f337802", "comment": "Malware payload (Mirai)", "value": "4d5c8861110c08c59a029af3dbf148b4e553f311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551494, "uuid": "6f6abf1a-5c27-450e-b060-49260816129c", "comment": "Malware payload (Mirai)", "value": "eb88e2d8e9bc7aad6cc45e1c8ce06fb2eb3d9b5e415abc9c7f32e57ebc258458d71b4a3b47a68d5d95617c4855fb90a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551494, "uuid": "dd2c6407-c2ed-405a-b636-9ef0a81db582", "value": "T1810419457C419E01D5CA33BAFA6E028933577B79D3EA7202CD205F5527CAE8B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551494, "uuid": "e7faa962-964a-493d-8fb2-5bde2a5bd5e5", "value": "3072:o/D2Xd9Fg8+g0s4k7vQT1aDWi3bOy8qJaAQVkVb3G1LTMiTVe40pAi:S09S8kk7vQToWi3CytJaAQVkVb3G1fTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551494, "uuid": "7fdf6352-697d-48a2-9a45-77250a401e80", "value": 178216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551494, "uuid": "9eb430d4-b95b-41dc-906d-d6ba0def8deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551494, "uuid": "c05d24a0-d008-471a-b0ff-3937173b57fb", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecb4d43-7248-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782579084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579084, "uuid": "6a0da7d5-839b-490f-bd41-19eb24495394", "comment": "Malware payload", "value": "cbeee5807322b86932dcd5c839d8f6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579084, "uuid": "0521d7fd-3b2b-4594-a8bd-acb29857f515", "comment": "Malware payload", "value": "09c4f8262c74179f6f9bf776866f8bc1873ed8ce6b5e258c03d30ea344ad7678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579084, "uuid": "7120ef82-db02-41d4-84a1-6f4ee7e7300c", "comment": "Malware payload", "value": "3ca16328f9efafbf8ea29529120450be1aa4f8ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579084, "uuid": "1db3b39d-2585-4cce-b772-3c770ccc9a8d", "comment": "Malware payload", "value": "e8f8cc418e80f4148574f72cee5fa869ce877b41978a5c107505ade61a53f23bc0ce09c9a9332f1cba198ef8913ba688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579084, "uuid": "754f30e6-c460-44b4-a4da-2bba8ae0b8dc", "value": "T194169D27A7E801E9C0B7C1B8CA578723E772B4191375A7DF1AE08A561F236E15E3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579084, "uuid": "671feb59-e45a-4073-a160-a3b28889c59c", "value": "717ce97eeab57877f4f82b40665e975c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579084, "uuid": "5d5d0437-56ca-43e4-ae1c-ddef75f5cef1", "value": "98304:cDz2a2xlwurTS4BO63iXhmoGlM7I1TnRZNpw3+Sq7:gz2a+SooXhmoGlM7I1TnHNS27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782579084, "uuid": "cb29fd05-5257-4f56-91e5-6f953a4dbaf0", "value": 4104640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782579084, "uuid": "103edfb3-e9a0-4f0c-9dc6-13c1d286aeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579084, "uuid": "c539d17d-0de9-4707-9440-d98b1ea17bce", "value": "SteamBoosterSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff19a568-71ec-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782539813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539813, "uuid": "c9a9d25d-f6f4-40a2-95cb-9c4726f323fa", "comment": "Malware payload", "value": "6afec22b9834656bbdc9d8c40a337a41", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539813, "uuid": "8ec51849-d059-42da-8f4e-d65d97cc4227", "comment": "Malware payload", "value": "0a1b66d1d353330ec0d1efd3f506242bf1052cf9356717a6a870da70801ca0e9", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539813, "uuid": "24707bba-8881-4d88-a43c-78be3355a8b9", "comment": "Malware payload", "value": "9cf22380b14f996c5c80dfc5b6c91b7b9671eb25", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539813, "uuid": "3186ec60-d057-4c0b-be51-0a6227585fad", "comment": "Malware payload", "value": "ac4f831031b4e2b669f071e26c5e70cb62132305a9e55f59bf21d843dbef3671482cfeca17ba9707f7fcd0280718cf5e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539813, "uuid": "6e23dc0a-5a30-442a-be53-32d97c57eb10", "value": "T11D82D7263BA94CAB03835698D4CE9208E62C456B101E6D90B9DC9385FF73D3B67F43D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539813, "uuid": "f686f609-f2dc-4eb0-aced-86b8685992cc", "value": "192:qVmidl91QAf4XAEZbmhbewbbBdMabzD8/bzbupoGvmAQ7GPDbSIdwSIhkFa7xKvB:qww188oqsGPnduF7qLoLg/BF0/y8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782539813, "uuid": "27aea7e3-003b-4f4b-af9b-ce6c5672fc60", "value": 19243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782539813, "uuid": "5f341dce-fcc7-496a-ae15-725361d1059c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539813, "uuid": "47ce6611-cd0b-4ffc-903a-c0091c20335b", "value": "0a1b66d1d353330ec0d1efd3f506242bf1052cf9356717a6a870da70801ca0e9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a96800e-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523269, "uuid": "7153445d-8a6e-4ffc-b50a-72a31a282123", "comment": "Malware payload (Arsink)", "value": "894d5a8b8bc28de22969bc44c008716b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523269, "uuid": "97dd1ebe-fb5c-4be2-b0e1-61df6596f73d", "comment": "Malware payload (Arsink)", "value": "0b47e13b4cb4d8943f45a94f1489294f61e0715a69614bc88c195b01daae6d68", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523269, "uuid": "7d3e01ba-a8de-4df3-8cb1-a4286fb15542", "comment": "Malware payload (Arsink)", "value": "2cf46e09d07d35e8373a62b7b22c705606714085", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523269, "uuid": "253f84be-e773-4e42-affc-d18c936bc307", "comment": "Malware payload (Arsink)", "value": "ec5189cf498cafc2012e808fcec831ba620eb28fe554e95180f75f7cf742ba569f313d3d882b4e284f8a83ffa9eb442f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523269, "uuid": "63d75712-d8e3-4701-be33-1b57ce70ba61", "value": "T1849423FBD954B5A3D74E5E35F03F9E17FB79938668B58AE6086010E1C5B01A9C0CA80F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523269, "uuid": "ab97c140-492b-4cc1-910a-617546a51f43", "value": "6144:JxcuhN9CK/xdD5wYFx/i26Bu6VNNDBU3TqiukWk4/XZ/plhUJYWQYd+wpDmm:NhN4axd1wOx/itu0NNznlPZhIWYd+qSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523269, "uuid": "f0e052ca-89b8-4fc0-9b73-fd24e6f5dc39", "value": 435139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523269, "uuid": "7527b2ea-8fd7-4621-bc44-5baf64fbc422", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523269, "uuid": "7c7bc985-a4c4-4af9-8b86-aa96f1f0b706", "value": "Doxgram_New_1 701 (Fix).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b304c2-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523340, "uuid": "653d290b-d3a7-4058-8942-689cf504cac7", "comment": "Malware payload (Arsink)", "value": "e3464c4920db76c63ef01c102ec3be3f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523340, "uuid": "07ae90f1-846e-402a-b8d2-bf0bdefa0bd3", "comment": "Malware payload (Arsink)", "value": "0bf4779a000a63a12e5d22ef884df612a5b9823ba69d008fa137312955eba65e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523340, "uuid": "47daeaf4-07f1-41d9-a8e4-a85383fbf8e0", "comment": "Malware payload (Arsink)", "value": "b4d34b06a8ee6516fc29ba46a399c637e7934077", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523340, "uuid": "aaefee19-0150-4e9d-bdd9-9c9ca4661f65", "comment": "Malware payload (Arsink)", "value": "275499ae3c30f2be9c9b33934ef06ad0c8dfd89d1953fa4a60fc9d7c09f92ac166e7248c7c6388ec61848ea661da421d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523340, "uuid": "1216d97e-4f49-40f6-a307-c941e6b9ef10", "value": "T15CB302D3DB44D95ACE7DB478D8B8E137FFD2976290A09B872A1251308DA68F10DB102F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523340, "uuid": "ec5dd382-6cef-44a2-b09a-65e715b40f2b", "value": "1536:xvFCdJgUwBx84E4uAXQlcWrZvS00eV688DANSct9eIjcngynCtYr6QcA4/:xIwBMAghNZV68C69/jcHncnQn4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523340, "uuid": "39f81243-3640-46b5-8b6e-75a607ccdabb", "value": 111348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523340, "uuid": "9b393121-0f7a-4146-8f6f-e574ede5335d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523340, "uuid": "c8529da4-5f94-4290-81a0-ba92735e0cf7", "value": "startuptest.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3d4e1d-7236-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782571188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571188, "uuid": "a6495db6-18e1-4a7a-a50c-792860df24b0", "comment": "Malware payload", "value": "5687616988e28c368c6c3f3aac9f059e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571188, "uuid": "e828c299-9f56-4253-b60f-0b83f3129815", "comment": "Malware payload", "value": "0eed7c83474a194e97e4ef254b96fd70b7bb2f6c6dd2594b88c7e7db9b3182ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571188, "uuid": "c2225226-f8a1-4dbb-94fa-214f1d06e1ab", "comment": "Malware payload", "value": "cc25168c11bdc5b842d5d386ebb99046eb2112ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571188, "uuid": "6b867418-b435-4cc3-889c-b064ed211ba0", "comment": "Malware payload", "value": "bfe0688f83b705130ce1e1a21140fd58e67376f688f1e5fb9a57313ae1a61767220c386f6c5392d49bc55a7f393de4db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571188, "uuid": "2edd0908-425e-4555-b2cf-a95a7a1640d9", "value": "T157A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571188, "uuid": "95f82975-0d18-423b-b808-2191e346c5d6", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYny:FOuhPHCKsqZ9YfM6g23ZJLYny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782571188, "uuid": "44c09132-3b0e-409c-b9f8-d7901ebfb3c1", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782571188, "uuid": "6fd74340-5383-427b-850c-b772f2da8f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571188, "uuid": "002fec26-e3db-4c14-b7c9-e694d23b8ab7", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af9d3e0-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523243, "uuid": "7c3f38e4-9671-4088-a34a-bbf9a5ba9558", "comment": "Malware payload (Arsink)", "value": "3bac8f69369e72bb70be3aaa67b75739", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523243, "uuid": "d6a2f6e8-6b23-45e8-b017-18c29af083a9", "comment": "Malware payload (Arsink)", "value": "11ef87f842857ace314f1ca881cf9834263a79e22752882712a93da186141415", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523243, "uuid": "08d012ec-9c61-44c3-91f5-23b0e0747382", "comment": "Malware payload (Arsink)", "value": "0e78e30d92e4e910b497b135da9d20d1fad49612", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523243, "uuid": "3b3d727a-54bd-42a3-9e40-db438e21166b", "comment": "Malware payload (Arsink)", "value": "ad3c31de91464734ee7a12143f3629a96494682eeb2467bcaaf51a537eba109830ddc29548985325b251ac47d1b3f311", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523243, "uuid": "3e41387b-4514-44b0-90ef-50a1f8193f55", "value": "T10616E089BB48AB2FC477543345E65236614B4D4B8E83D6836868720C79B7AF40F5EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523243, "uuid": "6db0bb2c-4c02-423c-9f0a-cf7a3b9b6e95", "value": "98304:MMPd2ZrM4XKgMPM1aLB49H42+WdCzyxkAi11t+9ehX69j:MGG1ay6cC1g4Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523243, "uuid": "6ed7a203-f5c9-4ea1-b80b-b0f4648e644f", "value": 4240922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523243, "uuid": "1f86ad2a-eea4-4770-9f52-e0a7ff6a3e07", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523243, "uuid": "228b2cd8-38fa-4373-9f3a-355b182cb5e1", "value": "AndUnlocker1_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f870f3c8-7256-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585328, "uuid": "e32d03be-6fab-4aef-b23f-be3caa27d290", "comment": "Malware payload", "value": "4322706ec257b3612d493aec83709abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585328, "uuid": "f11f1b6f-644a-486f-9d81-94a4531f7bc6", "comment": "Malware payload", "value": "123450a779753bd0045cb82de9179cd7a3aad2d560b16a8201ca4eaa7da52ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585328, "uuid": "05ade4d4-795a-4529-b12c-31619d844978", "comment": "Malware payload", "value": "45bbb23402b9d86278b9953820c9252d33ee85a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585328, "uuid": "16bc362b-b4e0-4db7-85e7-e17a92d509af", "comment": "Malware payload", "value": "8761a0b7560726619fbe59ff01e68e29197c1133aa05f710d6a08cc869a03324f03d0bb649f95e4df43fc74139e9122c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585328, "uuid": "0ca439e4-1247-4d85-a2ad-f777ebd259de", "value": "T189168C47BD9198B5C09A933289BA020A7B7CBC084F3627E72F71A2363E377D05975B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585328, "uuid": "93f68a0b-1448-40f7-943f-f8e0a834e465", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585328, "uuid": "27816140-ab60-4521-b6dc-b74b13458d1b", "value": "49152:X3HGVijjdCrjnsGo/G8YQxPhYM8d7wRSCm7HWpTAUMnf3RSEycWB2bYMpB0Lfe6k:Xi/o/G8YQxPhsd7ekbfSfeyVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585328, "uuid": "856031ca-e4c5-412d-bcb7-2d02516ffff4", "value": 4391696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585328, "uuid": "e6430f83-1173-470e-bd20-e1f0a7cfa337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585328, "uuid": "4acc5d07-3f6b-4eef-bf62-5e9fc923c5f8", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80288854-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782581261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581261, "uuid": "97772a17-c598-4ab1-8ec1-2207edcf5390", "comment": "Malware payload (Mirai)", "value": "ad4c957f61417d7a13eb7728dfa49c34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581261, "uuid": "4d22c185-46df-4330-bbbe-672a50fe6dfd", "comment": "Malware payload (Mirai)", "value": "125e9eecc725a29649a8adba3feea2fcb2d5077d1ab2f57fc8e6a2c82d4bda1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581261, "uuid": "123fea30-423a-4ac1-8e32-514cc2f8de93", "comment": "Malware payload (Mirai)", "value": "2d5d8a6c4085cc27bd301f89b3b9e118ede7d9cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581261, "uuid": "60e6c54e-f7eb-41b0-87c3-cf0a3189a747", "comment": "Malware payload (Mirai)", "value": "59e0f6077613a7b1a69d65db7a35ad0514ee40068619a78fcb3c13800edbd4162657eb736dd950969e227a7b35f8bfbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581261, "uuid": "142fb3cb-ef84-4ffc-a7fc-17db807f8ec2", "value": "T12B442A22B57A1E1BC4C0E47662F74336F5F2BB461CFC891A7E615E8C6B6528071A33B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581261, "uuid": "405f689d-57c5-4c30-b0ee-e698db1969b6", "value": "6144:qjpgw/FPItrquLwjxOLe0GYPNdP35FqYstse:vCULwNie0JNdP3HSye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581261, "uuid": "13614c9f-13cc-4702-ad9d-c9adb473ff96", "value": 278588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581261, "uuid": "83ad6af6-2c2c-4de0-bd93-65d456daf2b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581261, "uuid": "8ebd9966-0a26-479a-b06c-c5c80b4a28f7", "value": "kworkerd-mm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a046bad-7202-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782549065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549065, "uuid": "ffdff48a-8d83-4e4f-9306-be236624464d", "comment": "Malware payload", "value": "abce633cfcd147b48f9784e7536252bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549065, "uuid": "fe1e9cba-fed9-4542-8933-de848abf2d22", "comment": "Malware payload", "value": "12a9179c3da41590f4bc582668ea2b68daaf44168aa060887f1d568ee7df9570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549065, "uuid": "008cffd1-9752-4cec-83dc-5d7cf2c374f4", "comment": "Malware payload", "value": "c8ef813aa2efc36f373fcef31de18f68a0cc6c79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549065, "uuid": "1bb43f34-3986-46a9-9713-94a058f7d235", "comment": "Malware payload", "value": "90d345323b147da4e73747804cd387be350df1580432f9a4992659da752c6c3f6d9205e1020ada7cdf4763140787ebc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549065, "uuid": "2bf11be5-377a-4a42-babe-bfb868c3f4d8", "value": "T1C6B30845F8505B17CAD652BBFF4E438D7B260758E3EE320399256F20379B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549065, "uuid": "2059b514-14d3-4856-ab3b-68d2196b62e3", "value": "1536:Mj7CpmIoJOGa4VuQZ7Rtn6YlEOjp4Xv1ZeuXAMlX3wywMOroxakqosBpb+vVk:Mj/IoQ4nvnZwf11w/o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782549065, "uuid": "6b48c6dd-f0e7-4999-bdae-6febc94aa0d1", "value": 108908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782549065, "uuid": "1f12cbba-d247-4b14-ad10-fa6f10a6df62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549065, "uuid": "8a205253-ba7c-4141-a7ce-8a6829a92ea4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb623be3-71ec-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782539806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539806, "uuid": "604592ab-0df5-4ce8-8450-964efe1b5d79", "comment": "Malware payload", "value": "b17e663f451010662f7b41d58da54e74", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539806, "uuid": "99a7e7d9-38b5-47f8-a750-ecf5e1439064", "comment": "Malware payload", "value": "1356bf8be4d91d79450f17862cea9776b4a33d386762255aecd3f7c8b37de663", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539806, "uuid": "eb77fffa-2157-4f0d-8131-b0d7e7898303", "comment": "Malware payload", "value": "50729ac304fa43e71f4bae5f8a3fc1dace506052", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539806, "uuid": "93b12707-79cd-4273-b86c-a6e3ff9f1a3b", "comment": "Malware payload", "value": "c739e82ba6e2a195b526ca4b254668444c0c7be7c6e30d1ec30f6c4f5f3c00fbef31176ede5f85b053368fd1eba0a04c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539806, "uuid": "acf8d4fb-cc20-47f7-99ed-221a5283d535", "value": "T1F311866161210A36D7FE16B125A810FEAFFD4389023962683563AE5222A65A40B43868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539806, "uuid": "2577ec14-93d7-4c0d-9847-8c2604b00621", "value": "12:5jhiVZhxjYGhUls8O7SFhe7z44lw//tWxgGvQEMcxahPZgRXeEVf8xyVtJD90IY4:9Uj0s8O7SFOVbgCQ3e/VkmbDeIYNB+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782539806, "uuid": "7bcf595e-3cc6-42fa-b20a-7d41f74da065", "value": 855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782539806, "uuid": "5f748b2b-7db5-4c56-9024-7ba0214f6337", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539806, "uuid": "17c9a5c9-a4ab-40bb-84fb-eb637ad5d8d8", "value": "photo_98285721655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6ae11f-7244-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577607, "uuid": "96241a82-ad69-40b0-b341-d003a285e57e", "comment": "Malware payload", "value": "d147036222d39115df86716fcf6aec30", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577607, "uuid": "a9ecded5-5355-4195-9f86-6a609bf8cc65", "comment": "Malware payload", "value": "13647f2703d3430569c4605cb86d7a423ee73a09f45b6e80875a4dd933bf3e30", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577607, "uuid": "ed7bec7d-1cec-44e4-95d1-e2ad050675bd", "comment": "Malware payload", "value": "e5f807b68cf27554e58df9df7f4475722c20a885", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577607, "uuid": "295b7343-6840-41bb-980e-13cf1e560f52", "comment": "Malware payload", "value": "680329611a9047f6b98e509effcd549fe42ffe8572bc8773c25162b51c49ab189a5ff4defddc63e1ca19209df6994880", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577607, "uuid": "809637d3-4af8-4c3a-9b51-34d19a3c757a", "value": "T1F9932C3AFDBDC42AE213513C8630721EE4198348E945E7FFADD4885909E3EB68B179C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577607, "uuid": "d980d978-abaa-42cd-8e44-453c205b57eb", "value": "1536:bB1xlRME+/t31BYGd/4ti//0yZ2LaTfk3MTlwDm760z:V1za5lXN4ti/swT22lk0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577607, "uuid": "6ba62168-3deb-4897-a845-b082974e79d9", "value": 94881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577607, "uuid": "f4cc02f6-57bc-4095-b2f1-142ba349a9b6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577607, "uuid": "89a499aa-bace-4984-88aa-ef53e9cdaffe", "value": "fresh-dupe-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844e7f83-7202-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782549056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549056, "uuid": "589ab0eb-4fe9-4627-828e-b7db359a50e8", "comment": "Malware payload (RemusStealer)", "value": "787d7a0b27f676de5986ff2aeffa694d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549056, "uuid": "cc476b94-ca7f-4401-b757-d4b287da8a37", "comment": "Malware payload (RemusStealer)", "value": "139d50b674112ca42a6f9e2aea789d0a1f3bd64e7ed5584d54bbfa6c7a418f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549056, "uuid": "5e23370c-4241-42f1-888c-516df8dacebf", "comment": "Malware payload (RemusStealer)", "value": "41f8ffacbe031d1db7828d62a8e3a868f8599342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549056, "uuid": "db8829f2-ae86-4d33-9e5a-2d1994815f39", "comment": "Malware payload (RemusStealer)", "value": "ed312e513a7960b4f5cea44ac58181300da2051bcee0d8a1b8a21c44a76b0ed5deeae1797197863d4899657df598f5d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549056, "uuid": "1add92b6-0031-479b-9ca4-3a8cebbed5b5", "value": "T1BAC54A07BD9148E9C09AA33189B7529A7B75BC480F3227D72E90BB782F727D05C35B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549056, "uuid": "eaa5ded6-4aff-4f1e-a6b0-398e8fb61811", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549056, "uuid": "a7bd3b61-9f3c-4179-a058-7150497ae32b", "value": "24576:uPZtM8OLgPobE1yqIEpeuJ2IvDzgct5Kc29JaAh7Ylv1+Vfxz6vA2Bele5rKDXQe:uBWvL4oFEYuJ7vJr0JRwefFQYa/9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782549056, "uuid": "06992375-cb1a-4cd1-a514-d1065c4293f7", "value": 2684800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782549056, "uuid": "34f4d08a-5d80-4f52-99ae-cba08a6a9086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549056, "uuid": "af9f4e4a-92f4-4315-ad0a-068ee7e4e17a", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e8a080-71e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782536766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536766, "uuid": "aeeea79a-0ab3-4fc9-a62f-3fb927e9e152", "comment": "Malware payload (Mirai)", "value": "35ed2cc90804b81a9a6e2d582b7e5791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536766, "uuid": "82780ab6-1ccd-446f-8d32-05073d560b18", "comment": "Malware payload (Mirai)", "value": "14af609b663f782b8a228bf86a6a06ac0fe3da4d07c8a75ec3844de85886652d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536766, "uuid": "f2ab6d4a-3cae-494e-97d6-c84f05ff68bf", "comment": "Malware payload (Mirai)", "value": "d7f03c63f786674b8fa7145d0c6f7cd50b636394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536766, "uuid": "a3213da5-c1ca-4a87-be11-73cc89b57767", "comment": "Malware payload (Mirai)", "value": "fc11c538735df9332f14d8df04223bc6cc87c0dbcbdc093ca40c9a3c7a4b703ff465aefea8c7c15d43459a3f3c241ef7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536766, "uuid": "409ad00f-a971-40b2-9f25-19d46da90906", "value": "T12CE38D72C879AEA8C110E5B5F531CF781B63A96081471FBE19A7C2BA4083DDDF6453B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536766, "uuid": "bf0261bd-eba8-4fec-8a6e-6116c163ea57", "value": "1536:ESqkEHAqvzZYh80ppXqRsbhBL8avZTCwjKvFgz7BFiPJlEv7WrBAhOuS7b:biAkZM5eRsbfhVhGv4KPJo7W1Arub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782536766, "uuid": "563da966-6b8e-4f03-952a-44fd191c859f", "value": 152196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782536766, "uuid": "f61c2f0b-29a3-47b8-bb18-41129b7cc408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536766, "uuid": "d451e03d-fb2a-41cc-83ef-e2c6e70236f5", "value": "rebirth.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9eb0ab-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555514, "uuid": "bc8ad20c-50d7-4dce-8941-b0bd06c5c628", "comment": "Malware payload (SilentNet)", "value": "365c90dc771da53017a90212031e85ee", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555514, "uuid": "613cd50f-7188-451a-bc18-241a44efc0e9", "comment": "Malware payload (SilentNet)", "value": "17eba8be5d1884aff56925a266737bf99bba73ca7fec3bdf269d15d0bb952695", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555514, "uuid": "1ee941b3-abe1-4401-9e4e-1d1c4dec9d04", "comment": "Malware payload (SilentNet)", "value": "3e0f0b7906a73b6f89612ce744e2fbffdffdbed3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555514, "uuid": "01e8bbf6-551e-49d3-a71b-688433f10500", "comment": "Malware payload (SilentNet)", "value": "c5ed6092abcb142be0329b83428911048e40963da62709296d5705bc3507083ca7d12daedb87cbd84eaa08c3afd3ada1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555514, "uuid": "aeb69877-ada5-401b-b692-5b336b6db5e1", "value": "T17B35E123A6AD51FBF9EB92B342108E61FC281FFCD746B4160FF218915C428D94F496AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555514, "uuid": "2231e166-2d85-45c4-96e7-11e2dd79e789", "value": "24576:NTsP4jRlrVU5c3v+iRp6t62qyS2viObObPO8lQlIXxsxk:JK4jRt0M+I6t67UAPOXlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555514, "uuid": "41d56048-c9e7-41a3-8387-d97c38f6892f", "value": 1126002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555514, "uuid": "b9d0ec82-14b2-434b-b922-13644bab3920", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555514, "uuid": "f72d90c1-a7be-4532-9f62-a01893d3dea0", "value": "MarlowsCrystalOptimizer-26.1-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3609e84-7236-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782571468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571468, "uuid": "62f741ac-2fa4-400f-9756-b670acd847d2", "comment": "Malware payload", "value": "85680be2dff3e5bbbc64967139001b9b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571468, "uuid": "7d8ab1b5-61bc-4f68-a5ba-ff0cc564fe0e", "comment": "Malware payload", "value": "1a365ca54dd27d2d245aeee9f7d764270a8f3504e330ff95d1a1184e72abe68c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571468, "uuid": "246c05b2-b02b-4645-834b-cc808a5e33e5", "comment": "Malware payload", "value": "494a29bf768e8d3bf3cd1435a56efac50a250d1e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782571468, "uuid": "c186b118-c443-48f9-b544-4b1959d3f765", "comment": "Malware payload", "value": "8b54d0291727d83128bd21bb43e295206a9c38ec5b3ef14e847e646a86b4d5abbae1aa79941cd642874e7752f11cfad0", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571468, "uuid": "cd844b5f-a327-442d-a1dc-f7f5c736cf66", "value": "T139E57B07BC9008EAC0AEA23189B7565A7B75BC090F3127E72E90B7782F727D05D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571468, "uuid": "7d714c6a-0f51-4baf-91f8-78c6c1152933", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571468, "uuid": "c39bd65d-b102-4c5b-9a4c-440710e4d56c", "value": "49152:aM2YqD/0x3iNJ2qeydiKGWc09FDBcAn2L/YUi7QR2b:aZt6Bp09xvn2L/n8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782571468, "uuid": "8841c60a-9786-4d38-8c5c-a7bf1557aece", "value": 3134360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782571468, "uuid": "bf923631-449d-4b01-b831-f5fb9745de6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782571468, "uuid": "ef73a052-f091-4339-8da5-330dc8bc07b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fc925b-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555501, "uuid": "3a577bfa-6cdc-42bf-af73-c3459e2e80db", "comment": "Malware payload (SilentNet)", "value": "b36516a9e3ee0a534e7b1875f9ef1b3c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555501, "uuid": "7d29ab36-280d-44c4-a8d5-6aac6eaa1331", "comment": "Malware payload (SilentNet)", "value": "1c9e7689443d2decd65fdc2d5efc1d86e471d4cef06a91784281ec287e6ff533", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555501, "uuid": "a059f3f9-e19d-4ad8-8075-939a22c13df4", "comment": "Malware payload (SilentNet)", "value": "d40e4e0a013f7f5ad5f54e71cfaca33c82317f5c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555501, "uuid": "0019bc93-485a-4a1b-afad-57972811f365", "comment": "Malware payload (SilentNet)", "value": "5e23e3a9254cbc9ca0dffe22596e4731d94b41609f27b193d120095bad7dd621419a5b66377badac2baf018d5482da31", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555501, "uuid": "20e19223-0c43-46e1-b7bf-c338775248a2", "value": "T197D533067561C9A3D92630B80A4ECE3A779F3ABDD5A0166CD110F14BCAC7B24F6C6978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555501, "uuid": "92de5f14-a5d2-40d8-9d71-fb8556270981", "value": "49152:SyEF5duovyU3I+DZiqcDTO/FfXDY5Ou2tSGmWAGptoDJ2IhOWPysYSrLtwri:xEFKomuFfEitSGzAGoF2IcWqs39wri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555501, "uuid": "4c70e828-d97f-4dad-807f-f91caa37fba7", "value": 2972663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555501, "uuid": "a8e064d3-c131-4754-8f90-baffdfaf2a30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555501, "uuid": "e54aa9d2-010c-4804-8f79-ca9eac481d20", "value": "hawk.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b008c9e1-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532808, "uuid": "8a6efc64-abfb-4580-8eff-a7a2e0eb5c51", "comment": "Malware payload (Arsink)", "value": "bd1d58283783119601b96d6509ecbece", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532808, "uuid": "89f54136-13cb-495f-8677-40aaf2b9a98e", "comment": "Malware payload (Arsink)", "value": "1ed58d5794a5f8e2ba840ce56ac8659409d867584d75d049bcdec6b0e5f954c0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532808, "uuid": "0faf3ff0-d17b-4017-ac14-e4e5f8f10918", "comment": "Malware payload (Arsink)", "value": "9133e735bfbb7e67764e47e1548992dabb1b0a7d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532808, "uuid": "008be523-c24c-4a5c-9450-3a7e83a5dc72", "comment": "Malware payload (Arsink)", "value": "b1cb39bcde6c28f5dbfff0fb28d0a6f3d841ed31f95a231bad2a21c5ea67b834e743548e19f337bb455d2d28b65902a3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532808, "uuid": "14573c6a-ab98-4cc9-88c1-4e343f839b0b", "value": "T1BD66F088FB88D92FC5775532457A6322814B4C0A9E83EB53B959720C2CB76D50F8EBCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532808, "uuid": "f39c9dc0-17ca-477a-9339-8d2592d43ecc", "value": "98304:RWL+A0GH2oajAlhMiIMWC/AViJ/XDC3Que/C+pYMGSKKce4MtZZAOY9AaDcPpPnX:HbMfJZf9zC38/CfMGSuKZC0PZG/hbpL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532808, "uuid": "7c4710cc-876b-4f3d-a2f2-0a847479238d", "value": 6705150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532808, "uuid": "b851d855-d41b-4cf0-9f93-df40f154f5b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532808, "uuid": "b4590bec-ffaa-426d-8247-5010cdfdd75e", "value": "sms-spy-v5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161209fb-7254-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584089, "uuid": "94b50068-ddd8-46af-9a06-9631ca850bcd", "comment": "Malware payload", "value": "14c8a86a31aca262f5dcb0924985b984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584089, "uuid": "e404934b-5e95-4e70-b7b5-67f22e879c11", "comment": "Malware payload", "value": "1fc8f778ecfd331406ba099a89451a8e98e19a9d34e862cc3ab95e2a391a580a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584089, "uuid": "af35e8a1-5f26-4d45-b6c8-0bc1f84130b6", "comment": "Malware payload", "value": "fbdc134d8d50075ed8ed20b55bbe52561bc01c16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584089, "uuid": "33538801-e83a-4f75-b8fe-d02225fccc8d", "comment": "Malware payload", "value": "f134b3e6b6fa2589c2dca947498a5656fc0ff3056657b7cfe7effe85db4fae4fa4e902e34e6a7bacd06294b9a14ee1d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584089, "uuid": "91a24bad-57a7-4f51-872e-5bd93c3dc0be", "value": "T1C104971A6E228F6EF678C73047F74E21976923DA27E1D684D1ACC1142F2435E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584089, "uuid": "2cac4f7d-eaaf-4e60-96a5-7f59d91269af", "value": "3072:eHR7zSCuPWXot8Mjt/DPyqfyrLNlKtrKfiR:eH1SCuuYZD6q6rLKtrgiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584089, "uuid": "8f13a46f-376b-4785-ba8d-272bed7b36d0", "value": 173224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584089, "uuid": "9f01994d-5eaf-469b-ad35-e73d4ddbb80e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584089, "uuid": "1627df71-84ae-440b-b990-d7cfd1c58ae0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e460b628-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782551794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551794, "uuid": "29c5c573-799a-4e1e-8eb7-56cb5077db87", "comment": "Malware payload", "value": "53d4b56e1f7fe046ad3c9e898013e7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551794, "uuid": "9ae4f078-1376-4bb9-9ef5-538141e64fee", "comment": "Malware payload", "value": "1fd846232a824c1a06a36ca88ac968fa11d169a0986071d1fc0c8b132d7e3aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551794, "uuid": "389d53fd-af80-4153-af52-749ce8dd54b5", "comment": "Malware payload", "value": "fbd0dc7fdcc866e58bb699771da6ac7ed430b9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551794, "uuid": "1e69f603-1e8e-45b8-b542-f509f19a6e1c", "comment": "Malware payload", "value": "5291f9e12b68a6d8e25784264b9e0e20d5c0e9a44f8bfc846e5c25fad8817be2a860245361037148d253744373ecdf5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551794, "uuid": "cd5bb1c0-d3f3-4432-9466-e81ddca63754", "value": "T1E2F58C07BEA048E5C09AA332D9B6519A7B75BC180B3133D72E90B7B82E773D05D76B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551794, "uuid": "be0d90a2-ce93-40c8-9a81-c01d653d4aef", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551794, "uuid": "d1888692-f641-4365-965d-813ff0bdacd1", "value": "49152:WQXP6ZYOmOscfXQHGyB0KNbxY3xUqNN+qRQmContf7+6ukrd0Di4bIYP3Dm4Y:WZsBLlY3PM5s7L9xND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551794, "uuid": "a0b81848-ebd4-4656-91c3-6a968a09b8fb", "value": 3580296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551794, "uuid": "39386da4-ebc3-4e76-8262-4259cde52905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551794, "uuid": "e65dfa4e-2d91-4986-bcaf-0e9d8631f26b", "value": "HitWave.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecf9519-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782532806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532806, "uuid": "fbc5ea86-ebf8-4bc6-9da7-9175b0baeee3", "comment": "Malware payload (GuLoader)", "value": "2f426d2fb00858d8649cf99eb2e2aac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532806, "uuid": "c6d37067-3a36-49a0-80a0-f787c252078f", "comment": "Malware payload (GuLoader)", "value": "20dbcab2dc3f9e4ec9a7d55876b536fa1fcc5f6dc00f6181b5cff7c9338f45c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532806, "uuid": "7ad2ebca-93fd-47e8-b7bc-c2b78f9adee0", "comment": "Malware payload (GuLoader)", "value": "d234740fdb4a0860d18bae49d82827bef3dd28b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532806, "uuid": "f81ce674-d4a1-4d66-931e-65a135fb7372", "comment": "Malware payload (GuLoader)", "value": "77e4c283f4545efdb9ab316595bb22c44678fd09d81d96b1c4d9b5ee147504066ccb7c6dda1553c4948bd7633c6b9e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532806, "uuid": "3b08a0fc-add0-465c-b17e-2b90ccd5d862", "value": "T12EA48D41F8149CE6F8395672687F8DB609E13D3B46E019AE27DFB37A14F2212501BE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532806, "uuid": "9b3622e9-01c3-4879-98c6-600037ffbb24", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532806, "uuid": "1e50afa4-08aa-48dc-bc3e-b5774142e8d9", "value": "6144:7XsKoGShOkrI7LtxQ+/yqAkx9xjb0SNEhIXpjdWBP4L:7XOeUEp0SahIXeBP4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532806, "uuid": "b0be3070-ff01-48ed-ab79-6211ecbc6f41", "value": 478592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532806, "uuid": "56d33bc2-14fd-4296-9a19-e8223aee72fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532806, "uuid": "dc2e9a0e-a3d3-4753-be71-9f1656a9463f", "value": "2f426d2fb00858d8649cf99eb2e2aac6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31cd138-71fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782545805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545805, "uuid": "1a9c7c2a-7666-4c89-8b8f-9ce1c36c4a32", "comment": "Malware payload", "value": "432143f9a4181b98c06f8d655f58762b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545805, "uuid": "1b03dc17-b1e9-49d8-ae94-122b8d6fbd56", "comment": "Malware payload", "value": "21f1dc79be1f4430865f13dd9c0012e8bd17e46d01bf3f144b7e089d12240166", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545805, "uuid": "1684b222-3739-4364-b4b6-cccf59d4e129", "comment": "Malware payload", "value": "f5810bf13cc60fcf2c18e5cee936c8bf9748ea22", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545805, "uuid": "1a5ec149-a1a3-44a9-966e-02196de80f37", "comment": "Malware payload", "value": "c9ca7a2bbed47044b836208ded2334b0cf21aa1b46e8d4f53376d58a2207bce885825f53ff413037536b1df576a1715d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545805, "uuid": "21b44b70-3f4d-44e3-95c5-226c6252ae89", "value": "T1D9137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545805, "uuid": "7a271a0b-8943-4d1b-9fd4-7534d594995c", "value": "768:1+69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:1+vco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782545805, "uuid": "f9f8c688-5c50-4344-917c-edc521b8497b", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782545805, "uuid": "d24b0b10-fe8c-4802-a6a6-0ba0d5d1cf21", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545805, "uuid": "c2923b53-473c-4aa6-8599-c686498f96e7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0c8bc2-7283-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782604395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782604395, "uuid": "29945ad1-0450-4e87-bf4a-65cf538c2e02", "comment": "Malware payload", "value": "70f23922c80521b134aeea51cf3a1116", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782604395, "uuid": "e8ee77df-b79a-49c6-95f6-ba8262caf617", "comment": "Malware payload", "value": "22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782604395, "uuid": "9259a241-c2c1-408e-a3de-01ccdb579c16", "comment": "Malware payload", "value": "5e30ed1186eb796a56cf40e24520b79f93143451", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782604395, "uuid": "3e22cde5-ef00-413a-93f5-a92107c4d9d2", "comment": "Malware payload", "value": "b376af7fb2e1ff58359a0a55883a4625ce4a87cfc246bf07f9626ee144648e108865774ee26a0dd2988522d7bdf95dd5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782604395, "uuid": "cc52cf14-ca1e-459f-8ca8-36c6ea99eeb9", "value": "T1580392B2B6609930B68DCC3CB6750D51658AA42BC4553818701EF8F49FFC698DCE8BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782604395, "uuid": "8d8ce1f1-7a1d-45de-9037-5d6d556cb6ff", "value": "768:nfc133pNd9y464571VnJ64EnIgiK2r1nSawi:f65Nd9y464p1VnJ64EnIP7SI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782604395, "uuid": "e8cb6edb-85eb-4497-988b-82940f703dfa", "value": 39266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782604395, "uuid": "c592c28a-25a5-4771-9f60-804d105a213d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782604395, "uuid": "8269512d-1278-41ae-ad93-7aacbdfba91a", "value": "22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae751e7c-7260-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782589499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589499, "uuid": "bb3b6fc5-26ad-4083-929d-8dedf5da6826", "comment": "Malware payload", "value": "6fc7c24da89adad58981093910449095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589499, "uuid": "e8b764a9-e14a-4988-9c12-f03b9d10a04f", "comment": "Malware payload", "value": "2358266014965da1fbcab4fff34a4d7c0d57e6582408ba48cc42c002f7370e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589499, "uuid": "64d4b6bc-9129-48bd-8ac0-bd6bcdc7b450", "comment": "Malware payload", "value": "effc108a84ae4e2566d3466c52bb87a56f141345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589499, "uuid": "2b3914f3-a9f1-451c-9fd4-f8b55d8cfb79", "comment": "Malware payload", "value": "c01fa7542bbd20a9ebec0ebd9246570fdc6e62379c5044aac535bdc2bc89dd13bbd4a4d2eb5b55450e39e72b4f73354a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589499, "uuid": "b452bbbe-9001-4b15-85ab-171831018d25", "value": "T12EA63B03BF5829E4EA456D3001B64B0F939AFD453A366B8F1B09BA1D9FF73C12E41586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589499, "uuid": "f5eb7776-eacc-4796-9b90-cc2bf1080d6e", "value": "805f6dd42e8904f9405139fb7adc8f99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589499, "uuid": "218668a1-341d-4226-805a-bb0fe336a601", "value": "196608:fnV1zWZSFD+oEQmAK3HFYUdt45FLOyomFHKnP:fV1uSh9EQm3FYw45F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782589499, "uuid": "cfb828df-5784-48d5-84e2-7ea41794636c", "value": 10233344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782589499, "uuid": "86abd1b8-79c6-4a9e-824c-b9313b7602e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589499, "uuid": "4eebb508-b73d-4c0f-bff6-1ab435c6bd3b", "value": "SecuriteInfo.com.Trojan.Siggen32.58893.30928.10542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5dbd31-7253-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782583969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583969, "uuid": "95a8e113-945f-493e-ba8f-41b03e01c93c", "comment": "Malware payload", "value": "96d2402207e6c4e266050b0fa125af04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583969, "uuid": "a8930929-0a6c-4222-b649-3c2de055b9b1", "comment": "Malware payload", "value": "23c1ca03358ae3901fdce4a6340c1ad4e02c1abd99077175730b721658a983f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583969, "uuid": "359dc6ad-4a1a-4b34-84de-cc60a22316cb", "comment": "Malware payload", "value": "ad887d49c536e02a985fe155b8f75cfbc19b1bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583969, "uuid": "99817e0a-ea63-4250-bb92-911e224d50d5", "comment": "Malware payload", "value": "5a7c48f05903f117341944715bd25ce060518d56e995462a4418a227e403bbf0ae250ed06c3b668cf8c3b0fe6542fef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583969, "uuid": "483ca91a-2ccd-417e-8fa5-a15c9d047734", "value": "T10BC30755F8505B13C6C616BBFF4E428D7B26179CE3EE720399246F21378B86B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583969, "uuid": "de653e7c-ba84-44a7-8271-6ab6e6fee065", "value": "1536:rFnCJl6rWYVvQA26DU4VILt17s6x2au9nO5uz8hWjUflhgwywV/hsg7E+54uaj2b:zy4QAY4G/Q6x2P+UcLff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583969, "uuid": "14abd436-e73c-4677-a3b5-c3fc88b9a080", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583969, "uuid": "b77c6666-7f0a-42c2-9f34-94fdc3783b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583969, "uuid": "069df2c9-cd43-46bd-8420-7b3a4279c41d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8087a36d-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523279, "uuid": "7c10e2b5-fc3c-4dd0-aafd-31bd03648153", "comment": "Malware payload (Arsink)", "value": "2bcde3d0e2530011f65eaa18716ffd5e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523279, "uuid": "ea32817e-d7fa-442e-8ffb-58df3dafd30f", "comment": "Malware payload (Arsink)", "value": "23d668f31429fe38195087c3f7d9d68ef32fbb7bfa947be3589c08f0975193f7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523279, "uuid": "9dc4a6f4-29a0-4ba4-83b0-4b4395fd8942", "comment": "Malware payload (Arsink)", "value": "f4488af2339dab83dc6a97adb10547bfc38086a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523279, "uuid": "450406e1-3cca-462a-b376-3c5031ebffca", "comment": "Malware payload (Arsink)", "value": "6b947c22bf4934c7021281787e6c80ccd474f368e98beb955bde703ef1d12472c80b0b92b3dcee42fd0a3edc812c364b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523279, "uuid": "0aeedda0-6537-4129-9056-53d7f306e300", "value": "T1E9563312A240B52DFBA69BB48FB742B2F8360FA47455BF357329B3328173136D710A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523279, "uuid": "4e10f8f1-1189-41c5-8ab8-1212c266e99e", "value": "98304:J71lak0b3t88lreBG4PQTDR3Y5XCGl5aG+280+5SwXyEOOCFwmxtrm1gJGhT:Jh0b3HeBG4IHK4GtZ5UoOM41CGhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523279, "uuid": "07d151c5-d660-4482-a939-23cf365f62b8", "value": 6042634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523279, "uuid": "68cdc6b5-c8b5-4ae1-96e5-31714d972275", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523279, "uuid": "72d95f9d-57db-4b75-af79-4c2d8609d9ce", "value": "Eternal Hacker Panel Loader _ 1_5(fix).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86aa0978-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581272, "uuid": "b140292b-d1f8-49ac-bc75-185a3e1cf29e", "comment": "Malware payload", "value": "c1ca49443991a6a79de7215dfabf53fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581272, "uuid": "7991e20a-0b4d-402b-86ae-0bdd0170e952", "comment": "Malware payload", "value": "2623f6dc0b4d56f7aaf634bd25d0baec6f14bf5d902bc2b75534b731667d7646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581272, "uuid": "0c2dd3d8-9ca4-4e8c-a031-4e92f1772b00", "comment": "Malware payload", "value": "195ad7fc4d70c6323392b702a2fcd2f68d026533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581272, "uuid": "0c10d2ae-5b59-4fe2-b4df-b443c725eca3", "comment": "Malware payload", "value": "9adacb9f70d9373d8668fd8e3ccad5cdbc41d30d44057ed59889d6c84362538547121a5814d92641d8a310a8089cb27b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581272, "uuid": "89dc0df2-e6aa-4b86-975d-a0ac0a8cdc63", "value": "T1968413FDA5B3FAD2F103EF3402760DB45271679016D2FA46BFA4A568CA8870E7197231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581272, "uuid": "69536a10-97e8-4a12-882b-6d185eb1258b", "value": "12288:YCv5I7Awtb+1t3ISvuQK3H4lXNgXYmoR1DnisYtz:BvWk+6wSvuQWrYmoR1Littz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581272, "uuid": "120b0384-b1fb-4cd8-a884-1d6fb681f043", "value": 403812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581272, "uuid": "2f018599-27fc-43ff-9c71-65d65450fe2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581272, "uuid": "81684f7e-89ce-4c1c-9ea8-4db7860c1821", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7011636-7258-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SpyNote)", "timestamp": 1782586158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586158, "uuid": "f7bf0723-92ff-45a4-bb1b-f8351df10d70", "comment": "Malware payload (SpyNote)", "value": "68a12fa0f8cb46f2a33c3764a96ce4be", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586158, "uuid": "4dfc84b1-56e4-4746-b5ca-bce86241bae2", "comment": "Malware payload (SpyNote)", "value": "272248f64722ef49413a6f3c339aecb78785546c1c65b9c2897e3915bd91be28", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586158, "uuid": "db790bea-ecf6-436b-b3ce-9f9191cdebe2", "comment": "Malware payload (SpyNote)", "value": "f5e8d0d3fedc45a1c9ed6748fd8a7a9df148ff75", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586158, "uuid": "cea6cb6c-82f6-4518-8b23-67dd0cc96c55", "comment": "Malware payload (SpyNote)", "value": "0e63bd9a6b06e0da03897b61feb4d163a79392af2565670994d60cefa97ca1e61c89db6288d940138080fa335613c792", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586158, "uuid": "7068fb39-21d0-4e75-96ce-75c8433ad0ab", "value": "T13B26F203FB45DA87D8AA83F66F230DA919134F54C643BBE74461BA2D2D772D04DC6A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586158, "uuid": "2f6986fc-8224-4d84-bc84-35e1fd9fc4f8", "value": "98304:ngHFcAOApnaqmcVyyYmzbzB/T10t0q1Ku:ngWzApaaVhnzhKdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782586158, "uuid": "a2b4a102-be11-4556-b4a6-4b001da885ca", "value": 4660698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782586158, "uuid": "d5034ab5-a7eb-4004-82e7-ed37c962a10d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586158, "uuid": "9b85e85b-6452-44a6-b3ec-845eb9cb859a", "value": "Blockchain(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4c161e-71ec-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782539810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539810, "uuid": "6eee4b51-b99b-44bc-a4eb-fc7b30b0d5ac", "comment": "Malware payload", "value": "dde9134ec4d79e80de7b9533fc0c42ec", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539810, "uuid": "d548d0cc-6479-451d-95d2-f8eafea71c9c", "comment": "Malware payload", "value": "287e00573282382fae497baf9a74bbd7ec79d46084df366e4cbf6001d30afb5d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539810, "uuid": "b4124295-af03-4bac-9995-e0de05a6d562", "comment": "Malware payload", "value": "88f74c2edbb5c0c05ba4967aff8a22de27201f14", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782539810, "uuid": "c06de548-7122-4f22-8ecc-52269e823627", "comment": "Malware payload", "value": "5405980539e34c3195965be192f0a2e63ae84370939553bf408698e35cbe71ed199250cce2dd6afab11b7cef870a2d98", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539810, "uuid": "2da0bb82-12be-4ec5-88be-d7dfc1fb16de", "value": "T19B410E190BD94311D7F2C63A94BE9323CA663D42E9624E2E01C526C86D50711FD28F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539810, "uuid": "4004b73a-9600-4e44-a71e-20ff2639642a", "value": "24:8bJqpVBDeHayupJhUx+/2pCirdAi85KRD17A17/abUjm:8Q9KaJ43RBM/aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782539810, "uuid": "ea9e271b-d613-427d-8c41-66fbdff88f8d", "value": 1885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782539810, "uuid": "147ae01d-ae4a-48c1-a5cf-836d83120a7d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782539810, "uuid": "b8c5fb02-8574-4c80-99a9-3c475622eee9", "value": "287e00573282382fae497baf9a74bbd7ec79d46084df366e4cbf6001d30afb5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9080f949-71c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782522018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782522018, "uuid": "2ad201d3-d9dd-4d97-86a9-f2601bb64af6", "comment": "Malware payload", "value": "5472d990d2211e81c63c1e0458b29943", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782522018, "uuid": "1d6864fa-a4b0-4be7-a75a-8f9f866ce6e4", "comment": "Malware payload", "value": "28955cde4d05589d984605220f120878154bc081f95ed5c982baf976dd83c4da", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782522018, "uuid": "2ad30d50-86fb-4dd7-8ba4-b2ace09ac75c", "comment": "Malware payload", "value": "ab408dc389146220c4fdca56e2d47394386c570d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782522018, "uuid": "e95c1d28-448b-4ad2-ba58-21094887671a", "comment": "Malware payload", "value": "510e3f9864db869e2893437dfdbaad48ddcb7363e4dcae135152640d8896acb77d6ccfa159efa8c1a3ef7986a81112f8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782522018, "uuid": "e790c3ef-ed0a-425b-addf-a6804fb716d8", "value": "T144A6F67B2263C168C11EA23EC4DACF40B5F373B91FF2C1E7429147696B559C1AD7AA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782522018, "uuid": "95c6787a-9b93-4ca9-9b4c-781411aa6972", "value": "23db922d0730904371b565e7673258af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782522018, "uuid": "31a59fe3-f8a2-4cba-95e5-84fd9fb324da", "value": "49152:mshpAfs/ryRxY03kjzpalshD0SuZFGBT3vrRoeowspRdN+dWnYqBOaTkjMKdIgAX:i1F+oeodcMKdICVNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782522018, "uuid": "d627e276-d40a-4961-a4ab-623adc3ef349", "value": 10109952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782522018, "uuid": "2df328b5-3414-41b2-84fd-be3e1a28e6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782522018, "uuid": "ac6ae157-a038-4694-948e-e4ceb255e2bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61607c86-71f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782542554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542554, "uuid": "304222f4-dd83-42ef-8e22-b03738fcd1d5", "comment": "Malware payload (CoinMiner)", "value": "41ef13dadfd1bf7e252d4cf722f6e731", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542554, "uuid": "e05da876-1faf-4391-8cff-d09d40ef4238", "comment": "Malware payload (CoinMiner)", "value": "2963ce4ae8f9ebdb2caf7c6f748a10d546cae6f56e79900d8c0b6e878954905a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542554, "uuid": "ce871f39-af9e-49eb-a6e4-a8cd04435fc2", "comment": "Malware payload (CoinMiner)", "value": "8049f8cf6cd394317a4541b340b702ea164abcb3", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542554, "uuid": "b7ed1457-9702-4d84-873a-cf1c856df1bf", "comment": "Malware payload (CoinMiner)", "value": "8df9c6071d143caf3292bcdb369dde42e04db817482f260c7bea64f64c2fb39cd6559147ab8a65bb19353b182c8c1c63", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542554, "uuid": "79f20dc1-d499-4621-abd6-9b8bd3e15b8d", "value": "T17266E003E5E7CEF8C21BE67D46629333AD2474880E32B11C6995F36A5FE4934A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542554, "uuid": "57754582-d298-40ef-9f1a-a6ed66ab0538", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542554, "uuid": "e8478bb2-4092-43ae-95bf-228c2b798f71", "value": "98304:vvcO3YeFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:sg1demyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782542554, "uuid": "195bc75f-c1c6-4761-bf4e-cedf008bf842", "value": 6487040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782542554, "uuid": "de0b6269-00e1-4a33-9ff3-3cc5a8188e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542554, "uuid": "b709d8a2-dd04-4b54-8615-9fff7f8296e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dfc126-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782551447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551447, "uuid": "04d29e11-4bc3-4760-ba1c-ed52f9162a85", "comment": "Malware payload (Mirai)", "value": "440cce95dc3cbef547a904d315d60e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551447, "uuid": "8aaefacb-6f60-46d5-9985-bb22f36fb4dd", "comment": "Malware payload (Mirai)", "value": "2a978fd9de4b54537a90307ecdce570efc3a3dce816baa4ff7a2bbc81d7d8370", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551447, "uuid": "a6ea9d5d-54b7-42c4-af94-22a7baaf5038", "comment": "Malware payload (Mirai)", "value": "78a5cb098b37a083abcf5284f70c073d25763ec1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551447, "uuid": "48b6e8bf-9de5-40b5-9476-7ac7a41f6a88", "comment": "Malware payload (Mirai)", "value": "9138832a87b1b263b35ea9d169f8da2f52bfed647b886e1575cdd74e4ee2d32885500ed650a98921bf86d7864e3fe3ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551447, "uuid": "faf1d3d1-00d1-475c-873f-60724e7039e2", "value": "T1215302457698FD84B2A3F4787EA96C14F193ACB4D1C1F4ABB055ECC89EC254398FA4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551447, "uuid": "7ce29965-0357-4bff-8b23-99a4a304a145", "value": "1536:Oed6YgNLQ7W3SfQQk4Rea9PhyrFRbQXlMobpy4r8:18YgiHflp95/M8s4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551447, "uuid": "bbd966f6-51aa-40f5-a3e4-79799ee9a9da", "value": 63180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551447, "uuid": "e507764d-839f-4ea3-8f85-b590819d12cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551447, "uuid": "8dd5b461-d9ba-4573-a7cb-5739818d1651", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a06f81-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782551449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551449, "uuid": "9f896f10-2ddc-4d77-8008-27557ffae55d", "comment": "Malware payload (Mirai)", "value": "44351168cdab0b42ef9323a29fe0f164", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551449, "uuid": "d16bc059-31b7-4fbb-9b0d-b82b18231fee", "comment": "Malware payload (Mirai)", "value": "2be455272c761f303b309416531157473dd15538dff31a8c8558b6571534aaa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551449, "uuid": "b4467f45-8216-4bb1-ac7b-1acbce61b08a", "comment": "Malware payload (Mirai)", "value": "357e684c2a8eb87c7f9bcc07d7e9aa46b632b30d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551449, "uuid": "305300d6-816d-4546-a903-4e9444bf4294", "comment": "Malware payload (Mirai)", "value": "91a9f20e1876587551c4c32be900143ea86b3a25e04e060c7087e4e66a5f17b66e27bfd3dcbd06997f7d922f7dfcaec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551449, "uuid": "7bdbd175-3f17-457c-85e2-9cc70fe3f612", "value": "T183243CA3FD01DEBBF80FE3B284534C15B130FB6128525A3672A3BE9799350D56923E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551449, "uuid": "3dd09107-ddd7-4f5c-9188-d74b560ebaf7", "value": "3072:vHqZrMC+omSBS6UF9d1O0pedvz32KJy5k2Bu1Gt1TtRYcgq1dVzVIjbi0Lo7IIvT:iKXUBa7empmy5lBymT351d2LcQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551449, "uuid": "215fd966-8815-48ff-b63c-a0d75e38aaa1", "value": 219700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551449, "uuid": "049826d0-c59a-4d78-8cba-7a8151aab0b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551449, "uuid": "c6ade76c-29d7-4def-a7fc-7f38d9d08ac0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85219592-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581269, "uuid": "5fa7f47c-0663-4bfe-97cd-351d486dcded", "comment": "Malware payload", "value": "91739f46454095f5a22b0db73bf9260e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581269, "uuid": "87ad526a-9ea6-4dbc-be39-5cd44e61355a", "comment": "Malware payload", "value": "2c3416d10a67021fa236a254bf397ece6789b921af0ef5f33b9ca69c63f6e6c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581269, "uuid": "b75de630-0d12-4996-82e1-59cde0566a88", "comment": "Malware payload", "value": "351dbea81cf00f4019d8ad02e4a279ce3ac959e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581269, "uuid": "ec448c1c-3caf-4e5a-a6be-ae75529f3cd6", "comment": "Malware payload", "value": "e9a88e9428ada9c92f0f96d08f3766dfbe99b5ddd6732782c93ac0d7c0d5fcc619b079a923e93d9399b691e593050349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581269, "uuid": "7395d74e-16e1-431f-8b7a-54a367165f53", "value": "T19784222BD1E97F63DC5BDCFA18E80DCA296BF7A31766CF03CB645ED0A01A2162564C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581269, "uuid": "44fcec40-ba3b-4315-8b2c-b9be0c934729", "value": "12288:iRh11RjyZnAtjOWgtNUj9SDeg3B+zSf4t:c4IaRtOj9s+zSgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581269, "uuid": "f6cf1287-6f07-41e2-83e2-47f7dc360dc8", "value": 403812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581269, "uuid": "512b2476-2b07-4a01-b2b0-25a7742bdb08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581269, "uuid": "1536cadf-36c2-4ea6-af8e-4f6bf081202b", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec7342b-7270-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782596425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596425, "uuid": "ff35a649-4dc4-45da-91f8-123d1e04830c", "comment": "Malware payload", "value": "e24a62dd834cb62befcdd800425c493f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596425, "uuid": "f173b558-67cd-4720-80b2-eb62978ce78f", "comment": "Malware payload", "value": "2dd4175fc20d38e51eb59f0ee324618bc2b29caf10a3f11e41c12391976a7f16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596425, "uuid": "141281dc-caff-43c3-970a-78b3d0a838d8", "comment": "Malware payload", "value": "f407566c5a544e1de3a979cdabebdb232aed7a77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596425, "uuid": "8ce968f1-3b7c-45bb-b41c-cae8571886e9", "comment": "Malware payload", "value": "4f6ac7a08ab4bd5d078a38f31550eba1168f570023308bbd8186a6f687a0579507ac2233b690749239e03f2ed422ab21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782596425, "uuid": "2652aae8-caad-4e90-a618-455c53bd405f", "value": "T14E47DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782596425, "uuid": "1cf0c98a-c8b7-446d-97de-97c3a23c8f7c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782596425, "uuid": "70b5a138-5604-4589-96c7-8c1fc5d6f14e", "value": 25165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782596425, "uuid": "87ba26c4-3bdb-4c2d-b91e-85784b261557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782596425, "uuid": "eb47e4b1-9c40-438b-aaa7-2920267d2c65", "value": "2dd4175fc20d38e51eb59f0ee324618bc2b29caf10a3f11e41c12391976a7f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e3a107-720c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782553435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553435, "uuid": "59a930bc-07b7-4178-988f-e931ecd993b2", "comment": "Malware payload (ConnectWise)", "value": "2695e24e6d062fe97e0e3ae4238ecc11", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553435, "uuid": "d06dab1f-b30c-4cda-8d3d-81a2f60a8fd3", "comment": "Malware payload (ConnectWise)", "value": "2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553435, "uuid": "b77bea9e-44ef-4a7e-af25-53e9b5eaaa89", "comment": "Malware payload (ConnectWise)", "value": "4a22a0aeef82e9e9094f100e714ad71919ae8a84", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553435, "uuid": "4e9f62a7-cbb1-48f7-bdc7-cacf5078816c", "comment": "Malware payload (ConnectWise)", "value": "f391ed830983cf9a3e9fe19868673bcab8d5a42c48eccd65db9dffad15e7c537ef5c9727e34851d2d9df993e578903ac", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553435, "uuid": "0c87b2d6-9707-481d-80bf-211c71d475de", "value": "T190646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553435, "uuid": "965a01a0-53be-4224-97ae-b624dbe9894b", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553435, "uuid": "0bea4b7a-f8c0-4402-9736-fc5b6d717386", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9v:J1iw7gryNkSV1hy1Z1u2JLu9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782553435, "uuid": "90eb57e5-59c2-4327-9f2a-a586feee168c", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782553435, "uuid": "93feac1d-2618-44dc-8aac-ecaab0a2c487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553435, "uuid": "036a1b54-8b27-479e-90eb-49a785c8514f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495b66eb-7282-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782603932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782603932, "uuid": "e0841c6c-a69c-4b85-af65-0494001e7f6d", "comment": "Malware payload", "value": "ef4c778cc00449d703a946dd2889e523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782603932, "uuid": "ff6cbe9c-9025-4409-9df7-fc6a26668f21", "comment": "Malware payload", "value": "2f7e04dd499107fcbcd124d859bbe3d4479b1e7acf2b1c05daff57c9a8a4b0f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782603932, "uuid": "15c96cff-1a7a-425c-8571-a6d32412de9d", "comment": "Malware payload", "value": "cb06b480a3a550dfbc64924d661ab6a2ad737a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782603932, "uuid": "aeceaa95-4c2e-4216-aaa7-694e9b524a50", "comment": "Malware payload", "value": "1ed677ab4b7932dcca8da52f32cf1da24c4b1f9068f4c9315eb5487648c990dc0569e8106f382b343a07040c89fd968f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782603932, "uuid": "50b85422-6fab-43fd-bb49-8d3a8a460ef9", "value": "T1DE563903FD5515E5C0AED1308A7A9253BB717C891B2123D32B60B6387FB6BE0ADB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782603932, "uuid": "a8782226-dcdd-4055-816d-66088012370f", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782603932, "uuid": "87919e94-8a6d-4e09-8205-3efc46ccf2bb", "value": "49152:8TX+YbY0dJmHi9/ebr7pUgwbluI81XSc8yYhMG1SLze2UKQK1K6GyGqu5Ex:8TNMMw9pcutMKf9VXkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782603932, "uuid": "ed25e17f-a6c8-4e4e-a8c7-d7ca1eff953f", "value": 6187520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782603932, "uuid": "50e63118-9598-43d5-bb8d-2889885980ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782603932, "uuid": "8cc974f0-9ade-4bf3-ad9f-7a4c28138ad4", "value": "SecuriteInfo.com.Win64.Malware-gen.85337721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceeb320-7240-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782575860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575860, "uuid": "a8543930-a52a-4434-bcb0-765b9def5389", "comment": "Malware payload", "value": "8a5dd01e56114f2996eecb2347f095d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575860, "uuid": "75927316-81c2-48e4-a6f8-74474aac8ab6", "comment": "Malware payload", "value": "30173a37813bdba5d72674321428071f90ed8716c3d57ba625f7311017e090db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575860, "uuid": "81e87495-a3e3-48a0-b8aa-5a99f6452c2b", "comment": "Malware payload", "value": "e876771c62b15bfc2094bf874c995f7cd807379f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575860, "uuid": "846323cb-a8a5-404a-8711-693329e4feed", "comment": "Malware payload", "value": "4596303ad6f02460b55701f396af712dc1f9a4144d1b37b5bde242d288517b83b09078f035861053de263528145858ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575860, "uuid": "4c9a1c04-640d-4b89-bf2f-a57fc268eebf", "value": "T104C5F63B6954B168C01FC1BBD0925B24D83374781772A1E7318C2E5AFA4AECA4EFB751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575860, "uuid": "ab88560a-bc3b-4cd5-93bf-100bc5b39423", "value": "b7e8cfefed3a2b3f4a16e2ad1e6d5ac6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575860, "uuid": "a2e9922e-34cf-4e4f-8a31-73324a1542f8", "value": "24576:veG2hojUVnlganD8KgZTrgltC2yH8My9bfvt:AojcnF8KgZGC96rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782575860, "uuid": "4af9df3a-4005-4bb0-b2f9-f9342d5700c3", "value": 2612736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782575860, "uuid": "cca5b5d3-2b71-4ed9-8c5f-ab9e836412f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575860, "uuid": "9da55efa-5d07-42fa-9bed-c07254e9fc0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6276531-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782581325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581325, "uuid": "9777f981-ab78-44b9-96c1-c68a3d3a9b9a", "comment": "Malware payload (Mirai)", "value": "d22b33bc23a7c97a5945ce718e416f46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581325, "uuid": "92964ab1-49bf-4896-b4a1-66d2a7be6ff2", "comment": "Malware payload (Mirai)", "value": "304e7db1072c78f322297554b1c8b7c8f40b017cebf2d5f009e04674e633d92a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581325, "uuid": "ca17c94b-5206-4919-a6b0-5d80760489a2", "comment": "Malware payload (Mirai)", "value": "1ca2f6cbab1a5b0fba5578b549787190e91f7afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581325, "uuid": "1f530f85-f77b-4104-97ff-4440012aedba", "comment": "Malware payload (Mirai)", "value": "55b4899c3ed8630e9e72f53ee1eac9418a9e0b297d7699a9391b170c7df507008ddac53291f4515cf47760bdffe6f8d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581325, "uuid": "b86788e4-6de9-4645-abaa-f0bebb2684d9", "value": "T10C347D63D936AF96C022A8F4B1F2DF780F12BD6789071E99D576EAB08093DC9B501374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581325, "uuid": "f7614175-ce37-438f-92a0-d08f6015abaa", "value": "6144:Q/EDFp853nMt7u9BNypDIbMaZMrwSPz3E:Q/4Fp853nMxNpDIbvMlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581325, "uuid": "114bd426-ebd9-4adb-8391-d685d8522c5e", "value": 241888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581325, "uuid": "09bc4275-3b93-48e1-b72b-2fb50412d187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581325, "uuid": "9e5de12f-3608-4f48-9e7c-0d3c429ae414", "value": "kworkerd-crypto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ba058d-723f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782575180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575180, "uuid": "99e70a41-5b6b-4ed4-9255-3a04d5c9aba3", "comment": "Malware payload", "value": "d0d31fe37076a92bae7b530c6c08582e", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575180, "uuid": "b3336f9a-e03d-4df1-a0f1-8b9c38c7b993", "comment": "Malware payload", "value": "366761394325153b2d0927a996b9ca2121a2f3194e32c8fe0cc3acb656776cd0", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575180, "uuid": "f6c32717-74d1-49f0-b9c5-c14dab53aa23", "comment": "Malware payload", "value": "11fe1e8e2c2a94339f1a3e2932babf8129783cc8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575180, "uuid": "cb504150-9c27-4e64-a808-f8235fe33ae3", "comment": "Malware payload", "value": "f6bd9fff87cd501365dd0e92baf9f5faf747b6a400105e6d05ca0d6aaef8484837ff9e609a4c0e19f5c1375f7c51668d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575180, "uuid": "16dbcf40-cf2e-45b9-bea3-047f1f3c8fc5", "value": "T1F61833149B948CD6F95631399A915245E3E3BA6417B18F9F0FC06B212E276FBEC3C321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575180, "uuid": "da9bb316-ee1b-493a-aabc-0b50074a4312", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575180, "uuid": "4f968e05-0b8b-40b8-bf84-87a66d7b8905", "value": "1572864:wAYyyxBU7rUFpYMHK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:wfxgkEUc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782575180, "uuid": "deb729d4-c199-41bd-9160-1fdb1377fa82", "value": 85022003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782575180, "uuid": "de3dd023-a16f-49d0-8bf0-f771fa08632d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575180, "uuid": "24a85715-88e4-44c8-9a60-c8a0017f88ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7bb47a-71e7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782537317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782537317, "uuid": "6f6eabd7-b06f-42c3-8901-9ec23008876c", "comment": "Malware payload (WannaCry)", "value": "11b8b0934790fc8a74f392f10bb5c7c4", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782537317, "uuid": "77195ece-6df3-4b3a-9bbc-b5cd104bde89", "comment": "Malware payload (WannaCry)", "value": "3bd4b18e87e5707986da3059f204bb4e6f9c917e4c576cab484dda391c3e3673", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782537317, "uuid": "262abedc-da40-4c4d-9ef4-db50a8145b70", "comment": "Malware payload (WannaCry)", "value": "0f4c8c7ec3936ae2375fcc3d1ebc11783cbdb76c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782537317, "uuid": "7c043855-215a-42b1-b9aa-2b6ed4e628fc", "comment": "Malware payload (WannaCry)", "value": "1709a10e243b8beaeadee791d38d9b7ad646457c46958968bfe2a6e861a7b7b03d07c28a05e987b11459f0e849c63d69", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782537317, "uuid": "10ded426-bcae-44d9-8897-89e6bd914c84", "value": "T1B8363358726CA1BCF0450AB444B38E1AF7B37C5567BA4B0F8780866B0E53B9BAF94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782537317, "uuid": "43197231-81f7-4050-ac71-2b75a146e3ad", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782537317, "uuid": "687f95be-057b-45cd-9e9e-a95f885d28b7", "value": "98304:D8DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:D8DqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782537317, "uuid": "2807a1c7-0db9-4da7-9b99-a85040c9aa37", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782537317, "uuid": "83f47896-d9ea-4cc9-ba93-67b313a4db66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782537317, "uuid": "42f24015-484d-49b5-a6f3-4c60192b40bc", "value": "3bd4b18e87e5707986da3059f204bb4e6f9c917e4c576cab484dda391c3e3673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef0dece-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532753, "uuid": "4738f79e-53b7-42ce-bb0b-7877fa94e94b", "comment": "Malware payload (Arsink)", "value": "83d14fc38fdc4ca662f6abc80c3fc30f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532753, "uuid": "2b3b3d12-1df4-4dad-8056-4f50bbea494e", "comment": "Malware payload (Arsink)", "value": "3c29a7a2b35b47e8bd1b24eb3f2a791503cd717ac0b302481e2763873a417647", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532753, "uuid": "03c2609d-9635-4d94-8ac7-6af5db55244f", "comment": "Malware payload (Arsink)", "value": "53622c600a07f88b81d31f19b6863fd0ceec8f8f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532753, "uuid": "d126f666-2805-4799-bc5c-a2bfd0dcb73e", "comment": "Malware payload (Arsink)", "value": "873011175e7615a466ea8dc2902fab3cca3bdc6d2ecdebb67fd7312f488ffedefd82103a5ff33aa08fce21c46ad777cf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532753, "uuid": "da5db8b2-f4e7-4a34-8ac6-d26e3b293914", "value": "T10E66D089BB89D92BC4777436517AA322415B4C068E83A783BD447E0C6CB79C51F8BECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532753, "uuid": "264a461f-7dd1-480b-87c5-1fc1714014de", "value": "98304:8LStO8ftRrd5CiIMWC/AViJ/XDC3Que/C+pYMGSKKce4MtsZAOY9AaDcPpPnG/hJ:8WXbZf9zC38/CfMGSurZC0PZG/hbpa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532753, "uuid": "df56638b-5386-406c-9d72-89c35b7f103c", "value": 6708454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532753, "uuid": "707975cf-aa71-4bee-ae30-d42983cd1873", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532753, "uuid": "e15e4b0b-25bb-4b91-9471-d3f2af8a5ee2", "value": "Installer.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cc8b5d-7240-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782575796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575796, "uuid": "97e9b883-38bc-449a-a934-24e644bb05ea", "comment": "Malware payload", "value": "c1f9600e7537b494cc41ed716585384f", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575796, "uuid": "51dc4b43-fbd6-4156-86a7-83f018ba8e2d", "comment": "Malware payload", "value": "3c414f24f823b072019b5ef2bf9ba0bcdb44fed8f4d9793b49dfda55b8ec701e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575796, "uuid": "58918951-32b0-4326-baad-2008fa3a08d9", "comment": "Malware payload", "value": "793ea2d41268c3ae495e60afb782c1aec041c4ac", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575796, "uuid": "844daf40-5192-4d29-8fab-59e57cfc960e", "comment": "Malware payload", "value": "92a726c097c5aada6321037a7cc3ae66c1e16afba0fab8773d85d2cdabacb8708672e6b07c9ae4f42e39290a989e785b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575796, "uuid": "2f02d602-c863-4464-81a0-b860b25783b8", "value": "T125F4BC3A6DA0B534C44E94F7B544A074DD956C1968F43A03348D7E8BF6AEECBA8C2707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575796, "uuid": "5717b8c2-6f3d-4f61-9778-269c759c3ccc", "value": "7636034d7f84561d77daf6dd678cf919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575796, "uuid": "125ce479-0367-40f5-858f-5f8a4de6bf9f", "value": "12288:jjj4ck/SKtyHYfj8KhW7XgWhLldp+ozb5KdqQ9QOEh76t/9:jjkck04fQKKD+o8dH9QOY6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782575796, "uuid": "0d3be08a-b0b4-44e8-ab93-1ed3791da581", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782575796, "uuid": "1bef01b2-67eb-4422-bb38-57585f3de4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575796, "uuid": "f3cea12d-8519-410e-880a-9e1345cfd8cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99094c54-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555533, "uuid": "8b1490c9-f642-433d-b5b6-1ad4d01681d1", "comment": "Malware payload (SilentNet)", "value": "5ffa0b5629fc64e3319bbf914d5f6390", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555533, "uuid": "8ab7287c-224a-4647-bb74-6a0c926f1fa2", "comment": "Malware payload (SilentNet)", "value": "3f0194fc97d1fa02c724bf17dc4c80d74fd7742e03263b8b242c5fde93c02add", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555533, "uuid": "285568c7-e3c2-4948-8fca-499a9288c81c", "comment": "Malware payload (SilentNet)", "value": "7b3447ca6b3f2fae95154b1fbc29103336d4fe3d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555533, "uuid": "ed6a0ee4-186d-4c96-b8bf-04414373cb0f", "comment": "Malware payload (SilentNet)", "value": "262f75536cbff00403bc863f485c4d2c5cb1ecc9a8584677d067a69514a669dfedd119ecf38162aa773df05e2dd600a0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555533, "uuid": "81c0d5e8-1b68-45ef-a3f7-1805082f4f7b", "value": "T12D663321DA393032F02FE139A7460B7ABE6C05F2D28AB4F3177418DBEA9E445695171F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555533, "uuid": "8db809c1-c649-4828-bc2a-943d2edf8da5", "value": "98304:qcpqaI0GQjVPr4C6uN3RBkzQJjwl9GZr0S9+3WeO/CyP69HQUf9fHkRxPJpLM28/:qOhGQxPDN3rGcjwl9GWWaFO9JH8cl0jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555533, "uuid": "25468814-ce54-477e-af24-7bf797d4f61f", "value": 6809994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555533, "uuid": "d0134e77-2618-4d96-a482-ef5c83c6a47b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555533, "uuid": "2b23e495-d394-4290-8d68-e39edb29b49c", "value": "VirginsPremium1.5.01.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fccc7a-7209-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782551910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551910, "uuid": "d456dc73-0724-4fac-9554-3d0890ffe3c5", "comment": "Malware payload (RemcosRAT)", "value": "496caac1fa6369e93cb48970f72e26da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551910, "uuid": "f983d740-5806-4aea-93a6-98396ce632b2", "comment": "Malware payload (RemcosRAT)", "value": "40079f05ba7cdccac1f62f8e7e1b644bc0a806b58465f5c005725bc54ee73ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551910, "uuid": "9dc04e19-e327-48f5-9d25-45a730478ca8", "comment": "Malware payload (RemcosRAT)", "value": "bd2a22a6bab8f5d5c146f6162ad28244ab22985b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551910, "uuid": "aca7d1f3-0036-4712-a583-2ad20099726c", "comment": "Malware payload (RemcosRAT)", "value": "55c92fb6452b58f2a1a943322d6b2ae275c8db7a9601b58a2f433b52bd0efc4b844408846609e8e01531f8fb7874d7aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551910, "uuid": "0ff32e03-e171-44f4-84a9-e2c4efd20b26", "value": "T102B49E01B6E2C1B2D57254340D26E775DEBCBD202836CA7BA3DA4D57F9701809B39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551910, "uuid": "c08e2be4-bc15-4421-9d37-67a6c63f0dc0", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551910, "uuid": "558f345a-8813-40f4-a6ea-490b2ad51508", "value": "12288:U6pxxGI8gvGOHJpAbDYGxLhZ+sPZT/4mPFN7U:U6pxxx8U+bDYGxLhZtZXPFBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551910, "uuid": "4264f78c-3e06-4e52-a6a7-2e189317f6e0", "value": 514188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551910, "uuid": "3a62323c-ef91-42bd-8c59-b9ce64cf9634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551910, "uuid": "fd61d869-a225-469b-8a4e-93959b353b33", "value": "07_remcos_agent_7.1.0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15949249-71ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782526536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526536, "uuid": "2fbb98ef-1063-479a-ba11-5d418ac6ac3b", "comment": "Malware payload (CoinMiner)", "value": "5b532a2bffe54bf4de2e8029e84041c3", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526536, "uuid": "a7a4d205-0588-4e9a-aa0a-c775feddeb06", "comment": "Malware payload (CoinMiner)", "value": "40479b05e94cf5a4895d68867d9fdaebe1e2d7f9d632b76cb57041ea1fe20c71", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526536, "uuid": "045780f2-5f30-4765-9bcd-08e4d90401d4", "comment": "Malware payload (CoinMiner)", "value": "e499574f0ee36f979527a2a434b16936dc9ef9a4", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526536, "uuid": "c89fde39-56b8-4532-a720-50d364c9ddb8", "comment": "Malware payload (CoinMiner)", "value": "47c7eecdddb76268db25badc8d2baa2c3fea3971d71c42c795bee1d05721f82a3ca5ec97c419afa07eed1fad1ca93665", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526536, "uuid": "5a8a6b94-000e-497e-b062-8227183cd2ce", "value": "T14C66E103E5F78EF4C21BE67D46629333A92474881E32B11C6995F36B5FE0938A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526536, "uuid": "16317033-f44a-41fd-a1d5-aeb8f5de6937", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526536, "uuid": "f39d0c0f-ec03-4365-a848-44918baec721", "value": "98304:IU8W7IFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KJM:EI4demyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782526536, "uuid": "35a3b394-7cf9-4ccf-9e17-b317b879f655", "value": 6473728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782526536, "uuid": "06794d53-4964-4c53-ba61-13b7817fba14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526536, "uuid": "2f134d11-02a8-4e3c-bcdf-f2b5f99c675b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aa6b74-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555494, "uuid": "06eca6c4-759e-4870-979e-c4cabaa54d1e", "comment": "Malware payload (SilentNet)", "value": "00d1352e8afc4e6ef08ae1d8d5f67ad1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555494, "uuid": "7e71007d-d1ae-4fb6-93b6-2df0cb7f9216", "comment": "Malware payload (SilentNet)", "value": "42b0a8097179194666800ecaf65b0e61984987fdc9290a856ff382b4c987f07d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555494, "uuid": "c07f7fb8-67f0-438a-9867-7630155a1fbb", "comment": "Malware payload (SilentNet)", "value": "689e3d86912be05c276f4c5801701cf4648bb11b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555494, "uuid": "31c2e232-b036-41a5-a5d2-973ab81a73d0", "comment": "Malware payload (SilentNet)", "value": "0d831c0f4473b13fe713c03d6f05bc9d2c49d872c6c9f7c7b301301303c999af965f7e8eeb784ee006d6c1cdd1a0a1aa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555494, "uuid": "4e8ccd80-8b86-4eb4-8437-fd3229d0340a", "value": "T1ACA41227667D842BEA23AE315C5E9FE4D4FB02F018CB550625AD119E05478BB2F83F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555494, "uuid": "647061e5-c599-4270-b972-89be37e4b2ce", "value": "12288:DXusRB1BoVUDF1HuhVXOQDknVh6IJ0WbuMtaKLJB:1R3Bo2HurXOQDOh6lWqEaKLJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555494, "uuid": "7bb03c8d-2232-438a-855f-b10e9e4b4ca2", "value": 458173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555494, "uuid": "d5071bb6-f23c-44fd-816c-aca789a8a229", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555494, "uuid": "4c0c247d-ba1c-478e-8a95-6d32756fcb70", "value": "EXOlDEBUG (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3eb33f-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583318, "uuid": "491aa6c3-ea4b-45a8-b42c-a778122e2cfc", "comment": "Malware payload (Mirai)", "value": "af92851714b585193c3def0679989926", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583318, "uuid": "d72650aa-db4b-429d-b5a7-7c0bf2c3406a", "comment": "Malware payload (Mirai)", "value": "457ff20c00a295e27fe60a0a3e1a1aed1d297cc1cebe4c5cd876bcc21903fbfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583318, "uuid": "86aaf22b-f163-4b21-9dc1-f6fa63552301", "comment": "Malware payload (Mirai)", "value": "9277ebdfb560f752dc5ad6cc1b3ba7c584a34f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583318, "uuid": "78174c39-88fc-4b79-95ea-9fdea484564a", "comment": "Malware payload (Mirai)", "value": "381618cffd8dd17c69ae647a3d3334cd2f1e8d0715f24fbded01e4d4e05cc8a2cdab2d384b7a5cace2a45f4e5c0fc295", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583318, "uuid": "cd3d3ffc-fc3a-4372-8345-c5039a9b11d8", "value": "T17A6619136B28E70EE51872308AB1CA946B291C9545D79917A391F31CF9F30BD4EAEDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583318, "uuid": "8f35403b-f1b5-4d3d-9530-e33804d8eceb", "value": "49152:+9TdgZB4WJW1rw0LIOhUm35BrWXKT5qWBZsiRsX0PCR2gC9kazvTHH4t5ED:mdW/Cn4jED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583318, "uuid": "c5da96cb-c463-4f98-b006-9b7eb5f55cf6", "value": 6684865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583318, "uuid": "f7b0ffc2-b4cf-4109-8cf7-c6eb583d8735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583318, "uuid": "b0c0fae7-e99e-4246-87f9-b15ce36a627b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d6d7e-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581274, "uuid": "8640535c-4138-48ea-843e-9ff0d7e2a4d9", "comment": "Malware payload", "value": "6dedc8ebc7b8919a68a4163c0c849455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581274, "uuid": "e6ffdc19-33b8-4af3-bbd4-2d436706852c", "comment": "Malware payload", "value": "49061a4ad78f4891c747acff4fbb75b816635069625ea654f22f41810e2be45a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581274, "uuid": "1ae97d65-0cc2-4982-b38a-eef60e20a50a", "comment": "Malware payload", "value": "cb770faff1d3b85118fd74b1a7c5f9edf849b08b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581274, "uuid": "a4c10567-f980-465e-97fd-8497bfbe2a2d", "comment": "Malware payload", "value": "6fd455de9e620496595264d824d21b480baf51c29293671153c06da172252f18e5c00695245fac7251417debde398c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581274, "uuid": "d08b85ea-d2e0-4663-b383-3d1b965a2b5d", "value": "T16084229C96900F7EF30B427959F70E385718A7A664529B82F709EDCCC82720DBC56379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581274, "uuid": "ab069a5c-39a2-4df1-9be9-5c9cc5b398e5", "value": "6144:bDkGfYHYGsVoidzivGYG3xekCMIvx5MwEw150IA+lngH8YFstGQxMfOY/rLEs4Vz:XkGfYHYG6lulkCXvx5yhIAeYqEQxMfO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581274, "uuid": "863ec4be-a1d0-45a7-9219-c7fca6bfb723", "value": 386320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581274, "uuid": "75e66680-0bc1-4c42-a2fe-9efd0dc851bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581274, "uuid": "898211a3-59f1-4a3a-96c1-3bdae39319b1", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a20428f-7205-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782550354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550354, "uuid": "172dabb0-7263-4944-8671-9c0825027715", "comment": "Malware payload", "value": "26251ac33d9adc6c935c9edbd9dba7af", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "KernelInjector", "colour": "#8148D6", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550354, "uuid": "f8908b51-a8a2-4ea7-820e-76d7bff58d9f", "comment": "Malware payload", "value": "495c7e5513fa7766c236e76d8520139139fc4ad7203ddcb2ccdae17bdb691979", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "KernelInjector", "colour": "#8148D6", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550354, "uuid": "a9dbbd2e-9dbb-4d66-b607-13122b8a522a", "comment": "Malware payload", "value": "b6fb3707d78b216e53a59eab211e75716c8f3750", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "KernelInjector", "colour": "#8148D6", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550354, "uuid": "20a4bd4b-dcc1-41c5-918b-e7a2aeb365fc", "comment": "Malware payload", "value": "26b4e7739659048c1f1d86b64241d5b3ed71ca1481a5a8a3716fe7389da1ffcd82e21ba9468c66cfeaf88432ce93c2c4", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "KernelInjector", "colour": "#8148D6", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550354, "uuid": "2fc9227b-09f7-4be1-b55d-63cc0a8f218d", "value": "T143E26CD1CB6840D2EDA6C9B4D2B5D62B7D3471C12710DBFF0290D8681E53BC4B639AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550354, "uuid": "04193c44-a0a3-4f1b-9e20-f33fff227e69", "value": "5c6478fa51bfe6402aa0892dc333f989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550354, "uuid": "0a417c82-910b-4cc9-b916-c25e207b3584", "value": "384:7s/BuNJSxMVLkobr34Znl6m5R2wsrpdZEL5iZFRqFR9zcA:YuPS2VLxH3aDslfEQqX9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782550354, "uuid": "f4b1a77b-3d81-4cbd-83ce-3e174a2a2b7c", "value": 32344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782550354, "uuid": "4f91eb06-9dbe-434c-b17a-bf9f83820bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550354, "uuid": "23a5fa17-2a02-45f8-a1fd-11b10ac7e979", "value": "wskmon.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ba45fa-7212-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782555735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555735, "uuid": "c10fa822-f677-4c9f-9cfd-9c9deed9e203", "comment": "Malware payload (ConnectWise)", "value": "d5e9cd5cd5ba38ae51a114cbc2189efa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555735, "uuid": "63084df6-a4fe-487e-b8d0-f7c9555aad70", "comment": "Malware payload (ConnectWise)", "value": "4a087a74df20ffa9f4acc2427cea2158f76f32ae85389fe396282c8c44fa794a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555735, "uuid": "d53a610c-b2c6-4d13-84e8-55764f13a5ee", "comment": "Malware payload (ConnectWise)", "value": "449b411859b06e87e62ea42985d02ba8c5134716", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555735, "uuid": "840eb2a4-132f-4f8f-904d-dd470da1fa11", "comment": "Malware payload (ConnectWise)", "value": "e89c03ba609cf898ac21e26e6a11755ce3783d4ba17f43ec1d7cf5168ad91e560f38a6b2d908d90942171a7473521a57", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555735, "uuid": "daf8f48b-6f92-498f-b01d-732831b2ed91", "value": "T119646C11B9C48432C673383107B8E2B28DBDB8301D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555735, "uuid": "1fdb3ee4-c204-4e18-9363-883d8aafa7ba", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555735, "uuid": "0a0835a8-e25d-4451-97d3-15592e54514d", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9sM:Q1iw7gryNkSV1hy1Z1u2JLI9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555735, "uuid": "4de23011-4c24-4afd-8735-cf50cc60f9b4", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555735, "uuid": "2f73a5e8-4f96-4f33-b472-17fc87d12740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555735, "uuid": "8c0c8571-f4c4-41d0-a516-5353778311f7", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1267df97-725b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782587090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587090, "uuid": "bf1c1efe-98f8-40b8-a59a-7133f94142c0", "comment": "Malware payload", "value": "a040670ccbe6b4c9841d8706c433997c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587090, "uuid": "bc947f04-e6b1-4a95-9981-aa2348437ae5", "comment": "Malware payload", "value": "4a465658121a15449fadbeed82d37c461e601ae45c08a3d6c992285d31ebf804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587090, "uuid": "6a47eb59-9948-4a16-bd8f-ce568190464b", "comment": "Malware payload", "value": "f8feca6cc45f6b934201c28a8c0d86409fce8836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587090, "uuid": "3d642875-761a-4c3d-876b-3b41d331605f", "comment": "Malware payload", "value": "5c788ede7409b809201c3ddc4cffdb7a75172b83e5f2404ffb922338399e266497faed80b59077fbad876823ac382d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587090, "uuid": "ab8e26d4-0144-49ff-abdc-b912e6a68191", "value": "T1E3E6AE03B7859135E49B2A79046B97755D3E7E202B21CDDB57B038AC4E316C2AE3E34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587090, "uuid": "fe5a3c6d-3755-4c10-a82e-68799a49a0af", "value": "578cc8e30a11aa15cbed91e618811b6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587090, "uuid": "59ee446e-5915-4ca1-b2d9-b46379fed910", "value": "393216:DubmdBDPg48m6pJ+o6SVP1CPwDvt3uFrCeP2NOUAQWuS:H6N6GWuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782587090, "uuid": "ce03c8ec-2d3d-4ad4-99b4-1a161166fd69", "value": 14701792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782587090, "uuid": "a556662f-12be-447c-b26f-a81b13a7472b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587090, "uuid": "9f630de4-ef94-46df-985d-7248262cddb3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2395007d-7258-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585830, "uuid": "83ce1c5a-3ecb-4069-940b-6a42a9bbaee2", "comment": "Malware payload", "value": "7c662f63d784bffee808c8aaf6c6a038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585830, "uuid": "683b7c8b-e9e5-4798-86a6-7f8b9aee6f2d", "comment": "Malware payload", "value": "4ab7fce4429aa057f4f17819c8d4856239658873b20c6cd93e5f4241afab0fd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585830, "uuid": "a6e3c386-2736-4d32-a924-f0c692f5d875", "comment": "Malware payload", "value": "cf99cb6b160e33dcd5e4be2a600eda97f2bd5f48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585830, "uuid": "34bfcd84-6628-49bf-a67a-a1f66f671417", "comment": "Malware payload", "value": "b05ab5cbd84a6dbfe2fee23b17200dc68dc6e402c8d7c7a9f0600ad87b7202170a4a64e13bcc61b472e5e0f89f9f768a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585830, "uuid": "915efd6a-f52e-46ca-ae87-4834cbba721b", "value": "T136831819FD81AF11E5D525BEFE4E414933634B6CE3EE7212AE245B2523CA91B0F3B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585830, "uuid": "2163cf9d-8646-4eff-85c7-24f8c0a73be4", "value": "1536:ednKkJKElD03UXwemZgHvMjuaKrHC+XrgziMOl3U9ip5QJHKBYZFYdD7GRO:JkY3UX4OvMjuaKrHC+XrSe5QJHKBYzjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585830, "uuid": "61289b3c-a0f8-4cbb-8b99-520814e09c96", "value": 85668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585830, "uuid": "f766e54f-1959-4690-83e9-64247887f404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585830, "uuid": "25a13b6d-1f89-4958-ac5a-8068a9e35d4b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5a2d64-7244-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577602, "uuid": "5b56ca2e-7638-455e-8d53-da1d6b551903", "comment": "Malware payload", "value": "092fc14187a80f73be39571474b78b29", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577602, "uuid": "5c1fcd52-3955-41cc-be6e-41c3462f8297", "comment": "Malware payload", "value": "4bcb02b7fd40a5d6819c6e6979a5e9e59643e3ff281b46a10a08962a84f120d5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577602, "uuid": "b47ee4cf-7ce4-4ea9-b422-80ff31e87bad", "comment": "Malware payload", "value": "c033145e178e6f6a2172b9d83b873ab971e9d68d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577602, "uuid": "c179ecf0-9ebe-465e-bb14-787881ed3154", "comment": "Malware payload", "value": "1090b04749c374a0461f44ed46835a7c1f50c7237ce202a8efabf8bb4868c4db4d5f234a707b7c735ece04da347a56aa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577602, "uuid": "089f5f30-5722-47b0-960b-4b60912f1342", "value": "T1F5B4E1EBB9969DCEE50FE43B00818022F964E0DED44DF90F06B6419989A7DD83B15BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577602, "uuid": "372262e1-3aa0-4001-ba9d-55887ac4d336", "value": "6144:caiifwf6XYUxi6qUWE57o3AGpCy63ydEnaYYKiB0FZviqCZhzyiF/J:NYD8iJUlopdBEnabKHfvibheK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577602, "uuid": "d4fc202b-2005-41df-81da-c959c13bb716", "value": 528121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577602, "uuid": "aa99b672-76a1-4299-acd3-f284e2c99f29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577602, "uuid": "11a61e52-aa7f-457f-b383-cecc69f7150d", "value": "ewokkdebug.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e242f80-7224-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782563460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563460, "uuid": "5fb99269-0e8d-4fa2-b9d0-a4e8bf182429", "comment": "Malware payload (Mirai)", "value": "88f967f5910114225a198b12f6e214e2", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563460, "uuid": "36e13a25-797b-47e1-af2b-01605743e041", "comment": "Malware payload (Mirai)", "value": "4c396a79f5a55eb5489745b5af6d317b7dafe70c0a531bb2ff1acc79b70c5510", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563460, "uuid": "e3f97e4f-ec73-40b0-87fb-570b84e8f031", "comment": "Malware payload (Mirai)", "value": "e61c5516c2b60cf08e008719baaa640d00d4bf1b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563460, "uuid": "c12fb8c9-698a-4997-8a81-a803170c0230", "comment": "Malware payload (Mirai)", "value": "70f03b0c1f82b3f201333a8044119ae532648d2c26c3c1140e46551fc386f34e39221419fc476a79751222ca0ec6e7e3", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563460, "uuid": "6001f9af-ee04-49b6-8600-965f8f96a6ec", "value": "T109F64C47E5A214ACC19AC030866BD6627E317C5417317BFB2B90EA342E76FE0677EB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563460, "uuid": "15953b01-84b4-4b46-94d5-22b0d1bca6dc", "value": "196608:NExZ2V+8eSLtn+rHK8uiRMk+vtIThPbFk:NrY8eSJ+rwkaAbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782563460, "uuid": "fa4bd6a4-c28c-4001-84da-6d9c37840429", "value": 16315920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782563460, "uuid": "792241f2-b166-40b0-a0c4-46a25264c926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563460, "uuid": "fd7d4177-1f7d-4375-9fae-4d0472eb7db8", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e71ff2-7202-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782548872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548872, "uuid": "de5908d6-f3ce-4f38-835c-03c51d022deb", "comment": "Malware payload", "value": "fc20ca1948587c82f8df07a781c8c3a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548872, "uuid": "d9e58451-14a3-44a7-9551-ce212d474f2e", "comment": "Malware payload", "value": "4caf9d60388242edf13f40d524af9a4dcaf2951fd9ec02e932e75e03771a91c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548872, "uuid": "8031d70f-2eda-4109-95a4-462b74b19c45", "comment": "Malware payload", "value": "f3d71667ed98ac47478eedf28b23a9412d2ef384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782548872, "uuid": "fe6b3bdb-c185-4978-bde5-1121e4f0f873", "comment": "Malware payload", "value": "c84c48ddd45a54f025ebf15ea6f1bc36c69b1feffcf5bced61a5832d55202fe2aa6312ef28920f2009f5ac5dff3efedd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548872, "uuid": "66299de0-cd7e-48c1-8ee9-4f6b3874c760", "value": "T157A3F745F8505B17CAD612BBFB4E438D7B261758E3EE320399256F60379B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548872, "uuid": "67e4be59-984a-462e-bff6-b8026f5b4a98", "value": "1536:8jv3oQQoJJba4Vuqh7wfxQEBEOaycHNgUGHwWlVywywYB3rEEOrxTsa3Ufk:8jZQom4JhMfxfqtgUUa0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782548872, "uuid": "548038b6-1249-4f9c-a526-4f549a0eabf5", "value": 104812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782548872, "uuid": "0921de57-0575-4f42-8126-2e57f3d8ba89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782548872, "uuid": "1430a3bd-0fb1-4df9-817c-b66b45ecd98f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecae83c-7258-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585983, "uuid": "de0b06a9-3570-447b-94cd-75e6fa01e978", "comment": "Malware payload", "value": "77ac1472bfb41dcc80e160bc87691abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585983, "uuid": "ba079924-e4c9-481e-8377-1af8f4b103ca", "comment": "Malware payload", "value": "4ed6520516e5f756f1d020510d5e508c03811b3cb5062eed4bede73df641b779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585983, "uuid": "4a7ab5e7-300a-4e9c-8519-ca3fa9a1c172", "comment": "Malware payload", "value": "30f5f001631cb48f37b684fcbb7791976dbdadb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585983, "uuid": "45e14379-2c49-4b8e-9e1d-5eaf3af66dd9", "comment": "Malware payload", "value": "b59307160622d1cdc834cde87910369b8ebce09ea7ef5ee8120b75685c979f3301724522fd3c5e78717093a960b9ce13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585983, "uuid": "6c2332a0-8f4c-421e-8480-9957870ee750", "value": "T162F58C07BC9148F9C099A33188B792967B71BC190B3127D72E60B7782FB27D05DB2799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585983, "uuid": "d44af2fa-89b9-40a0-a8e6-287dc32a68ee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585983, "uuid": "2acd7c22-12be-4dde-af58-f01be5bcd11b", "value": "49152:Bh0uWUUWgoo/YWWZ+gc+dpT+MeD+g40SYoNEkY6g2JLJtU+WxfjdnegdDGYto3e:BaUZT+9Dn4qAEQg2JlW+WxfjdndIdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585983, "uuid": "d4f49c2e-19d6-4d2b-92fe-af3cd136206e", "value": 3576688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585983, "uuid": "bc94fb77-3127-4283-a5e4-05ac86abf56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585983, "uuid": "5b743322-7774-40fc-acff-c5ae702a090a", "value": "Figural.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc547c5-71ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782540539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540539, "uuid": "5c6c28bb-7323-4b1d-86a1-a81696c40be9", "comment": "Malware payload", "value": "95302a1433159a05d89ff591723c9bf9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540539, "uuid": "3d781cf4-b9d2-44d6-b151-67b961e472f5", "comment": "Malware payload", "value": "4fb2d6c296ab4f5f62eecbc96a0c1d259a3175ac4282ce114ebc7602573713d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540539, "uuid": "2498466e-51cd-4efb-9634-3da11a0699ea", "comment": "Malware payload", "value": "27106a43ed92021953e587637507012042053e5e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540539, "uuid": "516c65ff-00b8-4ea0-b919-99074b5d2db2", "comment": "Malware payload", "value": "a82139efabf9304d08eedd3b6ae2b3e17bfc7573c6ed43bb2eaf50a091c4adf8c64e12542bb17d5a3b91bf38b9a37603", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782540539, "uuid": "7778d197-3ea7-4405-9db0-d81092386d09", "value": "T149016BCA8960A9004119DE5E76A76290B461D3CF464A4F787FDC5D2DFB88A04B126F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782540539, "uuid": "51076190-c4d9-4cee-bd71-cd7655c6bb21", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkarf8Copj7CLayteXCRA6COKsmCyVbjTleR:kXCKysE2hi0ziQvZoharE34QqHKn07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782540539, "uuid": "998a30ba-7a93-464f-9918-0e6a07d56338", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782540539, "uuid": "35c16ea7-cb6f-457e-8342-9dde1adcf836", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782540539, "uuid": "d8a3a1d4-d837-42bb-8b94-17f1e30e8fc3", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8616c1da-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523289, "uuid": "6ec1db84-0860-4edd-8629-980e05efe40e", "comment": "Malware payload (Arsink)", "value": "532e184b94fdcc7c523c2c23bdac827d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523289, "uuid": "25213ac9-50e4-4e71-a2a5-11ba977ad377", "comment": "Malware payload (Arsink)", "value": "50d8632433d3954b14af9ce7da67f030f1d3dadc2d0be6fc9a06155314682701", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523289, "uuid": "8367d9d2-49e3-44d0-9d5d-f83ec9ab4806", "comment": "Malware payload (Arsink)", "value": "d5588c900ab5f9dfe8a2fcd394de162fd8b8e242", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523289, "uuid": "3b6ca47d-b425-4445-90e7-bc7da1461ab3", "comment": "Malware payload (Arsink)", "value": "e331aa052ad7387539d3262c352d55e3468a6a95aad3b794b7f3e888c95559f7fe23d2da6a0cb1e2f3e37daf3da66874", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523289, "uuid": "efe2c0c6-a22a-416c-b182-004595cca879", "value": "T15C36336EC366AC9FF2575A344ED70620CF924F59959675DF2208F306E0F322767E2282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523289, "uuid": "f6df5ed6-796f-4e41-868d-8d7bb83204ae", "value": "98304:pHG0YBPOlV2WMzao22onlgNP54dylcbM7F99ZXj:AFBPOlZMjwoRZlcb6/Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523289, "uuid": "061f1621-8e8c-4f88-a954-040a6ccc8a08", "value": 4924227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523289, "uuid": "c11d9d34-3031-4949-a8d4-26cb73d411f0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523289, "uuid": "fbec59a8-ef01-4e04-a4eb-ef5393bf02dc", "value": "Limbo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249164e7-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583255, "uuid": "fd2a7753-6f2c-41a1-a408-f20f75c63e09", "comment": "Malware payload (Mirai)", "value": "cec0e447717ef5c9ae25376994ba213d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583255, "uuid": "c1da9ceb-9f19-425b-aa7a-925cd2dac6da", "comment": "Malware payload (Mirai)", "value": "527430cb7b27167ef60dfaf0cfa44d1cebab0466b331bc25e4b21072cccf72eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583255, "uuid": "9f504722-9015-410d-8cd5-44462e8b99f9", "comment": "Malware payload (Mirai)", "value": "72ca0f6a0aea4977124ee17e8c4088adfa500ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583255, "uuid": "4ccae1be-b24b-4bdf-9ede-5823421a1967", "comment": "Malware payload (Mirai)", "value": "3aac13ea7bcd297756a8c2eddad862516ccb0c5fba37813eeb61eb94ba3d0578277eaae44959e3e7a3832d021a2ded67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583255, "uuid": "b16db7a0-1cc1-4112-9adf-41c926dc4b6b", "value": "T110561897BDD24942C5E83A7BA9BD80C433630EB99B8712575D04FE383ABE1D90E39354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583255, "uuid": "6ed027cd-cd3b-4d10-adf0-849837d68c06", "value": "49152:S9wlnm+06GACytWjNFYdsd4d6cl16rn5Ee:+snmfACaWDid6e6lEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583255, "uuid": "c8a45bfe-e8ef-4ac6-8457-b68f5962bf9f", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583255, "uuid": "8c3bbd1d-4f43-4377-947c-9a277b153005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583255, "uuid": "018a1566-ca58-45f6-bc6c-5ab8a0e584c3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dba5b4-7244-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577589, "uuid": "a027274e-f6c3-4f1e-ba10-5678e0ebac3c", "comment": "Malware payload", "value": "5e9c309ec38d2aa6a0eca5285a9b4b34", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577589, "uuid": "41cf6458-9388-4f1e-a6f6-f523765c1c7c", "comment": "Malware payload", "value": "538206dcf29e5aeb39fa9b6ea2238fd49d5d8331c428a5d7b3026b56ab78483e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577589, "uuid": "fc5fe74c-56d7-46f7-9dfe-8ad00aeb41d7", "comment": "Malware payload", "value": "75b6733d0164d6c5c649ceb97915b38e279443f4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577589, "uuid": "365c0cfc-ca3c-4f87-8fd6-8619d10f309c", "comment": "Malware payload", "value": "342532d9835ab79c7869eb40d2dc85713e622329035db6af0f758f390e7a4e9cf2c0f0de4661efca135df072a346bbca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577589, "uuid": "1f867af0-14bd-483d-8827-7c231ebc8e08", "value": "T1ABB4EF67F9690AA5E92FC9FEC0408913746C95D1B90FB0AE327416554CE3E8CBB0F6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577589, "uuid": "6cf7d845-1412-45fc-82ba-474905c8b7ba", "value": "12288:h0k4nS2Z/7pfDzy4QSEn8khpl44BIJjD5Js5chO6PP8piOP:ukuNZjC8Sv44ud9gcoEGiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577589, "uuid": "5fa796fe-cbde-4d69-951b-2d7d1316ae27", "value": 532208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577589, "uuid": "c6b9957d-26f0-4ed1-a9bc-a7692687db98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577589, "uuid": "53f03c13-2cda-474c-ac6d-c70b789115d6", "value": "538206dcf29e5aeb39fa9b6ea2238fd49d5d8331c428a5d7b3026b56ab78483e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82597c71-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581265, "uuid": "43e767ef-6cbf-40c0-99c2-fb58a8471056", "comment": "Malware payload", "value": "c29b241bdb210ddfd89b087aa8db85af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581265, "uuid": "747f53ba-940f-40e0-be51-2aacb319413b", "comment": "Malware payload", "value": "547e1c8e530fc32219070e50c482870e87b452a50854ccc491cf5ab157527b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581265, "uuid": "57b84b26-8a9e-4289-9bc0-1f4b5ca1858d", "comment": "Malware payload", "value": "b2b26a340dc455a0d2c7bdf3b678c5d79f6744c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581265, "uuid": "83ebf6d7-adeb-4e95-8838-9cc3a6e28f27", "comment": "Malware payload", "value": "657f59cd9429718ddd486bd877fa375d0c735af5f9a1d8467f791e944a7b0d2f831087e8dc942b1de317f922ba437e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581265, "uuid": "f2aee36d-f20b-40a1-bc7c-5c7e0e6c2c1d", "value": "T13D543A02BB0C0E03F1572EF0263B87F193DFA9A168B4B641695EBEC542B3C71E545AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581265, "uuid": "c53cd07c-1dff-47a2-adc2-d6babb602fc1", "value": "6144:1/2owZ/QovnR1eZZp4kc4xZllWE+LKF1LcdyVsJ3wX:1HwVvnRS7llHtjLLVrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581265, "uuid": "c3e15083-d398-4cc8-8d4a-70fdc040a5b3", "value": 278840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581265, "uuid": "d238891e-42c7-4d0e-9bf7-f986558ec4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581265, "uuid": "202b02a7-f45b-4c6b-8c39-c61db6b15f49", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6360e5b2-7260-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782589373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589373, "uuid": "8a2637a5-5194-4716-b9b4-7547b18630af", "comment": "Malware payload", "value": "4a5d7499025b6ecdbf80c94966f8caf1", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589373, "uuid": "d677560b-fd1a-4cda-9435-52507d2cfd0c", "comment": "Malware payload", "value": "56e66ffef4ae328ebdf3539fb741410079a2acb6cb5e817c1d48aa537c478dcd", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589373, "uuid": "f08df3e3-aaf6-484c-9c9f-4bf2fdd562d1", "comment": "Malware payload", "value": "62375785d66817aeb317e9d15a71282d70ee9f7e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589373, "uuid": "5cc2fcd2-8525-47fb-afb5-dd9698f69177", "comment": "Malware payload", "value": "9a69a27dbaf52a52086c41c99c0291b1efa48572548b562eafb12cee39099cf81b45fac536b3ba4588a0ee9c42317686", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589373, "uuid": "9abbfbc2-8f5c-455b-87e3-a411a8fe90da", "value": "T135F4CC3A2C94B531C41F61F3B914A5B4DC982D5819F53A22300C3E5BF6AAEDBA5CB713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589373, "uuid": "2b50c5a1-0b86-407e-8b5b-007b885b0613", "value": "7636034d7f84561d77daf6dd678cf919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589373, "uuid": "0f81e418-5402-4825-9242-4f2d491d051b", "value": "12288:bV0lA9Jz7XZun+LCddWR8Kx4F1VZNuTtd2CiQU2NI5szpH:bOmLzro+GEP4F1V2dXe2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782589373, "uuid": "d49c0632-e5d3-469d-9973-b6ca5874639e", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782589373, "uuid": "d615f6bd-db3d-4318-8338-356695c7973f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589373, "uuid": "1c017ef1-0d32-4c18-a79e-5eeb6923cbc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1c22e5-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523248, "uuid": "3dfc6c55-cf08-4adb-8028-b0553213542e", "comment": "Malware payload (Arsink)", "value": "89d84449956abd71561184417393e44f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523248, "uuid": "40653a1d-5a7c-48d3-96ba-33b12d96dbf0", "comment": "Malware payload (Arsink)", "value": "590c3fd1f5355493a62d7432c5a7721e6338137daf32f03d27cd89973990040f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523248, "uuid": "78fd1050-692e-478a-a11c-94f3305a385d", "comment": "Malware payload (Arsink)", "value": "c3ad4c45053435fb82066ceab69ab6b340659543", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523248, "uuid": "28f6721d-1483-439b-b2de-54c34978067a", "comment": "Malware payload (Arsink)", "value": "fbcc7160d3e7b905a84181d90a7ff77522e2a5dd0fca9f11960e8521d4cdac71dbd01809083e98e0fb57e06036c6390b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523248, "uuid": "157fc3dc-69d4-41a2-aef8-80e1a24f044b", "value": "T1A8B302E2AB44DC9BCE6F58B5C8F8E436FFE3636280F0DB0B1A1291215D955F108A112F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523248, "uuid": "0fadc8d8-36c9-45d7-99b2-c5669a243788", "value": "1536:BGvFCdJeUwBx84E4uAXQlcWrZvS00eV688DANSct9eITxhwUDLRak:BGqwBMAghNZV68C69/Tnwy4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523248, "uuid": "faa62ab3-abda-4bee-b0e7-10c8c3ea6a33", "value": 115383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523248, "uuid": "b9594851-62aa-42e9-88c2-35ef67080afe", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523248, "uuid": "3d4391e7-e843-441b-949a-3dfc0e99b263", "value": "apktool_1_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e1cc20-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782532809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532809, "uuid": "374a12ac-cc4a-4975-8c6b-00a7883a6f29", "comment": "Malware payload (ValleyRAT)", "value": "39b698a4a2ec18e256b2ad8503de9e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532809, "uuid": "9e5285b0-b8ab-4e83-9f7c-dc76614eebf3", "comment": "Malware payload (ValleyRAT)", "value": "59afd76ba4c60df30d59b1cd3db92f203040ed0d4e84279434bd702c919e9273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532809, "uuid": "12aed50b-58bf-4e3e-95d8-1c4970000f65", "comment": "Malware payload (ValleyRAT)", "value": "32cd6da281fc30ea7f10d084a8d1783559b5106f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532809, "uuid": "63070b03-84d7-4407-982d-a081a203a036", "comment": "Malware payload (ValleyRAT)", "value": "24fb00033fd8bb3d0d18ce1bdd84d1a42e2a1edf9bda37ce40e8d79329c0eb82ee5c2b88ae0744dab31ac8acee72bf58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532809, "uuid": "b628218e-760d-428f-8724-554aea5aea77", "value": "T17E95C023B28BA83DEC5D0B3B05B2A15594FB6E216426BD1787E4B49CCF351601E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532809, "uuid": "57cc4bb5-0ab8-43cb-b2e7-dab56e1094b9", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532809, "uuid": "b11fd6b8-9aa0-4def-b3ad-886a6e447aa1", "value": "24576:iaE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH+4xAiZQmXFOKzE2/d++HFkPIIE8Y1:a+MRvH7nKSFO4L4+HFPIUukqiRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532809, "uuid": "e37bc8f4-16f2-4c2a-b5b1-f07845ddeffd", "value": 1921049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532809, "uuid": "2cfc11ba-17c0-4e4c-b0ea-2ddfdd79f223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532809, "uuid": "9fdba6b2-8d67-45ef-a6be-e08614e149b9", "value": "39B698A4A2EC18E256B2AD8503DE9E4D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c25c2-7207-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782551265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551265, "uuid": "92eca2c8-a20b-4cad-947d-0115507610f7", "comment": "Malware payload", "value": "3fa1633e681319ac321fbc70ecdd2726", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551265, "uuid": "a543a39f-1c70-4ef2-b44c-5d4bb05b9726", "comment": "Malware payload", "value": "5bd762010ec26573fc11d98b67cb976f1eddc10d9ae29df29315ac9ec10409ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551265, "uuid": "09cd0866-926a-4eeb-b503-fe2c5ea39f8e", "comment": "Malware payload", "value": "829c88beb8444e8c203d5fe5dd45cbc42d68734f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551265, "uuid": "f2fa655c-4697-430d-b94b-7481a5454614", "comment": "Malware payload", "value": "7654804574567edfba5939b2ec2b2dc0387412dae5f49a3b1632de1c91f50e67e9ede396554a506d3369afc4609c54a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551265, "uuid": "7dd87119-a3e2-4ac4-a0f3-2979f9c1955c", "value": "T173137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551265, "uuid": "38b20da3-e7c3-4c8d-96c6-b94c970d834b", "value": "768:TT+u9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:/+7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551265, "uuid": "05890fb9-4d73-4717-910e-343de536d0f1", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551265, "uuid": "3e2759d8-e513-4c89-ad1f-537848e81ccf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551265, "uuid": "69f30ae2-8049-4f1e-b415-3126995f758d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee138cd-71cb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782525478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525478, "uuid": "a8737b99-399f-43fd-a8e4-9bd89d65257c", "comment": "Malware payload (Mirai)", "value": "e9eceb81bab3f5a991b3f893b3dada13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525478, "uuid": "9b260368-3671-4961-ab5e-1a6c624910ec", "comment": "Malware payload (Mirai)", "value": "5dde1b0de96d85a8dd0b3582dd9d32f095d0164f2b6d73e462415046ed19af6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525478, "uuid": "2ab57fd0-5874-4dab-a401-64264de56b57", "comment": "Malware payload (Mirai)", "value": "11cab6aea9a2d396f2682afd702f13800a05166b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525478, "uuid": "1932c9e0-55ee-4977-806e-76c10a4714ad", "comment": "Malware payload (Mirai)", "value": "2fc89e8f5bf26a0c6905923ec8d7abe79e52d781163c0e4d7fce9f092f8968d92544d2f7fb5a1468aefb4d97e4c1e9fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782525478, "uuid": "e52f8e7b-29fe-4810-96e8-4d5b92a83807", "value": "T1A563F645B982AF01D4D913BBFE1E018D33536798E3EEB112DE116F21A7CA61B0B7B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782525478, "uuid": "55407fe9-deae-4781-ad9f-2aeb425771cf", "value": "1536:byhncbk1Sz6pvhFk7gO2dBZh2kTl4OR0rekGPllwbi9LHXk5wbZn:Bbk1U6pvhFJBd1Xl4OR0reOQLH05wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782525478, "uuid": "2852cbcc-d1fd-42fa-8c01-3a505697cbea", "value": 72872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782525478, "uuid": "d294979c-ffbd-45aa-84e1-8b49190cd25c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782525478, "uuid": "8782f6ec-d90e-4562-b678-957dce5b21c2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefe43ec-71e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782536672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536672, "uuid": "d90eef03-1250-45f3-9a81-1fcea2487421", "comment": "Malware payload (Mirai)", "value": "93962abf3c2d7a7a21826647ea9720ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536672, "uuid": "1f90265b-6ab3-4daa-b6e9-3c14971df370", "comment": "Malware payload (Mirai)", "value": "5eee93f3d069efa6afab084ffc59d2df4b1d9eafe33c379d6c094c065bc44a67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536672, "uuid": "5d3d7bd5-f741-4e50-8a61-ab788bcaf598", "comment": "Malware payload (Mirai)", "value": "c8f0826f08621941ed2d30df4366a9adbe85c86f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536672, "uuid": "5e61f8e8-d8ac-4da4-a191-d7bac9d6f5cd", "comment": "Malware payload (Mirai)", "value": "ffe0c1f282aee6242e5c75dc9c45c5f5bd8570904ee0d1f341704dcf5beb63b579d61a12bcfd3e853e075e0b086063e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536672, "uuid": "88ca71eb-f1bb-406c-988a-018af471a76f", "value": "T165045B16B4C488FDC496C2B04BEBA136E972F46C1138B56B3BC4AF262E4DE305F5DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536672, "uuid": "6aaf59e9-62f5-4519-a7a5-a736d6384b2e", "value": "3072:Hz7z+hce5FMaEeoq5v0LS/ewpb8+iNxXOFC3+yXcSax2wDc:T7z+jCeoZ1nL7XE3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782536672, "uuid": "50588c20-4d11-4a36-98bf-1fe3a50dc942", "value": 174104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782536672, "uuid": "5565f9bf-0871-4305-b1ec-5c121d870774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536672, "uuid": "4597b996-fc8b-4482-b670-c4176e29d985", "value": "rebirth.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7eadc2a-7244-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577596, "uuid": "c5352949-7dcc-4c1f-ac6a-3fd452f0d9ec", "comment": "Malware payload", "value": "1c45c686e76fbfb56e5f71d3820110c2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577596, "uuid": "cfc001ea-53e7-4e9f-bac2-6f0b96183ad6", "comment": "Malware payload", "value": "5f78acea039d8558e91a4bb12a19e4fdfc0b19aae3662046a7b1a717ea6bb7b6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577596, "uuid": "5404ee8f-1cd3-41bf-abe3-299f78c87595", "comment": "Malware payload", "value": "db5eb84c423fb146c34a521fc5e8cec284443221", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577596, "uuid": "5f2dc85e-e6c0-4c65-a03b-da4a5c6ffa1d", "comment": "Malware payload", "value": "25ecda6a359b77b89a1b63ecf056c9b61604bab9e6ad81b4ce724ce9837129148f44716d4c43a5352745d0872be1c9d5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577596, "uuid": "20166ae2-64df-4802-b2c0-7dd806bbedb6", "value": "T180B4E1EBB9969DCEE50FE43B00818022F964E0DED44DF90F06B6419989A7DD83B15BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577596, "uuid": "a034fbfa-cfdf-4129-98d9-2e926f0d6c88", "value": "6144:jaiifwf6XYUxi6qUWE57o3AGpCy63ydEnaYYKiB0FZviqCZhzyiF/7p:GYD8iJUlopdBEnabKHfvibhekp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577596, "uuid": "8b5a693a-ad51-4d41-9fae-bddd1c03b1fd", "value": 527195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577596, "uuid": "0b6fe0b3-bbb5-4c2a-b5ff-3196d2f98125", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577596, "uuid": "30e4b884-1680-4a33-9beb-6e3da79351f7", "value": "Autorelog.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a74523-71e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782536767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536767, "uuid": "1f61dbab-a1af-4264-b3f2-a80ca4734b3e", "comment": "Malware payload (Mirai)", "value": "85dbb3f62321dc81a9813eaa76929aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536767, "uuid": "79d992a2-6fa6-4e50-9b28-a1493df4c625", "comment": "Malware payload (Mirai)", "value": "6070a523b607d05a28e22ecb56ebb382eb421ca8f32a6dbf5590db786cb75b02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536767, "uuid": "1b752c32-f899-45a5-8173-d45ec49f26dc", "comment": "Malware payload (Mirai)", "value": "e33f88bfbe9a9712164d29238071a6500fe5bc93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782536767, "uuid": "13bc645d-deca-4de6-bf6a-2523baf4a8ae", "comment": "Malware payload (Mirai)", "value": "f0837fbc36b52d705155751ee070c0907d01119e07bea9eff1cb17f389b6692ffd598227ce06615934c36a6baca8feee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536767, "uuid": "f3a47530-2914-4ee6-9777-5c45b2a13207", "value": "T113044AC7F800DDBEF80AE33B48130909B131B7A214926B377257756FED3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536767, "uuid": "200f94a7-9da4-40b9-8ea5-241a528c5d14", "value": "3072:c/aRMOQV4G7Ahw0QBTybv4gYTk5Q0TvaT2OYv/VgjbiSLfpwYoyTlOD:aaRBQV4NW0QpGL5QkvenYviLhsyTAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782536767, "uuid": "698ca9eb-b603-4cb0-aeb1-d066c74f4e65", "value": 187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782536767, "uuid": "9e8364ca-5bd7-4d7a-b883-f4f981650412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782536767, "uuid": "84aa6d0d-8a96-4d13-af43-21f9ab9f0fa7", "value": "rebirth.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8b4d76-7253-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584016, "uuid": "ef8fb907-c8e9-455a-8a3f-1ea3360fa3cc", "comment": "Malware payload", "value": "28bb1126bb3ceddf44abc73dc02116d5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584016, "uuid": "4d64abcd-ea90-4be2-8212-ed746bcc7b83", "comment": "Malware payload", "value": "6079d4fb8062991eb93be25f276b537e8531d5565239645d2b094573781a7f78", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584016, "uuid": "ace84eaa-3972-4e62-8c11-39efafbbcccc", "comment": "Malware payload", "value": "e7a76009764d94fc63df285fb15dd3cc418ebfce", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584016, "uuid": "2b115e51-aa2f-4162-825c-8b78e44f6f2d", "comment": "Malware payload", "value": "48ea01dcc03b21d2058035a16ce3d72e554cbebd7ffea2fc1bc06d253dc0ce4626d1d169eba7d04e8454cbab0014d944", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584016, "uuid": "6f2a0545-4663-4418-86ad-448db362feee", "value": "T19F26F221DA5E003AF833FB33904279E174FBEF91520BF06A3A79154D8859A838F7E556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584016, "uuid": "872fe433-69e4-4be7-b97e-3460d3347797", "value": "98304:MwcoPM00THoXH8kqS2SKrs1vw45qTdL0GCgGfgUw1Y:MBqbondS2mvwoqTJ0FgMgN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584016, "uuid": "2c8e210a-4752-4767-aa4b-be1ae0d89b08", "value": 4854280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584016, "uuid": "5ff5e7cf-13db-47cc-a219-4494272278b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584016, "uuid": "c0a22af1-35a6-4a12-94bc-8feed7a8912a", "value": "zinc-addon-fabric-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f69f8f3-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782581260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581260, "uuid": "e62bafa7-bb6a-41ba-9774-5b6713a7f903", "comment": "Malware payload (Gafgyt)", "value": "98c2dbbbf1c229471ee72a8363d97426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581260, "uuid": "2674e6e3-026e-4110-a6c5-221730d87046", "comment": "Malware payload (Gafgyt)", "value": "61b82406637f811d7f7191859f6ad1fe2be2af06370d1f1dcf9b500d45689a7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581260, "uuid": "c4906cd7-4f92-48b7-aa31-674c905f986f", "comment": "Malware payload (Gafgyt)", "value": "66413cf61303d7460ac7243c3357821a8b203c8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581260, "uuid": "df889424-7275-4263-96cc-86b275dd7cc8", "comment": "Malware payload (Gafgyt)", "value": "8633b3cc1be5405dbd3e484c42fb43daeb0e3cbb1a5ed71a3bdef01435e4f3cef3766e60dcbc4e97b9673623c22c66dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581260, "uuid": "62e8e3e6-25d9-49dc-ba60-aedaacc030c1", "value": "T106B312E477A66FD8D8B24E31243242AC3115DDCA5786632D1E3E2CB4941EB532DF6246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581260, "uuid": "c8c66fbf-b22c-47ee-8ea8-9c1d5901217e", "value": "1536:bYxAMeLsH8CdppwwL+vNNotwktVHcBIe93CI8zqeNKLep0C7urU6TIiNl5x8S0IK:bYJHfavNyeoI8ueILFU6TIiNaIryz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581260, "uuid": "8d50488f-7f70-41ac-9b07-fffe019ad305", "value": 107440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581260, "uuid": "67845350-239a-44f7-9ecd-dee1559c4cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581260, "uuid": "ea6e6316-559c-4fd4-ab01-88434ab3f4af", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939bd366-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555524, "uuid": "99e29f54-d6a9-43d1-b6fb-4a41723bf867", "comment": "Malware payload (SilentNet)", "value": "68c796680b1e8db68c4112ca82852042", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555524, "uuid": "dc7fcca8-08ab-4b52-9f92-e3323b8e8aba", "comment": "Malware payload (SilentNet)", "value": "61e607296a01031401b73feecfaab95b9aa9521357fd4ff689692cc5ca66892e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555524, "uuid": "40112987-9444-4e38-b342-a0a75ddeb13c", "comment": "Malware payload (SilentNet)", "value": "fd11b0b6e70a4471568752053a0a3b64b90a2143", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555524, "uuid": "c04e5468-3d70-41d9-b2c8-98da62ce4c35", "comment": "Malware payload (SilentNet)", "value": "3750a23ad9c85bc4f98b9e21309fc35ab4ff239f6c30fb8bbb5119c0abf4ede7cf525ab47862b40fa5bd2eab13445c1d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555524, "uuid": "fbf9ca2b-9be5-4eff-91d0-b453a3112178", "value": "T132B6014B376957C6E80EF7F8F0F38345792831C9A3578BA7B0A36895DC929C167C025A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555524, "uuid": "75ac2eb4-a66a-48e0-9f41-cf1f46048317", "value": "196608:HbJGWWUgX+zHJT5oHMX2/ErvTIgahAAoSce+A7lSfUtBr9y5tIPtbcXGD:HbJ/VzHRRmQTI7hAAhIKsw9cX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555524, "uuid": "8a066ee7-91c4-401a-8e66-f507faf4a321", "value": 10711167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555524, "uuid": "31dde13a-2875-4e2d-bd40-69ada6d73af2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555524, "uuid": "43f2f0bd-ebfc-4f8e-b80a-8f3cf01ff089", "value": "Pulse-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dedfd50-720c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782553367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553367, "uuid": "c0b18a62-0199-417d-9b91-06c73a6113d5", "comment": "Malware payload (ConnectWise)", "value": "a439f3ed1a23f8fad8a1b5b0e22bbea0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553367, "uuid": "6f6fc779-2655-4d49-bfff-2f359df78853", "comment": "Malware payload (ConnectWise)", "value": "643812d9c9cc62a10d46401fcca897897d2fbe843014d175206131ad4aeaa576", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553367, "uuid": "07cc60e7-bc13-4da7-9373-da95b61cc696", "comment": "Malware payload (ConnectWise)", "value": "9edc9d2206b28c939176a2fc4970ee7c4ca3a65b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553367, "uuid": "6cdca734-eee7-4fe6-8043-db600810db6b", "comment": "Malware payload (ConnectWise)", "value": "ec6ae539577224302acf63db082ce889cc2d734ede5279d6a0aa0ab46ca56a99d67742881516a7c679ebb7749f6c1352", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553367, "uuid": "df7c68be-a721-4ba2-9e10-803399f9a439", "value": "T11C46E101B3E695B6D5BF0638D87A56696774BC048312CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553367, "uuid": "c67bf60e-3970-4884-bd82-76f506173bfa", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553367, "uuid": "3a9db8b6-bac7-4ec7-8301-077b8c7ef004", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ihfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782553367, "uuid": "5ed25ce4-d219-4f24-a083-c08a362b3be7", "value": 5685424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782553367, "uuid": "aaa3ded7-aed9-48b5-8b28-74e1751553a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553367, "uuid": "4a3bbe41-f20d-4e2a-b2b2-91a66b53c1a1", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b811c0-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532786, "uuid": "6e18dcd8-796b-4c23-8fcd-23fc39664721", "comment": "Malware payload (Arsink)", "value": "e5750b2ad2f8983b3c73b4089faae10d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532786, "uuid": "7185aa96-bbca-4173-b0d2-43edb14e59a5", "comment": "Malware payload (Arsink)", "value": "649b4a4044a9ead43588f78a85576f51a63de847a4620920b06fc4da8ae2989c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532786, "uuid": "f861d365-b42b-42df-842c-c315ea9ab1bc", "comment": "Malware payload (Arsink)", "value": "f8ec214cd457cd3ee0abb198ed8c7f4819e0337f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532786, "uuid": "9e43275f-de93-4204-a4d8-9cdebedcacee", "comment": "Malware payload (Arsink)", "value": "39299b57cdd6edc18d8a8eb3b9fa4d04cbdb7957adacecf584433c61967a3d848b02356e16c19a2e46668e38873e37d0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532786, "uuid": "ae72ea8c-819c-460c-85dd-22f7cb1d9d0f", "value": "T199270243F78E492AE9F3B9F4028F2372A6165C58476255CB5E01F2046DB36E4AF39BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532786, "uuid": "a804d3dc-0f00-4afa-b48b-aba40bbad980", "value": "393216:RpRUm6Gt9pdgmjAZtz04n69YudxDOtU7wpiozBofen:RpRUmHmZp9QhdBio2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532786, "uuid": "16adfbc8-1bd5-4c0f-85ad-7f16601929e7", "value": 21444658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532786, "uuid": "6b79e82e-7bb9-4648-b33c-2f45bc2be714", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532786, "uuid": "eec49e82-e438-4c6e-b495-a646a9029781", "value": "Paytm (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea8cd9f-7227-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DarkMe)", "timestamp": 1782565152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565152, "uuid": "2eff808c-2d4d-413c-8d5e-38eb97dd1ca8", "comment": "Malware payload (DarkMe)", "value": "343c755fd6fe653b80d16c0af280f147", "object_relation": "md5", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565152, "uuid": "0a98f4ac-be5a-40c4-8c88-c1482eee7841", "comment": "Malware payload (DarkMe)", "value": "68dcb7b0ddb39c45cc340bb52b69961a3865aa533ca8a49c22a7f0e3ad66a51e", "object_relation": "sha256", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565152, "uuid": "458ca916-236e-4a5b-90f3-af4ecc01d9f0", "comment": "Malware payload (DarkMe)", "value": "eeeba78eba7c24abc1e69c5951db09d7ba4b4259", "object_relation": "sha1", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565152, "uuid": "3463d53a-d0d0-488e-826c-447b7c06db3e", "comment": "Malware payload (DarkMe)", "value": "0bebd60a7b2c5507849c88d127d8122d24fb988aff899632b241933b8fff8e2ac85ef5893c0320fd427be121044e4b79", "object_relation": "sha3-384", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565152, "uuid": "1c4428fb-8622-4ce4-a098-1e484d03256e", "value": "T149453B4F35F72F68EE9A8F3F13005E1485EA98440145F727A18036A6BBCAE471B879D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565152, "uuid": "8e81e6fb-0909-4434-99de-ecb2381a6896", "value": "f877f0fa738b96bd512c2deca2a6f75b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565152, "uuid": "0a2513b1-caac-491b-beba-e6139a0900f1", "value": "12288:N7YJIB0xPwLjCTo2jkGnY3IXS4dsgK9eRGYNo3ec6k+USVhgUmM6suTwfikQ2qjz:N8WB2c15dwPHDOJ0GnSdbu6G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782565152, "uuid": "517ea88a-a5e2-4c3d-b0ea-1c88613debfb", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782565152, "uuid": "df952e43-1f98-422d-aa01-068ba3523dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565152, "uuid": "70de21b4-2164-4504-9df9-67545f7cac61", "value": "FoxEnd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84500917-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555498, "uuid": "6ba622ab-42e3-4992-999f-a4317dc1e0ee", "comment": "Malware payload (SilentNet)", "value": "128634d4acefa426e79b5da23c8e8cc8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555498, "uuid": "bc2a72e0-cc32-4eef-8646-60e624ec4499", "comment": "Malware payload (SilentNet)", "value": "6939908e30c1b2d5969baaed6515285c50c9f8884991f412320f5de293bc5552", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555498, "uuid": "88adb391-8369-4993-a49b-940324c2e797", "comment": "Malware payload (SilentNet)", "value": "f2d2586c9ccd294a5eface0f799097ff817268f6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555498, "uuid": "bbf2515e-b306-4b80-a291-44ec6ad26014", "comment": "Malware payload (SilentNet)", "value": "4582fac70fefc289224791745864cfda47225dfd019fd59a6bc6678e51654dd65ce967541ebf5202b0d2e6d474cb1318", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555498, "uuid": "795ced26-b51f-4560-8e2d-12b9f6102ef1", "value": "T171A53318959CBFD3E6CD313648ABD6065AA49A9E24A3D12FD032C3DF977809FA160DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555498, "uuid": "d2738f51-1699-4b1c-90f0-a79dca527553", "value": "49152:JT2HFps/hLmxHPKlGMqRhVuBm9EYc0SgTb6KI+22Btc:JYw/wxH9MeVj7c0SgHpTBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555498, "uuid": "1401696a-0c2e-4938-8f26-7087d437569d", "value": 2186588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555498, "uuid": "d708da87-bc74-4c3f-b8ab-7ac0bf8b70e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555498, "uuid": "6c5ec878-ad38-4beb-bc63-8da08e878472", "value": "FastClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5693c5bd-7203-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782549408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549408, "uuid": "20378cf9-58a0-4a59-be69-27673d04a6ec", "comment": "Malware payload (Mirai)", "value": "166dda8cfa31ed37edff168f565c4947", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549408, "uuid": "48e31797-b3c3-46f3-b14f-9ff55a2ce744", "comment": "Malware payload (Mirai)", "value": "6a7611eb4c8790b0b5adec4bd8378bd3ca0a25b7f2220472c428daa526ac7a32", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549408, "uuid": "d1ac4daa-da5d-4873-8d43-069ee0a85ddc", "comment": "Malware payload (Mirai)", "value": "91a71a0b642ca4f19c1cbd28e74056f23f1b86e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549408, "uuid": "1f1416f5-4bec-40a6-8bec-54056c018d58", "comment": "Malware payload (Mirai)", "value": "380419dbaac772d1282006dca92e13eae9c53b7c0006ca030d27eb5e4226d4c045b26411b90b99f2698c08fb8705d86c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549408, "uuid": "6e7fb0a4-1aa8-4dcf-be01-b02538f09ade", "value": "T1CEC08CE706117A30C8C1AC287356002F428386C03DE80F88FA982A16868FA80F020F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549408, "uuid": "dcb09cf4-b79e-486d-b4c1-4d59506ccc91", "value": "3:O22exARMCUjUSqq3FOdJ2GL9rSUCUjUSqbBFS/TWUKT6VVI9LJdvvvF:O25CzSs2GLNSBzScTT6IZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782549408, "uuid": "d0c13d92-e93c-4504-a51c-a7aaa1113c64", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782549408, "uuid": "40fe8bc0-d87a-4ca0-85bf-4e0b9bb03069", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549408, "uuid": "74e3e6d4-6d26-4105-8599-c29269332c73", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d77df0-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555527, "uuid": "a878ba21-a71a-43d4-96d7-5f67664513e6", "comment": "Malware payload (SilentNet)", "value": "6c17c2db44b14f9d78b4f43830080cb1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555527, "uuid": "fea5a499-b08e-41da-90bf-8fd38b9c998f", "comment": "Malware payload (SilentNet)", "value": "6b261fe86443ac9ded33b10fe8ec1fcacfec83d059296b02e45c24191e4abd32", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555527, "uuid": "e6d255e4-520c-47eb-bc37-8b18faf37a1e", "comment": "Malware payload (SilentNet)", "value": "d614ea01f9a6d3c6229a07866152884e7278224b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555527, "uuid": "18faa60c-1f9a-49dd-ae46-b75d5dc21d36", "comment": "Malware payload (SilentNet)", "value": "d4d6261ccd3fd5e9c3274a25fbe7fdc77ba385cf9a97754b145665e20a457708495523188f30ef746fc133c93949a509", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555527, "uuid": "cfc9253e-b3bd-40f0-bd03-dfc45e40267e", "value": "T140D42333D70AD746C4D6E6B30292DCFA660C1AD3D859D570226F867CA8B4E08B71F49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555527, "uuid": "cbaa54c9-5a5e-42c5-b9b1-38b3c05bafee", "value": "12288:cFi4OCYeCUwsmdurdq7P0EEYTjTPqGchyA9B0t80TWxn/LFNj2koTjUm3Nh9:3vYmduM0EVjjqhhyA9B0tJOjFNyk4jZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555527, "uuid": "9f8f6e40-6178-47de-ab7c-f22ddc827912", "value": 610556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555527, "uuid": "901d0c29-5eb1-4eb6-bd4c-6511f8e5cfe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555527, "uuid": "197a1a4a-9009-4d3c-85d3-479f992befe3", "value": "SkyBlockDupeMode.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73dd2be-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555691, "uuid": "c70dda9c-8e16-4db4-a64a-28ecbe13891a", "comment": "Malware payload (SilentNet)", "value": "a1856636846948b488f2172028084294", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555691, "uuid": "aad47ca6-013d-49c9-a903-273db55af305", "comment": "Malware payload (SilentNet)", "value": "6b3d90c90c03d4ebb10f6e76f32d5f12dbae8e01d42518060e14f8968e32dc15", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555691, "uuid": "0da3e05a-608a-41f3-a524-af4ffcd088d7", "comment": "Malware payload (SilentNet)", "value": "e3ce283b5c396130ed22e6d004f61a30ce615151", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555691, "uuid": "99d138df-9fea-4fd5-a993-7156aece9b82", "comment": "Malware payload (SilentNet)", "value": "0f3caa7ba8a892ad4d5089470cf6d840fd8664a4e2571c920a704a0cc17e40d158dca743c103ef9532bf2a92e06fb114", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555691, "uuid": "76a7c784-03ee-45f8-9c84-500e73e58ea3", "value": "T165A623209F0C4036EC77FF73D04378A1A0BBEE5A120FF5563A7A628D8816B54DB39695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555691, "uuid": "6a9c255d-9cd3-4f06-856f-c77a4fe9fa5a", "value": "196608:oNdonIlkZgvWMy2948PbEBhImHb4N3WtDVWQbM5OS3d:oNdoOkZg/z4EEBhIkZtDVIJ3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555691, "uuid": "477ff816-7680-48d9-a620-8ca7b9ed3ead", "value": 10061867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555691, "uuid": "996b5d2e-8e54-4d18-881b-4cd102a49506", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555691, "uuid": "ffee1df9-6603-4214-bda9-a0f6d77a3345", "value": "nightclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0aabcdf-7227-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DarkMe)", "timestamp": 1782565102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565102, "uuid": "65ab1ced-dc9f-449c-a689-b7400c9352dc", "comment": "Malware payload (DarkMe)", "value": "dadcbd96fbc67634350408903490193d", "object_relation": "md5", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565102, "uuid": "910d14bc-3dbe-4f3c-9cca-bb8c77f41bd6", "comment": "Malware payload (DarkMe)", "value": "6d8bbe9c45a9380f0312740bd154bbdb88aca4183ab6aa7e15eb2b652f33c8e6", "object_relation": "sha256", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565102, "uuid": "9fc19169-4770-48df-8293-1135339f9e7d", "comment": "Malware payload (DarkMe)", "value": "0f797f3d5ce9bb0a6fd0b8208ab17a97ba165de1", "object_relation": "sha1", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565102, "uuid": "cbd36c58-fef4-41ee-a200-cefd13e6611d", "comment": "Malware payload (DarkMe)", "value": "e23c9b9d1f71d5052f9164487f67704d8bad4ced9114c7aac4b39fb98a83aaa8ba2611d21810fbcca821c4543da8359b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565102, "uuid": "0cdd6454-c0bf-47d4-a227-4a1a7f1ee5f5", "value": "T131D2C515B2CBD17BE29846B11E22D7EC2105BE106FC2CA5F71ECB75EBF7A1008560B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565102, "uuid": "1284b5d1-92d9-47ef-a1e5-b7e2d6af28ad", "value": "157bb20098004a7677015ef0dea0fd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565102, "uuid": "cc906b75-630f-4d5d-bdeb-cd2f2de467c0", "value": "192:5JBA+sfQwz0pD7NsHnQeh5dFV97Bh3LehID9T/A6QZsFDBKW3:5jA+HZD7NmdbNZ9T/QqDL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782565102, "uuid": "655d1ba1-797f-4eb1-a63a-d88f38d760fc", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782565102, "uuid": "ae714959-88f5-4452-ab20-44606f4e5874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565102, "uuid": "4e2759e6-5bfd-4044-989c-c4bdb8dd55d5", "value": "Damned.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95176bbe-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532763, "uuid": "b3132012-f3c9-4a8e-a6e3-f69d51df1c18", "comment": "Malware payload (Arsink)", "value": "1eda0754c8c136070328dc89a2a77fca", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532763, "uuid": "a6f89c30-af2f-4f0c-918f-59b06fe3f015", "comment": "Malware payload (Arsink)", "value": "6db0e9536318dc39df0ae4f080fb1c3b122bb6848c133bef3cc5edc0304fefcd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532763, "uuid": "f048aaa4-5d5b-4c34-9000-ac6fbbe7823a", "comment": "Malware payload (Arsink)", "value": "a91ed738f3ba5345a5e1b9c2c7c838bafc077cd7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532763, "uuid": "f4298658-fd30-49b1-bd6c-e8fa4dd9115c", "comment": "Malware payload (Arsink)", "value": "223752085ff497107a675f1caccb5d878d168548c7e061bd19dfeb97dc34fa66b6e7c0e73974c717c9d3cceb31a191fd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532763, "uuid": "d1361f0f-c1c6-4165-9d08-397197280b4c", "value": "T160560189BB58E72BC477903745EA5332558B4D1B8E8297836824720C7DB7AF40F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532763, "uuid": "b7cce601-c282-46cb-82df-fd1fd9cbad7c", "value": "98304:Ny4+5i0CFxKAFZcjLQLEvxCd2Zr0MKgMyM1dFAJPDTu+odCzyxkai11E+9KhXiSP:NUOxK2ZcQvp1dMnKQ1T8jY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532763, "uuid": "c1301de0-1992-4d93-ab08-7fe3e330e719", "value": 6089058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532763, "uuid": "412aab8d-a06b-4b74-967a-c62206c4bdbe", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532763, "uuid": "24c58bc9-e83a-46c0-8f4c-55d179c117cc", "value": "my horror Aaron 0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa08624-7258-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SpyNote)", "timestamp": 1782586164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586164, "uuid": "277ecefe-2248-463a-a310-90e7f4129eec", "comment": "Malware payload (SpyNote)", "value": "f03323c6d037244cf03a674c9e4756a2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586164, "uuid": "af45b0ff-ad9d-4808-b3ed-2e6352d32d98", "comment": "Malware payload (SpyNote)", "value": "6db892bb9921633415b73799421a00cea90d089960dcf2734f8722fb1bbfe210", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586164, "uuid": "1cc4ca09-2f09-46e6-9bd4-895e62be0b2b", "comment": "Malware payload (SpyNote)", "value": "87fc91079eb2042d7044198010ec85cef36b9639", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586164, "uuid": "687ea1c4-1fa5-4f0b-b91d-81059620db1c", "comment": "Malware payload (SpyNote)", "value": "be4965d0cc7973d833ff5f2df156889158457e3a21691b369414da9ffa194620cc578dc87c3ee4c0e82c5bcf63347182", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586164, "uuid": "d4be1cd6-9f2f-4506-ab3f-037356cb85f8", "value": "T160F46C86FB8AF863C9F3C6368275C66AD6164D554B43D7831985B23C09B7AC08B49FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586164, "uuid": "3fc91667-1d9a-4167-8e6c-b710b80e26aa", "value": "12288:+XqmTa1a8Lre1vhbJSRz5WmpYshXZPbGwidNpgrdYX:+3a1a2e1lJSRz5WmD9idNpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782586164, "uuid": "1d66d681-447e-4f02-b8e8-e66baeafe41e", "value": 778660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782586164, "uuid": "249ec9e2-bcb0-48d2-a867-69b35a13ef1a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586164, "uuid": "f57ed0f9-1d05-4263-8010-e196730fcf1a", "value": "client.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84625ed0-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581268, "uuid": "5c03edf2-0737-4c62-a0b9-3bcf4a330a01", "comment": "Malware payload", "value": "73da6329d37791005f8ed9632eaf6393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581268, "uuid": "83b050cb-d047-41cd-8fe5-c64c2430e9d4", "comment": "Malware payload", "value": "6dec293665c624ca094b8d312697a50d0e757deef68f3e5bd71bb80cf994036e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581268, "uuid": "f5ebc432-ca81-4ff3-b5b1-54cb6fdaac0e", "comment": "Malware payload", "value": "5543cdf0ba44f2ccc1b38c748af8618cabd3c94e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581268, "uuid": "eb9bc394-f2b4-4520-a7a3-dd9c2a8cb0d3", "comment": "Malware payload", "value": "e963ffed89f4542805e9aa762af779b61bef5a9c83245ccbd1fdb7a0e87e04a189e2cb5ed80e79d4c7ae09220d9ad6c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581268, "uuid": "eeed0446-2f49-42d2-9cbd-86b750d3bc60", "value": "T1D044085ABE419F17C6C216F7FBAD4288371A7BA8C6EE3113D8146F50379A48F0E36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581268, "uuid": "a5f66e13-2c90-40eb-a716-b259b8278cb3", "value": "6144:0Z0wsFsXof+Lf9smhLLl4JeAusERf6By2YFY:0JsF83vLl4MG4HFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581268, "uuid": "f84a363a-4a47-4e6a-8fa8-93862b9eab1b", "value": 275412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581268, "uuid": "721b7220-6c43-46af-960d-14f6905914ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581268, "uuid": "08f89452-ea66-46bc-936b-1eb5ccb61717", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad85167-7263-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782590620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590620, "uuid": "9417e07e-a095-4142-b6b8-b90178e9e506", "comment": "Malware payload", "value": "a9e45058306111e3a37ca2c266346dd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590620, "uuid": "8f22dc9e-3dc5-4134-9c9a-c72549b5fbc9", "comment": "Malware payload", "value": "6f93534ca2cf1260210d189cf8a8f955806651a5aa1cf0801bf5832e3f7b8a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590620, "uuid": "7528e348-22e1-4055-9b88-42b2549d272e", "comment": "Malware payload", "value": "2ed87bdcd1148a72d6cac073fd34f8d6f429c8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590620, "uuid": "19feb41e-c740-4b47-8cba-dc0c5610b22d", "comment": "Malware payload", "value": "6d7b965f04b8af41635afa3c661e67edfdbdd358a5be69c5ed5fbc90e7d7ab75f6b7a1aaf86fc2c41c5d28e4cd20a592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782590620, "uuid": "49c1f3bc-489e-4c2a-8ac7-e0880e95af67", "value": "T12FC43B53F691187ECD79EC38839A9131D334748A835266EB2784AA103F54BE4DF3EAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782590620, "uuid": "6652a775-8c5c-41d4-85bb-2fa9104c0784", "value": "6144:NcI8mKLl6Tqs9Wn9OZT4toCDEhL0ti/up2NO0DCueGwuyMrFQqbsLkLsJGhW7xPu:qVR9UtQlSzBF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782590620, "uuid": "b2057a0b-f5d4-40f5-a090-3bddf24865da", "value": 550424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782590620, "uuid": "ceb04b37-8444-4ab3-8c9e-b8151c7d3631", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782590620, "uuid": "5bfbe358-e905-42ce-a489-f7ff282a3df8", "value": "libdpt.so.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b91db8-7269-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1782593167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782593167, "uuid": "b2eb0a46-c92e-46ba-9cc6-db6cafeebd52", "comment": "Malware payload (Socks5Systemz)", "value": "52c76d9b7366f34a1fad3b5b0527e24f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782593167, "uuid": "7f46061f-f8e6-4a82-bdc2-63ab5a880835", "comment": "Malware payload (Socks5Systemz)", "value": "716612c11982500cca51970f822ddffb5a4b3aa84fda3cb30ffab6daa94f5248", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782593167, "uuid": "253b74a2-6145-4185-a14b-928b6102c184", "comment": "Malware payload (Socks5Systemz)", "value": "89eec27c0af96d4932891f02c0a7988b05526012", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782593167, "uuid": "63bf83c0-014b-4567-99ab-30596a3eaf84", "comment": "Malware payload (Socks5Systemz)", "value": "4bfbedd78900cad121ba762a3678857d39d45001a796af48f2f613f2eec4b4b40adb569b418bc2a4b4ef41306ce14286", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782593167, "uuid": "e5b31995-5dbe-49a5-821c-c5fd876e35a9", "value": "T103F5332155D1C734C46109BE8CEAD47D088B1E9A5E7A54DD60CECAFF872B1C7C4893E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782593167, "uuid": "803f1c80-2c4c-4cd9-a32b-b949446db248", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782593167, "uuid": "725352ea-4d26-41a1-b08d-629c93b2637c", "value": "49152:1vYVyAATy0rHLQss7/kmptqfnwku3T07zXU8OsIbc78xJS1DKftdWU3+IUJXZKXQ:NLAz0rQXV+wkOsIQwx0pKlQs+rXZ04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782593167, "uuid": "61e2b644-9fb8-43d6-9e5f-37a18f56b89e", "value": 3451324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782593167, "uuid": "1fdd933f-2919-45e1-a6ac-3c5e5cd7d440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782593167, "uuid": "beae29c0-9cb0-47a3-89f1-293a3ee05fc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f7c80a-7223-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782563091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563091, "uuid": "72aef807-fc93-4307-8398-43ddc7790be3", "comment": "Malware payload", "value": "5d0db1a68ff89bda2fd4098fb34b3e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563091, "uuid": "1d9fb723-a223-4d62-835c-f382fb185adf", "comment": "Malware payload", "value": "71a953f1daa8027e8cbe8c236efce69e616d825e1b834033b362989870c50c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563091, "uuid": "756bc013-b89e-42da-a475-925368d6e861", "comment": "Malware payload", "value": "00b6a4fb2df9af08d40a939eef0117299210b3a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563091, "uuid": "860553c7-2ae8-462a-b6b8-b1a61fb78b57", "comment": "Malware payload", "value": "596b6f8032618f323da62125c8ab7f3102d1a9b4a22a7662cc75cca243a978a6d1ae7a1a463f1914e9067ab80c569ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563091, "uuid": "e09a7f0c-55bb-49d2-9ff7-b27a715fbef4", "value": "T157732959F9816F11E5D625BAFF4F424933234B6CE3EE72129E205B2527CA91B0F3B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563091, "uuid": "9057f44a-76f7-4937-81a7-3ce3d44ab7a0", "value": "1536:Ti9nJ1OYrfB2J/ujtpLAlQddaEUFM6pgj2VU8qei5yeC48AHzVZZYAnRH:TrAIu7slQddaEUFM6pgj2mZyB48AHzV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782563091, "uuid": "fa48d60e-8999-4fe0-9bc6-92c6ad33881b", "value": 79144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782563091, "uuid": "efdc612e-ce39-4db9-ad2c-1fb38205da9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563091, "uuid": "6633434d-c6de-4d5d-a5bb-6bfa9492e67c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7f78a8-724c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782580716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782580716, "uuid": "aec674f0-08a5-4747-97e3-c67b82b7c5e0", "comment": "Malware payload", "value": "df47ea7b4b581e1927406bbff062a245", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782580716, "uuid": "fa5a5c50-20bd-44b7-94b3-700d1f37c1d1", "comment": "Malware payload", "value": "71b203ab29d830edec1f478d7a4d9bd9dd6bbdf410ff70daf5b73d5cb1b26523", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782580716, "uuid": "1aa4ceec-a5b1-4e91-9c54-7a3dc624f11d", "comment": "Malware payload", "value": "de72fb8001d963326f9d647decfa8ad46f13af2b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782580716, "uuid": "149a2afd-2b4f-4b81-902d-3f8e37a2df8d", "comment": "Malware payload", "value": "1d3020bdd5bcbaf5ab7910df3e4a5e296d2eb653246f7754db4e0970a88053436a1fa9f1d4eb241941d1f0bae46b6af3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782580716, "uuid": "930469eb-7602-4dc8-baa4-d82f761736de", "value": "T10BF59D47ACE14DF9C09A933089B7619A7B74BC480B3123D72E60B6B92EB33D45D36794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782580716, "uuid": "1425ccce-565a-45fc-9ba4-a281dfea673d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782580716, "uuid": "6f8e0a29-5e42-45d6-b59e-e37034a2377e", "value": "49152:vsVVDIjYgBJAED0KGk2LE0guLOIKYUGaZaXYNS2/YcNlfaEY1il:v2ImE0guL3gGaOYNnYcNfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782580716, "uuid": "2099eca0-fbdd-43bf-84aa-34aac43a6942", "value": 3574656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782580716, "uuid": "f2b7f9a2-45e8-49de-990b-e2b6427a71d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782580716, "uuid": "7099b6d3-8215-4be6-9d44-86f5bbee2a70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6276f7a7-71f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782542556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542556, "uuid": "9f884a16-b737-4549-a720-7e36e275c263", "comment": "Malware payload (RustyStealer)", "value": "adc2835abe882225ec2f39dbac27098d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542556, "uuid": "0db8de87-e5fe-4aea-8a00-30bdfee3f17c", "comment": "Malware payload (RustyStealer)", "value": "726a9f9f83e3cce8aa328f771dcbc12ce213cdbbf2d84b116605d774284f8fb1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542556, "uuid": "e1aa3265-cb31-45fd-8272-455a7655aa2d", "comment": "Malware payload (RustyStealer)", "value": "46f61ff4f72ad197e1b4f76a50a4db38fec59483", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782542556, "uuid": "fd265fd4-38ad-4d6e-8077-d7577e61bf66", "comment": "Malware payload (RustyStealer)", "value": "fb2d11344e328aafe0c699f9b2a179dfa8c222f24943219f2943fe6960079024079231cff8c92611e4008c1489b1d6e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542556, "uuid": "2c1066f8-9aab-49bd-83b2-24532af9ce7c", "value": "T175663947E1A290ECC06AC17C831BA633F631B8498534FAAB5BD4CB312E75F506B5DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542556, "uuid": "b6ca2802-6f9e-4019-be92-b4299f4f43c1", "value": "d0ae42d454db5157ccec2f36703c36c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542556, "uuid": "441c43be-d850-493a-9539-3b1ca62532fa", "value": "98304:aeHSA1xtkOQPL+dBiRU4jlFwcAyKL1vCRAM/TG+I0:ae29zbFkyACdGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782542556, "uuid": "06b1b03d-1d1c-456e-8eac-87aaf5294b1e", "value": 6486016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782542556, "uuid": "4cc78a0a-5245-4d55-a865-5069983c2df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782542556, "uuid": "1997e6c9-2378-4d90-be08-17ec79791817", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e17a98-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583259, "uuid": "63da3143-fcfa-457c-bb2c-72fd8ec661e3", "comment": "Malware payload (Mirai)", "value": "5a45255ae82c83cb614f73a0636bbd49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583259, "uuid": "31983bd6-c4a9-41c5-9907-de6431e87be4", "comment": "Malware payload (Mirai)", "value": "72ae99c2af2f47b65dc99c828a8227d88b3143f698ba7bf4370f8a90f18ac37d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583259, "uuid": "a5296ccd-3b2b-474a-b661-ecabf95b44c0", "comment": "Malware payload (Mirai)", "value": "95013393e30f6b49327f8c565350f143c0d7e2ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583259, "uuid": "256f6eec-cee3-4423-abc1-9d5af3cf3053", "comment": "Malware payload (Mirai)", "value": "36818c73199b2d76b7e69c8b6a85e5842703907e1f7dc6657ffc30dd2dac7fae89f1007ba8a2e12a4ab61053e27c2be5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583259, "uuid": "88da6e50-5560-40f5-90b6-4a9a0dec80a9", "value": "T1F2561897B9D24943C5E83A3BB9BD80C433630EB99B8752665D04FE383ABE1D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583259, "uuid": "4ee6c8ca-a4bd-4096-9be4-fb73c3253f19", "value": "24576:IBwMquSmedBXzQiXA9ExGuZ53hT+t5LFrQei80rT3XUXD/OEQdF2Dk42h+gFnZ6p:kCA8RFASDukfTzZ4Rg42D3XVHWG5ErV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583259, "uuid": "3c0a4deb-88e9-4e71-b8a4-f41f711eaf60", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583259, "uuid": "918ab495-11da-4c78-a6e5-e2d8f3cd44e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583259, "uuid": "db993b41-4850-4b44-9d79-f5759c40bd05", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e89e95b-7255-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "0d1f7cc9-3968-4d53-9911-a56fda57bf3f", "comment": "Malware payload", "value": "871b548f51505090c9fc5a06013cef44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "72c577d1-d33c-4899-9468-1c76611ed73e", "comment": "Malware payload", "value": "72e4015d336b0811179b182304396baabcf55b261631602e6c59163821e4654c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "f143d887-3d69-4a15-9147-7d9290d763ea", "comment": "Malware payload", "value": "62d0c03aca07bd4fa004f2df095f6a62f168038c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "1c4c22e2-db7d-4abb-8ab3-346c219d4b35", "comment": "Malware payload", "value": "27546c7e85f19511ccb2aa1a315a27d535a8859daabc37355cc7fe54861a69d064f4ffc216b84c17d7b567715f543832", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584694, "uuid": "15a83d98-99e2-4df8-b0d7-8fef21e5a29e", "value": "T1CD04D90A9F510FBBDC6FDE3702E90A0635CC955722A43B753674DA28F54E90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584694, "uuid": "c714012e-8e3d-4838-bb41-41c85b3aeb2c", "value": "1536:TUSeNQ2qAsbwmIsoJDy7QYA0aHtKrKCSBu4rSgu5ym3WPcL3anEH8W90v01AyXLw:TUlG28nxOBuJA+nH8W9C0Cybw5qTbwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584694, "uuid": "76340616-2b41-4368-b8f3-a8290756e20e", "value": 173224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584694, "uuid": "3b99306a-7e20-4f34-b32e-01ae629dffde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584694, "uuid": "96dced5c-d907-4ad8-9436-cdab3f64026e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2982b00-7213-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782556435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782556435, "uuid": "b0172f4f-c198-4b2e-beb0-6dcfb2ef6042", "comment": "Malware payload (Gh0stRAT)", "value": "c21c6962c9902ddbf4d08537ea7d96a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782556435, "uuid": "2f7a853d-3798-46a5-b2a7-15d9f849503f", "comment": "Malware payload (Gh0stRAT)", "value": "7317d297686d154b4d78217e100df5f57949f05efe095f1a017b5988cddef98b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782556435, "uuid": "4c1604bf-9773-4b0a-81bc-f29a44b41a98", "comment": "Malware payload (Gh0stRAT)", "value": "2c707ca426222f790dc10216f9784127b386bf75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782556435, "uuid": "8a09e88e-51c2-48b4-9a28-c18e7f9d5c62", "comment": "Malware payload (Gh0stRAT)", "value": "e6e7c0a06ab0e1c6827fdc86a50bf22f9d5be42d969aacb69e1a0a412c4c653d0e4aeef6348a1ba426bc1afeb50d0e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782556435, "uuid": "e65cd23a-0b0a-4593-8666-b2cb266e5d12", "value": "T1F737333FA28F653EE03A19353576B654597F3621A6134C4A8AE4C58CCF2D1B01E3E78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782556435, "uuid": "e677ca9e-608a-4da7-9fe3-9795358ce1b1", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782556435, "uuid": "b2d0c602-03f6-4ee9-afc9-a55ed8284dc7", "value": "393216:9CUvxEjSIftNuxeca4tBrtENrMcHtyeA75pshBtzlT2jwsNYu0Ign5jzAYxwhi:nCTyxecLBrtMrMcN3A75uztzlT2jw4Yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782556435, "uuid": "bcfddb1f-81dd-48dc-9bfc-f903f9531048", "value": 24260952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782556435, "uuid": "1ef403a7-1077-47f1-b759-867f3b6f2148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782556435, "uuid": "19f71572-7e59-405d-a14f-46025fa551dc", "value": "2026-6-26_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bbe562-7228-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782565211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565211, "uuid": "c0c1ef3f-5a6c-48cc-9c31-8a503eb8a816", "comment": "Malware payload (RemcosRAT)", "value": "038112c489a65525aaa6c2ede6c33c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565211, "uuid": "f1e02650-6325-4c52-9de6-68d9473048d0", "comment": "Malware payload (RemcosRAT)", "value": "737646392a7c882064e22ecb9fc0b2732399e44ced2f56d873e656d0035af288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565211, "uuid": "ae6bcc01-c9f9-4d2d-bbab-f226ace46223", "comment": "Malware payload (RemcosRAT)", "value": "2b4e83cfdab5b79ae1aa1b4df8dd4503a9c99deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565211, "uuid": "ec57d59e-f04b-4a47-9244-91d5934e4aa8", "comment": "Malware payload (RemcosRAT)", "value": "3a54f9d88758eac477fd074f11cc8e773ad226eee6ecebff3033fc688a5fa0fade2f0242b9855baf8cad6a6559a80fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565211, "uuid": "3e56c84d-92e7-487d-a24c-b1af2f4dfc94", "value": "T1D855026C3522748EC893DC718E74ACB4A7216CBB532BD10359D31DAFBA5E556FE002B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565211, "uuid": "82e487b1-a55a-4730-9387-0cc7e935dd6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565211, "uuid": "f2c1bd8b-6464-4835-a36b-b6b5c84a8918", "value": "24576:195B2OVmJ576J2Mcfjtza088n0PEKE/e72kz7fc:7TVme1cI9H0/iXz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782565211, "uuid": "ba8148f5-830f-4dca-a879-9e1de911c0b4", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782565211, "uuid": "8c180b44-29dc-4340-9680-ab2af5840dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565211, "uuid": "e493f671-47c4-467a-a2f9-282dfa2ff500", "value": "038112C489A65525AAA6C2EDE6C33C2A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec66350-71fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782545557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545557, "uuid": "c8e99bdd-dfbb-4fb0-887d-15e7eab1c58f", "comment": "Malware payload (WannaCry)", "value": "4212402fb798b8e332ee153ec3597196", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545557, "uuid": "de840907-027a-4c3f-a795-94e8cddb9ac7", "comment": "Malware payload (WannaCry)", "value": "764c5e5d18af9185ceac64577e3b108f7c178b87c21bd1cba73a18719738e51c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545557, "uuid": "35154fc9-4422-430e-ae4b-449540578fad", "comment": "Malware payload (WannaCry)", "value": "cb7ee4cb367b0773240164973eba54a68f06365f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782545557, "uuid": "1a5b504b-62a7-46ff-bc7d-c5660069df20", "comment": "Malware payload (WannaCry)", "value": "fa235d03e57df307fde2ced1689fcc3349b8bc3e64e8e66724c229a5ee71386a98e8e4694fe30632e5284e155eb29f79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545557, "uuid": "8fa6fcfd-7036-477d-81b7-a506c91c50ab", "value": "T179367D4FD452F8D2D56688B7126BBC110A56382318CDB67E3BCAC005C62F71BFD16AB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545557, "uuid": "d230028e-3c47-4bd2-aea3-4f9806122d9f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545557, "uuid": "eee8d82e-9f1d-4054-a00e-16e060b2da2f", "value": "12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF1:SbLgddQhfdmMSirYbcMNgef0QeQjG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782545557, "uuid": "de1c5d48-0dd4-4ece-9676-31ecb784fc0c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782545557, "uuid": "0a3e4953-2b8b-4b72-83ef-c6785529d2f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782545557, "uuid": "c0e63bfa-f164-4e70-8253-e6ebaa1f8871", "value": "764c5e5d18af9185ceac64577e3b108f7c178b87c21bd1cba73a18719738e51c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23f5c3c-7255-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584888, "uuid": "ca9146dc-2256-4f39-8699-0949bb6df6ce", "comment": "Malware payload", "value": "5f90203df60ffb887ab615beda431cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584888, "uuid": "3cd11152-133a-46f9-b3de-fabfd8052cc9", "comment": "Malware payload", "value": "795da5d26669adab59a43691a323a360f3ce2baf9a2a3181ae6db494fc74a830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584888, "uuid": "6d854b1f-c63e-4ba8-8fca-ed1c6288c8db", "comment": "Malware payload", "value": "2d339b4d1c3a8527b4925f3e6915067bb588fdd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584888, "uuid": "e7365512-1182-429d-89ae-baf56bc80f63", "comment": "Malware payload", "value": "a0a3dbd87b0a3e9dbee7ab57d09b004cb984e0526ebb59a59990b148c3e676519e1e9036970f0ea7963e7193f8d036f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584888, "uuid": "72761837-aca3-4a0e-8f01-4e92e17d2845", "value": "T12A261A45B3A58C86F703DABAEC695DD186C4FD959B06827B34FCC68764CA6D0CC04BAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584888, "uuid": "28c8a860-deef-4338-98e4-0fcfc0881baa", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584888, "uuid": "b630897f-0903-495c-bc07-26668bfab954", "value": "24576:YSnjV5Pf/V5wPun2ZcGyWwOZVqKKhR2ssrDjYC6M6c:ZFnSahR2semc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584888, "uuid": "264ef84b-8e15-47e4-8608-2ee02501b17b", "value": 4557424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584888, "uuid": "7a45f765-b491-441a-9e0d-b8beffcfca22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584888, "uuid": "9fecf282-5b45-4845-b532-080bd941c02a", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7beef343-7260-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782589414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589414, "uuid": "0d7f7983-1291-43f6-872e-1c731bb08b82", "comment": "Malware payload", "value": "3121ac461b00d1d559cc3c66604e5c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589414, "uuid": "0573bdd9-4c62-429d-896b-6d9916e27675", "comment": "Malware payload", "value": "79ced052ef336b98a3dd0b032e79dd2fb2e91c36d8cf0c0d55cf7a2c6cdcf37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589414, "uuid": "2a21792b-0aaf-4385-b482-cb5e6d866cb3", "comment": "Malware payload", "value": "ea1b0b08148962f96afe14ddaa2f31a64c8376d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589414, "uuid": "013d7ac9-3a6b-43bb-ac2d-c2698d7eb63e", "comment": "Malware payload", "value": "32200b7956f45c5da461f76ddf62bb941cc69b307d313481caf4aa6d5ad89411480f942165d536e8c654b7bac26183a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589414, "uuid": "bff4c8b0-8862-492d-822f-4398bf0eb120", "value": "T17AC5F63B6954A168C01FC1BBD0925B24D83374790772D1EB218C3E5AFA89ECA4EFB751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589414, "uuid": "54a73b74-7a19-46c8-90e3-b15212289f33", "value": "57417c97e4cf3a257e5ac6245626f99d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589414, "uuid": "076e3282-405d-49ff-9e6b-a32d66f6740a", "value": "24576:QDm2enVqZCnwRVzzzdEErWJ+yyj/VTA8v2XE:PnVqQnEPdEErq3c/IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782589414, "uuid": "4755bb44-9e1f-48cf-9580-7414e29015e9", "value": 2616832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782589414, "uuid": "71ee81d6-3395-4e87-b081-2de126c00b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589414, "uuid": "8edfaae6-d547-468b-a66d-a51e05feacf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd2adbd-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532828, "uuid": "a4615b5d-dcaa-4c54-aafe-8a3db36f3ad5", "comment": "Malware payload (Arsink)", "value": "f506536b95f1af75bd93f75530385461", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532828, "uuid": "f9f67aa2-9f45-49c8-b85f-ecc1f0302665", "comment": "Malware payload (Arsink)", "value": "7c8d8eaa543c4e9bb54e8f7da36a1ccf343042dc61ed9b60d586cf21e6b8f891", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532828, "uuid": "60b70ef4-3d36-45d6-87d6-314c66cb6ea2", "comment": "Malware payload (Arsink)", "value": "2b87d75efdbfd1df2332a13fbbef54fc3c659bad", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532828, "uuid": "a37a812d-3d57-4ccc-92cc-a3862e2c918c", "comment": "Malware payload (Arsink)", "value": "a21b3fe915bebaa2103fe7a42f8fc47bc145154a62767d13617b1698e8722783250f92df8435cc04977938b63f1c472b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532828, "uuid": "2f2fa57a-4440-4313-ae5e-780369d6c265", "value": "T118A61285BB44EA2BC477703205BA9722558B4C068E83D743AA587E0C6DF7AD41F4EFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532828, "uuid": "c6c31ce9-fcb1-4d74-9804-19ba7db9f18f", "value": "196608:ejaEwhKKomLSjxjGY6EA2XCp8AsbtyQYvjJCpXm4p5Ta/zCzYePXi:H3UdAiptUvj0BpgKVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532828, "uuid": "26efa7da-427a-495c-8431-369fb2d76775", "value": 10192273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532828, "uuid": "87d7473e-d39b-46a9-a2aa-dffe77fb3c83", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532828, "uuid": "dd8b7279-63f9-4b81-88c1-7905bdfae6e1", "value": "TurboPay%20BD%20Reader.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1759c43a-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782551450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551450, "uuid": "7a738ef3-9325-49b5-aad3-58972cdf99d6", "comment": "Malware payload (Mirai)", "value": "b1fe94191e347c2666c9dbc7a1ecfa3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551450, "uuid": "d7af8c35-8952-4bbd-933e-f55b6d5a6d53", "comment": "Malware payload (Mirai)", "value": "7dda7a0622487014d5d42cd016a29cafbc1ceac51a13dad0ea2e4d249d9c5a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551450, "uuid": "4ae73e60-fe82-45f7-87f1-20eb24e1521d", "comment": "Malware payload (Mirai)", "value": "d537a37838a8fbd4cc39a0122711a48feed2776d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551450, "uuid": "f0486da2-8cd3-4245-ba1d-665aa8346fd6", "comment": "Malware payload (Mirai)", "value": "b7139deab0ed37e846410087dbbe385769cc78504c1bd5fd5e89410cfcbfc20257a171b3475ae79951f40a36eb7acd60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551450, "uuid": "c89d3969-fb6f-4cfa-bb3a-bd3d7d7be51f", "value": "T1DD6301219C23E565CAA355FB9874011762082FE972CD7A26E547DCE0ABD3983A3FC0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551450, "uuid": "104136e2-2a9f-4225-8f19-3f2297d61344", "value": "1536:6S3/eV4hohwcEALJUymF8sns3rTJjOSggaGLT9:6SGVBP9RmCPvJ6Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551450, "uuid": "8dba33cc-91bd-4ce4-9bc0-39c78b4ee235", "value": 69648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551450, "uuid": "1fd78f00-a48a-4025-833f-45770cc59040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551450, "uuid": "59fa5587-f3a6-40c9-aba8-63a6eb721d6e", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125e56c3-7212-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782555736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555736, "uuid": "12414779-f4ae-48ab-8a06-bf920302ce9d", "comment": "Malware payload (ConnectWise)", "value": "d6d0aff94ec9c1d794fa31daf5fad87a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555736, "uuid": "ac4c1057-e897-4246-9d87-12dba8c439ec", "comment": "Malware payload (ConnectWise)", "value": "823aa0257a4c971b780e5569f4f93a017db7337f9ae6eb16692c37f68920b6bf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555736, "uuid": "4d33afd9-7c2b-4464-9c8b-55b75e591b86", "comment": "Malware payload (ConnectWise)", "value": "ea8402d8d42601b6c8efb38dd19c60e52bb60f09", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555736, "uuid": "dcc8403c-b2ea-42ae-9f0c-9b1dfb896e5b", "comment": "Malware payload (ConnectWise)", "value": "55dcb2478e4ec766aefe451516920e3e52f81d5f5966dbf2c5ae5e061cc54f14c6e441d7f0a4324fa1eda456946ae219", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555736, "uuid": "c10dd847-976f-4754-9da3-8dbe8196f27e", "value": "T11746F141B3D695B5D0BF0638D87A52A65634BC108312CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555736, "uuid": "fd6acd7b-58dd-4f53-9929-59a1694e2761", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555736, "uuid": "ffaa00c0-9d96-46da-a606-15c3acaac6af", "value": "49152:HfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:bqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555736, "uuid": "b0d8feb6-0498-45ad-aa8a-a3e718968218", "value": 5682688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555736, "uuid": "3bd003ff-1420-49c1-8b7d-07b0e82850e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555736, "uuid": "4998b142-3442-447b-8e82-ca2ffc256bd0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7d8c38-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523353, "uuid": "d8d8c11a-a19a-4e61-ab36-d12d81fdc3ed", "comment": "Malware payload (Arsink)", "value": "a5abb7bb7eb2d4d124289270172090c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523353, "uuid": "53b86586-9a22-4d2b-bfc8-e5ede995bb0e", "comment": "Malware payload (Arsink)", "value": "82621c55f48c03093f5682ea1b3a6c5e5ac48a1c964643d7ce67fe41ccdba387", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523353, "uuid": "239a6355-5c2f-4772-91ee-e2e9d9c024a9", "comment": "Malware payload (Arsink)", "value": "18c1685508c6c90fac1b41ad47f9b395178298f8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523353, "uuid": "7789ddf1-f65f-40f9-bc3a-41543a90db0d", "comment": "Malware payload (Arsink)", "value": "d62ea1286883265289e447721175894bb59ff74d0fdaffbcd06fb372eae3f3e0d78d4936c92bf9888cc55135b53523cd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523353, "uuid": "280524c5-c513-4ecf-955c-ac905aac3ce3", "value": "T18EC3129BBF48D833DA2E1C3C89B8E17BBEB1679560D0C7872F12C25269854B24DB051F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523353, "uuid": "4c6650bc-d06e-4635-9d4f-021b0435c5b9", "value": "1536:EWcd0+sUwBx84E4uAXQlcWrZvS00eV688DANSct9eIJWqZrDqWQa6bI:EWcbwBMAghNZV68C69/JWqJDgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523353, "uuid": "ec1cb3d2-849b-462a-b790-579ffce3ad5e", "value": 119478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523353, "uuid": "0ef70ef0-a214-4d76-903e-a7c474b17480", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523353, "uuid": "2b5c66fd-2a67-45fd-9c42-24eea34785fd", "value": "triadaShowcase.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b648430-7205-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782550249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550249, "uuid": "51f68119-5730-4a85-bb92-48d9cee09324", "comment": "Malware payload (Mirai)", "value": "50dbec848931252301f61b084c83d9da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550249, "uuid": "c3726c39-1da9-487a-97e4-13f20b6d53c9", "comment": "Malware payload (Mirai)", "value": "829d62580142731539857a13d2d2cf4094deb3344205ae4e4fbf8f569b392e06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550249, "uuid": "96062a81-e5cf-4f76-9a4a-61c57e4b2108", "comment": "Malware payload (Mirai)", "value": "232ea993d5a944b7aedc9c5aead2ff93b06addd5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550249, "uuid": "f3c62a4d-3973-41d4-a804-644ce853074b", "comment": "Malware payload (Mirai)", "value": "96bfd5f8613c397f74c433d5710611ff23e798e249bb940208cf96e2d5b552a855ff96ece8858f9dad26fe72a106c1dc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550249, "uuid": "ce480e20-8b0e-42ac-82a9-6d4f36e88b59", "value": "T1B20186E603225AB1FC90AD1571A1642F53C7AED53ADC23CCF6641D55004FDB0B011F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550249, "uuid": "cad1ab0c-0d37-4042-a3d8-6ad9feafd669", "value": "12:BLsnTYFo/+ewJQOWNn+09snviC3/+ewtdQZt+JGy:lqoo/+BJGM3/+Bzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782550249, "uuid": "a07b7971-e2af-4488-ac6c-b25f82ca3c46", "value": 661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782550249, "uuid": "9ba6cd97-e582-4207-b653-64b2f58a58f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550249, "uuid": "92889f0d-72ec-44b4-a9a3-9597511e5daa", "value": "tbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fcf40d-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532737, "uuid": "8ec86583-1dad-4fa4-9930-0777be09ee65", "comment": "Malware payload (Arsink)", "value": "c70ea27947382e4be16982503e9e8aad", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532737, "uuid": "3b91ef90-5cd8-4340-b4b0-ea39af139689", "comment": "Malware payload (Arsink)", "value": "836f2b13d8481e9461925303d5295908efbf0a58cd7307c851082ed5e1a074a2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532737, "uuid": "25508774-c1e3-4456-9f1c-f3533c70b6ac", "comment": "Malware payload (Arsink)", "value": "148487e79337d98abe8105fa23e7f7c0f79302a5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532737, "uuid": "fed84e2f-d27d-46ab-8d3c-f9cedd1c74a2", "comment": "Malware payload (Arsink)", "value": "ef69b54d24748c1c8e57c0a2bf6aa75b1e9a0441945d6afda3ef0363bf10f73134ef225b7f8a6f8ac3d32205d215de5b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532737, "uuid": "3c6cd1a6-3c57-4c05-8e3d-e0b31ec6be7f", "value": "T12644124673A985E6D5BE40F88C24873FEEF2627285D09B3F074CA61C1C754F40E5466A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532737, "uuid": "41d8ca2d-61ec-4906-91d8-e46dd56395f3", "value": "6144:hOwyinq4NfUiKRZPGmLZ2wo8cAAGaNDHVVhN9CK/JBe4dq:hO8qPiKvXZ2woNGG1VhN4aFdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532737, "uuid": "aa3d012c-f4bf-4969-b18e-ea4612ca0dc9", "value": 275495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532737, "uuid": "0c13d4d6-e565-44e7-8713-3d9be0a90c5f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532737, "uuid": "13383f02-6509-42b3-8149-3b807fb3ce34", "value": "Brawl Stars Pros.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e8cef0-7270-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782596143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596143, "uuid": "e1eb4d55-d429-4517-bf82-395dd66f066a", "comment": "Malware payload", "value": "5132f57428e339856aff5629b1d0ce68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596143, "uuid": "db872401-e736-4c5c-8abd-ab606d5c4fd2", "comment": "Malware payload", "value": "848d134ca9d68ba39e5a448af3235557cb1339f4d06b2e41bfcf381fd5cbb275", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596143, "uuid": "a3941895-e6a6-4cf5-8180-2bedff9b0227", "comment": "Malware payload", "value": "5c6c97a24c091d389d18f4b63a147cbd26f29844", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782596143, "uuid": "85dc276e-d3d5-40e9-b1e0-b8ddf2f02a4a", "comment": "Malware payload", "value": "a29c4c5d8c876019a1be92431f73cf51f517e25a81c00acdf4807d26d75591d51178e6725f6cfd18e19ebe14175e5e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782596143, "uuid": "80943e0d-7e39-43f1-a4b3-7bb8085ca8ab", "value": "T16817AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782596143, "uuid": "e5099cd5-5b29-400d-b6a1-48d43723a6c7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQd:cqYUQuVDt0TZEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782596143, "uuid": "4059632e-d63c-4bf4-b073-fa7c8432510f", "value": 18513920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782596143, "uuid": "b6098f52-db50-477d-acf7-778dc23a05f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782596143, "uuid": "f47c6247-5662-4125-9999-f398a713818d", "value": "848d134ca9d68ba39e5a448af3235557cb1339f4d06b2e41bfcf381fd5cbb275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772a281e-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523264, "uuid": "ab9ffa0a-7b6b-4b00-b30f-58f2e5c04ec1", "comment": "Malware payload (Arsink)", "value": "6d18a4bfec6e553bbc877ade088deeb1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523264, "uuid": "7a78ccbe-1a5f-4486-9f99-d3a08d89b8dd", "comment": "Malware payload (Arsink)", "value": "86acd31a7de65743ad8135ee5e3dc90d076dd9cda5d2fb8be9b45e5f5cb8b3a0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523264, "uuid": "42f95359-158d-46e1-912e-c9c1a6b852d9", "comment": "Malware payload (Arsink)", "value": "824a69c46561e246a67ed78e9d1cd426d82240a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523264, "uuid": "d3c25baf-e77b-416f-ac8d-ac3f168ed6d4", "comment": "Malware payload (Arsink)", "value": "0abeab181d69ba34186d4536d42c5b35d5f2de53877ca0070b7db861b5c1ae7b3a350eedcec92375aa38925941b5d754", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523264, "uuid": "9551ac5b-f8b0-434a-8d40-30f288783d7a", "value": "T1294402D4B74878F0C56E95BB41F82838A69D7D8E90A4DB07353E39439FF04602ECA56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523264, "uuid": "77b476a1-8871-4a15-af0e-44aaac330877", "value": "3072:Jcb6J3g65Z1ihjsI915MD9kZ0rgl2/OFuT6Wl/uNwBMAghNZV68C69/sg8kohRX:DJ3TiZXfcYUY3fW9udhN9CK/THohRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523264, "uuid": "e94f05dd-ff64-40bd-a28e-1002baa9806b", "value": 267075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523264, "uuid": "0d86fb9a-71df-4f92-9a78-e6818d49017f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523264, "uuid": "2b4ac7c9-492c-46d3-935c-4e3ee3a694bb", "value": "djzrjdshks.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807e18ad-7261-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782589851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589851, "uuid": "1e740d7b-6011-47d0-aed5-8301979c32ca", "comment": "Malware payload", "value": "cc28b273c00391f0ebf011fdbd5e4caa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589851, "uuid": "9344a9da-ad3b-4781-9679-b0923166d941", "comment": "Malware payload", "value": "8ac21ddc17f81979134b2a1e2d9aa191927239f55090eaf28d49a0297619e645", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589851, "uuid": "57e97122-b135-4d59-89a9-545f16bf8359", "comment": "Malware payload", "value": "dbde03ada756e185ff0137b9c7713aa0dab1dd87", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589851, "uuid": "611fe5b8-8be2-445d-bb6a-7dec5d6b156c", "comment": "Malware payload", "value": "7500e2e84f93abff7d83ee78cecba80b309847494be65cc17238a719f3d1087d31380049ba40effafcd6e8cda7fba314", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589851, "uuid": "d2dafaf4-60da-41e9-b909-1bc7039d92cf", "value": "T174237D6516817C24AA99D4371D7F2F0CBDA983E6320492DDBFCA3CF28C59A9CD11872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589851, "uuid": "18e3bb90-4787-4520-a91a-8c8c3a64a256", "value": "768:9XRWNGxV69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:HlxhcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782589851, "uuid": "8b9f32c4-037f-4073-a164-7fa9c1a27c17", "value": 48364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782589851, "uuid": "9bf820d6-8c8b-4665-a13d-50b6a7973f0c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589851, "uuid": "a1f4881b-43e8-42bd-8db2-1d76781fd309", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748d3fe2-7272-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782597133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782597133, "uuid": "4d628f65-7691-44d8-9b86-d3896d73658c", "comment": "Malware payload", "value": "8c33054c0b6ed1dbdddd2870112b6b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782597133, "uuid": "5cb7c272-a6d5-4f7b-9605-b6ed0cea1ca9", "comment": "Malware payload", "value": "8ba894b2cdc50ad8abc2b462a923f9506d9ad6b504583d29517a26f2107abeeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782597133, "uuid": "2ce2a851-39d4-4736-be82-492a83f4e0a5", "comment": "Malware payload", "value": "d5e5ca1b2d5f20fbeb697618d75de37596ee2e72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782597133, "uuid": "a032a752-f042-4cd9-8fa5-f90c2eafaf13", "comment": "Malware payload", "value": "c750c76f4c743b194e9acc4956e2bcb5da61b6f001a12d6f40d1609a16dd1d42b039d2c22a2cc418e928674fb76da258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782597133, "uuid": "2553d0df-86f8-4dcb-99be-e44d2df91a87", "value": "T18007AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782597133, "uuid": "bcac2ff5-3b18-495f-8502-d4d497e9077f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQh:cqYUQuVDt0TZES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782597133, "uuid": "65c1e19f-3584-4629-8c19-17f831bc3e37", "value": 17891328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782597133, "uuid": "201e31f2-5b4c-4a30-b240-6214186dcfb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782597133, "uuid": "b6795421-ee75-4913-8f1f-c91b62f9960d", "value": "8ba894b2cdc50ad8abc2b462a923f9506d9ad6b504583d29517a26f2107abeeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636c7ce2-7257-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585508, "uuid": "98bf2a31-53da-4039-b6b5-773f4c18320b", "comment": "Malware payload", "value": "d14bb23c4a891221e56f36cefdbc6a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loaded", "colour": "#26C548", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585508, "uuid": "46d21b1d-63de-40e3-8a01-36447b0eb163", "comment": "Malware payload", "value": "8befee725051508cc4651f95dcef53b60b0ccc20921c4b0b3cdc574ca0ad48c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loaded", "colour": "#26C548", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585508, "uuid": "bd820389-c121-49c2-b7d6-39d7e16b2035", "comment": "Malware payload", "value": "8ddf6624e572894644ec7f169690f2f5627a9255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loaded", "colour": "#26C548", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585508, "uuid": "ac29c6ff-4821-4479-a01e-938805bfbbb5", "comment": "Malware payload", "value": "60ba1727937257377c1a120d6d970c8cea05e918e87fa231a2e3129e7746008b8d35b68faf295109490c2885a0556f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loaded", "colour": "#26C548", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585508, "uuid": "1235c9ee-41bf-4473-b168-d7b0deb716ac", "value": "T12DF1D75BF5484AEAF09EB37DC8D77E2296F4F35C22DC499F92A04B4A0D4B205B0BC255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585508, "uuid": "9f50e8ec-b047-4965-ac36-e6fdbf206eb1", "value": "10f85c662c37e0cd1e465528dbbacb60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585508, "uuid": "f5c405f2-a8b9-4082-ae94-9ea5f2446405", "value": "192:67m8a8S1/xQazjuCLReZ6TTamckVPxIiT8qty:67m8a8S1/xQazjPLRsYWmckVPxIiT8qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585508, "uuid": "b18907a0-a24b-4952-b23c-e9a5640a2868", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585508, "uuid": "8ce6447e-bda5-4676-b0c2-bbde54478b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585508, "uuid": "96255723-c59c-48b2-9411-861ce99aec51", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9319e752-7231-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782569267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569267, "uuid": "6597d890-dca1-43c0-ac86-f26ab19a5dbb", "comment": "Malware payload", "value": "59fdddbded2b9961d4f1c623a5a402a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569267, "uuid": "8e97521d-7c89-4c79-bfad-57c797756b59", "comment": "Malware payload", "value": "8c8497883a9457977616a475d8d34580624ac0bfc0aceb578a9dfeab7ed936e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569267, "uuid": "706d2a86-9d75-41d0-8fe2-3a0f0ac0b6b7", "comment": "Malware payload", "value": "e451556c15662340d6901254a78410bf2778bc5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569267, "uuid": "5f97ff7e-8eec-40ff-93e3-a54245c16127", "comment": "Malware payload", "value": "5a6fdcfb3b7f4788dcd73769502c3e321d3e5f5596415d2bc84aaf3c82efb1314ba10b1ccaba0fd7ded39c995643e6f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569267, "uuid": "c20b87f7-6b3b-4a5f-a0ac-b791416e5ca9", "value": "T11ED09523B463117014624861F2C26810B0124FBECE84955D741361305EC0318F4D4FBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569267, "uuid": "0aa3b842-6704-44f7-b13e-183ed5d6c6fd", "value": "6:hTzFzrOry+eUzp06NwAulNXYq4HvXDG+NjVsNXYrkJ:V5Ory+yUwPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782569267, "uuid": "92abc6a5-656c-4566-8b78-6b7c5e353cd8", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782569267, "uuid": "31b8a638-eef5-4ad1-a61d-4d9d457d33b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569267, "uuid": "16bac8f6-6cf9-4793-b376-8b014bf8de3b", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca012a2a-7227-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DarkMe)", "timestamp": 1782565064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565064, "uuid": "a4a2885a-b083-42c1-89bb-7f6368675776", "comment": "Malware payload (DarkMe)", "value": "891776acc33d8c22e4667d51c8370d49", "object_relation": "md5", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565064, "uuid": "c58e2fee-b201-4f06-90fc-aa847e1afca5", "comment": "Malware payload (DarkMe)", "value": "8cd1408dbe57b890cb7aac49c60567e659156f376075ef617d5d7afb588daa09", "object_relation": "sha256", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565064, "uuid": "cfa5fd7c-29b9-4dd4-bac3-8aff35dd0d57", "comment": "Malware payload (DarkMe)", "value": "6de94861e213b9b876edac4bdc716e141df735b7", "object_relation": "sha1", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782565064, "uuid": "369ba33e-b093-4723-84a9-3b9d388f1adb", "comment": "Malware payload (DarkMe)", "value": "030ea792bbf58fa2bc9b314336e58a396a5a3438d178d3610ab9b7242d243652a98bad82274592f6d3620828929eb6df", "object_relation": "sha3-384", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565064, "uuid": "44dd02f8-598b-4e92-8647-9653772fd65d", "value": "T146374573650488F7E8589370098782A617EBD9096732135D22B866767FE3BB00739FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565064, "uuid": "7fa81959-e79b-43ce-b2ce-ec138c6c08ac", "value": "35231f57929109c853d373ff43445289", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565064, "uuid": "cc527904-9ad8-4192-8263-c828cb78e904", "value": "196608:FpHOapg2d3bhlMBUWanrNlYqPyuwFWFigaQ2BYmx8RBcCEN+vKg:XOapg2d3TqMyuHEzxMfEMyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782565064, "uuid": "eecc8c54-f149-4722-8c80-2191140e72c3", "value": 23236632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782565064, "uuid": "cd6855e7-8dc4-4d10-bba2-a0bf80d531ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782565064, "uuid": "793f992e-6ebc-4732-aa71-b0e2755f95a3", "value": "File-dat-decrypted.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2dc8f3-725c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (IRATA)", "timestamp": 1782587750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587750, "uuid": "d9984da7-6e44-4b2b-8a5d-877a0988645f", "comment": "Malware payload (IRATA)", "value": "859af85009682ae2e07cb19e7a4467da", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587750, "uuid": "1e4db29b-006c-4188-970c-5c642faede6b", "comment": "Malware payload (IRATA)", "value": "8da70cdcaf30bedd3040f03b71e8bc4362f13c12f38582dc71d796ba089cf93e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587750, "uuid": "8766a656-6cd7-4e00-b01c-f7dc0834dc7d", "comment": "Malware payload (IRATA)", "value": "b144d8a0482fc5182d2577763a9b8c3aa0da2716", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587750, "uuid": "41dbff0c-82cc-401a-ad09-63a5fbce55ec", "comment": "Malware payload (IRATA)", "value": "f40fb2f9cd7442d4b6dc556a8b323d89afc007bf7ef14756a5fdbf27f0f858e692edf641d145ded6e7325ed01d311a7b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587750, "uuid": "109fb9ae-e9c2-4d1e-9e5c-1c58e83d883e", "value": "T1EE562346FE57A8EACCFAC33111761B35213A1D268747D74727B0BAF828BB9D847466C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587750, "uuid": "3de9ee75-7a41-4329-8ca2-8a0b7d877193", "value": "98304:iu1gVZS37ZgiInHT8I98NZhWsusiLV+t3xhZJsr2A+sS3t+RhQb8:J14ZSG4I9KZqzcFHy27Zvb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782587750, "uuid": "4965cd23-a93c-4357-abc6-29d2215c5a8d", "value": 6245288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782587750, "uuid": "884ecef7-d19b-451f-845b-9457ef4f3e07", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587750, "uuid": "4b1168e3-a2d2-4293-b306-1efd4e44116c", "value": "geeeh.25175.signed_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d25bd8e-722d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782567351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567351, "uuid": "17504da0-3d03-4c47-a07d-caef04a7a1c9", "comment": "Malware payload", "value": "7e24b6f83f38fd25eaf5f17b137b2407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567351, "uuid": "4a5d5f4f-f6b2-42ba-94f0-3022ba2e4c23", "comment": "Malware payload", "value": "8df9fee6cc31f0f62218ac3fc3165f6533968370d718cc59e0c49dad870582f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567351, "uuid": "0d14cee5-7d0a-484c-8bb1-288745c4fa82", "comment": "Malware payload", "value": "e7e1694162639ed587625432a79cfaa49f560d11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567351, "uuid": "4d298489-d3e3-4a4b-928e-cf9a99db9862", "comment": "Malware payload", "value": "9df580b704babc224caa8a51609483c4163c141bf90a97746c01a05cf8bc82b768c5d84a374370ad145628514e2e001e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782567351, "uuid": "fb398925-ade1-4e3b-8744-679e03f9586f", "value": "T16DC31885F8515B17C6C612BBFF4E428C772617A8E2EE72039D256F21379B46B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782567351, "uuid": "67d81e94-73d9-4adf-ac9f-116947114914", "value": "1536:6XlE2DAL8IIJ+sY4VkFZ7AVjzipfazO4MqsijX4A9laqwywkBGGDd5lVwinyvgnf:mE4IIc4uozips3LZ8qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782567351, "uuid": "93ebcf4e-5cd4-4e66-8690-78b7c6110de0", "value": 121196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782567351, "uuid": "62f08e88-d426-4cc3-9d7c-d297e4747baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782567351, "uuid": "05e196ac-ceb9-405c-8dd5-aa60a1676072", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2a4a76-720c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782553360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553360, "uuid": "82fcc765-ab8c-45ca-8842-31a7073ff731", "comment": "Malware payload (ConnectWise)", "value": "80b9ce821562da8e4178c2e08e761aca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553360, "uuid": "2d04404c-195b-4d71-b405-322f94fdfe51", "comment": "Malware payload (ConnectWise)", "value": "8ee29f72021306cf5ed6e3a5e7ec19a8e4de837ec77c6dc307ce5dcc96d833b3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553360, "uuid": "4405cbae-7674-4eb8-8e6c-96d3f2a6b1c9", "comment": "Malware payload (ConnectWise)", "value": "e7ddbec4cc309a35f40ed6127fa108363a56ffd0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782553360, "uuid": "36188f3a-e41a-4f65-8d32-ef89d9e92a7f", "comment": "Malware payload (ConnectWise)", "value": "36841116995386f6664bec6242dd450610755959ea720b6ac9d3c71fa7a77d5ed445cbc42dcd784a4fb4856d012a8b21", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553360, "uuid": "7d93df82-16ca-4b69-97e5-9f6619b946e1", "value": "T1FE647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553360, "uuid": "42071ffd-7665-44a5-a786-75776a3f6e9e", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553360, "uuid": "9f5ec2a7-d854-428a-a055-1a361b12ff26", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782553360, "uuid": "bf822d84-9ead-42f0-bdd2-c4779dd84d40", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782553360, "uuid": "4fb5af4c-3147-4004-9196-d223d57116de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782553360, "uuid": "9bcd9039-98dd-444d-9899-41fbd7a50eea", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e71a9bb-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555488, "uuid": "8cd5fd49-9923-4a98-8ac8-182ac4a08754", "comment": "Malware payload (SilentNet)", "value": "65deb34843c2c7d6a6a52e9783748049", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555488, "uuid": "56711dca-fc8d-4956-ad21-284c4a8a4e4f", "comment": "Malware payload (SilentNet)", "value": "8f4b01f8df1446398089df8a64cbf37ed685390647ac1d577c9ac8cb20a2c779", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555488, "uuid": "524a206f-606a-4f6c-bd27-fdc1b1fa1f9f", "comment": "Malware payload (SilentNet)", "value": "f05db037f850d48d168554eac0c03c7d2c7be1df", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555488, "uuid": "268543fc-0f1a-4e1d-a11b-43ba45776e3a", "comment": "Malware payload (SilentNet)", "value": "2be8d65311fba98aed36bbaadbcdd07a0d7a0f43d5598a868f1d7a4c0d6bcd629315e4dd32a0e1fc9f77e123a2c51f79", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555488, "uuid": "479ea5a9-074b-4261-99a0-7a169d4144c6", "value": "T1ABE312E92474DE2FCF2B6BB0D086919374ADE7604BB5945B2B08A4CF3C1D5DB4740B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555488, "uuid": "8ff1746a-d08f-48b7-80dd-bcd5939cba04", "value": "3072:Dq+ojf7DbYklpDpdCuSX8zY6r8D5NXpSWkjA5oty/gfjXf2MfYn:DNoLPbYcpDp4rXgbM5FnAtWeXfV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555488, "uuid": "324cb55a-5653-48c2-bb54-decfbf14b09f", "value": 154586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555488, "uuid": "196e7b4d-e344-4320-9d22-9c0ca9fc098d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555488, "uuid": "181a9b75-0384-470e-8270-049d87ca79d4", "value": "Buildassist.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50d10a6-7232-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782569780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569780, "uuid": "b7bd926d-ddf3-41ee-92b4-ed55a87b4a48", "comment": "Malware payload", "value": "fe4a8f37016e1e5b6f0ea7f46a6ba6df", "object_relation": "md5", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "IRAPrivate", "colour": "#41A4C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569780, "uuid": "9d3a43e4-7a58-4c06-b2d3-737e8d622bef", "comment": "Malware payload", "value": "8ff01c27233489580d51a4646312c2e10160a502a5075c6fa4326d8992012612", "object_relation": "sha256", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "IRAPrivate", "colour": "#41A4C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569780, "uuid": "0855a030-2787-4680-92d7-a1f15b55f4b3", "comment": "Malware payload", "value": "4bc376c876e122589854ecde7ade0bce83756f31", "object_relation": "sha1", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "IRAPrivate", "colour": "#41A4C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569780, "uuid": "101c342b-d085-4426-b874-a611d54a04fc", "comment": "Malware payload", "value": "686cd07b0859a921fe7c5fb86b6719f0b28fc1dc5c464e0b10290a3ad9d71df3964c93f53097e08c297cf9cac62b1adc", "object_relation": "sha3-384", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "IRAPrivate", "colour": "#41A4C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569780, "uuid": "2f457cb4-4026-4400-b3d0-ec2e54ddd987", "value": "T1D9671216BDC6D129E997A4362091C0D7B47925EDD80BD0AB01E84DCA9D72CBA0743FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569780, "uuid": "643c2f86-dd27-4d61-b3bb-a3fa53b5a90b", "value": "786432:OFlYgEg/I2S5A3PZY6v0e+E0VBVqJfeocm:OvYmgVwPa6v0e+72deocm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782569780, "uuid": "db87f3ee-2e98-4382-8879-4cd57f165d37", "value": 31616594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782569780, "uuid": "57a0f27a-b0bd-4433-b4bd-9b3f7280f6a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569780, "uuid": "a3f2eead-81d8-40f4-97c4-47572e3a8abf", "value": "0163pro.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2b3c4b-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555535, "uuid": "6a0832fd-1f6f-46cb-9a93-97f7f7f4b62a", "comment": "Malware payload (SilentNet)", "value": "9c7e4ef7570a25f65605accac8dbf5b9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555535, "uuid": "f071270e-999a-4e50-92ab-52c266b37fd4", "comment": "Malware payload (SilentNet)", "value": "905ab90df2f6d3359ebd97ba54decb3eb7ddc11bed3283e1b0080a19d528cd54", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555535, "uuid": "ff12c3dd-31fc-48b9-b1aa-4599f397cadd", "comment": "Malware payload (SilentNet)", "value": "43cc12ff7113c689ecf108d4e29691b9d2fd99fb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555535, "uuid": "c644ef84-e32d-4d6d-9198-06217a16a19d", "comment": "Malware payload (SilentNet)", "value": "9b24a7540cb4b5b22ffc06d387c89fe0fe94642efd530167c9f42773e31384ddff7882164c9099ed3fc9b48b43ca8d5c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555535, "uuid": "e5b8e0a2-580a-4641-8fd0-c6b87168a967", "value": "T1E3C40216D84CDC3CE94B3271106F2F67A019627598866D2B16B0F7DBD582DCA2F3E21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555535, "uuid": "29fa2f9e-7b49-4036-b279-276475db849a", "value": "12288:PzhEn6quIofzcb6tNYluUkx5JfJarWFYIc16NgW:PzhE7Kwmo87ao6SgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555535, "uuid": "fb50151b-8829-412e-9eb0-3b14a0811b0e", "value": 583736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555535, "uuid": "a0b2a467-98b6-471b-9b8d-1b061835931c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555535, "uuid": "2c01f9a3-b41f-4580-9bf0-c7f9e009bf90", "value": "XENONCLIENT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9466f6a-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523348, "uuid": "aba4592c-185c-4caa-94a1-a42b9e6fcd99", "comment": "Malware payload (Arsink)", "value": "30456e5840b3e0b2ba8b17536f9dd267", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523348, "uuid": "49a213fd-4fbf-4d63-8e6f-fcac9ab96b63", "comment": "Malware payload (Arsink)", "value": "906896b11849040c03a0260dd290320c08b1df19d0bc5e885abf2f99de0daebc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523348, "uuid": "65afcc35-489a-48c9-aa01-8690fdcc1fdf", "comment": "Malware payload (Arsink)", "value": "4a13b036480b509264a5c89eb58f1ae2f90c84ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523348, "uuid": "9efd7e78-f2c2-47b0-a919-b47ded907f7f", "comment": "Malware payload (Arsink)", "value": "fc0661e2bdf2184af39f6a9d2b2dd99dd56309e2eab5f03501453fb3c5a7d46a5df091bce9fae872ee6e0f4762254848", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523348, "uuid": "702c5035-fb8d-499b-b819-97bb0980d077", "value": "T1BB9423FBE918B5A2D24E6C76903F9D1BFB79D38378B4C9EA18A050D0C670595C19AC0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523348, "uuid": "9901d95b-52ec-4598-b105-7d65d711626a", "value": "6144:JhN9CK/1dD5wYFx/i26Fu6VNNDBU3TqiukWk4/XZ/plBUJYWZ9NiU3:JhN4a1d1wOx/ixu0NNznlPZh0L9NV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523348, "uuid": "7f0bb180-ca47-4f61-8fe5-a14f1bc6a60c", "value": 435139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523348, "uuid": "8dac06f9-5c0b-4e97-afa4-ce7eed326c35", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523348, "uuid": "2e8fe7d5-0642-43ba-b752-23f5f106cf71", "value": "Stealer.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd20d05-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523305, "uuid": "42f8ae5f-6c93-41c9-8980-5d26989225ab", "comment": "Malware payload (Arsink)", "value": "45c887c11f36570a34291b4ccc7858df", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523305, "uuid": "e7190046-e48f-4522-aa16-a18107f0c549", "comment": "Malware payload (Arsink)", "value": "926d3c5cc0c4f93cd63e1dd0cb7fb7a2da96fce980fce4cf77cdcf69ccca4e6b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523305, "uuid": "fbb90319-81e4-439e-b61e-501041c79896", "comment": "Malware payload (Arsink)", "value": "1ef628a54157f6963549a480b8466da39ff78b51", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523305, "uuid": "73a04912-2d62-4f79-99a0-df1c20011cbf", "comment": "Malware payload (Arsink)", "value": "9d8c66b543aab990fd2a0173f5c4bacc07c07644f66174aa8144ed78483bc7e1f07109de43e0c42f0c0790a427289205", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523305, "uuid": "402d75b0-b751-4679-b70f-da7a4e8c1058", "value": "T12035239B8B9C4C3FF86FAC3A41AADF75C99136197F01C9E650418A12F63B153A3F4A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523305, "uuid": "a040d180-0aad-4763-bbd4-c6592dbd9dfd", "value": "24576:hkKU0x/fG1vW4IQMxCznkkY2h4iiCDeACsrIICTtp1Vo6U4pH/GhD7rf:hkK7JG17IQMAzn62h4UVMICTth/pfGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523305, "uuid": "434dbe20-9a4d-403e-99c2-9b148b5ba12c", "value": 1061697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523305, "uuid": "dd0344ef-9ff5-4f10-bb65-4d3d19ec01b7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523305, "uuid": "16ef1eb0-9a6f-4ac8-aa98-b2c2519aec9f", "value": "MinvyRatClient.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e182f835-7223-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782563385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563385, "uuid": "87d2060a-866f-4587-a44e-1391f01e5bb1", "comment": "Malware payload (Mirai)", "value": "487ec7dbee811f846639d40f4eff06cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563385, "uuid": "32c2f479-d93b-467f-bbca-e2f2f4572505", "comment": "Malware payload (Mirai)", "value": "927f0b118336a7d05bb04103c157e6ee63820a0377ed11e83cc150eaa66a2e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563385, "uuid": "d0201303-2ceb-4c62-a155-ce3749209af2", "comment": "Malware payload (Mirai)", "value": "ae8224bb3174fdd869db4bcbd13f0c093e169a3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782563385, "uuid": "66c338d0-9dc1-4e9b-843c-6d97dac6e50a", "comment": "Malware payload (Mirai)", "value": "62179b519c40308b53a3a44b2dbd7b295ac465a0cc51bf5c525e39e5e3104ae79dba7f2c3bb78dde92427b0dab062947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563385, "uuid": "6beb1bfd-9988-44a5-b5ff-5bd7ff246c2b", "value": "T17876126AFB429982C95841748E97CBA47372FD14CE5243432368B72DBCF73DA9E71881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563385, "uuid": "22a443dc-e61d-49b8-a6af-1abe38bc5e4e", "value": "196608:hmMbUVys7KP0mENQvsj9/DshKUy8nymu5IH1hpyVUkc:QMKcvsh7s7yHpc1hEFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782563385, "uuid": "2e0bece2-8ce3-413d-a6b0-100915a351eb", "value": 7698264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782563385, "uuid": "b51a2296-2d4d-4977-aefd-f50810867ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782563385, "uuid": "dfb31470-60e6-4465-af2b-3120757c69b3", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f66b28-7257-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585747, "uuid": "f8688538-e117-4045-b5c9-5c06b148261f", "comment": "Malware payload", "value": "80098eb679148039022fede96a87a316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585747, "uuid": "67de58db-fcb6-4f40-a101-897b7ca3af79", "comment": "Malware payload", "value": "93dc6dcacda7607c702ce645c95d97094bf722cc22a5e5a31300e94909b9abb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585747, "uuid": "0e8b916a-1d49-4954-9e76-37ccd36435ba", "comment": "Malware payload", "value": "8f49067be2ee201fe3297849b1941a45e2354ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585747, "uuid": "d257d29d-f826-4440-8adc-ba1a559afc35", "comment": "Malware payload", "value": "cfd7cab0887b66146080ba3a1fa95f9e3131359bd940877cd203c6baf34ce5929be74ca6e9c264ea38d1e0bf5f96d0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585747, "uuid": "b040c2f2-c0cb-48c9-a7cd-3302f3fa9a94", "value": "T18A576B0DA38059E9D136853486D7BE32D3B1B851076D958BAB96F60D3E33FC14A3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585747, "uuid": "dc9f3a33-cabb-42a0-9a30-b5bfebcec8b7", "value": "109f73cc95228e3eacd82c151b1a5e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585747, "uuid": "fb540334-1571-41df-86aa-c026b9400e5d", "value": "49152:vm1tDrvmooHq4BwGf68EFlrBPQTUcdXJ1MfIHERTU:aDrE1EFxBPQTUcdXJ1MfIHERTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585747, "uuid": "c4eaab1f-b164-4b47-a124-3e9b349ea4a5", "value": 29191168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585747, "uuid": "a4aa8eea-9b81-4399-bc2e-4f00f1b8d668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585747, "uuid": "088383e5-9c86-4383-9386-71a26db4ffe5", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b8bce5-7209-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782552120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782552120, "uuid": "68c9bf57-9170-4529-9d4c-fd22c183ab34", "comment": "Malware payload (Vidar)", "value": "9f18eac675b554fd802aa4641f61da47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782552120, "uuid": "3c506c41-bb63-4d8c-bf1b-3c9c2088b800", "comment": "Malware payload (Vidar)", "value": "946754adecdf78d5d3fc21edcf01023405faf7bf698f3a5bf5b98df2060bbc3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782552120, "uuid": "b66d98fa-5a69-4d74-9c5b-50c38e8f8615", "comment": "Malware payload (Vidar)", "value": "773b2f09868d6a0ff62927d59f09f9e4d34dc726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782552120, "uuid": "f9a2d106-96dd-4193-b395-8d5369f8e76a", "comment": "Malware payload (Vidar)", "value": "037ebe0886b4078be95034dba1ab1c24261e81cdf6c71a566c6637d6ae2c14e42204c35e1d67c03fa5eb638aaa189488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782552120, "uuid": "784d908c-8225-4f4e-94ad-45d7fadd2aaa", "value": "T1BFF58C07BDD108E5C09AA33289B7569A7B75BC180F3263D32E90B6B82F727D05D36B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782552120, "uuid": "5a52ca04-d2b8-4ccd-aaee-8bc90aa04a55", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782552120, "uuid": "17de8e09-2501-454c-a30e-ca3d65110cec", "value": "49152:5YpN/Vw6lYILADx1LmgkuJuNc3nrwVYCth3KkAseveWzm0YVfjCsNx:5QumIuNc3I6Y08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782552120, "uuid": "d4d5307d-c4b1-4c05-81ad-b307fd4e5d55", "value": 3534728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782552120, "uuid": "d16e7b3d-ea73-4754-b4f8-c3f278de29cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782552120, "uuid": "a50ad6df-97eb-42e7-b4a7-f90bf05b7268", "value": "Figural.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d36452-723c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782573892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782573892, "uuid": "b75e6799-0761-41e2-a020-a46b904f3c21", "comment": "Malware payload (Mirai)", "value": "eb6cabee04757d48d32a01fa537788bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782573892, "uuid": "f1e2c38b-ec92-461a-a87b-5f248e1749c0", "comment": "Malware payload (Mirai)", "value": "94c4072f7e4c6020f5f9c2eb4dcf1ac1808776804ee4daeaf798c01e69fcbce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782573892, "uuid": "5dab1531-ac9d-4be5-97b6-fa8e74da0f44", "comment": "Malware payload (Mirai)", "value": "b9386ab479456fbe4e0bca056d2f5fcc005d29b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782573892, "uuid": "eae3439b-f3f9-42f1-bc28-ef8694a8667c", "comment": "Malware payload (Mirai)", "value": "3a56dcff3e8ab57fe524a3449a068b9c9118975a1a73c16403fc99177d4f8993259cb4790b01c0c74a030edbfc86c0ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782573892, "uuid": "e49ac24d-ae02-4363-be83-bd2e1bc37dae", "value": "T13C66FA05ADC43FEAC41D4B3484EACA9512B05D544AF19A3A16A4FFADBC772387F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782573892, "uuid": "0d1347bd-cfb9-4055-912b-3e2e2bb7fa8e", "value": "49152:E+4gLTxh3dE1Lxnf5LdsrJnES2vIJgztTq+5Eg:Ze1LFhE2Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782573892, "uuid": "6d4adfec-2909-4893-a508-772eff8e3992", "value": 6684865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782573892, "uuid": "8fb4f937-adc4-40f0-b6e5-3dcacfb9bac7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782573892, "uuid": "7cba1647-4456-42c6-b7a0-660aeb3bbd1d", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4170148-7265-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782591656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591656, "uuid": "cb00d5a8-40cf-45de-b1ae-7138b5d70595", "comment": "Malware payload", "value": "64a18042f163039202205779d84500b3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591656, "uuid": "fc6128bf-8286-4bbb-a515-e62835b8ed9b", "comment": "Malware payload", "value": "94e03e46b656afa0d66f8d08ae08b21a3d96dda4cd3d51afd31c559f715b56db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591656, "uuid": "b71147f6-a6bc-4a9e-8e3a-0ba3f5e62b54", "comment": "Malware payload", "value": "85588f2a321c01c82f0f685abe9c6b428c1b37b2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591656, "uuid": "b36197e5-30b5-43b7-8b48-d9133b046696", "comment": "Malware payload", "value": "aef937f8bdac3bac0ae6c02054b6cd8a79882605e758f53b0615707acbd49d13105e2cffc79b04bc2275058d3803346d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782591656, "uuid": "e49eef77-812b-4bd3-86aa-3d3544dee347", "value": "T1F7016BC68620AE10902DD61E62D7A290B461C3CE164B0F747FAC5D3DFB99D14F036F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782591656, "uuid": "dfab9de8-eedb-40ce-b637-95f96c523599", "value": "24:kXCKysE2hi0ziQvZohacXcFM9GQjVqOSE67:e9Qp+Msw0ktVB67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782591656, "uuid": "d880231e-6c67-4d4d-907d-1d4f62f9cc28", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782591656, "uuid": "f76caa80-a31f-4764-a3ea-b43494902c09", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782591656, "uuid": "d0c92e82-56b5-47c3-aba8-77a07c374878", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977724a5-71cc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Moobot)", "timestamp": 1782525895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525895, "uuid": "191de776-7ab3-4f28-b689-9ca437c9a83f", "comment": "Malware payload (Moobot)", "value": "6de6606b1631db719470e5fb0f031ae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525895, "uuid": "014d66b0-66d4-4b51-882c-0ce7595b2d84", "comment": "Malware payload (Moobot)", "value": "992c26a5cc1ca754400a33b9973acd1c24a26997c0a19d1e2a2feaa62586f074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525895, "uuid": "07ce2f95-1a00-484d-b5da-ddb17304d15f", "comment": "Malware payload (Moobot)", "value": "9751a52697847b867a701bd1ec575cf2c7d4a987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782525895, "uuid": "6f73a205-79e5-407e-912d-556a27aab489", "comment": "Malware payload (Moobot)", "value": "6fba30f7d7bc004a897699154693c67198c50eec0456bc894da7b7c887b08034cb71a5b8ecd77cea6ce538e77feaa941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782525895, "uuid": "23d999b4-482e-4356-bb6f-be99bc4fa9c4", "value": "T11243F846B9829E11C9D4037BFE1E118D33137798D3EEB212DE116F21BBCE56B0A6B461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782525895, "uuid": "4540aa0e-0a7a-4d32-adba-599c26838e37", "value": "1536:IVnQOt1RzAVwh4NuYzUviTpOteNTeTiI7iIDz8J7KwbZn:/Ot1pAVwh4MWCigPDz8J7KwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782525895, "uuid": "95e5cb56-852a-4a5a-8955-48d7f0d97b41", "value": 59864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782525895, "uuid": "5b9f7551-6d36-44f7-9768-8ae94d3b7fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782525895, "uuid": "48653112-28eb-4757-b375-61cbf6f280a2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44439990-7207-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782551096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551096, "uuid": "25a1bc7b-647c-49f6-b185-d71aec7403ad", "comment": "Malware payload (RemusStealer)", "value": "e2ea34aa55123dd1c1c4ca7027b12053", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551096, "uuid": "f6626471-00f5-48e0-a32a-3832110a445e", "comment": "Malware payload (RemusStealer)", "value": "99fa87f8885cd8d4f0afb63b6c43c0f00d3cdd3edf535c1730641c8f919449b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551096, "uuid": "5ae7d4be-9788-4be9-9a23-d2e0970e4d32", "comment": "Malware payload (RemusStealer)", "value": "e12a2429c946114b6beb8921b7326b284250ebc8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551096, "uuid": "1bf05bd3-4ed7-41c3-8dcd-c6c59a73b8ad", "comment": "Malware payload (RemusStealer)", "value": "c137b6ff5437d847e548af4f74f22126c122e6d36a8bc7852f06e98b634dee326d52747de985785bf69f57297cee68c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551096, "uuid": "3fdac11a-53ef-4402-9720-7a098586e8a1", "value": "T164065A1ABE916866D0D9E630A8A6125D3F7C7C4C4F7123D72EE2A2793E273C04D76B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551096, "uuid": "85152e7c-bf24-4dbb-945e-c8fe3ecf713a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551096, "uuid": "2f7ce632-1101-4486-bf45-d4d53629d9ae", "value": "49152:W8zXd6F3W4mJZG6HUGQ2ozkb5MRS6UNMr7:WWlUGQlAnZMr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551096, "uuid": "c6647215-f3e0-4b96-89cf-be70bcafb3ce", "value": 3748488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551096, "uuid": "2a93cdda-eb28-4092-8e09-390909a7d2bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551096, "uuid": "9c41c0f9-9857-46f9-bc4e-7cf36a676c03", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fdbb97-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532743, "uuid": "81b679a1-212f-41e8-af14-a08637c401cb", "comment": "Malware payload (Arsink)", "value": "851e6c8180c8b5f97a4146648c7912ce", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532743, "uuid": "dde8ab73-46e3-462d-a1c7-e1fc170eaf6c", "comment": "Malware payload (Arsink)", "value": "99ff6067685b9573c9e09e61b4ed910b8a74481bec345cfaa4037ae4a1155495", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532743, "uuid": "889443bb-dad7-4351-bf44-dce57c22fb8c", "comment": "Malware payload (Arsink)", "value": "4c39409f2aedd629065727cdeb1fbb9a602503c4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532743, "uuid": "ce46abd8-170e-4da2-a240-1bf891ba54ee", "comment": "Malware payload (Arsink)", "value": "95ec53ba478f3e3730a17fc4a6b07a7d5287340f51da83fda76c923ee39a6c6ed37853fbfb2596d5651c27a0ba12d33b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532743, "uuid": "4ccb56a2-d77f-4272-b63d-e8f48a60ee61", "value": "T16FA302AB9FA8E952CE2ECC7C94B8E13EEFB15352E4F0C387091252116F929754DD121E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532743, "uuid": "c4144423-e4c0-493e-b585-244454326f40", "value": "1536:D9yZIUwBx84E4uAXQlcWrZvS00eV688DANSct9eI/mcD61pSr:565wBMAghNZV68C69/qpSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532743, "uuid": "a95ba633-d8a1-4154-8bc9-2bf8a89b6250", "value": 107191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532743, "uuid": "fcc89e3f-55c6-43c7-b94d-492d0e34bc61", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532743, "uuid": "5d206a31-c847-42a3-bc71-5831d1e0366c", "value": "emoji2entity.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060254be-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782551421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551421, "uuid": "b609fd9d-f6c2-4baa-ab4b-d642c4ecab4d", "comment": "Malware payload (Vidar)", "value": "ccdd5b209678728be86711582b64f86c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551421, "uuid": "0615d3da-dfe3-4e30-bf39-1ef192d31e2f", "comment": "Malware payload (Vidar)", "value": "9a9e73edcf3b0732bb82ebcd530d4d9591cd057cbf080fb5f00eecc6366190b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551421, "uuid": "a9daff5f-1268-4032-8abb-5ab441653348", "comment": "Malware payload (Vidar)", "value": "e861ed732b772e44994486dbfd62e0d49fb1fcb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551421, "uuid": "0b6a7944-c3b7-4ec1-993e-6c6d6c92d275", "comment": "Malware payload (Vidar)", "value": "242338a1ab1525f66f0fea1c027ef8f72c843cf4efc7856dd152a52c9f91b9a86c3373d696bae606bffec7767ce16ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551421, "uuid": "96a70ef0-eb54-4eba-98c4-4784f894f60c", "value": "T133F59D07BEE048E5D4AAA33289B682697B75BC190F3133D72E50B7B82E767D04C75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551421, "uuid": "9ebac96d-7d23-46b0-996f-dc0350aa0624", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551421, "uuid": "41d32de0-613b-4c63-8bc8-4d6153f37acb", "value": "49152:Y0hplrQA3x8o/l7RV4K8sRlUnwqC00yBs+9OtUqMBYRRjfurmK:Y6yKXUnwq90yX9OmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551421, "uuid": "c73ce886-bd3c-4cf9-abb5-228cd632c739", "value": 3539840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551421, "uuid": "9381842d-ed2c-460f-930e-0a27b592abff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551421, "uuid": "f7cf57e5-2009-44dc-9924-a1290cf637ca", "value": "Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fb0898-7245-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577620, "uuid": "a90e8068-4084-44c1-9785-7131d2994ed2", "comment": "Malware payload", "value": "0e2ef7e37c2ad15a218e83775bb21bc1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577620, "uuid": "f496b07f-7ed3-4fb6-a888-12447117c1c5", "comment": "Malware payload", "value": "9d071feb44401183549385890b933686066988cb3af97d263a07d5afb4d44354", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577620, "uuid": "37c1b6f6-006e-468b-8115-c2dade5125d0", "comment": "Malware payload", "value": "94c58f30a4738df462b3bcee998cd8225ee09668", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577620, "uuid": "83b42fc2-405a-450c-b9bf-4027fab31d77", "comment": "Malware payload", "value": "af70099c8cb7545ba8b428ecbff17f846673e1d7447a30d6ac500b7a4742f90b8882cc26ac99807ade20f1e66fb2a407", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577620, "uuid": "fcca098d-e835-452a-8811-4d67624813bc", "value": "T1480523B13B7FEA16F82BE17F625679D0926D5FA1340562CF9141940E8CB8F3E6F02681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577620, "uuid": "d588940e-4368-46df-abfa-51bc9663d50d", "value": "12288:PlfEi0Db/lbKbdNMTX+QM+/+ClCvffHaWU8eEQzPdk9KZ9YogkUDAEvmHJhVoJ:PlfJ0n/VUd2bCvff6WLdCeA2QU0EveoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577620, "uuid": "8f1ef912-c0ba-4368-9082-50ec56aadb72", "value": 832773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577620, "uuid": "34c59b67-3831-4024-a290-70c5cca77175", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577620, "uuid": "59f37b29-8a9b-48ca-9b06-5d8d3f683c3c", "value": "Mod-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3386d0fc-7203-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782549350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549350, "uuid": "52e1b084-d9f7-4042-bb34-08bc0618cdbd", "comment": "Malware payload", "value": "a635ac28e53dd6b623b76cbe61545703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549350, "uuid": "5f7baf36-0772-4eaa-8a2e-973122180e0d", "comment": "Malware payload", "value": "9e4df976046ad1d55ebdb3e8e43ada3f5ce17872c973f6b10b1d7d5560c79e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549350, "uuid": "55912805-d01e-4ce8-a66d-0c4c01cb996d", "comment": "Malware payload", "value": "8b4217fd81c68497d32a7b510f2eae9bc142b99f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549350, "uuid": "7ce24003-f380-41c8-9128-3d447c0c2859", "comment": "Malware payload", "value": "c34165b5377801d874f2b71b46546f5068563316da156092bde5703ccafe24caa5c7bf4a4f255763a692d74d03bb064d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549350, "uuid": "246bd95d-47c9-48a4-964b-729e41597e92", "value": "T17BE3C7169F510EBBCCAFDD3706A90A0635CC951722A43B753674D938F64E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549350, "uuid": "1e8f10f8-4141-4853-8fb6-4879c785b941", "value": "1536:f7BeLlhx9X0cky6jHOyfKwp8xxlMAFi2vZgtLmzt6uW3okhFX6SqlBH83:VebDkhzYFNuQt6DokvPuH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782549350, "uuid": "8827edea-5c4e-4211-a498-c6144100a54b", "value": 144084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782549350, "uuid": "4ca845e3-b2ae-45f4-9961-6c52d31082f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549350, "uuid": "b3f8ba97-ce01-4189-95fc-2742c89916ca", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0242a8a1-7245-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577614, "uuid": "3828a99a-4683-4102-9bdc-42d4bec492e3", "comment": "Malware payload", "value": "b52a811241b6e7a8f050652a6b6d66aa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577614, "uuid": "333044c6-8b3f-43c6-9379-f373d051cc7a", "comment": "Malware payload", "value": "a30640a0a22b6933463a6652303c11b10f8f05727d29bef787994032e9c1b15a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577614, "uuid": "b3573a6f-9caa-4dde-ba98-f7e5f3a5d184", "comment": "Malware payload", "value": "54fe7a2c52858d89ef9537fadcd60607d3155daa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577614, "uuid": "f8b648c7-0c57-45b2-9c29-f4f1db05f0a1", "comment": "Malware payload", "value": "a4b84aa7826e3b56cdb6e6a7aa1734aed32c400cb45e44243ae7360c48c783f707d7cd423a1096668d726578052f44b4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577614, "uuid": "96e7ba7a-d853-4f34-bbb9-626f16964b35", "value": "T1C7B4E1EBB9969DCEE50FE43B00818022F964E0DED44DF90F06B6419989A7DD83B15BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577614, "uuid": "85df92ff-43e8-4e7b-8c47-93ccea0c2249", "value": "6144:8/aiifwf6XYUxi6qUWE57o3AGpCy63ydEnaYYKiB0FZviqCZhzyiF/xG:LYD8iJUlopdBEnabKHfvibhe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577614, "uuid": "b145c5af-41cf-4b92-ac7e-75a6060f43c9", "value": 527118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577614, "uuid": "3e88fa58-23fe-4f62-a005-4d2dd2c8d026", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577614, "uuid": "88955e63-4895-4df0-82fc-7624d5fbba2c", "value": "Krypton-cracked-1.20.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57eff468-725d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782588065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782588065, "uuid": "b9f7cadb-341a-4696-a601-5966bcd641e7", "comment": "Malware payload", "value": "9fc877b010e2c630c4db9efd1e0c5ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782588065, "uuid": "1017e83e-65bc-40fa-b711-9df55a825793", "comment": "Malware payload", "value": "a3fed15f05903e3bb645f059a65f5e56ffeab45ab02f535d6df263d4363a6628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782588065, "uuid": "40bd1613-34ec-4130-80c0-6d4dd572874e", "comment": "Malware payload", "value": "64dda3b0dc00c304bb3b65db472548d7d4c7204c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782588065, "uuid": "c266ca0c-67d4-4eaf-ac9b-0889530f0527", "comment": "Malware payload", "value": "e94cd9d45315835edc60473834cb4c4fe89a26da33945f89396f2a646758541c92f77379ff85a047461d25ae9e6e125f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782588065, "uuid": "27944edb-7342-4a24-a7f7-b0e29ba9f483", "value": "T127267C87FED0A5B9C09EDA3194A6525D7A79BC580F3223D71F70A2792F723D0487AB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782588065, "uuid": "632c1083-1eef-43d5-9faa-5ca1b25f0932", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782588065, "uuid": "cff86240-7416-4037-9318-1a3f93ea3a26", "value": "98304:GaIVQtM0gEssdyX444q+o94GOvpt9jmaWl1:GCtM0gEssYIBq+oqGOvptk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782588065, "uuid": "53e2fee6-604f-4011-9761-8fc398ef16a6", "value": 4564704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782588065, "uuid": "e0138f82-15e5-4f4d-b645-ff7e5874dd50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782588065, "uuid": "0254aa32-8128-478c-9aea-a318f51b563e", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969e0f3b-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523316, "uuid": "5511cfd0-bc05-4441-b33d-d7074c4eb0fe", "comment": "Malware payload (Arsink)", "value": "8447175e0c37826c2d5d8487d5272700", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523316, "uuid": "49d81031-511a-487f-a75f-b47f550b4ceb", "comment": "Malware payload (Arsink)", "value": "a571605812fbd816070e09fce86c2f010673dab8f8a33f8e7de7a89f3ed3ce74", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523316, "uuid": "f02ee4aa-8002-4af9-9f3d-0e29851a56f8", "comment": "Malware payload (Arsink)", "value": "47e4e2674b86971bbf15640d20e0da9c92194d1a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523316, "uuid": "067b9e29-05b3-42dc-ab5b-9ef1ed211478", "comment": "Malware payload (Arsink)", "value": "7104731b7a77f9efab3ba0d92386c68b0170b6b002de9c61487576a9bfa233b9f643086c10bce54d60822490e7f4a249", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523316, "uuid": "89d39d92-5619-4a63-9ffa-ec94ae893bff", "value": "T1D5453365A7B6C14DFA1F367DFC4F1104EDC222388F39E7144C168E21847CAA5B6AAD0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523316, "uuid": "32bc78ce-3522-45fe-bd39-748249232b17", "value": "24576:17KsyH4/Mk69S9nQq5iUH9vI/2rkgHyoLiqmYLLOI307ASTKLhVJHf:Zd1Xjdzc2jL+YLYAfhzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523316, "uuid": "fa7a1f9f-533b-4ca3-aaf1-719cbfd5dae8", "value": 1233799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523316, "uuid": "efd6b01d-21f8-4103-bd50-760ca8266efa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523316, "uuid": "1e068866-83f2-4c9f-87b6-0d98760a7eaa", "value": "PoletDidlo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7c9d7a-7233-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782570306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782570306, "uuid": "b71329ea-6b23-468f-85ea-6ea7ec0f390b", "comment": "Malware payload", "value": "e074b74a3da6f8ba2922d9d21b57f014", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782570306, "uuid": "e008ded7-c9d9-442e-9aa4-ac441c9599f0", "comment": "Malware payload", "value": "a97e68c49ad0cc0e81e776d4a46151a3be70d390c8bf9bc95647da0daf7c2cda", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782570306, "uuid": "f49d7368-2ca9-4bad-b50b-a7ace86325d6", "comment": "Malware payload", "value": "8514ac8b541edd5d4a9f76ef7e73737d33eabe94", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782570306, "uuid": "c91af3f8-f04a-4259-ae11-b6c05d2ea634", "comment": "Malware payload", "value": "c83c8cc1f5dc7527ba12488819e2b99398042ff847b72d5046e03686857d68a46f76f5b8f364e04dd99db43f4e34bfe2", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782570306, "uuid": "73872ed0-73fb-47c4-8e4c-7466828eece0", "value": "T160B78C0733E501A6E5B3E1398A9B4103E772B4575731CADB329C43542FABFE09A7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782570306, "uuid": "0e17f69e-0266-4a64-b3a8-3f1b55aa1a0a", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782570306, "uuid": "1ccf888e-d9d1-4718-9c7f-bd1ea617509e", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfd:fMguj8Q4VfvEqFTrYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782570306, "uuid": "1d2f7b81-a786-41d4-a28a-bba553797b9a", "value": 49925082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782570306, "uuid": "4230f553-933b-45a7-8bb8-73e329ceee25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782570306, "uuid": "6c3dad46-29aa-44a4-bc4e-289b9ef23f4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0ba71e-725b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782587379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587379, "uuid": "ecc8ae68-6ef9-44bd-8ef8-bcb4b14cf5a6", "comment": "Malware payload (Vidar)", "value": "f269378bb7d1c7817fa6200a1198b9df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587379, "uuid": "ee020557-814c-4e81-a2c4-527e0d8a3aa2", "comment": "Malware payload (Vidar)", "value": "abb0ddc5d6972b69a938f88cbc354dffbd14adcd13b8049e6654f51dd3f5836d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587379, "uuid": "001db0ea-3235-409b-9587-8017b36c558c", "comment": "Malware payload (Vidar)", "value": "b10573574be99566629f6ca88ba82d0e7e2122a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587379, "uuid": "84c90aa8-e42e-45a7-b73e-7c08199754ff", "comment": "Malware payload (Vidar)", "value": "13c4be1dafee7be2fd44319d94d951eb1789057c8a1104ec6362e5d61afb87f3f409405dd171022af2b02d18ff2e5d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587379, "uuid": "975860ea-c627-4f02-8c83-641007e371a8", "value": "T11DF57C07BDE148E9C09AA33199B6855A7B75BC490F3223E72E50B7B82F723D05D36B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587379, "uuid": "973c8b7a-b6bb-46c4-85bc-8b9b00923145", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587379, "uuid": "6fb8b37c-5a26-4abe-988f-1e5f99d69387", "value": "49152:kbdXPg5ldVhjuv8wCHRaj6hQVXoEXdXGWiY5WYHziPsicn:k5UgSGXdWWRcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782587379, "uuid": "9859abd6-89ca-42d4-9d05-b3ac654b093d", "value": 3539848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782587379, "uuid": "ed595299-0d02-4126-be5e-405b69dec803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587379, "uuid": "17a02285-df20-47a7-96c7-099c6bb18822", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4331577-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532815, "uuid": "534561dd-7a01-47c2-8e04-1109c27585ae", "comment": "Malware payload (Arsink)", "value": "69ac5b7031a8ccffdfdb62153f14bfe0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532815, "uuid": "bae728bc-7dde-45e2-aad0-80b71b6c54bc", "comment": "Malware payload (Arsink)", "value": "ac57da29a3b20679113c7ff33ac81c977c1b964863f8310d3fdf5b351fbfd8f2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532815, "uuid": "6c3261a1-3754-4f96-8a57-f490adcf43d1", "comment": "Malware payload (Arsink)", "value": "81cd99afd6b23390c59732f1f0a6cf7042439bc6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532815, "uuid": "e52c1ac0-ca87-44e0-883d-3dd296b8a15f", "comment": "Malware payload (Arsink)", "value": "9df44aa0b0d2294e17e5598d0bf624532c7716c0cc8dc8d3898dbdeaaf246a4473ddf1a6d3094f34055f22f1abe4d176", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532815, "uuid": "b75c291a-759b-4ba7-a4c4-e43f93039b27", "value": "T183A312DBDBA8E876CD2E5C3588F4F56AEF7253B39060C3475B17A224AD944B10DB041E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532815, "uuid": "611cb03d-45a1-43bb-8c90-d10a3d3f1448", "value": "1536:L9UwBx84E4uAXQlcWrZvS00eV688DANSct9eIxEnan7eI3BnaA:KwBMAghNZV68C69/xvX3daA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532815, "uuid": "19f72943-6ed6-4ee7-854c-512b9083b7f9", "value": 107189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532815, "uuid": "b9240c47-e65a-44a4-9884-0b6df2f3f09e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532815, "uuid": "6f8ce8b9-9179-45ea-b03b-1cf15b99fea9", "value": "tickr.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf7932a-7243-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577041, "uuid": "a6519182-373a-432f-bf35-7ca4c20bbbee", "comment": "Malware payload", "value": "664ad9c9cfc554aac6f2aaaa43a65b48", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577041, "uuid": "a525cdb0-946b-4b8f-a59f-af6f65c9f99f", "comment": "Malware payload", "value": "acb170fce322724a198780becc450823aa99d58283efb1a8fc8d7b14e2925549", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577041, "uuid": "91682dd8-1bad-4f5e-84d1-19e8302c3685", "comment": "Malware payload", "value": "7afe5c428f786f960588a326e56be368a5bb80e6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577041, "uuid": "d7d4b1cf-606e-481f-b1e6-182702a0ab6b", "comment": "Malware payload", "value": "9d15abb0d601edd3f1d8836c8ddfb811f29dffbe9be03981040df2022da88b1b3a8926d86e74f051abae05c6ce84f10d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577041, "uuid": "a0928600-9561-4a95-b1ac-c0f32d00c790", "value": "T15D56234EE97812A9C937E13FD1021FE2FE1C42C5A185704E29FC46A618CB78B5B1D7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577041, "uuid": "d0896802-c449-432c-9b54-6e136dedd6f3", "value": "196608:Xi9ijT4RsMB8juUQBCfg9OQCDAPrwPJPPO2zl8Pnx:X+ijT4RsM8ju9Cfg9Ov0PrGO2zl8Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577041, "uuid": "cf3c3bc3-2253-4ffd-afe8-78232679b6ca", "value": 6414356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577041, "uuid": "6dca8e27-f7a5-4191-992e-75576674b186", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577041, "uuid": "74bcbab4-ea87-4c81-bac8-a590ce00e761", "value": "thunderremake-op.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0530e27-7257-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585663, "uuid": "5da59bc8-02ee-433d-8fee-b785bb7ec7b3", "comment": "Malware payload", "value": "029714671183c6988e3067a1d2fdec6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585663, "uuid": "c30ca774-c5e2-4f0e-956f-a836ec962162", "comment": "Malware payload", "value": "acb2f08fd49a1958c809389b01141248f19bde31dc70b44b9f466ebd8c6dcbd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585663, "uuid": "d8d095ac-cfaa-4583-afe8-103b7e00aae7", "comment": "Malware payload", "value": "79bb656381c24aacdd3bdae1e6c3ad8448eaf34a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585663, "uuid": "611fbcc1-2048-4c17-9c83-a8e05d6abee4", "comment": "Malware payload", "value": "d7dc916e42f1ca7ce4aec3b59bc1e89836f66546864e7585b0ceb1278336b141a62b7437efad33fd188439d0a7d1c0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585663, "uuid": "27bba63c-fbde-4676-9513-7c580750e051", "value": "T1A8F58C47ACA149F9C09AA33189B7525A7B30BC090B3523D72E90BA783FB37D05D72B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585663, "uuid": "4314f6d8-3446-4172-a3f8-c420f7ba06c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585663, "uuid": "3a12e30d-c0aa-41a2-9616-f8ec898e9ed4", "value": "49152:v1gi+qBD+1KxOQ38k20wzA7XfKtVhfhWZt9jqdqu4r8FY1A:vjlKA7PhZ3udqu4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585663, "uuid": "d4476713-2656-4b9d-8a40-91078b769bc3", "value": 3577208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585663, "uuid": "0fcacc94-ad45-424d-93ce-691b40456719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585663, "uuid": "988be63a-7682-4706-af4c-a8ad133a748e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bad626-7256-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585196, "uuid": "901fc266-20cc-4978-bcde-9413e361f261", "comment": "Malware payload", "value": "d070cecbc810cebe7c1cf373ea69b5fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585196, "uuid": "37322c1b-a487-458a-8cf8-486f3758cfe8", "comment": "Malware payload", "value": "afed5328d5778877ed29130d62987f9492177080a067d249ee303502ef9530d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585196, "uuid": "e9190426-896c-4686-9837-2afafae05227", "comment": "Malware payload", "value": "87452ff24f31736f014cc9852c6e879d3f3c3b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585196, "uuid": "8ee907e8-3cde-40c5-bb30-517c25d61e88", "comment": "Malware payload", "value": "d5cbdcc190d54a9afd31d9c8dac27fcd95947d67398e84ecbcb4a69f464ae0d82c4344f0baee358383fa9b0cbd8d0c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585196, "uuid": "cff2c975-5cf2-41b4-be8d-287987518e47", "value": "T115B6F66F22DD8268C25E927BC0768B41ABFF70745B37C2E746A933595A079C09D3B630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585196, "uuid": "62707948-9f01-4e77-a810-a465b0d4748e", "value": "23db922d0730904371b565e7673258af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585196, "uuid": "f4e209e2-fda8-4d95-8b10-0e6c9c8341c4", "value": "49152:GshpAfs/ryRxY03kjzpalshD0SuZFGBT3vrRoeowspRdN+dWnYqBdaTkjMKdIUAg:C1F+oeodDMKdIO7l7eozTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585196, "uuid": "4ca25b73-03a0-453e-b8e6-773a619dab66", "value": 10675088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585196, "uuid": "7918a2c6-4528-4508-9679-5e613d829bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585196, "uuid": "3fad6212-ab67-409f-a0f7-7611c8496434", "value": "Lumen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a8c56d-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782551819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551819, "uuid": "12ac223f-6d07-4f5c-8419-69555b777ab3", "comment": "Malware payload", "value": "4f23a2149946307672613b2c814b6d2c", "object_relation": "md5", "Tag": [ { "name": "anti-forensics", "colour": "#950BA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551819, "uuid": "cb7d4c8c-5ee2-4df7-b1fd-2e97fa9f3229", "comment": "Malware payload", "value": "b02b8547644bbfe77428e59c5ccec56c412e3c83aec44180e59110189a249956", "object_relation": "sha256", "Tag": [ { "name": "anti-forensics", "colour": "#950BA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551819, "uuid": "27aac958-8833-47b3-b74a-90ca2171e1a1", "comment": "Malware payload", "value": "4c83f6f093b2384209c834494b82f5ee44b84c1c", "object_relation": "sha1", "Tag": [ { "name": "anti-forensics", "colour": "#950BA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551819, "uuid": "c95542f7-d8ef-457b-970c-bfabfec52bf8", "comment": "Malware payload", "value": "1ec712a31595a173e631d6f27d99e1be0e68c8ef9ea9a2d78fa29f83c9a8a18e7b92033ee469d7c0466a9f01cdd34a02", "object_relation": "sha3-384", "Tag": [ { "name": "anti-forensics", "colour": "#950BA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551819, "uuid": "5cb520ef-6f76-4a5e-aeb7-dfc5b8d15b06", "value": "T16B5111DFFBA064D6F83D8179458BC8693A693561836743CB1AC5A71F8EA17E4793C300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551819, "uuid": "ca32b6cd-c39e-484e-b1e3-70209c248700", "value": "24:eH1GSO6i4XtaAhhGITjm8WQyGo93u9yDZX9XKLy6pxU:y3i4gIu8N2e9yDee6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551819, "uuid": "bf41df0e-bf97-407a-8f10-f4a50c600392", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551819, "uuid": "7ede64fc-332f-407a-8a33-bb97da7eebef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551819, "uuid": "a5aa9c5f-400f-40da-a538-a2a42a7cd618", "value": "06_000ea556_x64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b6fa81-71c2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782521599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782521599, "uuid": "ca8a2e1d-5458-4eca-bbc2-a17ab03d2bce", "comment": "Malware payload", "value": "71277d67e9a936e997a57827a57080df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782521599, "uuid": "aa9d905b-6a21-4347-94ff-baff6a93e755", "comment": "Malware payload", "value": "b18cf21b9e159b07778aad026f369c39bc24c4b221b9c9383497942cecbdc6d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782521599, "uuid": "0c6557fd-9837-4893-b035-0ad5cd0d0436", "comment": "Malware payload", "value": "b421f1919a9453b848d1e1eda8b53880f165d50f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782521599, "uuid": "0072a5a5-4090-4a74-b5b3-b0f854a344bf", "comment": "Malware payload", "value": "6c7ee9c96b9ca728b7f039d4d500afdd54e068f98ce9dd460848415229aebd258186eebddc42001167bcf2cabe7ff910", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782521599, "uuid": "836f4a44-c1c5-481b-886c-8e9edd1206d1", "value": "T16401ABCAC460A800419ADA5C36A76154F420C3CF164A8F76BFAC6D2EEB84D04B026FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782521599, "uuid": "23cf7443-db55-4a74-827e-2b4e55e94482", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkarf8CopN17CLayBeXCRO6COpmCyVbjT6X:kXCKysE2hi0ziQvZoharEb4cuH4YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782521599, "uuid": "d13681bb-76bd-402d-8215-b57186af5858", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782521599, "uuid": "3ce96e31-728a-487a-ab9a-ba82b7351e9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782521599, "uuid": "9da9210a-6164-472a-99aa-787055285d4b", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67811335-7255-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584655, "uuid": "49b230a9-ce08-4455-9a3c-43ea9b060915", "comment": "Malware payload", "value": "b31277a5b1b8431cdb0373c963a5ff44", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584655, "uuid": "6cd4c2c1-4ccd-47c1-83e8-6c6e9e1e094d", "comment": "Malware payload", "value": "b29c59ca65b413a081e89db27c0842fdddb1ce2d16f4e23611ebc7f7ac110870", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584655, "uuid": "8f76b304-b57e-4b05-8933-88207f0434d9", "comment": "Malware payload", "value": "0d0165518a4629cc5c6bbb90b9a630f1f4e65c11", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584655, "uuid": "257e2bd4-e662-4245-8e6b-374ff6163505", "comment": "Malware payload", "value": "b8be33d7ba69ed1fd267a819328a9a29da6bd97120cc004c767cc7d47d8249f3907e4986564c26ed99f5220eca938744", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584655, "uuid": "7523f555-ba65-4590-96fe-816d017e23f3", "value": "T167E533DE147D066FCA94C2FD69CDBA7B0308218D600D8EC14BB7FF7292398E86355669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584655, "uuid": "03b156a3-b15b-40ed-bbe3-a70ea00d1971", "value": "98304:77Gi7ptmrYr4g4E93wWWTTHPUhnPrbyueX:+QtmrY0g4aAiPrbyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584655, "uuid": "7a49f3be-62f1-46ff-be58-00328bc73261", "value": 3235812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584655, "uuid": "ef00b6b4-def0-4fbd-b3ca-d6a637d42706", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584655, "uuid": "de5e5549-eabd-46d5-a544-b04816f5679b", "value": "dupemod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47082bcc-7257-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585460, "uuid": "76ff2888-a89f-4f8e-a49b-99f982fc7220", "comment": "Malware payload", "value": "28a483eac56dcdc47c904ce010f34d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585460, "uuid": "59faf1dd-9863-46d1-a36c-f1c5db89bbea", "comment": "Malware payload", "value": "b30a55c62ea914a9dd179a56583cffffdccdf03b38210b87af7f4064a2a941b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585460, "uuid": "bf667923-d5db-4588-b5b5-11e1bcf52a74", "comment": "Malware payload", "value": "af51eb484b38c2084bdfca42d5178821238ec5a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585460, "uuid": "6c77cdee-90e1-4e11-adc8-f9a2a934dee7", "comment": "Malware payload", "value": "4bb901d8964ea21bb74ea44c9c78e45edfabfb8ac1f759317ecf3d859d87370bba55bd1da789ff40b4205c8dfe7745a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585460, "uuid": "47d626c3-2fd1-4435-8906-501b5eae20df", "value": "T1544723D3B6D562C4D3938A3896CB13CB53C1B59ACAAB871E34CB9C033911D939E46D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585460, "uuid": "232bb26f-6db1-400f-9c51-e3c0d87b88c2", "value": "5266280a70b1ce396c3ba4269bf4b646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585460, "uuid": "bda93bf4-760c-40b6-a95e-548354f1af52", "value": "393216:SL+aT3cLN75J+gt9Krzy9FJ69Nuhl90D6g3/QtNlMs0iGw56J7mV3hJMz:SCOcdlOrzpNe9mItNT0056J63hJMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585460, "uuid": "73cdac14-8c94-428c-99dc-c86bbdf2b929", "value": 26794784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585460, "uuid": "95559c03-3334-4c7e-97fe-07f7fe30bd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585460, "uuid": "3990b16f-ded5-4d6e-aa3f-2448f43411d4", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3519f88-7249-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SpyNote)", "timestamp": 1782579656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579656, "uuid": "b36020af-4017-4709-b02a-28eccf7805b5", "comment": "Malware payload (SpyNote)", "value": "8e408e3d592fa2bea942749408fa14c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579656, "uuid": "e879cda0-70cb-47a7-9a03-53a2589b6fe7", "comment": "Malware payload (SpyNote)", "value": "b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579656, "uuid": "6e0551b6-2fc8-4733-add3-f0f9db1f9f97", "comment": "Malware payload (SpyNote)", "value": "5d39d2b7a311054d9044135d33340d66fb2642ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782579656, "uuid": "92332514-b67c-498c-9bdb-de9fe8a2e52d", "comment": "Malware payload (SpyNote)", "value": "676f551c5c3c165b9eff84f5b8fe6f6a7391e2295b673399d3821ccd35400d3a2d0d98dd8d371d2b4d77449219a91384", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579656, "uuid": "d5db576e-51b3-44fa-a9da-3dc7cb4f09cc", "value": "T10226F143FB45DA87D8AAC3F66F230D9919134F24C643AAE30461766E2E772D14DC6ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579656, "uuid": "a76d4fb6-f4a1-41d0-99b7-d70cc414ded6", "value": "98304:Z1hFXASJ2Buoty9gvNnA7kUmzLzB/TV0tICxX+:rhprJquW9vi7kTzhqpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782579656, "uuid": "6722c242-c8cd-4fd0-99cf-374822ee3027", "value": 4660698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782579656, "uuid": "dc9247e1-40f4-4b91-b6e1-dfc34f85edbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782579656, "uuid": "bd5cf10e-071b-4cbf-be11-7ee46c6e59db", "value": "Blockchain.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fa9743-721a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782559318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782559318, "uuid": "abe9c7c8-3df6-45f6-b87f-17111cefea69", "comment": "Malware payload", "value": "11f5896207bbc2accb6a6cf716f05f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782559318, "uuid": "40b9df81-b8ff-49d0-9d87-4f66ee26ecf5", "comment": "Malware payload", "value": "b39340f27591419aa3180d1d08fe55e6a4eef0e7aab666c0faaa8c3acbb14ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782559318, "uuid": "ad54a717-6a51-4fe5-bf40-94c14ce34bc9", "comment": "Malware payload", "value": "672a643b9d949b6fa393af81f615acc609a0caf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782559318, "uuid": "f1cf721e-099f-46cf-8557-9752b655bd38", "comment": "Malware payload", "value": "e8d96dc1e1eb6c28e212a071198413c339375c11d76b4bc99fc2e728fb20a3ef8e368eeb515407d3a94563aada553f67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782559318, "uuid": "56baba44-3a65-4c95-ac65-a3d3114d09f7", "value": "T1AD08333851AAC5B5F8ABE9F20501F3B6FB838375506B189F465E22D9BC9858E10FD313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782559318, "uuid": "65461000-5f71-4269-b688-a9032862c976", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782559318, "uuid": "39b3b063-ae3c-4101-b7d1-b574d60127e0", "value": "1572864:Vt9IKPxjcGC/PlZ15cTRNwkT3rcKf/4TubHBTTHhuwWdrADoV0KQ5fYo+WL7:VUKJjcGuPH1OVukTL/R1HhuddskpcPX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782559318, "uuid": "e89955e8-45cb-41e7-b7ad-b86812fedfea", "value": 77267162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782559318, "uuid": "9a6ea9a4-968d-4f04-8d06-5f1efbeb0b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782559318, "uuid": "939c4415-c352-4953-872a-a2011bf56d3d", "value": "OneRoofSummer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400a1f7a-71c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782524460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524460, "uuid": "28d59916-cb5e-4d9e-88db-7dc24be7f8f4", "comment": "Malware payload (Mirai)", "value": "0702af8e555ded8476b7482c839b7cd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524460, "uuid": "bab6c2d6-d561-40c7-b6a7-ed40323d4707", "comment": "Malware payload (Mirai)", "value": "b3f4e9f001c0d227b00dad00914eddb52280dd07f92ee13e54039eae5eb32133", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524460, "uuid": "6d091a00-b6de-4131-94e0-83b204e190ff", "comment": "Malware payload (Mirai)", "value": "98f54f282b3ec298332db9d6234ca2fbee424fe6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524460, "uuid": "3aff1964-497b-4edc-b456-f256834e687c", "comment": "Malware payload (Mirai)", "value": "113525540c50bcaa0eae7d63573a65a4015413a243d669d10b293cfe0ff0b6c4284752414e1a1a8ecc5e68518eba75a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524460, "uuid": "5acb583c-ade0-4d06-bc7e-b5c455397b98", "value": "T14753620EAF601EF7EC6BCD3716E81B49308C641A11A93F397A74D918FA4A20B55E3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524460, "uuid": "01a48fa1-3ef0-43b4-838b-38ef6cfd87b2", "value": "768:qjgRzuSwtad8/8qEiFoD05fRMPiLg1aeUqe2AWqDtXiuomCz5SwbZnl:qjgZj3OFoDIR1jhq5AWmXCgwbZnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782524460, "uuid": "7e1e7db9-1b97-4ae4-9c27-34bfcb1610dc", "value": 65076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782524460, "uuid": "6f07d1e5-a150-42f6-9423-0b00fe62dcc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524460, "uuid": "0c262f48-89c1-44d7-99ee-b6ecbf2e23ae", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876ef098-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782581273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581273, "uuid": "353da3cd-7d06-4b5d-a1ae-2b0f72dbdfdc", "comment": "Malware payload (Mirai)", "value": "ea99f2b12040b9aedfb57311950217e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581273, "uuid": "5869e49d-ebd9-4136-9a32-e4c579597e0e", "comment": "Malware payload (Mirai)", "value": "b3f96ec768b213ab4a61d0286491ba48a667b3a6746c6a662b6a16705162f8ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581273, "uuid": "4366bebb-8daf-43a0-93f8-2e51b1b35bcb", "comment": "Malware payload (Mirai)", "value": "397ab645aa02243d801a5ed7148e522f29231abd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581273, "uuid": "578eb3e4-af83-47a3-8dd1-29c5b8105296", "comment": "Malware payload (Mirai)", "value": "bf289f5a4026e6268257db61c72fc96903dc599437457ce9ea5ed51cd103667fa4fb2341cf3c51b6b61b698ed0115eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581273, "uuid": "c8e6e549-1ef6-4e47-ba2f-d049342dfd0f", "value": "T1D0440856BE419F17C1D216B7FBAE4288371A7BA8C6EE3113D8146F94379A48F0E37241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581273, "uuid": "3e12620a-6497-4e74-9562-9d12eea3930a", "value": "6144:InZ3s12sEB4cGWI1Uxe1ke4TAYw7BvFjAeSHQa3:IS12TB45q7e4Ts1aTQa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581273, "uuid": "5e79bced-f459-4f2e-841e-5fed9e9d11c9", "value": 271700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581273, "uuid": "0bf101db-640c-434d-9dbd-96a38f849343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581273, "uuid": "0d8e942b-eb78-4731-9056-378d43af9cdf", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de26d5f-71ca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782524966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524966, "uuid": "0fc8c102-618a-4247-b1a3-480db362de41", "comment": "Malware payload (CoinMiner)", "value": "50a332343d5e3e038378262f73bc9e79", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524966, "uuid": "444ee44e-f2c4-4e38-bf3a-c4402ec7a856", "comment": "Malware payload (CoinMiner)", "value": "b626c4317ff6d4ca1ec04471421bef1d0261c59d77cb0bc0cf3c1e077d984865", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524966, "uuid": "52fce5e7-a31b-41a8-a658-31690d0c5175", "comment": "Malware payload (CoinMiner)", "value": "35c12d0508cbf7ddf43a4b22b5df2c96309d4205", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782524966, "uuid": "0db86130-828b-4a9c-b40d-f723be08f499", "comment": "Malware payload (CoinMiner)", "value": "beb05b254c185f1640843015b24d043768e0f2e0bfa9977a2ea09f56dd1bc8e8f8243d6359d28c33f289ede70cfc8a94", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524966, "uuid": "1b1da4c4-a8cd-41e3-b2ef-d521aaa1972a", "value": "T1BB66E103E5F78EF4C21BEA7D46625333A92474881E32B11C6995F36B5FE0938A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524966, "uuid": "cb7e9047-45cc-48ac-afdc-dc7be4d3c25c", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524966, "uuid": "d8b10dac-b224-4cae-83af-f724eae766ad", "value": "98304:RU8W74FHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KJM:1Iodemyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782524966, "uuid": "876422e2-6747-4ce2-8927-75dd82e8348c", "value": 6473728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782524966, "uuid": "71b02219-6885-4ef4-a53b-9bd7e116b100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782524966, "uuid": "965e3b55-6631-4027-b44e-852bd4b6b0dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e5d0c2-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581270, "uuid": "ff7aa3be-0493-49a5-9bb6-57f8c87178f7", "comment": "Malware payload", "value": "23ff57bf449de4239a22ace9b318f215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581270, "uuid": "e021ae67-ffef-4ab6-a170-d43615082e63", "comment": "Malware payload", "value": "b7df3e2020c12c1359090dca42a5b341ce3609778711864ad79c19aafbe9487d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581270, "uuid": "f5d09e8f-aa92-48d0-bbf9-059de14f1652", "comment": "Malware payload", "value": "cc998a9f95a114c6a4f9c09c053cbf3f9e913930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581270, "uuid": "bd613c18-bee9-42d5-9bc5-7192293d0ba7", "comment": "Malware payload", "value": "b0ca06d710569d8a60385b4c047041ddb68d89075c9b24307c7dcf0b5b793cf070101939e4238912f73dd60c06b41021", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581270, "uuid": "df7f5e02-276e-44aa-b17f-a709d047ed18", "value": "T133541916AD419F12C1D112FAFA6E828A33173FB8D2DE7212DD146FA4778A49F0E7B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581270, "uuid": "e83b69f6-5ae9-437e-a1dd-c687b2c57c99", "value": "6144:P5OJGge98Pv9SDoLA9Df4IB0wiX68ncraT6uVZkZ9p5C65Zpev:MPnSDoLMDgIu3XyraTMnp5C6Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581270, "uuid": "c5a65999-04c1-4cb3-bc8e-8a82170a1bdb", "value": 287196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581270, "uuid": "cb24c7c0-7b13-4c17-8461-f7168ab364d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581270, "uuid": "a47a2fcb-cf37-4cfc-a751-d173ec4bd412", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3780333a-723f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782575126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575126, "uuid": "63297bc5-188c-43e1-9590-78801131c4fb", "comment": "Malware payload", "value": "3e7ca33a0746e65cc08a92035af226c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575126, "uuid": "1753058a-c915-47a4-8f74-bdf9734b424d", "comment": "Malware payload", "value": "b8b16633d9cc1eda12aa9415d2fa2e91f39ffe8b7a94e38812e5c49ac88fe9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575126, "uuid": "f4f2ebd7-0394-4c0f-9910-33724e78f2b9", "comment": "Malware payload", "value": "ec6c1aa469dea25359080e6e2f22a7dfecb8a14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782575126, "uuid": "d8b12e0b-6241-4bb3-a5c6-fe1971b5c654", "comment": "Malware payload", "value": "4c277a4c41e6542f6b084745aad6e865b59cefdd01d6b0ae85d700c8404780e7d7d060fae02f9ae75c58a04a3bbeb073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575126, "uuid": "6bac41b0-5af8-4370-ad2b-cf47a56c7405", "value": "T1CEC73380F46EFDA2EBECD574E1BF229D376A85764870C180B8D9ED6466C30C91A33791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575126, "uuid": "d29d9863-dec2-4527-8f17-a020fd430ea0", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575126, "uuid": "59dc1047-7405-4f83-8cd9-82e2b743be27", "value": "786432:Q6NFL+D5zPvzzQmKHJUG9f3BbQVdOn2upGgJ/UvwDtISbhK4QI:Q6NhOzPvvKzfR8Vdn1cUvwDtxY5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782575126, "uuid": "8480e3ef-c257-4c7f-9c18-df64be944f81", "value": 52717752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782575126, "uuid": "7c0bd33f-fbbf-42d0-98b0-748883732212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782575126, "uuid": "c69b2d6c-41a3-4ec7-ab5f-b8cec806a945", "value": "yuanbao_2.72.0.613_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4aa7c9-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583320, "uuid": "dc26fcf4-9781-4101-b98c-456395db0b0a", "comment": "Malware payload (Mirai)", "value": "0bf2c86cbb592b54fe0bc1ee0ec1f686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583320, "uuid": "ffb89eee-c0c8-45e5-b05a-1bd1c3d39496", "comment": "Malware payload (Mirai)", "value": "ba01bc4f787871ce0f3ab3c2382cf5fe250dbdda7a06bdf38908d22fe79d6b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583320, "uuid": "eae9a3b5-9a62-4123-9fb6-dbf10578c662", "comment": "Malware payload (Mirai)", "value": "49bd72cb73e6306ea0a332cd1b8683a2b6e86965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583320, "uuid": "5146b3d4-fad1-4d34-bca9-9a318f24f40b", "comment": "Malware payload (Mirai)", "value": "b6bf08697e605ddd329f9fefead52fcf47cc24488c4a07718da631270100069c7549e347f45b5c6e9a252cad33301cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583320, "uuid": "9ffbfa29-62bd-486b-ac5c-1ee15560e598", "value": "T162565A57EC9514E9C0AE9230CA729153BB717C991F3123D32BA0B6382F77BD0A9B9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583320, "uuid": "a94805c7-d511-4070-99f5-7d7bf0796cb3", "value": "49152:4nFAt/cznBAdT8Eih8qSEiMDCs4qvlZz5oSe8iRQJfL9NinKlK1KcglCQ5ED:4necjZZOB8vW5w9ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583320, "uuid": "b56573ab-f41f-4f1e-aa52-9d1f4c3deecd", "value": 6058146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583320, "uuid": "9eeadf9a-5334-462c-9ba6-6d74ce1edca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583320, "uuid": "3c24269f-2b26-4103-b053-d2cebd04cbb5", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5daace4-71ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782526912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526912, "uuid": "85949ffe-9aa1-4743-92c1-9c46a31199f3", "comment": "Malware payload (CoinMiner)", "value": "f62887e1a794ddaea9ac9aaf8d94234b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526912, "uuid": "a9a6982f-2a4b-4576-8482-dc736a42a09b", "comment": "Malware payload (CoinMiner)", "value": "ba852441acba7f4e928215426a94f44f6f5b74dbf21b323087e007f9baf0645f", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526912, "uuid": "2f143ddb-755f-4898-a6e8-165efd343b42", "comment": "Malware payload (CoinMiner)", "value": "d3ebb6839607136507a053f1f1f922886a079016", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526912, "uuid": "c7f5e856-842f-486b-a3e3-dc7b6dc8a187", "comment": "Malware payload (CoinMiner)", "value": "674db040ad82c183492e8850ac376d502bc1b0dc64dbfb0b9abcf040689a2330de9549f02de52d75aab51ac0fc48d66a", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526912, "uuid": "e4586d90-949b-4730-85f6-0c3a838be1f5", "value": "T16F66E103E5F78EF4C21BE67D46625333A924B4881E32B11C6995F36B5FE0938A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526912, "uuid": "282c0d1b-83e0-4e37-9330-7dbbc8075073", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526912, "uuid": "40f6c44e-7739-4378-a299-7d555a987e51", "value": "98304:XU8W7tFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KJM:zI/demyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782526912, "uuid": "7e4ed309-4c25-4a4e-a48c-3088ede30843", "value": 6473728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782526912, "uuid": "5620c3c3-7f89-42f6-8a40-6e7673d021c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526912, "uuid": "29b2846d-bb01-4ac3-8112-220c03bcaa32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcbca40-7232-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782569852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569852, "uuid": "be64592a-75f6-407b-a03a-dab40b3005de", "comment": "Malware payload (Vidar)", "value": "885e4c62d17993ccffbfd44a1c128ddf", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569852, "uuid": "81cd3156-86e0-48e1-9807-f687abf676f6", "comment": "Malware payload (Vidar)", "value": "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569852, "uuid": "31b0b53b-3bff-4f26-bc5c-955d76e3cd2b", "comment": "Malware payload (Vidar)", "value": "3eae959cc134d89dcfab4f8388569626e166be0e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782569852, "uuid": "bda4225c-5019-4459-a8a6-b254180cf18e", "comment": "Malware payload (Vidar)", "value": "522db0605425d3be94f5f35e1f6319bf9bec6082416f2abe3760c59fdcdaaa3765c6c4c09ee3cd075c5cc3ef46d85bdb", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569852, "uuid": "fa934e9b-0e9a-4426-b879-38e7d6bd95eb", "value": "T198F59D47BC9148F9C09AA33189B7515A7B30BC081B3127D72EA0BB782FB27D09D76B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569852, "uuid": "18c72152-a35a-4e47-9775-262d047e4b9c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569852, "uuid": "e686edd8-384b-4d39-805f-56ca50cd4db8", "value": "49152:C/8Kskg2ZafgUoNkXq9NJ/SB0ECqwVPNOHp71ynqrRaY6T98:C+O9NBkHCqwpcHp7gnqda78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782569852, "uuid": "0288e75f-1fe3-416d-bb1b-8bc34f7ef80d", "value": 3575168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782569852, "uuid": "8d067e1a-59e8-40fa-b2ab-c6887517a7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782569852, "uuid": "a5b74feb-5834-454a-8fc9-0be1923a840a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9a69cb-722d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782567588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567588, "uuid": "ae54da47-eb60-46b3-aeb9-6970b200fa67", "comment": "Malware payload", "value": "8680ac17260e8036219a922454adf0fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567588, "uuid": "3c29754f-d09b-4c6f-b1d2-61d322327052", "comment": "Malware payload", "value": "bbdad8c3dac1f8eb89ceee11039188b207168e57ba32c3b190064df32dc110b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567588, "uuid": "6a703e51-5d18-4e2a-9ead-8b9409f6e0a8", "comment": "Malware payload", "value": "a71eb52f3019f2407ff8c42700cb6c22a4b68bd7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782567588, "uuid": "1c686e53-425e-4397-bd63-3b6dc8ba39a6", "comment": "Malware payload", "value": "ff77ac38d5f280c9b479fc4ef7b21cd77033b3321428139ec9875df0a292206fb239fbb08d4a518ec8def0a43b7cc53d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782567588, "uuid": "b40683cc-707d-418e-90b5-71f95c091967", "value": "T1A1236C6516857C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C0AA9CE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782567588, "uuid": "2b950766-3568-473c-9de0-958c62fae3b1", "value": "768:1r9NyXsZztC69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:dHusZicB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782567588, "uuid": "a137365f-54b3-4f4f-ad79-58030fe26c4a", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782567588, "uuid": "df7baafb-9fea-42dc-b969-29b1a95cc0a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782567588, "uuid": "b209830f-efc3-4242-a0fa-7336de429247", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcf0950-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782555598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555598, "uuid": "2ad2b7fb-4ef4-4929-ab24-49f5da821231", "comment": "Malware payload (ConnectWise)", "value": "fda577720a8c60c46a37650398fc0144", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555598, "uuid": "a65882f8-cd7b-48c2-97a6-2fe4bdaf63e0", "comment": "Malware payload (ConnectWise)", "value": "bc5a6386c6ecdc49d1714ebf156059d392c8d40def48eca333aee821da492e0a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555598, "uuid": "c70a27da-7956-454e-9494-4078d2eeae5e", "comment": "Malware payload (ConnectWise)", "value": "5d465ee2e2567bd59a1110597045c87d14a7a611", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555598, "uuid": "7905f847-f5a7-482d-9833-3bb388b89aa3", "comment": "Malware payload (ConnectWise)", "value": "e6afca00213957cf2489048906e58de8c570acd27dc63087155815cde5b0a3f8cedb0b2c5fe6370eef5bc301d93f9945", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555598, "uuid": "61853fda-582b-437c-bbf7-2973bc1b280e", "value": "T1D346E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555598, "uuid": "b781c272-71ae-4ec9-adc8-617188d33e41", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555598, "uuid": "ad470f93-af68-43d1-be28-50adfeb879c8", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555598, "uuid": "3a536236-aa78-412a-949a-cc55df47d908", "value": 5641496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555598, "uuid": "187f759a-0e34-4c98-a86c-ddebfba57a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555598, "uuid": "322aab5f-6efe-4fd0-a76e-49da8cae0e4b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4771eed-71bd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782519555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782519555, "uuid": "d66a7635-c316-4b98-a5ad-bd8e7817d0fe", "comment": "Malware payload", "value": "35ade1b85d2f4a3563622625c1af0862", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782519555, "uuid": "ec594451-d1a0-4657-af6b-307f6020b4e4", "comment": "Malware payload", "value": "bca3e5ca3be21f841fb6f5e1bd8c0bac3850a68cdd517059783978f879b5e669", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782519555, "uuid": "72338aaa-e683-4227-b29b-089732088dbe", "comment": "Malware payload", "value": "1f94f56c37691f19ca57090f93a5ff764533baf9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782519555, "uuid": "0d2f1b57-2a86-484d-8847-de815bd732e7", "comment": "Malware payload", "value": "9e6fc3c63cc7e41823d6ca14cf126b7b923f053ffbc01d59359d65f058d6ec2223c68693896a4e9c6d44ca2abd651412", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782519555, "uuid": "3f49520f-0f9a-4f65-ab1c-70748754afa6", "value": "T1CED05EA2A57312F420669914F2A2A800B115876E4C8A865DBA4B38B45E8834AF1D16D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782519555, "uuid": "20d2e317-d181-4b01-9935-22450b37e1c9", "value": "6:hTCYUDtvqu6teuFAulNXYq9DG+NjVsNXYrkJ:VCpvq64Piq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782519555, "uuid": "64369f8f-83b8-4473-a7aa-3028093875d9", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782519555, "uuid": "0e93ec8e-7778-411e-bb41-136e8f2f45be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782519555, "uuid": "4a8fda61-563a-455c-a7fa-20bae3658ddd", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0cc17b-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782555597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555597, "uuid": "9c11c31b-600e-4e7d-a7d8-b084f5f81c64", "comment": "Malware payload (ConnectWise)", "value": "3993e71fea3db426410909d3752d4932", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555597, "uuid": "8ec915fe-9647-4b05-a3ea-37c08e0c4239", "comment": "Malware payload (ConnectWise)", "value": "be245c2e6674ae197b407cd08b7d995909f79f4b2ea128f2a049ce7227ac5b93", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555597, "uuid": "5f08b07c-b3a9-4717-9d81-37863f87d227", "comment": "Malware payload (ConnectWise)", "value": "f53a40ad6fae35057880eaf1dbd0624e2ac7c7f1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555597, "uuid": "639c0f74-f3b2-4561-9c1c-a9f74c2a1cf1", "comment": "Malware payload (ConnectWise)", "value": "e59812257bcf3c4e9fbcbe037185b16f1e6d5fd0b72eb7e909036002bb6b42023886133e50b993aca2b2718b1cc89c36", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555597, "uuid": "d4edec90-cf8b-4b45-a3e8-5999a5310f40", "value": "T16E646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555597, "uuid": "6dac4e8f-5bd0-4ca9-9f07-5131369a0eee", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555597, "uuid": "7691da2f-eea5-4c61-bf5e-05a6d9f73cac", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji93:R1iw7gryNkSV1hy1Z1u2JLu93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555597, "uuid": "1b70d60a-104e-463d-96b0-2ff12bc7bb9f", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555597, "uuid": "de05bb4d-0e9a-4167-92ac-65066910ed37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555597, "uuid": "47c03379-5dd4-4fc8-8958-9aa8432c64cf", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8368066b-7206-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782550772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550772, "uuid": "45b3fde1-0ff8-46d4-b2e2-51b12594075b", "comment": "Malware payload (Vidar)", "value": "5e8d529f583e42a5b107fa8328b40c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550772, "uuid": "8207295f-0df8-4efd-84ac-aed5ac8e6845", "comment": "Malware payload (Vidar)", "value": "be83d2ef399368140800f80465eddfc8b33fb6edcc3dfe728ee5a09db8929c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550772, "uuid": "287a9c59-4466-42dc-9030-a601f80920c0", "comment": "Malware payload (Vidar)", "value": "c183fc794ea3938b80447e6d2b41012e8bcb2b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782550772, "uuid": "5ac488cc-579b-41a6-a798-9934521cfb2e", "comment": "Malware payload (Vidar)", "value": "83a360a015a25703569cfbac9d8e37ac35387199c168c88f8761a98fb1e9daed111b273f3ffc3eb29a19d05cf0855163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550772, "uuid": "b0260547-b96a-48bd-979e-17f6bd1ad984", "value": "T1F2D51268978BE5F6C09C4130215F8BAF3AA185DE47A1820AC7668C6E2DC3FC47F61D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550772, "uuid": "8814bf4e-9d59-4456-ba3d-66b46799018b", "value": "49152:PGTKpv3z9oZnzXdOV9O6FqyOxImXJHFeut43EcHgu+7UImgs:+TKpv2BXd8ftOxIaJHJafAu+7ULt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782550772, "uuid": "b300e337-bee8-412a-83a4-9be092b595b9", "value": 2936942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782550772, "uuid": "019794e9-3def-4fc0-8150-4d99c05e522a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782550772, "uuid": "00a94618-23cd-4f80-a403-86ca2fe9963a", "value": "install-1.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02f61b7-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523333, "uuid": "77068a09-d697-4995-b131-0af47addb18a", "comment": "Malware payload (Arsink)", "value": "fdd029dee2aed15be39de35afb848c78", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523333, "uuid": "ff384863-84e6-445b-b2fe-3c1faa4b42ac", "comment": "Malware payload (Arsink)", "value": "bede3630686cc90e359bc52567d72198ca97c527d5ebadda922208b93b7cf94e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523333, "uuid": "277a0d0d-53d2-40ca-8ec4-53513aa4e5dd", "comment": "Malware payload (Arsink)", "value": "5302b8feea5707371e5b0ba616e1591151048951", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523333, "uuid": "cc2f2eff-dcf4-49f0-8234-e8c11478d829", "comment": "Malware payload (Arsink)", "value": "df75589ff21666a6a5969a995989c70597acc16395e80816ce5c9423bff5c1be8a2d152f27bcc929ca0eade734880200", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523333, "uuid": "342dce3b-d925-4e58-9258-93985170669b", "value": "T1E6A302D3BF18F8A7D95F5C79C8B5E636FFB06B62A5A0C74F1B12911028A50B00DA095E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523333, "uuid": "92e931c7-1aee-40ee-abf5-d8b09e317373", "value": "1536:zZL05NUSUwBx84E4uAXQlcWrZvS00eV688DANSct9eIKRXnkijnD1LYQamKz:1JwBMAghNZV68C69/kfjhraX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523333, "uuid": "dae1e8cf-31a5-49d2-9a35-caa53c747fb4", "value": 107257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523333, "uuid": "11ac14e8-f60a-4ee5-bf0d-1bfd00818382", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523333, "uuid": "684bc809-f777-45d3-875b-e26f6daf5c81", "value": "SimpleMiner_XMR.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e07d26-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581262, "uuid": "b52c1776-8585-4846-9bb6-9fc2242f9ba5", "comment": "Malware payload", "value": "a736c0b9128212df18b435bc4d8556c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581262, "uuid": "06459903-be46-4f7d-be5d-f759589fb85a", "comment": "Malware payload", "value": "bf23faf4440b3ecf07ebc99d4961bae4274a68c0ee8bb35f1936fcb80284ef47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581262, "uuid": "2be83958-eb06-43d6-abbd-ecc16bb46657", "comment": "Malware payload", "value": "00eaeead4afaaa1465db24367ffcd83e0a647167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581262, "uuid": "6a15ec43-13fe-42af-a9fd-c14838c6cd5a", "comment": "Malware payload", "value": "216811c7352e6167b089e360eb8a4ffd3a79936b419c14aa71f87d9117625e65f2c39abd4aa6a82d76ec7bc7a203f323", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581262, "uuid": "423c7c0a-17e5-4859-9af2-4a4ee03c9471", "value": "T15F442819BE409F02C5D126FAFAAE829933577BB8D3EE7112E9145F64338A48F0F67141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581262, "uuid": "0c5b83d8-eeec-43f4-b0ca-63dda68fd34d", "value": "6144:Zy9dw+Q+l4FXeFutEV4EU1NvF7AGgp/LaRSQaeo85kYv9qrEiwoo4QnVe:kDIXeFutE+zhBA/LaRHaeLkYv9qIso4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581262, "uuid": "cea75ddc-4553-49b4-bb1c-50c54e929f1b", "value": 265772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581262, "uuid": "6a51dccd-e707-4a8c-bec9-8d390fa9f882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581262, "uuid": "999d4a3d-8229-445c-a58d-b0888aebcb3d", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95c53b5-7261-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782589974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589974, "uuid": "aa3f3f5f-8e25-44e6-b3ad-c72b70430aa7", "comment": "Malware payload", "value": "0bee4846f72c762b42e3e256e3225013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589974, "uuid": "0b53f259-56eb-4be3-8a09-d1aaf52ff3ec", "comment": "Malware payload", "value": "c0e4f1cd9cad6fd1a8485c945bbd384c25a441225657d440b35b743a852627ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589974, "uuid": "9fb94ae8-bf5e-444e-a976-ea3cf532d77a", "comment": "Malware payload", "value": "a64247d5582154d9d3c0f23a3d2fde26dc632516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589974, "uuid": "28db2e30-5ea0-4f5a-a043-39508805818f", "comment": "Malware payload", "value": "b98aa0e3c3122e9963991805afcb9357710804a7c380618cab98756a257e77ef4c6129ea5353cdabced036b654017604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589974, "uuid": "674a97f9-abf2-439c-a680-3aff2c2b58d5", "value": "T147B4F746F44186BAC67975B521CFE33AD906185E833388CB8F4A9D607A272E1CF7D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589974, "uuid": "5eb809c5-e3fe-45f6-b3ac-1b8a0315feac", "value": "6144:amKpl6Tqs9Wn9OJT4toCDEhL0zi/up2NO0DCueGmfXFQqbsXgLsJGoFfW5ztc11C:xAzq16xPRcqOzM3smr5YsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782589974, "uuid": "7e2447dc-5e64-4fcb-9231-843c0f1b509e", "value": 531744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782589974, "uuid": "15389524-3743-4d80-b981-41abc384b359", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589974, "uuid": "613e3729-2a11-468e-9f14-226031c259c7", "value": "libdpt.so.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443b9b10-7255-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584596, "uuid": "8e047b3f-973e-4b8d-8277-a7004899dd2e", "comment": "Malware payload", "value": "f5e151b9af231d281d87ae6a78c09352", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584596, "uuid": "3fb3b0b5-3a10-474c-af45-fd9174e94c83", "comment": "Malware payload", "value": "c498a8e5ba64a72e944710360d416f9db7c1ed2d629b48d6fa7cfc9d44615f5e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584596, "uuid": "d6a796a9-55d6-493a-bf73-d031f1fcd01c", "comment": "Malware payload", "value": "72cfedda282c51c4067229c05734572a54f12836", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584596, "uuid": "b562f459-baac-4260-8cce-90b791a8b661", "comment": "Malware payload", "value": "65593788cac2b2fbd8e1fa90d21367557b00137ec7e36dab372c995e428518542b1b4ed892ffd94bd8ecaa36ccd665fa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584596, "uuid": "83dbbfc7-d053-41d2-9a0f-9aa469e347d3", "value": "T12A8302155290EF1EF523AFBC30D4460B3A095BACE54E845B8445CED6C6B9D2B0A0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584596, "uuid": "9d1ef43e-e4f9-4ceb-b9f2-c65f81b4012e", "value": "1536:eic11xMYZ9SpnpjL3q8q9BRbPbSo+Y5Qg2GmosLJZGYr/dYmXnVcUeAAfFh41/GW:lm1JZsnh3q8q9He1N7JZZrPFcUeNfFh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584596, "uuid": "f64be3c5-2114-46db-acc6-5784ef7c7249", "value": 87819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584596, "uuid": "e5d8c9ec-d5f0-4d72-bd89-f25a5bd25971", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584596, "uuid": "c4b396e5-a17f-4d8f-bf99-6702ce285c87", "value": "dupe-mod 1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9819589-720e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782554406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554406, "uuid": "4c17fb69-b7a0-4e24-a184-f1564f39618d", "comment": "Malware payload (CoinMiner)", "value": "b30e363aebbf4857f5369a586d376e06", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554406, "uuid": "c9f0d814-5fdd-4003-8ef4-7009ad697843", "comment": "Malware payload (CoinMiner)", "value": "c57c42062d2956d8e999eee90c60e356363dd4498530f99d77b1d8b725daea47", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554406, "uuid": "e7121375-0d81-4aa2-941e-4071900b155c", "comment": "Malware payload (CoinMiner)", "value": "d59c1bc3465921a7632515f596ff69587e3aa785", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554406, "uuid": "270c623b-a4d0-449d-951b-e70674d2954c", "comment": "Malware payload (CoinMiner)", "value": "16f922c7599721b47f04b84ba5f5cd20cda3d6ad0f058d709f72a690c75a49a5ddf5153fff2f15968f59ab4ad7def7e5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782554406, "uuid": "66b2d419-0259-4815-b1b1-e12e6b6ca89a", "value": "T104468D4BF1F394ACC09FC4340B9BD592AA7074B80635793B3784AA312E77EA1576DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782554406, "uuid": "54c00f5b-87c1-4f82-89a5-634cf7f30a32", "value": "98304:/LuR3QRMNlfGukqDzX08ODfnuc0wjE/MYUPE+pdavPrjNw+3NlZmawHyRiBPz:f+qpdqnNFZ3Ni1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782554406, "uuid": "28e65c15-968e-4c23-bb64-05977db71d99", "value": 5358449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782554406, "uuid": "cd35a49a-3fb1-4985-99d6-b1de9b40df22", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782554406, "uuid": "3372f75a-e71a-4e83-807f-ebb5217de30f", "value": "_up.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f561a1e4-720e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782554399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554399, "uuid": "f49c5b70-9e72-44a2-888a-797dfc183cd2", "comment": "Malware payload (Mirai)", "value": "314b5c5319b12a2271002ffe28bd6ab2", "object_relation": "md5", "Tag": [ { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554399, "uuid": "02a87724-ee78-453d-84e5-3f241e5d3d34", "comment": "Malware payload (Mirai)", "value": "c6b66eb10127e8bc44f2b5f6d5f27164e75fd989264c6eb831b3768ded773276", "object_relation": "sha256", "Tag": [ { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554399, "uuid": "87fe5517-836e-4ead-9bec-06224d5c3729", "comment": "Malware payload (Mirai)", "value": "73573bf85ed500a41b4ab04a6f73d7d6dd307533", "object_relation": "sha1", "Tag": [ { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782554399, "uuid": "cf03543b-73c1-4088-934e-c1c565142e70", "comment": "Malware payload (Mirai)", "value": "60e0ad98e81eca1a05e746d680b6306fda652e75d2ec0326ca96740c604586324f50857e2b3bab7566c820bf63425612", "object_relation": "sha3-384", "Tag": [ { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782554399, "uuid": "9465e204-63dd-4df9-9b01-498dfcf55af5", "value": "T195866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782554399, "uuid": "4463b05e-04a0-4951-aca1-2e64b9c845cf", "value": "98304:zr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrep8:Gl4lcmDi1WIPFCBNcJ7oEkLsQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782554399, "uuid": "66423aa3-18e0-4280-b14e-26728c13f0e7", "value": 8315081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782554399, "uuid": "93d827a3-1f4e-4335-8f43-789557a335ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782554399, "uuid": "63062d53-9d4b-4503-9862-62dc68a9885a", "value": "_up.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8107e4fb-7241-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782576108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576108, "uuid": "cb1dace5-d522-46f6-9ce0-ce05baf63836", "comment": "Malware payload", "value": "1cf6f4bf5d675fd85f130c7ba3111282", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576108, "uuid": "112c2aa1-00f4-4905-b8b9-f133860a4d06", "comment": "Malware payload", "value": "c92073b388e8f038d3215ec2512f52ec7e1fa238ad22b9c94bc667c0129f1303", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576108, "uuid": "810385bd-f2dd-47d2-85fe-5026234c9803", "comment": "Malware payload", "value": "390799eb4b82acea30ec5c22158207d141ae327e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576108, "uuid": "0f11e3b5-f597-496a-90c9-c4c0cc482eef", "comment": "Malware payload", "value": "93932862fd8bebd815d311a88b2e02a24fb57179ab542117d30ebec75a28e495d932b5313cfde0683a477f0c7df0b6e3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576108, "uuid": "1b69e42d-70c8-4104-bb93-4359eaba733d", "value": "T1F8F523BA3BCB6BB4D09ECFF1C65A347D34293B8A4674CD593EC8690E4E42112D572392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576108, "uuid": "d8188674-9144-46f8-9c0a-830da2cd451b", "value": "10e55d27a1a8c63585ccdf7d640aaab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576108, "uuid": "85e9da04-50e4-4ecd-8727-74112e44352f", "value": "98304:eWKk1Qzh9aLVycXcEFxnwYhSVyLMpaJFf9v:8N9a5yL2V2ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782576108, "uuid": "e0ecf8ce-4a11-4218-ba20-99c95084cc8e", "value": 3559936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782576108, "uuid": "dbd066b5-2675-4e54-87d2-6544d3c879bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576108, "uuid": "e2fe2fed-3b30-4fdb-9f37-c4d55c12855c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f624e53-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555490, "uuid": "122c5237-466d-4f9f-b5d6-fc3bda6c3d93", "comment": "Malware payload (SilentNet)", "value": "1787529dfc73bac0bd27b42f8d051851", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555490, "uuid": "4e660c2a-89b2-4944-ae6d-827fe5ed44e3", "comment": "Malware payload (SilentNet)", "value": "c973c292e260df62736c8afb43d7aec5d3408c985ec789733a6cb9fc60f4554c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555490, "uuid": "6184b611-b8fe-4e1e-895d-cfa51b72ea2a", "comment": "Malware payload (SilentNet)", "value": "9ba3c52a1f59fe5e71de8eec32125f6569fb70e5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555490, "uuid": "bc4c01f4-f59a-44d2-aa52-9bcf9cd583d8", "comment": "Malware payload (SilentNet)", "value": "8849128f2e2d5dc17e3818b36eb673214a736ec77cc2514f8ac4d8f8fcc8161f8fa467306b0aa3109b0a12f1299a669b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555490, "uuid": "c3aca903-3c7e-4f1f-91c9-06d6ae35cf07", "value": "T1398312164048ED1EEBF26E35018A60F2FE167F7A594F10340B6F65C80064EAC5E1BAFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555490, "uuid": "54f8d20b-45d6-4d13-a4fb-4805bce3ecf2", "value": "1536:/3YVw889abJBHiiMx4T2/jombGPV1MH9a6hcFsl0ouqJk7V:AVtbUxtGPKcFw0v3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555490, "uuid": "20e64e4b-92f6-430f-98fc-2a2c86c953be", "value": 87219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555490, "uuid": "f07604c6-c697-4117-996d-0820dee7f6b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555490, "uuid": "28bb8b09-ff2a-440b-b8e3-39bc0a35d0d1", "value": "duper-mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a9ab0b-7226-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782564362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564362, "uuid": "fe1ba9d6-8ac4-4909-8cb1-dfdaf36794aa", "comment": "Malware payload", "value": "ecaf12ecb765bf01a9ac6d10b33e91a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564362, "uuid": "915f0552-013a-4b5b-868e-521c1eacc439", "comment": "Malware payload", "value": "c9c1286e51d7ceec1dfadcb1975d95695fcfb3e11f61ed9dd0092e81aba5fe1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564362, "uuid": "44dfd166-9955-4b97-8618-242a4057eece", "comment": "Malware payload", "value": "fd6537474e36bd3504a0709a69ac9e01121e5de8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564362, "uuid": "6ca2785c-24e5-404c-b00b-4a3df543070d", "comment": "Malware payload", "value": "75d505fdc3e30e8830e5b71006339076cae982acfd18955c427e3694183442f489f11a484fe1580025358088215e8f12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564362, "uuid": "00716263-071f-4f37-8803-5c45d4d837a8", "value": "T11BF3C71A9F510EBBCC6FDD3306E90A0239CC955722A43B763674D928F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564362, "uuid": "1e43362e-cc5e-4fea-a792-b3add3c8ca06", "value": "1536:+DJqhSwvI8D+8mk8circCJPVQriO95p38LPlgHaA1fEORJKcXq9LQ27+K6+TWW1E:+JiSVVNkLCJG338qLD1XSjyK6+KWPjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782564362, "uuid": "3ba9f937-6ee7-4bd2-8840-0b826b979869", "value": 160620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782564362, "uuid": "cfb7c068-33b7-4ed8-bc50-6dbf7ce3903e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564362, "uuid": "6475de62-747f-4c28-8a7e-bccffd0cb80b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bddbcb-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555526, "uuid": "81ffc245-b6fb-47a9-a2b2-2dcfabccb753", "comment": "Malware payload (SilentNet)", "value": "e848cb370494e8944b13b1563d96b5fe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555526, "uuid": "04415d97-5378-4a45-aca9-f9ff8adf9b83", "comment": "Malware payload (SilentNet)", "value": "c9ccc4baa54d90f46e7d05ca19cb00db6bae36eb31d5a9ab6b380ae88473d494", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555526, "uuid": "c04cbe7f-ca3e-4821-be78-ab895ba9634f", "comment": "Malware payload (SilentNet)", "value": "381ca2ec06b102c516a9f09d9c6f087c122f4abf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555526, "uuid": "e0c48233-ffbf-4a65-916d-cea9a2ac1081", "comment": "Malware payload (SilentNet)", "value": "c544dbcb03bfd7a720db7da1d0ebeebb3dbdab0d520d50f077a02091265c213949f977435fdbf158acc745b4b9419411", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555526, "uuid": "f0afea80-dda2-45b6-b14b-c4368f54ff5c", "value": "T12364222698D7748CF10A52B181CFB5E5E6F28DC94E4AEC7E9660C6223793FCD261C217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555526, "uuid": "63ac5a3f-b4fd-4067-9c3b-bfa9f52d91c8", "value": "6144:/YDn/5/i7+2wqvvVRNY4/5ZlyUi6Ly9IfQXD2kVf7+e9IBHmAQz9OJq:gD/5/UukZH86ID2kVT+eIBGnpOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555526, "uuid": "86d3a37b-4f50-4c60-9fb2-ef0b90ba4574", "value": 322782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555526, "uuid": "1b697573-989e-4abd-8eb2-3e7244c79be9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555526, "uuid": "86e2a2aa-c899-430f-977b-922dff8f0894", "value": "Skeli_Scam-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71237a86-7260-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782589396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589396, "uuid": "78df6f01-6848-4098-b7d9-eeebe404ecc0", "comment": "Malware payload", "value": "ccf1d5505879acc776a19bd3fcbc46c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589396, "uuid": "7201fe47-cb8e-429f-afb2-424a6f0f23ce", "comment": "Malware payload", "value": "c9f0f8875297bccfa81dcae3fdec8cc67f6872e0e58d295cf2dcf89985e7a22b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589396, "uuid": "e0bfeb98-0b2b-49f0-8305-5914e2a5a084", "comment": "Malware payload", "value": "b328cf8ebdc1ead78eb1ad25d3ff5f6f676099f9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782589396, "uuid": "cee5e8e6-022c-4b3d-bc28-bbca2734e58c", "comment": "Malware payload", "value": "a74f54c0cebe83941c4c861d6ced69f728830ac7fe39caa35d2db5786fed90aaa080a0d7c640c49c78475b5f29115b5e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589396, "uuid": "ae2a400b-b140-46fb-853f-157ed4b2d66b", "value": "T1748601C6F7D8A92FC4775032C5BA52F6914B4C228E879F536914760C28BB6D84F4AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589396, "uuid": "61c7bcc2-50f7-4dda-89c6-c9b57f89ecd4", "value": "196608:rcrkfljMbVwiuKVO9Ht6foGMsGge4lVvoJQVujS:wkfSGiE9t6fgsH1lVvoJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782589396, "uuid": "a67db4d6-6073-4ab0-a72c-950e87d08ddd", "value": 8558466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782589396, "uuid": "fdcf7242-6988-42b1-89aa-d4358010df56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782589396, "uuid": "702f8011-acde-47dc-9dd6-4b162501e16d", "value": "nested_app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb217616-7251-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583185, "uuid": "61086cab-af5c-45e7-b0f4-55e7b786f607", "comment": "Malware payload (Mirai)", "value": "876fd318fdc34f99f4287b3d86790d9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583185, "uuid": "cb3b3956-e7d3-43b4-a54a-5ef07ef6b150", "comment": "Malware payload (Mirai)", "value": "caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583185, "uuid": "712ee440-d9a4-4232-beda-dd9c1f08a15e", "comment": "Malware payload (Mirai)", "value": "22b3f5db2854896dc5e1a41d24d8dff03ce54e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583185, "uuid": "9b078d78-14ee-462a-99c4-006047198dd3", "comment": "Malware payload (Mirai)", "value": "d9d54cb17dbd0df217e3f860b83bef918b654e80aac26bbcd626b2bf5f7b48a7ec81915486c1658dca9b072272908b85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583185, "uuid": "8b3b5712-06ba-4da4-a988-ca82b24251b0", "value": "T1D5563811FACB04F6E6031E3104BBA27F67315D064B25DBD7EB407E29FA7BA911936209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583185, "uuid": "5010c38a-5b33-4074-a7ea-857cc4a82abb", "value": "49152:42pVfZ03PyySNwWl3neuLayncJgzFtNd4yUkG730Qh5sL/Aah0WZHa5Ek:Xle3qySNpay5Hd4yG7wIdWdwEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583185, "uuid": "fc9f4cc0-af86-4968-8b6d-b423a1c8df38", "value": 5890210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583185, "uuid": "f21c7f03-88e1-4430-8778-7db60ef33bdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583185, "uuid": "44698182-c2d7-468d-9b82-3134e3614b90", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a200c9-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782581267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581267, "uuid": "58fd805b-f51c-4571-8b19-bc0c155fc924", "comment": "Malware payload", "value": "88ce243fa186522369afbd6872b1288c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581267, "uuid": "5433aae7-1c97-4f78-8266-4d5f751e0703", "comment": "Malware payload", "value": "cb573c8f6aaddb1c9ca8c77e996c01128b452ecc66518c5e24a01046925fb3ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581267, "uuid": "196fa075-fc68-4d10-a020-a073dcd61d03", "comment": "Malware payload", "value": "ea9a350f639f5336b0aa6b826c14a5d44387ba49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581267, "uuid": "458a66d4-9486-4931-a598-9277f722937b", "comment": "Malware payload", "value": "6d800b91d999c26196569b7eef4dad10f59753201ff93d9dcff3c5175869e0a611cda406230692c3be2f848d1f3082eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581267, "uuid": "4129d6dc-50e5-409c-a856-44013d8b19ba", "value": "T1779312E145655F1FF20B42727A2DAA0AD2D97A1D7456623F8B8406E0470030FE6BFF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581267, "uuid": "6fc2df95-a426-46ea-9e2a-51f5acca8b56", "value": "1536:NjkamojCC895NqJYOvOCOSCdnJF/V3qwnjTcHQZPTnONng+3zcVHS2qhNf:NIt56V61RnnjZP7MghNSl3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581267, "uuid": "511bd435-4916-4772-9029-66147900ef48", "value": 97248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581267, "uuid": "777a1f0e-d029-4f7d-8ab8-739b339d9dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581267, "uuid": "521f0d8a-f511-4df5-a70f-21ba295a0d25", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236f6d77-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583253, "uuid": "feb3610d-1098-4042-9741-8c2a992a9092", "comment": "Malware payload (Mirai)", "value": "2698042648d45ee4316fabce5bd0055a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583253, "uuid": "3c82376f-d1d6-4bb6-90d0-31c4b29c5400", "comment": "Malware payload (Mirai)", "value": "cc5adaad983d6eae97c7e7abc75452e6fbc8caf9a57f413f646164e2d4ca044a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583253, "uuid": "044474dc-3183-4f20-bdb2-d20886f618ed", "comment": "Malware payload (Mirai)", "value": "9b59ce769954a6ad5b518bd8ebb48bac1ada1d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583253, "uuid": "4712ceb8-ed48-40bc-8702-d5acbb315e05", "comment": "Malware payload (Mirai)", "value": "31326d49c9006ae83bd7492fb90776fbebf00261eba5820fe37986a98cded3cb07f45941bc54484422628d151750456e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583253, "uuid": "d576ff3e-48b0-472b-8e39-34dda5bd02fd", "value": "T158561897B9924943C4E8367BA9BD80C433630EB98B9752675D04FE383EBE1D90E39354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583253, "uuid": "d905055b-d13a-434c-b50e-d1cc8d8280ad", "value": "24576:sqPbgl8lCXK6ToPZIknlnW1PYhYjeStZV6RT0NelsDwcwpfkoyKB+idY3g4UgRx6:s2CIZVXciqNNYEk5imIC2mwq5xG5EJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583253, "uuid": "fb2935d4-7bc2-4a61-9080-3d0e970beb75", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583253, "uuid": "7aa2e8ec-0205-4065-9b13-532183c3732d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583253, "uuid": "b4ec4d13-b1ba-47c3-8aa6-4e75e2c3c684", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee02bbf-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555516, "uuid": "b3eb61bb-60f1-484c-a79e-96211bf925be", "comment": "Malware payload (SilentNet)", "value": "26fd5767d4822c476bdd9fdd061ff5f7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555516, "uuid": "e9e985e7-5041-4dd9-b6b6-73f2025340c0", "comment": "Malware payload (SilentNet)", "value": "ccb38ab0049f73d7da3217df1d8d61de340cf7d12c26379e3332faa641885d64", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555516, "uuid": "bbbab9bb-2b7a-4377-96e2-88d4737e2a08", "comment": "Malware payload (SilentNet)", "value": "c975a6a88857ef5c826cbf6b4300b9cf378ddadc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555516, "uuid": "a50f1360-e3d4-47fa-bfd5-475a474c858a", "comment": "Malware payload (SilentNet)", "value": "10fdbf46c03d63c7e8f7cd5d4a633da57ad825b1895a0dd9982f542adfdc0c4bdbc690375cb8406f191d938d80d469d2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555516, "uuid": "f19668aa-4b1f-451f-8bc4-c351d98df2b0", "value": "T11C93021B3FCFFA5DEA4F7CBC5403DA3B512F213D5DAE582AC1A79220392A9294105DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555516, "uuid": "21ca0bba-de6b-45b7-b529-5f16dbaa3c81", "value": "1536:ijVpH7PnNdJUd/SpNyk0fqqlagmTVODTKLvX9enYVoGxV3T:4HDnNdCYOFVmUDTKLvkqoGxVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555516, "uuid": "78bcb7cb-1eca-416e-ba29-dd7e1fc3f625", "value": 89348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555516, "uuid": "55b192d5-d072-4538-b7ba-441e2ffbc3a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555516, "uuid": "51cb6d7f-edf8-46c1-8f23-b0a88764f963", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce7b17e-7264-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782591053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591053, "uuid": "92bfca8e-46de-44d3-a105-039e2fc9a2e2", "comment": "Malware payload (Gafgyt)", "value": "5d531946e9025e8ba59d0ca267f918df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591053, "uuid": "adc21576-75f0-47ad-82cc-e71907b40498", "comment": "Malware payload (Gafgyt)", "value": "cee808610a5064df4b156931891925432ebef98e64a79b9805c10a39b0b417dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591053, "uuid": "eb2a4fa0-67b8-4d70-8edf-e64b5292ef04", "comment": "Malware payload (Gafgyt)", "value": "9e63f44b5551970bcbc4b23ee75553de62191a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782591053, "uuid": "f99ed24e-7821-4d7a-b363-cfbf21781dcd", "comment": "Malware payload (Gafgyt)", "value": "38afd09300cf2727d7ddadebedb53ed57c394b66a7f20e0a1eb8cf454971801dbd482d049308c8f9abb5a9fa5eaab9f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782591053, "uuid": "b99c6ccf-364b-4b66-bbc5-558fab1f2f20", "value": "T163B33913B71C0B53C49759F129BB3BF197A9B9E112966285A50AFFC01373DF02422F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782591053, "uuid": "6bfc8df3-6971-4087-a309-854bc12bfe86", "value": "3072:Y+PrNZ+s+uJSuR5oHdDJdBRmnK0PDrO7fFOo:Y+PrNZIuJPzs5JdBRmnK0PDrO7fFOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782591053, "uuid": "5aefd99a-e4c6-450d-a58a-583db223f642", "value": 115122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782591053, "uuid": "11061ad8-4f21-4a1c-bed7-076a1b2fc8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782591053, "uuid": "bb82e862-c7f9-4b07-8c6e-9608129a509a", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c019e21-725c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782587508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587508, "uuid": "0a19b880-3ba7-496f-b1ea-636f14fe988d", "comment": "Malware payload", "value": "6c66aba509a66e9ab69e24fb30bcc324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587508, "uuid": "36b01e90-7bc1-4124-9462-7ec4341f49eb", "comment": "Malware payload", "value": "cf827508b66b36fc399690492cd798751f99f9cbaf3319e08fd3e6f60ed9b507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587508, "uuid": "5b8a3303-9dda-4fe6-83ec-f5f04ae98847", "comment": "Malware payload", "value": "8e4e7339ef5dc202638ee18f436213ce6af6bba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587508, "uuid": "d8cb9470-b771-4550-af7d-3bd7ed14059f", "comment": "Malware payload", "value": "37b76281b447b44746e35c2fc2cabaaf8e78eb68b2588c9c61b36a6fb116f821cd328086be7723287eae5dec76c02c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587508, "uuid": "05ab3ce1-27eb-481f-9488-0db886f3b242", "value": "T14718336C8AE5A31EEE3EDDF40170E613E65DB429AF5D74BB96D82031323340407B96A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587508, "uuid": "cf5febb8-5482-40b5-a2b9-26f5f0b9ff62", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587508, "uuid": "220d01ff-6662-4747-aefb-5139277b376c", "value": "1572864:Wt9IKPZlkiUILav0x7wDwYieTqowzKYypCPRfYLgRLlPBnU6InslAWLAK7:WUKhl1uXDwYAoyKYyuB/5PU6InstAK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782587508, "uuid": "7dc6f9a4-79a9-46e1-b0a3-21346989b6b9", "value": 89798972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782587508, "uuid": "05eab63b-5c74-4d40-91fa-bb3545c7445b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587508, "uuid": "33ef59f5-fb53-4076-a39f-f0fc8a33061f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46746751-7226-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782564414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564414, "uuid": "e536949d-7a44-4725-87e3-aa1e95814a2d", "comment": "Malware payload (Gafgyt)", "value": "461d1a69d8725b4a3f6e794d3ef89d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564414, "uuid": "63f71108-0f2b-4925-a338-a3dd00842f6f", "comment": "Malware payload (Gafgyt)", "value": "d1486a20c53ff728caa449ff0c465dddb4f8e1553bb00910668ffb4d09034722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564414, "uuid": "d2ed3280-d35c-49e7-a3bc-929291e0d2db", "comment": "Malware payload (Gafgyt)", "value": "96deaa1c497a268888ece36a5bb58e618c2f62f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564414, "uuid": "e330b948-0d6c-4cbe-99c9-7b28c21b5120", "comment": "Malware payload (Gafgyt)", "value": "76ba58f309e7f926957d800970c13ed8aae3c7a6bcd5f2438788813833f10c31d57091a8d3f82c565a28e96c9e086ffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564414, "uuid": "de22c8d6-7e96-4921-b895-4cfdfc4e01e4", "value": "T134B31893F501EF67F80EE67604D34B24B670BBA10F932662731739AA9E761D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564414, "uuid": "edfe420b-a103-4755-b69d-cd04e687261f", "value": "3072:eejkqb936yFRuWz2wnuAHyTmiK0PDrZlfkKo:eNYqyFAWz2whwmiK0PDrZlfkKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782564414, "uuid": "41b4fd7c-0b99-49a5-af21-e28c84f36356", "value": 116925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782564414, "uuid": "bbf7946d-75cc-41d5-9428-b615d05f953d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564414, "uuid": "0a20a5de-d494-4048-9fd3-372d8d68cde5", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578f304d-726e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782595366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595366, "uuid": "851240a1-25e9-4c73-a087-ca1d1260a12e", "comment": "Malware payload", "value": "8d7d45534bdfefedb6bd7c3214eb3c5b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595366, "uuid": "dc82c9b5-1c6b-4fe5-90ad-ba1448a84468", "comment": "Malware payload", "value": "d1e4c6578b588e95d8ed03b46f2febc0ce2d5a8a8b612cafe640b6e23ba637d7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595366, "uuid": "e0993ef2-3583-4926-883c-e784ec91561c", "comment": "Malware payload", "value": "ce69cdeac9c1ca625859134414323c93bef5c728", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595366, "uuid": "5ed3d2ef-5cc1-4d95-b762-30e46da186a6", "comment": "Malware payload", "value": "6b530918cf3dd5f77b7097051b2567c7be357bc3315036a5629bd1144dd0e2abaf9db94b359f5c18fa62a11645cba0a4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782595366, "uuid": "582ae291-46b9-41f1-a0f3-a6e2e2f51226", "value": "T1F25649695894B0B4FDF6DB81C21F9899430BB3332A076D7B406C07A46E1AED9DE12C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782595366, "uuid": "4e06cc5d-044d-4af6-bf6a-4f030c703160", "value": "49152:Wrkal6dDYAEo55DgCkOxKJ0ifEab0mDeG8ydlR/iplWYc/+h8:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782595366, "uuid": "6dc00636-5fef-4eef-b443-157dcbc0aa3a", "value": 6229959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782595366, "uuid": "1f2046d3-730c-44fc-91ba-23d8853d9896", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782595366, "uuid": "1a464c76-f826-4070-84aa-a3011fbdecf5", "value": "NetMedved_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e643aae3-7255-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584868, "uuid": "281583e8-f512-4d25-a2b8-5a18331bac44", "comment": "Malware payload", "value": "dced1923790be572edf4191106a6dc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584868, "uuid": "04421fcb-6059-4131-80ba-2d1785f31c6a", "comment": "Malware payload", "value": "d6d38c1850e229809385420e9473ebd68fc9ade8d3d2b25052c476741db52bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584868, "uuid": "1e5f1f51-8f21-407e-992e-0b4abf7646b4", "comment": "Malware payload", "value": "2b671eb88103b9af4fb79f494eab79f80f0d7899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584868, "uuid": "3bdb0dd2-de0b-4ad7-8f21-b1add4626479", "comment": "Malware payload", "value": "fba2f2d9b143ecc84ab2779fa9a3f77101750c6baf72d55f5519eb79699c9f4e63c1c045d52e39c7c0ee3b0ab0670b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584868, "uuid": "4abde125-732b-4a1e-92a4-f09aa4d606a0", "value": "T1A5B53907BE9488A9D4AA4631897293A17B31FC085F2123C73A90BF7A3FB76D15D75384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584868, "uuid": "3afe08d8-0a02-41f6-97d1-2324401cbe3c", "value": "19061a0685d6c386564244409c0f32a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584868, "uuid": "efa025e7-b4d4-45ce-97d6-a8d900e68e37", "value": "24576:zCMTmpxBgtNJS4BauRVpXcI0MVKUXNeIbUdv5FKmgu:zCgQBgX04NUd3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584868, "uuid": "9c89b70e-2b5a-4f9f-8e53-b8402e921104", "value": 2308048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584868, "uuid": "b49d50c6-5c20-4c71-8e69-bec16e255287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584868, "uuid": "79a16f98-53b7-4c0c-9d48-412529cc74ad", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4012aa-7221-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782562251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782562251, "uuid": "b9f31388-02eb-4977-8659-4b586f4ae469", "comment": "Malware payload", "value": "f9df93ba66d68c17a0aee198a909966b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782562251, "uuid": "abadb1ec-8db0-42bf-a4a0-f715c055213a", "comment": "Malware payload", "value": "d6d6ecafe1b39281fc859997f9d0031a8197e9a0ef3809a23b040074df56b974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782562251, "uuid": "d4a7dcb5-b221-4783-a8d1-319a4c2f3fa0", "comment": "Malware payload", "value": "1796776e6f840f20fa81abd3c1072db2319866ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782562251, "uuid": "b0dc16d8-359a-4b5e-b2c3-2574441a2070", "comment": "Malware payload", "value": "bcc55bb5e9c9cb20206db1e15a4dbe5d49698768e4ce3297ff3717918bb1f5da793b0477a05dea4056924775b94d07df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782562251, "uuid": "30561b89-ca9e-4647-bc9a-bab34512d4b6", "value": "T162F3995A6E328FAEF678C73047B74A31976963D623E1D684D2ACC1141F2038E545FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782562251, "uuid": "5a898bfb-1bff-4cea-ab35-41c0ea9e46bc", "value": "1536:0mZORnaJJslzZQWeCEflsMrO5etbue52pZ+zaX9ZTXGhMQasmjBXRJFaf:0mXsiNsMrOMtbaZ+gAMvsm3JFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782562251, "uuid": "ad0674ea-680f-402d-ac28-568984e5a678", "value": 158476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782562251, "uuid": "99d59508-acf1-421a-81b3-40cfddff6918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782562251, "uuid": "c315fcaf-2ed7-4d0a-ba35-585e2ae8591d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6610ab5e-7257-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782585512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585512, "uuid": "1aadcc73-9da4-4b58-8d7d-6e9f826b357a", "comment": "Malware payload", "value": "5490c293b4fe06dd40ca9922a3284762", "object_relation": "md5", "Tag": [ { "name": "Deobf", "colour": "#215049", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585512, "uuid": "130173fa-26c7-4b5b-855f-b41b35028fed", "comment": "Malware payload", "value": "d81a34a88adab105dd2b74c20d11a7bcf81ed413485b2109ed7050e6ef8df4bd", "object_relation": "sha256", "Tag": [ { "name": "Deobf", "colour": "#215049", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585512, "uuid": "462763ca-f825-40d6-be5f-6b5cb00aa61f", "comment": "Malware payload", "value": "fe5f56b543e2d82ec7b977027c90a89892de618f", "object_relation": "sha1", "Tag": [ { "name": "Deobf", "colour": "#215049", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782585512, "uuid": "6ecdbbba-1bd1-4bd5-ad3b-7472f00a653e", "comment": "Malware payload", "value": "85f054d0021f6970cc0c531af3f7816891eccc5ba9424a9b7b33f7507d2dc0fe326a528368f8589cc86563de0559a15f", "object_relation": "sha3-384", "Tag": [ { "name": "Deobf", "colour": "#215049", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585512, "uuid": "dd9bdbe6-0f6c-4d17-838d-1480b2b3abaf", "value": "T169A60EA40DC4566D432DB3A2F6545FAFC792F82C5184E1E07A1CA837EBE5F288678D34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585512, "uuid": "d7accd3d-1dc2-45bb-94d0-f419a33c45c9", "value": "196608:Ahr3zru8b4qVZlOnB0N+2ZvDV8nN0+dl37Nk5UgChc:+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782585512, "uuid": "90b253a6-bf84-460c-b1a2-09575764f842", "value": 9596535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782585512, "uuid": "2e726ed1-0cdc-49d4-8be2-8b83d4b980d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782585512, "uuid": "7683f12a-0802-415c-98d7-dba339a1e827", "value": "fixating.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ecb74c-725c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782587552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587552, "uuid": "c7b63a1a-b12c-48f5-b460-a5cbe2f2ec08", "comment": "Malware payload", "value": "fec745d87efbaa86f853c6e13bbc3e37", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587552, "uuid": "3aa2041e-3425-483c-800e-748fce5cd8cc", "comment": "Malware payload", "value": "d8cd89e8f7eb14c50e25705fea6f34390ab18486f2d1cadd5e195b0e663672c4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587552, "uuid": "6ad07c98-03df-4888-b888-5504162726b8", "comment": "Malware payload", "value": "5f7241cc8998a4850b76482099e15a92c96b1a7a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587552, "uuid": "d5f3b388-71af-454e-b115-3fe51589ad70", "comment": "Malware payload", "value": "344e4f891cbf1a5c4977d99e67c9f65917229c8b3ba4e8fabd474102a55c81a01e589f2cc65137d22277a0d6825beae2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SaferRAT", "colour": "#ED30C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587552, "uuid": "5b9039e9-57aa-4996-8943-9f4fda536912", "value": "T103E622C6F7C8992FC4774032C5BA67F1554B4C228E839F876958760C29BB5D84F8ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587552, "uuid": "5aecf42e-2894-48a2-87ab-b2eb5ee405cf", "value": "393216:9lEauZPzL0QzC+j/lAq8sgLtufXsYylLNdHIVvy:9l9uZPU16N4sgRuFwdoVvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782587552, "uuid": "b86a7cf5-b0a8-44be-b93c-46ddeb95bc35", "value": 15138871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782587552, "uuid": "cd6e3b74-db7f-4429-b550-1df06165efb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587552, "uuid": "bd6b2b06-4371-4716-82f9-32ee734e07bc", "value": "Strawberry.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88668602-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555505, "uuid": "54ea18db-ae2d-4d98-8797-6a2381b96457", "comment": "Malware payload (SilentNet)", "value": "55570aada409cc35a67d6ca920b481a8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555505, "uuid": "d298751a-4bca-4f7c-853c-0c07a84e9078", "comment": "Malware payload (SilentNet)", "value": "daec3ebd49b3d83edf3dddf9cd49405699db14a3452a91607813a9c738d5d14a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555505, "uuid": "1e474754-4102-4dbb-b4e5-db851db6bf9a", "comment": "Malware payload (SilentNet)", "value": "3c8a6e6e682ada13f3cb45022dea0e0f8e74e17b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555505, "uuid": "7d6e7fb3-9673-496a-a426-a751fd509f2a", "comment": "Malware payload (SilentNet)", "value": "840c2f49967da8682c9c24333849700aec13e9ec4ee2625487707b7141f8ce3ed6ad344cc30061075b55e979725340c8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555505, "uuid": "866be3e5-c945-4cfd-88e9-1c372dfec7db", "value": "T13A46337356119B864882B5950B607527E65329DB7708E92838A52FFC9CCBD03C7FE2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555505, "uuid": "71185c18-b8dd-442d-a67f-d7a64d9b575e", "value": "98304:3KvPT1CUq/V8xnOcGrPASUiidXGTQ3MZx8NJkICwlPuZLBLAGhbMj:04fVsOpzVUiiAMcj0HCwlPABLANj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555505, "uuid": "a6be0056-934e-4527-8cf8-f0ef077159e6", "value": 5400208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555505, "uuid": "00e496f2-4903-4e1f-972a-0562fa284dc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555505, "uuid": "28cec7b1-dfb2-41bf-ab50-c0872ae3b1bb", "value": "krypton-client-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a9edc8-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523295, "uuid": "9b9995c5-8312-4d74-a303-c690fb82c960", "comment": "Malware payload (Arsink)", "value": "90fb7057bfafb8497ac9013977042565", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523295, "uuid": "00812f43-6e22-4ddf-8087-8955471b8cb2", "comment": "Malware payload (Arsink)", "value": "db317a9cb1a5fe669f01022e31d426240f675c3834426b23b83bcf56a5ecaa5b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523295, "uuid": "6d8e2936-40e3-474f-94c8-fda0ba569425", "comment": "Malware payload (Arsink)", "value": "1b9e603ee29b5b596a626efae653a7ee9efcee96", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523295, "uuid": "3ede8ce2-3072-4572-9fd5-7210b08600bb", "comment": "Malware payload (Arsink)", "value": "c9e1d4490c9027d4f1dded6bf554c2581f8319c2c24aa9a5c63100ae77b6d12bab05d8e7ffd04bc82ffc51fa5b77f275", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523295, "uuid": "8434cb12-634a-435c-a8c6-a5948151358a", "value": "T10DC312A6BBA4EDA6D97E9C7A8DF0D619FFB1E342D0E147970F06D21019948B40CB580F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523295, "uuid": "a20d38d9-4818-4917-9cb3-397c8e33c7cb", "value": "1536:/+jtMEA3Z2U5VdT6BIUwBx84E4uAXQlcWrZvS00eV688DANSct9eIYf0cdcuNOQx:WjWdJp7h6DwBMAghNZV68C69/fcqMOQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523295, "uuid": "5f7b5b0c-8bac-43b0-97fb-f9b25e438aca", "value": 123575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523295, "uuid": "5e532d52-23e9-49fa-a164-4d326afaad41", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523295, "uuid": "d58c040b-f9a5-4f80-b57c-5ba301ca64d6", "value": "loader_1_2_9_3_Panel.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a153bdc2-71ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782540085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540085, "uuid": "457f9d75-1a55-4ed7-ba3f-f27d8bc66182", "comment": "Malware payload", "value": "6f57d95ac44db985fc8c002d69439b1f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540085, "uuid": "2af58147-27c3-4578-a03e-1b60f9b3a887", "comment": "Malware payload", "value": "dc79d1bce7b4e2c126660c78de8ab4a8fb1dba95f065044bc0e1c2ac01fa3ed4", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540085, "uuid": "dfb27e41-ae73-4abb-87e1-01f4a33f90b7", "comment": "Malware payload", "value": "6ecf6b29ddfe9c520c7bfae77597501e0ea284c6", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782540085, "uuid": "f9d4a1fe-430d-46a5-8414-45fa1d40833f", "comment": "Malware payload", "value": "e9887c2f672c36781c25b8224fcd71680f5bffa36d22f8cc247095f4afaf61c65c23dcb2e7716c2b49f15ada31554aff", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782540085, "uuid": "fc0eed86-756f-4f2e-9f6a-46f7a12fb02e", "value": "T186820906375904BA028706B8E4CFD3089A29557B21569D54B5CCD3C8EFB196E83F87FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782540085, "uuid": "7e3988c4-5230-4c43-86c9-716eb1c00e29", "value": "384:SLLLca4zxnDvVYCoLg+xpYcS09dcD0SeVszwKF6hP/z2h:SLLYa45DmCoLg+xpYcS0L80S1zwKFgzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782540085, "uuid": "6d8a03b8-4224-4a9b-8b58-b0ee9df73266", "value": 18842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782540085, "uuid": "64f95d5d-f705-46b2-bc15-c33204a7071d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782540085, "uuid": "a185177a-35a1-4830-a6f0-bdc229af4385", "value": "yigu360.com.bin.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae2e74b-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555509, "uuid": "ff1524d6-b656-4bfc-841c-6caaf7635955", "comment": "Malware payload (SilentNet)", "value": "18e802f71e0cf5f4fe35054432ae7dd0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555509, "uuid": "a4d78dd4-8bf0-42ca-8642-531332628c56", "comment": "Malware payload (SilentNet)", "value": "dce3111a0327b3e3a572cdb2e3894e759d0b7678c8e0c3bd3be07361f4f7c69c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555509, "uuid": "61a4f717-1189-4714-b67e-ec4c04e1548d", "comment": "Malware payload (SilentNet)", "value": "4cb637c971fe2d691f831a7ca264b65a16c682a0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555509, "uuid": "c585ad43-960f-4db3-be64-6f79242f64d7", "comment": "Malware payload (SilentNet)", "value": "7a0dce3f97e2d04ef594f520ee740b9cb0065a54b84627786ea97ccbeb8dd8fb488a29100a72d07a0461438153717908", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555509, "uuid": "15c0f9c2-93af-43a2-8e68-34d3c00a5024", "value": "T1F5463320D5BD267DD1632730D4860E2B7B5E23C4AD027E2F2FB418B60D466C66FC6B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555509, "uuid": "c3c7eb16-e119-419a-8ecd-f9e9ced8c8d2", "value": "98304:vQX66vQGWc8IQYrc16j5E0iG6oEiUyQtka0fyLmm800Dx+KyksqYGO:06MQ/+QR16j5E0bjDaUG80S8KMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555509, "uuid": "a3f51aff-f5ef-401b-ae83-dcd832a02a13", "value": 5652824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555509, "uuid": "815f590e-3fd3-41ca-b48e-870884e9c553", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555509, "uuid": "263f7916-bde1-444c-b8c4-de1d6d881df1", "value": "KryptonCLIENTCracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6981e40b-71bc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782518946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518946, "uuid": "6b46a76b-c7e4-45a3-a1da-6d1d9b805415", "comment": "Malware payload (Mirai)", "value": "9b8ba0109a86adf7dc8a6374826d2a1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518946, "uuid": "51dedf6b-0cef-475b-aa67-be2262a8e658", "comment": "Malware payload (Mirai)", "value": "de138420498fbfad575b7c47f0eb80b5196d3741e1344b2d11468ad945e2c7ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518946, "uuid": "d4de9b89-8822-4da7-8c7b-0bca8926c401", "comment": "Malware payload (Mirai)", "value": "c599e4a3b9ac56a0c7eefd8217527f8e60cb7c75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518946, "uuid": "7baad842-c700-4f23-a3a9-e80412f8300c", "comment": "Malware payload (Mirai)", "value": "4494edd2d4e5c44a54f24da9ca7479ed81a2063390d872d2472d951d10a82f3392fda38089b7f2360a63fea173e1a7cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518946, "uuid": "ff5efcb4-9307-4140-ac8e-f1a9036fb6f3", "value": "T1C0535F1E2E618FADF76C873547B74E21B24823D216E2C601D15DEA015EA034EB85FBBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518946, "uuid": "7f7e814a-8859-4dda-82b5-2235b4cdd84c", "value": "768:0x+8cEhesDsXopQiQpPs4Z49/WSsGKYD8U/7c6wMi1/GICFGf20bxAJTbUdwbZn/:0xNhe9T9pkzlBgUot3GInwbUdwbZn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782518946, "uuid": "bc047b32-6e7f-4f02-a51d-85b888db93d4", "value": 63412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782518946, "uuid": "26510d48-8972-4801-8238-b905d294fcbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518946, "uuid": "ac0673f1-e2a6-412a-93dd-c87d52dd5ce9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6550ad-726e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782595406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595406, "uuid": "cb8c8663-6b63-430a-873a-a589ea953822", "comment": "Malware payload", "value": "54ad73dda690f63470cff1c0c60195d4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595406, "uuid": "cb94ed75-f785-47c6-a401-ec9091e11446", "comment": "Malware payload", "value": "df1bb5c2aac6220ca59bed32b53e02836ff53b6d732bd4a91c5252d507748d03", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595406, "uuid": "64d49dd3-0e44-49ae-928e-b124ea33ae6b", "comment": "Malware payload", "value": "c436bc363ccb5fb3b96950ae23c766c4aa468b0a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782595406, "uuid": "be28ae21-78b1-4322-bc72-9a6f0fdcd8a0", "comment": "Malware payload", "value": "3a276999fc7ea8bfe8e244e7f4e1bff4aadbb5a5d5d3dfd4ab4fb13f79e913d294c45e552d889558e1c84fc9f6d306ce", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetMedved", "colour": "#3B547B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782595406, "uuid": "0e2b61d6-42ed-412f-ba3c-d4168f7ed0ae", "value": "T1815649691894B0B4FDF6DB91C21FD899430BB2332A076D7B406C07A46E1AED9DE12C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782595406, "uuid": "81791ea0-6eae-48ae-a07a-51f4e0c53299", "value": "49152:rrkal6dDYAEo55DgCkOxKJ0ifEab0mGVNoKpD7p+VAGripld:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782595406, "uuid": "21a52115-21c0-4d2c-bc27-756d26e61ed5", "value": 6227249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782595406, "uuid": "7e347eae-6d26-475b-864f-dd5a91691159", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782595406, "uuid": "43650bd3-5746-4579-be81-7d82ee422e47", "value": "NetMedved_2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a193dd-71f1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782541602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541602, "uuid": "624d77de-f6ff-41a3-a499-d1e0167f9150", "comment": "Malware payload (CoinMiner)", "value": "0c4befa56ca087221fb5706ba15e7988", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541602, "uuid": "b7b515e9-e454-44b7-8fac-5f1ceeaefb99", "comment": "Malware payload (CoinMiner)", "value": "e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541602, "uuid": "77b5c404-b215-442e-b549-a25cb9530b20", "comment": "Malware payload (CoinMiner)", "value": "462110f09bb941c726d1536cb5ad8e2f5e78293f", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541602, "uuid": "510d7da3-2e1c-4ee5-b114-f538eb8027c7", "comment": "Malware payload (CoinMiner)", "value": "a4572198c68739251b240224ccaf2fe756d661c4bd4e203c32eff7c237d886c2831f8abecc8497e18ac209959cb54314", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541602, "uuid": "da1829ef-ba1d-4413-8f06-855092dbcfeb", "value": "T19366E003E5E7CEF8C21BE67D46629333A92474880E32B11C6995F36B5FE4934A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541602, "uuid": "57c32d40-5b70-487b-afb0-3c1b4790c2d0", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541602, "uuid": "8ce23841-95f4-4a65-ac8e-d17df83a1ddc", "value": "98304:Qgc/0XoFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:wcodemyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782541602, "uuid": "f1c7185d-6a8d-4d4b-8b34-0b27ae44febe", "value": 6487040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782541602, "uuid": "1b22512b-b073-4a6d-9f08-4e4ea994dd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541602, "uuid": "ada3b672-a27d-4712-9e78-cc2c7f7fb008", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3875ae46-7204-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782549787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549787, "uuid": "07842546-ef05-482a-a201-0f7202016dd9", "comment": "Malware payload (Vidar)", "value": "796c75cc4d7986e8088deeac118b3ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549787, "uuid": "039f8173-fb38-4cc7-a908-d164d359a1e5", "comment": "Malware payload (Vidar)", "value": "e19f312bb3c65120c5faefbded0ce63abb79ae5871fdff02cc1c399c58ff5236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549787, "uuid": "1e85f38d-5619-4290-b44f-7dbcf26724da", "comment": "Malware payload (Vidar)", "value": "24aa148b9aa0a391ec5fb157ef1c467f2eb75763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782549787, "uuid": "d716fe8f-694f-48a4-950d-ab33398a1d16", "comment": "Malware payload (Vidar)", "value": "e150139e539dacd5af2436529ff416db5279888ce012be6c41cfef3477419d4c826166504cf147ede93895c26b8ccb45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549787, "uuid": "0a9905bc-3578-40fb-9708-3c297743cf68", "value": "T198F59C47BDA108E9C0AAA23198B781567B75BC190F3223D72E90B7B83F727D05D76B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549787, "uuid": "341c7240-3ddb-4c2f-9c91-f87bc5eb0034", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549787, "uuid": "1cb888c3-2d49-40ec-9e39-c05c9a85a773", "value": "49152:TwJMwsAUfwwWtMTcFehUDmGTtJZo0QLk43/+wXDV/xYQzIfx:TRDRotJZnQLkUWwpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782549787, "uuid": "d32637de-bccd-41e2-a642-49b65353f1ff", "value": 3535248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782549787, "uuid": "3cb828c1-a0df-4433-bc8a-ccc800c23199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782549787, "uuid": "91b9e5fe-b17e-4f47-9ca5-9e979c859750", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aeeeb17-725b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782587077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587077, "uuid": "b946d82b-0861-4469-876a-0062ac6682a8", "comment": "Malware payload", "value": "948b712d99e0c5cad05416e7f13841bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587077, "uuid": "450f6db7-7e86-46da-afae-241bde89d102", "comment": "Malware payload", "value": "e21f70aebb96b545be30ba9b92fb7a77321d78da5641ce9f4d7b3ab8f6d09e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587077, "uuid": "bf77606d-d0fe-4a69-a82a-879d5136b74e", "comment": "Malware payload", "value": "cbaebbe158ff69d922a67b61eb93b19e3a92306a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782587077, "uuid": "3af2afcf-7422-474d-8670-17e1d3306d1e", "comment": "Malware payload", "value": "21169ed039e529a8ed3424e853513f89ce41847c11e0f8b0ae461f4bfb943c2443adcb0352abcdf3126e1375781a931e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587077, "uuid": "841e8d24-77e3-4d83-a3c7-6d8dfa05b6f7", "value": "T1E8E623E666C552E4D4C70E70665E97CD32D0F84D49ACA82B36C72C03AF25E9F0A49DB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587077, "uuid": "ad7dc7ee-8d05-45fa-a0b3-d0f309ad813f", "value": "544d328d505711c061637b5e94979592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587077, "uuid": "6d769d0a-5bd0-4ad2-8e98-dacea9ee9461", "value": "393216:pK20oQacOvXsy5iakYLjid1qD+jh7OqnIDJa:pK20onhX/WYLjiSDWhqrDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782587077, "uuid": "d305cd18-0eaa-4d0d-8eaf-fba31df362b2", "value": 14760000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782587077, "uuid": "88aa1e7b-47cf-443c-b7f6-df60a7f29eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782587077, "uuid": "83f09053-d865-47f2-8c2c-dd5aae491a1c", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1057ce-71f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782541207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541207, "uuid": "4e2fe0c8-4697-4923-8723-a56f24752dbe", "comment": "Malware payload (RemcosRAT)", "value": "86620624a641f0503bcc53fc1450424b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541207, "uuid": "27931b20-331e-478b-a6e3-a537a3440a88", "comment": "Malware payload (RemcosRAT)", "value": "e61e14aaba209be7bfed6b4ef08d1de630fd0b2f05c12eeb3f8906946522e7b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541207, "uuid": "7cf01da3-86f6-4e02-84ba-bd64853a74c8", "comment": "Malware payload (RemcosRAT)", "value": "32a2708235c647f066ca9b6825b5a51de98ee960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782541207, "uuid": "36b652d2-dded-4f16-ad6a-289d1268785d", "comment": "Malware payload (RemcosRAT)", "value": "9ef479c22e450f7f1e27ea42507148d28af2451313f6e6197b5c8881bf9b44ff34d31e203adf3640d7fb8402d47723a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541207, "uuid": "74535852-c27a-43cd-ac28-6e7d0b8b349c", "value": "T1BFA4BF01BAD2C072D57654300C3AE775DEBCBD212839897BB3D61D97FD70190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541207, "uuid": "d4ef44cc-371b-4d31-ab3b-f38fdcea4630", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541207, "uuid": "fa1a3a76-5054-4303-bd58-b0b121787fc8", "value": "12288:T13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ+S:Zak/mBXTV/R0nEF76gFZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782541207, "uuid": "87f23cd9-b7f0-4daa-8bc6-9a96b47a4be6", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782541207, "uuid": "363e2c42-b914-4d6c-8669-eb1704cf998a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782541207, "uuid": "8e0b94c0-796c-46ba-909f-4f741dd1cd8e", "value": "86620624A641F0503BCC53FC1450424B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84d457f-7239-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782572792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782572792, "uuid": "d8cae1ec-e1ec-4f68-bdb5-3862530ab223", "comment": "Malware payload", "value": "84b296c314df7954e8a829ec3599f69a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782572792, "uuid": "638a2b69-237f-4140-a0e9-c9e523638cc4", "comment": "Malware payload", "value": "e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782572792, "uuid": "e93fe656-f576-4a3f-9e9a-bb18f24da9ed", "comment": "Malware payload", "value": "c9e15739ab6597e94350bdc808a77815fc38ad1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782572792, "uuid": "fead58bd-bc9c-4651-93f4-efd1946862c7", "comment": "Malware payload", "value": "6a2508b571470d4245d9ba2254f292a7aa2fbd7f2ecd8d2d43e5f4a6f6c5197e678c0c53f4c34dc0754e2c474d2c5b9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782572792, "uuid": "47a56fd0-5db5-4ef9-839a-3732fead131d", "value": "T19451F28BD4915522AD3A6C35AB9DF5418A4601930239CD4DF92F2C443FF9900BE17F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782572792, "uuid": "246d35ce-b1e6-4854-af2b-221d76b44304", "value": "96:HsKBiqTamDhDCkxwq05GiG2YnELncPFkrTJnY7m9mncTp:HsJRh39Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782572792, "uuid": "906e4468-5b26-4e06-b693-3e43c4bd7a06", "value": 3121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782572792, "uuid": "75b517af-57d8-4f06-98b8-70a3690a8350", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782572792, "uuid": "e26fa574-5d5d-4606-8007-902acfabea77", "value": "e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b79d26-7258-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SpyNote)", "timestamp": 1782586188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586188, "uuid": "60f9cc24-a431-46a5-ad28-32b18f6dd252", "comment": "Malware payload (SpyNote)", "value": "86e8f6621dae6dcea005ec58e32fbabc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586188, "uuid": "3119c1a3-9008-490b-a588-e0c52bfcd2a5", "comment": "Malware payload (SpyNote)", "value": "ef94a5ecaf100b9c9102b101b98f8c01fae9ea9304e5b8fbf6097beec59ad885", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586188, "uuid": "7c02fcee-0377-44fe-bdb4-ac92540aba32", "comment": "Malware payload (SpyNote)", "value": "749aed0b75a6e115c0135abd616104be563c0d91", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782586188, "uuid": "5a80395c-aabe-4e6e-874c-4c44af2d9995", "comment": "Malware payload (SpyNote)", "value": "a40cb7c18e7eb5a72d2f608bee43f802b78a40ca865e71d3b6e106b02bf7b5e22953fe828d2a057209bb6df1960888d9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586188, "uuid": "b6d41aa1-8525-482a-a46c-58d9281eccdd", "value": "T17556E103FD09CF9AE6B983B4E63B554237037F07C881466B0205B26E6B729D937DD989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586188, "uuid": "ded4e8e4-d0b9-4636-98b6-d722295e0829", "value": "98304:uxDWz8ypanPAf8RinM6Bopvfzemz5zBkTG0tRzDDpV:uxDeU4fFMk6lzMNpxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782586188, "uuid": "0cbd6f0e-2a47-4f4d-bed8-f6da9e4bc26a", "value": 6443919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782586188, "uuid": "c21a2d4a-913a-44d6-a084-dfe98244688c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782586188, "uuid": "7fef75c4-75a5-4612-be7e-0da17ae51ac7", "value": "NightmareClient.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33ef910-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782523364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523364, "uuid": "17622f6a-95f5-4ab9-9a19-5cd5c6983e7c", "comment": "Malware payload", "value": "879492ce87ef05e79ed37a3e341a7c1a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523364, "uuid": "30b2c579-ced8-408a-8c14-d17c8bbbadd3", "comment": "Malware payload", "value": "f04d5131819615b067b336daf118f9b4bba9d48acea4b61c0b88e6e4416258bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523364, "uuid": "ce975a97-4ab4-4b5e-b934-7baede02826f", "comment": "Malware payload", "value": "a2f03e8ae41a544c5e405e2d65eac8a9d818f274", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523364, "uuid": "026b8f0d-c766-470a-a0bd-dad4e6338395", "comment": "Malware payload", "value": "bcdf812af9b43c90ca9178038b6bab4618cb21fe1414273bfd753e814dd137766f75b831cc01fa1a1ad3152918bed1b0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523364, "uuid": "e925ada6-7a5a-46a3-b403-a58facd8562f", "value": "T109862346EB29E84EC0FB56374A36027542479D2E879396C75DEDB37818739C07EE2E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523364, "uuid": "1d9b2a20-9394-4108-9686-73d772e10da6", "value": "196608:wVRKI79uDPPnCOQYMH4b8b1F1DfwXvw8NGRe/gn9JdJuI02A:oK/bnK4gZbYqe/g9xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523364, "uuid": "26272517-1023-42ed-ae7c-515cbb33686d", "value": 8111385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523364, "uuid": "6b02a0c5-227a-460e-b24f-3edd915ba40d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523364, "uuid": "92152881-4e9c-4403-827f-00bf942c80e5", "value": "\u0412\u0438\u0434\u0435\u043e\u0437\u0430\u043f\u0438\u0441\u044c(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eae13d3-7255-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782584694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "b27603f6-71cc-482d-a284-d3ce7ba1d30b", "comment": "Malware payload", "value": "573fc4ccc8b0018534fd4328e03e93e5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "PussyRAT", "colour": "#F4DB34", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "f59c2006-3a6e-455c-adf8-916ba9824a36", "comment": "Malware payload", "value": "f1600a7996129ec26473f82b846800ebce3bf53f59a0c0246d62761f3f603bd7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "PussyRAT", "colour": "#F4DB34", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "07120025-5e6b-4567-a310-f32310aeb10d", "comment": "Malware payload", "value": "dad86f3e29fdfbcc8bfb9aba8c46994eb92e1cd5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "PussyRAT", "colour": "#F4DB34", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782584694, "uuid": "681767b0-f531-492a-9a70-be8e60b4b684", "comment": "Malware payload", "value": "ef95fc920776d0cbb5322dc9aaa2641bcd8d041273e17c2a4d9913270c568d73f60e83bf8ce2a9d0b27324c625c57408", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "PussyRAT", "colour": "#F4DB34", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584694, "uuid": "8f5dec27-f888-4df0-8cb0-9dfa5f4e3c23", "value": "T1D1D2E12EFB56A94CC40FC13F2080991298DE135FC649D19BA5B4981EFB15AC02B62BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584694, "uuid": "c69f8566-558d-4206-bca4-61d68df060b8", "value": "768:YJ83kR+27ZN++nb8C9/GXPX+zmWBePn4GMFac:YJ8C+27ZU+b8O/G/OJBOn4VFac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782584694, "uuid": "ff367f67-5831-49c0-b8c5-ab6c7feba435", "value": 28416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782584694, "uuid": "fad2045a-5abc-471e-afac-e7d7f6ce3738", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782584694, "uuid": "f4780151-7cbd-477e-ad22-725bd84b3619", "value": "kypton.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7d809b-722f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782568427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782568427, "uuid": "4c265d3a-b443-46c3-a4e8-fa3cac1dcd27", "comment": "Malware payload (Mirai)", "value": "8253b1f392116877a21aeb8f79b8783d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782568427, "uuid": "41bc3999-9464-4653-9d69-7ebf28f75974", "comment": "Malware payload (Mirai)", "value": "f215d4258c590acee350dce11b99d6eaab3f29db38902746409db62d00c95f8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782568427, "uuid": "45024fcf-5452-4587-9a98-dbbb5ec26e89", "comment": "Malware payload (Mirai)", "value": "8fa99fc887affe0f2922930b4c0feb3334903021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782568427, "uuid": "2f99edf8-1639-4721-9754-77b4220fbaf2", "comment": "Malware payload (Mirai)", "value": "3cb39d4ae34b5293d0510d71a5d47357fe3557e363b239ff568a6fdca7ce4dae9082dedab007ac140cc7aea527e4674c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782568427, "uuid": "4cf599cb-47fb-4412-a051-6b23c78d9ddc", "value": "T1F7B30845F8515B12C6C626BBFF4E438D7B261399D3EE720399256F20379B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782568427, "uuid": "4e64e664-5f14-4365-8723-5c836e940a0a", "value": "1536:D2thV0XjyQoJ5hX04VkcU7A3bVojTHazOYNw8xd263KlKPwywIZ6zviLft6WzC+r:d2Qox04NUuRITlodF4Ti1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782568427, "uuid": "7262fee8-43cc-4f5e-a793-df2b90c0b875", "value": 117100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782568427, "uuid": "25b7144d-f15b-4d9d-8da9-935c95c4eb17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782568427, "uuid": "ad4a9467-f216-45a7-9af8-873ac94649ff", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9883fc4-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532797, "uuid": "59be19ea-fe45-4f58-9dfa-6524b377fe70", "comment": "Malware payload (Arsink)", "value": "545dc2ce39c12fddcfc5a9d25ea3abe8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532797, "uuid": "b2550501-be2e-459a-b799-977662b02fbe", "comment": "Malware payload (Arsink)", "value": "f27b5c92c0e34c5adf72a0f9b813cd4f3e1adb9944328139c5fa38b6a1224ae2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532797, "uuid": "44100ef4-d001-480d-8f9a-9472aef95dfe", "comment": "Malware payload (Arsink)", "value": "670fd706b61d716d122c23fb869b8c4ac1f2850c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532797, "uuid": "3a1c3ef0-8a6d-4422-bb64-2611f77ae825", "comment": "Malware payload (Arsink)", "value": "88aee57c903e4601804d0ebf601ebaffba88c226578649817a8ddb8fe16c7c8281e461da76585e4ffadd7ac15cd4893c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532797, "uuid": "c9c8e0ec-196b-485e-b0fd-eaa6f0a0b9be", "value": "T1AF560145BB48E92BD477703245BA5722558B8D068E83DB53AA443E0C6CB7AC41F8EFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532797, "uuid": "cd51095c-0a06-48df-976b-51b8e2db9fa1", "value": "98304:GtuO8ftRrPg7QW2a7U8AvkezXEEppppTWE3dOST3vjJCpXujHUBmyOT2U4X13ENL:G17QP8AsstWa9vjJCpXmUBmTanE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532797, "uuid": "f2328d22-f756-4a8b-bda1-480c9ffcfe46", "value": 6384146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532797, "uuid": "2b12d1d8-1055-4785-bd08-4067cbea4a34", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532797, "uuid": "e1137332-5d99-4d1c-aa71-57426480d2d3", "value": "punnitoot.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7256ac79-7243-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782576943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576943, "uuid": "e4d90955-270d-439f-812b-1bff7a7c0ef6", "comment": "Malware payload (WannaCry)", "value": "c0b5ba4fbb2d486362d4be79caecc2b9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576943, "uuid": "cd1d9acb-7013-4f83-8e9a-8fdebc276a0c", "comment": "Malware payload (WannaCry)", "value": "f2cd38b6c081535971bc76d9aa3560ce3bf33e02986a430464a75e3261c4a8f1", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576943, "uuid": "f0cde4b2-05bb-4eda-a5d8-8e51ca8261b6", "comment": "Malware payload (WannaCry)", "value": "cc0ae92edb66b42397a1f91894c0e14d12c83454", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782576943, "uuid": "e4d28dc5-9dbf-4379-b252-9b824e8c270e", "comment": "Malware payload (WannaCry)", "value": "23fadb5f9e01e48ad600ea4d83013053cfa44998f110d8f6757b0ab15c75c69efa4e93c06be70bc7f079a1b24e4aa2c4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576943, "uuid": "bd7df522-1aff-4d03-bf3c-df8136b75f6d", "value": "T19136235A31A8D1B8C0062534CCA7C9FA92B27C55AEB9960F7BC07F6F3D33755AA10702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576943, "uuid": "2fcb47a1-4c7f-47de-90f8-218dc8e45e18", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576943, "uuid": "d8aec3e5-88bc-4c3c-96b6-34119c68c3af", "value": "49152:jnsnaQqMSPbcBVQej/1INRx+TSqTdX1HkQo6S:DMlqPoBhz1aRxcSUDk36S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782576943, "uuid": "47f3bf78-e5ab-4dff-a9e4-972489af07ed", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782576943, "uuid": "18bdaab8-5f85-48dc-ac80-0f4a790460c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782576943, "uuid": "9cab0e3b-4279-4ba3-8c08-30fa5a276c4e", "value": "f2cd38b6c081535971bc76d9aa3560ce3bf33e02986a430464a75e3261c4a8f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a37be3-71ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782526917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526917, "uuid": "17c0544b-c800-488e-96a5-8a4c89f9f035", "comment": "Malware payload", "value": "70c3c3576a79371eadab9419caa15ed6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526917, "uuid": "2a1e164c-fa20-48de-93f8-2ea88ec5e79a", "comment": "Malware payload", "value": "f2deee4f7cb4770c9e909c5319ec1357cee341dd442ebf51c644d6bf16f6709f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526917, "uuid": "41359128-0c11-408e-8be1-e47b67d2cdca", "comment": "Malware payload", "value": "4e5fedcdb08547301d009afa1ddc5c205dab9b08", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782526917, "uuid": "0a33cf93-d4c9-4be2-9a94-3edfa5ea09df", "comment": "Malware payload", "value": "238cd1365916e0ac9e13202974252f8c7ba36a2e501aac4d0236cbd1a5ed0cfa3372970895b949333f3a7c7d6d4149fb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526917, "uuid": "dacede41-7f8f-4785-a744-e5ee280dac91", "value": "T18A137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C19B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526917, "uuid": "6cd7000e-eafe-4dfa-a539-5bdd3cd50db6", "value": "768:Y+s9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Y+Bco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782526917, "uuid": "0a6d5727-cc5a-42da-b619-47b8c504b40c", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782526917, "uuid": "b55eb994-4963-4886-8a00-e70693d2a2e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782526917, "uuid": "60dc06ec-147d-4d1f-a740-294204699a74", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8355064b-71d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782528438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782528438, "uuid": "00f1e3e4-4889-4d50-b872-35dcb9c478a5", "comment": "Malware payload (CoinMiner)", "value": "5192e8a1fbe21cfcb28ceb4c69219c09", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782528438, "uuid": "82935fb2-4816-4517-850d-32bed0121615", "comment": "Malware payload (CoinMiner)", "value": "f3eb87983169d29f6eedf685922a02146f575bcc695b4bb0fe54019f09d3e8d2", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782528438, "uuid": "8f53c7d3-c1e1-48f4-b6af-04ff2034fe73", "comment": "Malware payload (CoinMiner)", "value": "b73545164f143d3d93bd1726653c62b0d828bf92", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782528438, "uuid": "f7f85da0-e34e-4488-99ec-45ef51478fc6", "comment": "Malware payload (CoinMiner)", "value": "d862a938ee4cf98a624581fa6011a38b9e0727fd87700786875c2e30a0bf03a247daf6c42c50d9a59c4c85440a51fddf", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782528438, "uuid": "19ccc900-9248-4f67-8d7d-80f025c5c7b4", "value": "T11866E103E5F78EF4C22BE67D46625333A92474881E32B11C6995F36B5FE0938A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782528438, "uuid": "50e03561-de83-4d50-858e-39194a737833", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782528438, "uuid": "89debaaf-6a90-40ac-b80d-47fbeefc5409", "value": "98304:9U8W7UFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KJM:pI0demyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782528438, "uuid": "154be779-7a76-40fd-ba8e-bbdb42fbe65f", "value": 6473728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782528438, "uuid": "50f7a502-d41a-4cd2-a6db-d5c878db601d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782528438, "uuid": "454aa771-38c2-4af9-9c8e-750b55c6764a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b37569-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583257, "uuid": "59b3129f-0c65-40c4-abce-16087f63025b", "comment": "Malware payload (Mirai)", "value": "d52ea549811e796bbac8be6fde0c5a5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583257, "uuid": "16db9d67-fd30-4655-8ddd-2fca09cef707", "comment": "Malware payload (Mirai)", "value": "f44b6ad0761b7503866d2ec0881a5b73523cd761d4e9e3db4b9f83b172e11ec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583257, "uuid": "d1b580c0-a383-4049-8324-083bd823eb8d", "comment": "Malware payload (Mirai)", "value": "efe6a82aa664369ec43933a36f145520ba1824e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583257, "uuid": "48e614c0-7264-4ea5-bd18-cdc0409fd576", "comment": "Malware payload (Mirai)", "value": "7c816e32abd930f10624b3958999eff1ee9c961fc2c612e781993256ddcafecf2ef5a3aae645411c04f40be6dd91273c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583257, "uuid": "fc3758fb-8bf4-4ea6-add1-95ea71ab76da", "value": "T14E466B59FC2D7462C6C9B6B56F7613D53238BC484F82D3236A18B73CAAF63548F12261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583257, "uuid": "341c1a94-7eb2-4ed9-9829-47738cf12362", "value": "49152:nYU8s0bPwKoanwThcYZ4MQAgn3hEg6g1gz8iVT0P5/5ECS:nYv/blopTl4MQn3u8CQECS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583257, "uuid": "1ffde477-cbaf-4f15-9a41-5de3e47ceb30", "value": 5636258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583257, "uuid": "23e368d7-ccb3-4d90-a1a7-281487e372b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583257, "uuid": "dcf5312a-433a-4e78-8f84-f6375770c7a3", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04395938-7264-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782590931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590931, "uuid": "9daa6146-4dcb-47ac-9b75-f8c3f1ef09c6", "comment": "Malware payload", "value": "ba5bcb57fef96201412425fb0af10f94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590931, "uuid": "fad5bce1-edcb-4226-bca1-1988308e1a27", "comment": "Malware payload", "value": "f4940efc61c20e2257dd53e13c57ddd99836022cfeeca3faa32c580b7b049173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590931, "uuid": "2896bf1b-3d76-402e-bce8-82787c4bc523", "comment": "Malware payload", "value": "ae27f63da11f310d4726620b015e687cfda18867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782590931, "uuid": "aa94c793-3c4a-4cac-8309-fffb53ab01ff", "comment": "Malware payload", "value": "b24c7c5a59138edb88aee093a57175d79056a11eb78f4eafe0ec090257744dad8dbd1ba4bf5b80c0c9e224654b4c17e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782590931, "uuid": "0004048f-3efd-4f04-8b55-95d95f9742f9", "value": "T137C30855F8405B23C6C616BBFF4E438D7B261798E3EE720399246F64379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782590931, "uuid": "0450a04f-cd29-4a0e-b381-d18d1e84ff30", "value": "1536:R3keGprJWcS2B2133i4VI7e7kneqet9rOB5um1vx6c2rllBwywEy0thZf/pt7vhI:idM2BV4eeIneqQ8NxHCCvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782590931, "uuid": "59bee6a6-0cf3-40d0-bc3b-76c88cb0aafa", "value": 125324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782590931, "uuid": "6cb87749-7786-4579-9ff1-a3a7c811f93f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782590931, "uuid": "c6f17d89-913c-4fc9-acd2-8995c5fc2735", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80902306-7211-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782555492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555492, "uuid": "03d6c086-b60d-435d-83d9-b5e7dba734e2", "comment": "Malware payload (SilentNet)", "value": "0d5037beabf7e73a2beacc5eaebbe3e7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555492, "uuid": "f8c273a7-2bbe-405e-b4bf-4dfdb9fc0193", "comment": "Malware payload (SilentNet)", "value": "f4a5d6fb9677f6b72a8287c356a0e676ce1efe5d9c252775e3898d9ac008013b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555492, "uuid": "c9a6ed88-f6d0-46be-9062-6b84deb77da2", "comment": "Malware payload (SilentNet)", "value": "a1da16928682f3a02e3b015682ebbceaa1550541", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782555492, "uuid": "434deea9-7d9d-4524-81a3-3b795aff0f6f", "comment": "Malware payload (SilentNet)", "value": "e39515655bf88909f0ba7c801cd4d2b0755dc2499ae019958cfed72f13717fcab752b49893a98664a8b378026a66a1b2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555492, "uuid": "f6e55f56-a1ce-45c6-abf7-e89f3ee05f40", "value": "T1C23412C599A842B5FDF76637D669ED8A6E3C1B44D92181930A28C2CBDCCCC9F0E811C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555492, "uuid": "0c61cb4c-5827-4962-bedb-8688ced56e3d", "value": "6144:zW8uNXJvscWEsIXff2ShZgmwbOd80CDQolMaXkvIcPIc:+XJv+IXGShW1bT0CDQo/h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782555492, "uuid": "e18d113b-a0da-4cc3-82c3-843d02a59387", "value": 246907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782555492, "uuid": "eaa9203f-0490-4899-9113-6e36188b0df3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782555492, "uuid": "c12463ec-ea5b-466d-be3a-b37463d6619f", "value": "EthurnallDebug.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335d7e65-7208-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782551497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551497, "uuid": "b8f140a8-fd3e-4686-85b1-f0dfaa6400a8", "comment": "Malware payload (Mirai)", "value": "8d87a26bcc3f5590316d4f9c647573de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551497, "uuid": "93dd5d24-8da9-4625-af01-7b4dba839c7f", "comment": "Malware payload (Mirai)", "value": "f4a69010f0ae6b28b8fd31b5580342cd5ed759c6eaa17e5f31997318d6ab558b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551497, "uuid": "127bfb7e-16e2-4bfa-956d-6670fa6b6d4e", "comment": "Malware payload (Mirai)", "value": "5a6aa8aa3ed74b63205135a385874adc2ab0a0eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551497, "uuid": "578af986-e092-4901-b5f6-acd45e2db7b6", "comment": "Malware payload (Mirai)", "value": "4d67641d5dbc1cfa8232f4b549e044e5a2c23b40ae1e133b46a623b62349ce298d73fab0077a0ac0a18d6c189126bd16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551497, "uuid": "f7bb67a9-46b9-478b-97fd-ba1927450116", "value": "T174241A42B8418A16D5C523B6FA6E028D33173B78D2DE7212CD246F547BCADEB0DB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551497, "uuid": "e671f1f9-c790-48f6-9b41-415aae055eaf", "value": "6144:VWJm8pxHGuuEPCEpfMaGE7N8Z98bLE0U6S:VwFaEfMaGg88bLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551497, "uuid": "17f5c5ed-9526-4a3c-81c4-3749b7cedf20", "value": 210260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551497, "uuid": "63ba9a1b-adb0-410c-8242-ae0e3e785098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551497, "uuid": "c9d83cae-f07d-4695-85c2-fc0eaea093cc", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819dad8b-724d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782581263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581263, "uuid": "5f2bea41-9280-4602-9963-e4c7e36d320e", "comment": "Malware payload (Mirai)", "value": "6f0ecbdb8b67c2805a1e1057ad5ad13a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581263, "uuid": "69f377f8-a638-470b-a1ee-b4db82778622", "comment": "Malware payload (Mirai)", "value": "f4abb11473d61da7c065a13069f797d4441d9718f5a218a5d6b5d00f2bf10682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581263, "uuid": "d88b9601-efae-4336-bec9-a9949cb9fd84", "comment": "Malware payload (Mirai)", "value": "7044cdd0c92eb9eb298fa76dd92bac02cea1ca74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782581263, "uuid": "72b9e496-fb69-4c26-9e90-5fc843c002e8", "comment": "Malware payload (Mirai)", "value": "dc7cb5393e493be2d6eb4614fedad2782d5d570105b6521425468ce2a60448ba0eb17dfb847039a56ba961309e838c6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581263, "uuid": "3c26123a-6fd3-4393-99a8-0041cbaf3b4c", "value": "T1A1545B83F900CD7EF84BA377859349157030FB7608524A7AF2677DAADE3B0D61922E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581263, "uuid": "9a1ec339-79f2-4f1e-86d8-80ca83acfae8", "value": "6144:aPEUUpQ/LD54yWdlQxygBVF2aYHPc7jLN+c4iW:epjaHI+c4iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782581263, "uuid": "adc1e54c-97f8-4b12-9c56-fe647cbc686d", "value": 287556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782581263, "uuid": "7988cec4-2e13-455a-ad9f-3efb6d5d29b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782581263, "uuid": "f457f555-4f89-4d09-970a-9d4c7e7c5f74", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49322c53-7252-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782583316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583316, "uuid": "be8702be-fbb0-4a09-8963-5b871fa26afc", "comment": "Malware payload (Mirai)", "value": "05fda71868fe0643b0a4935897800eeb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583316, "uuid": "919e54b2-c035-42ff-af20-9d31eed0b55c", "comment": "Malware payload (Mirai)", "value": "f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583316, "uuid": "48e0dc4f-428c-43e4-97db-0d49476c55f1", "comment": "Malware payload (Mirai)", "value": "68208ebc39593e3be91f2ec536f90ed2ac5ef9d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782583316, "uuid": "44938dfc-b7d2-470e-804e-b9535e2359f3", "comment": "Malware payload (Mirai)", "value": "ba66ece1361dbe17922e865741fef0cc466ba4fac6e8eae310baad486a7b38db4509844774545b0e00bc44bbac1df4f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583316, "uuid": "177a3cb0-98d8-401c-aae7-ec5c54e572ce", "value": "T1C241B28B726434B3C40AEE55F3E495C4E18997E3E2B7CAB8B4A48763105D12CF5A6F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583316, "uuid": "1dc37b82-bc6a-4e3b-8e9e-3b91b07e4d12", "value": "24:1OJXUI6TpeBtmNIiNI+KPOKPnn2vsH2vpdUHTdR:eX8pctCKPOKPnn2vsH2vMHTdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782583316, "uuid": "17b77ce4-c532-4045-b2e8-ed7546936809", "value": 1900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782583316, "uuid": "1406dfc9-2ac9-408b-afe5-37568f13747b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782583316, "uuid": "254c2309-15f6-43e1-806c-821847b1b670", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413db9e-721c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782560088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782560088, "uuid": "bae69d4f-054c-4fde-8da7-b78dc030cd3f", "comment": "Malware payload (Vidar)", "value": "7e359d8fdd0d72a0971d639c20197d40", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782560088, "uuid": "79a19701-3d27-436d-a18e-fbed95c16efd", "comment": "Malware payload (Vidar)", "value": "f89d864f7d2382e8e2e34c35ef0b435eb6fd3f1e43cc4c2a9e3d2e96faf452f7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782560088, "uuid": "3f1de153-185a-4e66-89fb-49e443168871", "comment": "Malware payload (Vidar)", "value": "fab8258cfc30c4a88de0ca122513ea8ddd306f9d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782560088, "uuid": "d03f5b61-8674-4ca9-b8ee-7e63868b8b54", "comment": "Malware payload (Vidar)", "value": "bac6627b1eb81ece8ea6974834921a5fd5ecbeeba50dd59fd0bcfcb3b9a6f7916545489c0a977a8ed9ab40d0e2bac34d", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782560088, "uuid": "39fd82e4-a69b-497f-937b-1a9d19682551", "value": "T105068C03BDE158EAC49AA33188B6815A3B75BC590F3227D72E90B7B83E763D04D35B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782560088, "uuid": "7a2669e6-cade-45f1-8271-3d4da5db63c8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782560088, "uuid": "dbc59a01-b059-4820-8daa-d1d2868af605", "value": "49152:56RHEf8Eea9vnmfOCvCKp0luZblb1D7L4SxtiPDGBfYnzQuuha:5xCW5l4bl+qAifv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782560088, "uuid": "823c319a-2caa-4092-8a8b-a6cce976bafb", "value": 3663872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782560088, "uuid": "55e0ad6f-8ef7-46e7-b42f-a93a6ab0d59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782560088, "uuid": "207d38b2-1751-4806-bc26-3862502ef98f", "value": "install-1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff13960-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532727, "uuid": "a70b8b8d-3b93-4c75-bd6a-9bbedd8203f0", "comment": "Malware payload (Arsink)", "value": "b9cfa6dffcf9c7df75b776203b807367", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532727, "uuid": "ad744c33-415b-4b62-9cea-330e351cd37e", "comment": "Malware payload (Arsink)", "value": "f8b875e84dcd83ae2f858ea6e496da4fee407c5b6cc819563bb7ac1458729ee3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532727, "uuid": "cf7d9b7c-0e23-4b93-a999-bd3a7b767461", "comment": "Malware payload (Arsink)", "value": "11e3b281b44b38193c96c35fc448e83f0736fbd8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532727, "uuid": "5db6cabe-11a5-44a7-bf21-e3ff35b6d7f4", "comment": "Malware payload (Arsink)", "value": "ce76745dfaa0478150dd5f1cb303b734173cae7bb741b849499f7e922a2085574b9e026f03786eba8bde421e821053ff", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532727, "uuid": "be2bb552-0733-4ce1-8f00-3458df4fda8f", "value": "T189F623C6FBC8D82BC4339132C9AA47A6518B0C168A839F536E54764C58F7AD42F59FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532727, "uuid": "de5b0637-6703-45eb-9adb-9c28fd83e26a", "value": "196608:nYpHFQQJ7WeWZ9BCcL122mP5LY38dr4P3RjKY39VsKMIBD1fKCm41R59ZWEhvfO:YtFQQ/W5ZAXPy3HZjPcIB5yfoJWEpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532727, "uuid": "61708975-497e-4fb4-996e-25379d0e8011", "value": 15380467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532727, "uuid": "bdc1092f-97e7-46ec-96a0-1c4a27b80607", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532727, "uuid": "d83ec967-ab29-4d77-8c8a-8ed78abe1c65", "value": "BOOYAH ZONE_2.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1f8e74-71d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782527758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782527758, "uuid": "3a4b4263-c3bd-4df8-87a0-c1d976b57d17", "comment": "Malware payload (CoinMiner)", "value": "0f7d062922f5cc9a17ad53f26fd0fb1b", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782527758, "uuid": "f2f20526-1c76-4cfd-9fdb-765e90194ebb", "comment": "Malware payload (CoinMiner)", "value": "fa2a09342548fe01c57030f6d69dc38997fcd3547855701afeb6519f3e390c18", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782527758, "uuid": "18bb4cfc-1d76-4253-905b-165b45c2fc1b", "comment": "Malware payload (CoinMiner)", "value": "78511dc7a946383a4555eda16495cff4745692c8", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782527758, "uuid": "41a251ba-0d9b-4fb5-8517-2490e179380f", "comment": "Malware payload (CoinMiner)", "value": "f2b9147aa31795a9c39e88b942115e4cb255de99334c773626b754e58c172c8cac7a7da3f1b65849e01338fba9c2529c", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782527758, "uuid": "5560a4b1-983e-40c7-b9ac-52fd3b664220", "value": "T13E66E103E5F78EF4C21BE67D46629333A92474881E32B11C6995F36B5FE0938A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782527758, "uuid": "0ae04811-da26-42a2-85b0-b987a5f2ef2a", "value": "79fc34079e4f2426d5934af60b648369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782527758, "uuid": "fc3951f0-0e2d-4dbb-a398-d78cee51197f", "value": "98304:bU8W7/FHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KJM:vIxdemyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782527758, "uuid": "14440d6c-5ce3-4156-8f7b-711c2bb80991", "value": 6473728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782527758, "uuid": "b6dc64a1-a1e9-420f-b95b-e4d51819cc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782527758, "uuid": "7c019346-fb48-46d0-a4c1-ba51f5a237a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097559b1-7245-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782577626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577626, "uuid": "fbfa91b7-2d29-4760-8b79-d4d4549c3cd4", "comment": "Malware payload", "value": "3ba28eb4529d95f261f448a22b024e89", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577626, "uuid": "29572e1d-7339-4210-a7ae-9369a03652e5", "comment": "Malware payload", "value": "fad80f8c49ed2efded067444299aa0224a1a5b18f6fc4889abe2b4086a54fb3f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577626, "uuid": "bfdc5882-7445-4dd7-b913-84a7e39f5353", "comment": "Malware payload", "value": "146326ca0d42a5a72ea123e5e0986a79df25a788", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782577626, "uuid": "8bec1e78-c2a8-4391-9b96-c5fbbf7cd7ce", "comment": "Malware payload", "value": "921fe739057605ecf4764b065e7ee2f0d2e82a4845cd2787475fa8180b68f0ec5dd366fbf21982a2afe57acea9cd4083", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577626, "uuid": "8bf277a0-0126-4c5b-a235-f5eb982644fd", "value": "T14FB4E1EBB9969DCEE54FE43B00818022F964E0DED44DF90F06B6419989A7DC83B15BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577626, "uuid": "7b480078-54ed-46a9-b368-8c4eb029f105", "value": "6144:waiifwf6XYUxi6qUWE57o3AGpCy63ydEnaYYKiB0FZviqCZhzyiF/1:xYD8iJUlopdBEnabKHfvibheO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782577626, "uuid": "2a05f1e6-8f3b-4258-b945-f6f87e015139", "value": 527921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782577626, "uuid": "4f1b037e-e8e1-4bb3-a877-8cb57d7861ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782577626, "uuid": "cf31a3a9-3b5d-4088-a267-2ec861761552", "value": "Vanta.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e70449-71dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782532711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532711, "uuid": "7b9bdfa9-1df1-4ae8-9d8b-42f6f5a8c3ee", "comment": "Malware payload (Arsink)", "value": "cc599a755eb40a774941502bb90bd984", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532711, "uuid": "19660e60-cfca-4a9a-80b4-e5e3dc0181b0", "comment": "Malware payload (Arsink)", "value": "faf71cb7a1ccb81896e2eccf26fd106cafd357aa20c0533d04a3bd8947325d19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532711, "uuid": "6ad74d3b-0e2a-4064-b814-fc3634577446", "comment": "Malware payload (Arsink)", "value": "28203db44d7e6b0b6ce717e7366e20938b18d55e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782532711, "uuid": "eb48645a-08aa-4c1d-9974-a689f9c4f515", "comment": "Malware payload (Arsink)", "value": "d8654d67d815416cab211e16ccee37889be1b654d46d4576a4f490ff11555b6b3936ca08445a4ecb254fa0adea1d4a1a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532711, "uuid": "f4ad4c2e-c2db-4aec-a4d9-9b8ae643795f", "value": "T137353356A3FE16AADD4371F0477B47007C582FDFE9A262E11F405AD418DE4AB2C9A323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532711, "uuid": "c719e3ac-c404-402a-8347-c69f7b0b131b", "value": "24576:BxivCXO1x/UVBP5u82mKB03+nBeLfF7j9PvlAs:BmWP0YOgLRjVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782532711, "uuid": "5e0f2d3f-8616-4600-97ce-7503aaab166c", "value": 1139664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782532711, "uuid": "5d6b12b6-e5be-48da-93a1-b43760eddf6d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782532711, "uuid": "16d83420-047a-4c0f-b78b-b29827d89ea8", "value": "bfludo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc8ae04-71c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Arsink)", "timestamp": 1782523325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523325, "uuid": "224f18bb-7834-4e2c-b44a-8b5e8ce9f531", "comment": "Malware payload (Arsink)", "value": "474c199ff6f0f72cc2445595a3fff96d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523325, "uuid": "3aaa5cfe-416d-489e-9e77-27b4bfcaeca9", "comment": "Malware payload (Arsink)", "value": "fbfab254dc250f89c58a5eed9c0233d0a0afdb029da1bba9537cfe359e2e4794", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523325, "uuid": "da25b33e-a8d7-4722-912c-1e8ef2529ad3", "comment": "Malware payload (Arsink)", "value": "c43dc3e9dfc223dcdafbe15684177edece78680d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782523325, "uuid": "b31e7cff-7c1f-4803-bc08-a06786ab719a", "comment": "Malware payload (Arsink)", "value": "80950e8c6651c7fc2c0ec4aff7a5a3dd9a1525bda6ab3c07d1303dec762a6b987826d60692fd14f7d0e1c94192961954", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523325, "uuid": "0f69436f-df8b-4fc4-99a5-b7cf30493c1c", "value": "T1A58523AB87F97525ED31AAB6D0D16331FE776371D687A3C3169AC12D0C243AB08B50C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523325, "uuid": "fa2d362d-b69e-4c55-a9ec-83d046e205fb", "value": "24576:qwmEcM28Dpn5Uoo7lZR3aubqMXfbWFMBKrUd5rhik31rGR4ESveTL/GRD8QpZRiI:OMdFalZYub4oKQ7VJ3Fjve/2wQpiBqZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782523325, "uuid": "b9e05966-344f-4d24-987b-47aa6a2bbe1b", "value": 1717127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782523325, "uuid": "6a3cf475-5d55-4431-b988-01e79b0294b0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782523325, "uuid": "09809b7e-a36a-49bd-9063-a3f8fe2a42a4", "value": "SheetCrypt.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662d9bba-7226-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782564467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564467, "uuid": "cecab7e2-0b11-4d6e-beb7-eff658262e39", "comment": "Malware payload (Prometei)", "value": "c92c715700e8fcc2b019d0c60442ca4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564467, "uuid": "14492b51-4537-45d0-8884-fc500ffeb212", "comment": "Malware payload (Prometei)", "value": "fda60092e105b9fa1f7b94062f3defaefff215ca1cc8e2e58bca67c55e2f2958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564467, "uuid": "f5adc581-d070-47e5-98a0-6e1970c6b3d5", "comment": "Malware payload (Prometei)", "value": "5258d9919df434973fa9767e7bc1e8ad16f42046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782564467, "uuid": "55eaafaa-301d-4e57-976a-cea8060d8baf", "comment": "Malware payload (Prometei)", "value": "c12503931c0b2317f236ca904bb9cdda217ce387a3fbc31e82e354759b353e6f0e92cf308dd2d3ec12c71d2c16c9754c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564467, "uuid": "041ff379-5a42-495f-a29f-299202e4207c", "value": "T1E3A423B4F9219E8F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564467, "uuid": "d64512c5-edf0-453e-a2bd-48ab5faa88cc", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsds:Fs6pyCC/Ya2hpi6T6N4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782564467, "uuid": "b3d886b4-ea25-40ed-b5d0-6a0734fb1c15", "value": 449087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782564467, "uuid": "cfb416c7-0c49-44a4-9a99-e650b7d05ad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782564467, "uuid": "0c031066-aa50-4864-ba91-1383dbac1365", "value": "fda60092e105b9fa1f7b94062f3defaefff215ca1cc8e2e58bca67c55e2f2958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be21aedc-71ff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782547864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782547864, "uuid": "704259aa-26bc-4e4d-9ddf-098643b4990c", "comment": "Malware payload (Mirai)", "value": "9783d820d859147de84a8199e3abd3c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782547864, "uuid": "c9cda261-6090-4456-a17f-4a1903587190", "comment": "Malware payload (Mirai)", "value": "fdd6eda01a69c5f99624aa3d1b26a78da2e761d1dd61d44480a374e51177b719", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782547864, "uuid": "c58ac14b-126a-491b-acb4-d278db0c5532", "comment": "Malware payload (Mirai)", "value": "a1cf3d7a642d6f7620d8fc9f080a62939a447caf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782547864, "uuid": "8b297efb-1512-441c-a1ef-338ad2f888d8", "comment": "Malware payload (Mirai)", "value": "e9716eb7271cadf84c8683adaf27001ac1bda6881cb3ec1bb5cc3a2e0d81f4a0561a9cd9a61c1ff35edc85d3211112ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782547864, "uuid": "eab32698-520c-4985-bcbf-7329781978c0", "value": "T1DC8195C517D73D70A8B1C839AAA6C80FE2D956CE58D61E8D84C9E558344CE1DFE12E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782547864, "uuid": "d149625c-22df-460b-9f47-ad0c9c79d495", "value": "96:SBJBEyxyWK6BnB9BUnOBVBTBpBXhBBhB/tW:SBJBFBnB9BnBVBTBpBPBhB/tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782547864, "uuid": "b57cc204-d09c-46d7-a3f0-f51111b30bad", "value": 3844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782547864, "uuid": "ff1b4a0e-cb35-4a6f-bc1c-2e799ec18326", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782547864, "uuid": "f83d0463-0953-40ec-bbce-621f749aee52", "value": "langflow.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e551d6c2-721f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QatarRAT)", "timestamp": 1782561674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782561674, "uuid": "ffa06d5c-e086-4129-a8a4-0b0f5dccaaf8", "comment": "Malware payload (QatarRAT)", "value": "41251868de0e68da924595a9e4b6b899", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "first", "colour": "#AC2119", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782561674, "uuid": "67729977-abd8-41f4-9e20-def6e66b899a", "comment": "Malware payload (QatarRAT)", "value": "fe566ca92d40914438c7ce3157a6a0936ac7be94e71e6c37b95ac84177511874", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "first", "colour": "#AC2119", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782561674, "uuid": "af52ea87-60a7-4b37-899a-a5b75054b3ef", "comment": "Malware payload (QatarRAT)", "value": "38fe8d2da94de97b0a6c0e7648dba85e00eeecca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "first", "colour": "#AC2119", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782561674, "uuid": "bbb8ee2e-27b1-4ca1-b688-7f31155b520d", "comment": "Malware payload (QatarRAT)", "value": "18df6635b2dcb0d563e2d0b707ea7bff23c34509b8ae5091943030744e2ddf788cc054ec2850ac51862f2c2e403c46c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "first", "colour": "#AC2119", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782561674, "uuid": "29852e24-3a09-4d73-b115-bee4215ce90a", "value": "T184D5DF81B5A8B1FAE0546F3082E398E157F92DD60AB466011E07F66DD034BBB3C4D76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782561674, "uuid": "c27121f2-adfc-4da5-8e74-d298bbaf615f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782561674, "uuid": "b37ad52d-ae67-43bf-8fbf-42c1283ea8cd", "value": "49152:EskiAPIyu6mNOWek2aB1KYULQ6INRA4d/FLN4WVVWh9A3h2R4bbmyQy0vIXdPb5K:EskiAPIyu6mNOWek2aB1K9nINiwFbVS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782561674, "uuid": "b7e2b67b-937c-478d-8875-b42e86208015", "value": 2907512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782561674, "uuid": "54bc4085-30d2-46c4-b5e1-b2a6d484d2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782561674, "uuid": "fda912f3-67bb-43d2-a96e-587839216860", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54962e85-7207-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782551123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551123, "uuid": "d9e9ab99-0dc0-40e8-b51b-1b9f2efbeff5", "comment": "Malware payload (RemcosRAT)", "value": "b79f10906032c137cf05c2ecd4e04f70", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551123, "uuid": "3f23fc7f-45de-437c-9ad9-44803346183c", "comment": "Malware payload (RemcosRAT)", "value": "fee96a66a8c143ff4f172963a56a813427a65dad7758834bb3283685a37df633", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551123, "uuid": "f0d36d78-9057-4e92-b301-5472d23203eb", "comment": "Malware payload (RemcosRAT)", "value": "38c77711feea3347173be39bd952e5d8d935538e", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782551123, "uuid": "db61ae49-1b5c-4b83-9c00-8f6ceaad2933", "comment": "Malware payload (RemcosRAT)", "value": "1665fcec49b33dfacd11f30465dc908f78fd86a61dd76d368de920b21cf5d739d2cf75212d898f29e06eaf2bf2815ec7", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MB-0005", "colour": "#53085F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0184", "colour": "#CAE0FA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551123, "uuid": "01d474d6-685c-4a5c-b2ab-0faf455c5af7", "value": "T15A763362E1CDDCB5ED8E05EBB9B76E5067E4F48B858374BBD59A9EC2010F9903394308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551123, "uuid": "73b802c5-4d8d-41c3-b6bf-48e9575caba0", "value": "196608:fyF2hzjWm01z9hucQjGE7aCFaDJaeAeJ9b2IZAatlk+tkgC:m9m2phucQral9Jp2IZAKrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782551123, "uuid": "4df04c62-ac14-408a-89fc-edf54efe8e37", "value": 7316943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782551123, "uuid": "95c976a1-d17f-4358-82a9-0d2331300a85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782551123, "uuid": "4edeeeff-7238-4509-a590-46dfc1785988", "value": "szch45clusterhum.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f26f475-722b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1782566495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782566495, "uuid": "9a9a6c25-f7cd-41cf-a52b-2894f36bbba1", "comment": "Malware payload (QuasarRAT)", "value": "2549dc1f259917a6179f726de0ed45e7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782566495, "uuid": "e95b9f9f-9cea-4763-87e7-0e993c55f335", "comment": "Malware payload (QuasarRAT)", "value": "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782566495, "uuid": "838d09d4-0d3f-40fc-982a-eda3c02de49d", "comment": "Malware payload (QuasarRAT)", "value": "8c00b490332ca6af591294e1b2ffd01e708c612f", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782566495, "uuid": "6ef888d4-02dd-4ea8-9008-c3ffdc43d205", "comment": "Malware payload (QuasarRAT)", "value": "4ef9101839f661e9e9e79c112be56bf23d837fd109dea554d783d2938100f6f76ff1a58fea5fe966334625ba0a15a03b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782566495, "uuid": "77a0c6ae-c8f3-4267-bdac-a3afc05ea9d0", "value": "T100E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782566495, "uuid": "63bfaeb1-151a-4669-985e-4bce78565745", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782566495, "uuid": "c0714c84-ac73-424a-9858-8258e34adf74", "value": "49152:CvLI22SsaNYfdPBldt698dBcjHMxHEak1k/LoEoGdMTHHB72eh2NT:Cv022SsaNYfdPBldt6+dBcjHMx3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782566495, "uuid": "59468262-e551-48f6-a1a4-080f822f419c", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782566495, "uuid": "85bf8f07-80aa-4c58-93df-67633ae45242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782566495, "uuid": "a41afe52-09fe-496a-8f0f-f99d4c405b81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }