{ "Event": { "published": true, "date": "2024-03-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-16", "timestamp": 1710633781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f2e0ad0a-0706-4dde-ae90-4ef93418757a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26728acc-e32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710549355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549355, "uuid": "2d3abd26-e40d-44c2-b93a-7834be7806ff", "comment": "Malware payload", "value": "785f0d3f22d5c03aae457bfb0fb94126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549355, "uuid": "0139ccc0-576e-4c47-ad93-bd4c9d02f6b6", "comment": "Malware payload", "value": "012246bc3048970d6463175d947fc65dda7a0953627ccd79f99a139d9a7729ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549355, "uuid": "c41c3561-9595-44e0-aa88-d869d177a3e6", "comment": "Malware payload", "value": "302bb354d45d05513ac48d459f4de87ebc217d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549355, "uuid": "66c4cdc4-774c-4047-b651-14a19884fbd2", "comment": "Malware payload", "value": "b5e7d03fd3625a9d8344705007b0273a77ca1f0358c6361cb421c96f0f42b432ed343585b13f4905c26d5108d7fcddda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549355, "uuid": "0eb3db5d-0161-4be0-a10f-96f289724831", "value": "T19174D001FAA1E465D7B30A708D76CAE429297CC36B34225B366C79DF2DB06F049737A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549355, "uuid": "1d91dc81-ea04-4063-8675-90adaefca47a", "value": "4edbf64a48a248d03f99a68a18ba0325", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549355, "uuid": "429358c0-bc56-4dbf-a939-049ddf3cd103", "value": "6144:sSG1fyA0eBLEqoBhU9jQyiGqLmT+AL1ZAuwnF:sSG0AF1o3S0mT+AHwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549355, "uuid": "528014cc-74dc-4f6f-b705-1fcc1350476a", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549355, "uuid": "2be201ba-df15-4049-93dd-ac1ccd7f86ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549355, "uuid": "c4ef4308-1bb5-469f-abca-b17cf3161115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a666406-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595505, "uuid": "be120ad8-0e24-416b-9f5d-33f63b7dc971", "comment": "Malware payload", "value": "5f24ac5410a1427d43dc895c5e2f3962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595505, "uuid": "1a42f3a2-6ab7-4855-a26f-368c0a7aa2a2", "comment": "Malware payload", "value": "01aa6bb05f83872a698be735af0243165d291ba838d35c9bd7f1ec38ad66704d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595505, "uuid": "8064b768-0222-4830-8545-8a18270203c7", "comment": "Malware payload", "value": "cc4cd1c6d9f12341b3e0393fcd40b7a197c34936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595505, "uuid": "ad9f3b92-37f0-4148-af7a-96d9aceb654f", "comment": "Malware payload", "value": "5101a888699de0f76c60bb301dfde75747325e322a1ade371478bf8be0886c3a66932f74774c79d1596041d7028fa665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595505, "uuid": "10931090-8bd7-4a01-b8e1-df16c85ebdf3", "value": "T1D9033A23A6E5C031D831CBBC6C38A321AA3F3D313D65467AA7E459DE4C696935C843B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595505, "uuid": "fa932d06-e1ea-4ea1-8783-03fa9b42143f", "value": "768:HC+q5Qmw/IaZ6UUN6en9a8P/m3FlUwqMXkGEwaS3lntIt:i+q5QsmJk88cRqWna+2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595505, "uuid": "c81ebe98-7696-4b27-ac49-e9795e3c1146", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595505, "uuid": "b5258395-5e6a-41b1-a480-c3eeb74cce85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595505, "uuid": "0e2f4a07-375c-4460-8da4-1f89386dfb11", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.13691.8349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c703238-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595509, "uuid": "256c912b-b957-4dd2-8c64-c6fff1e9ab9d", "comment": "Malware payload", "value": "832037360384cce7694f1bdf55d535d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595509, "uuid": "b7f41841-8ebd-4bc3-a1a0-271d60820c01", "comment": "Malware payload", "value": "01b29a0f3084f8c432bb5ec1a4444a683bcd0003ed5829d21f76d8388ff61100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595509, "uuid": "1e0784f3-f681-48df-9ed7-6c814a972961", "comment": "Malware payload", "value": "6a3910e8679f6dbfd991056a124910234d4ad626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595509, "uuid": "d4342677-bf8a-4981-9646-0717a4bcd2ef", "comment": "Malware payload", "value": "0340059b75f436514f51cdbcad46ec7a22bce274dbb56428fb3ce354cad1a86c153c8c2bfc112d322a7d6d4367c37f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595509, "uuid": "ac395532-fd65-42a3-a7b0-caa7c9e1d752", "value": "T185553376099272E3CFCD24B9A026CE0E4E1CFB7FCF3211140E6A4154AEA29D75751E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595509, "uuid": "b159d9a5-d9b1-4a09-bd90-9d748c80db0a", "value": "24576:6tTUUB6tp70EzMoDGZWf1t4sblmVrTEg6qG+unggOmyLUOxeld4bbfg5KDBDFNqD:6CUqexoakf1CsblmdyqGXzyQdQfg5KBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595509, "uuid": "809372da-6662-4eca-bd27-a8455d6b7f28", "value": 1360443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595509, "uuid": "7fc29ee8-6540-4664-992d-8aa9435eebea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595509, "uuid": "951eaae9-0a36-4793-8b92-0836e84dcefc", "value": "SecuriteInfo.com.W32.Fujack.U.14662.31584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7c090c-e3c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710612721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612721, "uuid": "dcab8358-344c-44d6-8671-4b2c854bfc34", "comment": "Malware payload (Mirai)", "value": "3f25ef1d3227f32fcd8e4735aace7aed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612721, "uuid": "f40274f9-9ace-4c9b-aa6f-9c86ef9eb0f7", "comment": "Malware payload (Mirai)", "value": "041d2c338765e506054762e84b926cd6ef248519065878c8e8d75639c40cdaee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612721, "uuid": "5a4ea74e-942c-485d-a853-9b6cb88e8edb", "comment": "Malware payload (Mirai)", "value": "9fb6421edd2e0fb285b8b541d9a9138f06c2231d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612721, "uuid": "92e506eb-e4ee-4657-a196-4065db98c888", "comment": "Malware payload (Mirai)", "value": "6aa0357e88e0e5a8e6f994d1b52c2cc13c45e108117fb2efc8204a501ff8322690d38ab93a91ca4688971b9c58b65c16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710612721, "uuid": "ae1eeb76-56bb-4076-a733-5b6be6d540d7", "value": "T1FAD2E130B52BE519FB8B35351F6F4A8DD494FE200FEF8E5265044E93A1336A079B84DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710612721, "uuid": "7ad7ca09-f02a-4374-bfc0-97e6e7e25fb6", "value": "384:MDHpcXPUEh78xKC3ukYs+K6gaxZRpPnKPWsTPqOoMpVizawsq90er1nTq7Xc7GW5:cU8Etp++uaxZrQND/oMz4awxHq7XJWXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710612721, "uuid": "8e8be423-470f-4199-a31f-0aaafa3ebcf4", "value": 30948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710612721, "uuid": "8f594aab-fa85-4856-9fe3-462b19936374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710612721, "uuid": "59e9f445-b2ae-46f8-8ca8-12709c1c7be7", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9455db22-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580892, "uuid": "f2904224-9438-4cd7-a33f-b2f4bb9ce1d6", "comment": "Malware payload", "value": "c4f00b6fe4b00fccb339f4a6609532e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580892, "uuid": "64b06180-4387-4c95-a6ef-9dadd92fbc9e", "comment": "Malware payload", "value": "0433df8816e39bd011113c3d412e51384ae2f4202f54ee9c0b2e9af614c83d85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580892, "uuid": "850fee6d-13bd-4062-9379-3b5ff2f6c208", "comment": "Malware payload", "value": "efdcfaf5109c60d802966c70d225eae5f28c82a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580892, "uuid": "94572162-2c0d-4944-a3e9-ab84a2346b28", "comment": "Malware payload", "value": "e91f14fd051e49f0583c156e9aff7afea08026f2e419504f083154a1e7be5010f07261089d4374e24899b17a7dfff37e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580892, "uuid": "ade68efc-c122-4151-9bb8-4903d1bf4c5b", "value": "T12DC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580892, "uuid": "ea7d8e8a-eb56-4ec7-a629-9e3d4d0eae19", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpT+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Ep+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580892, "uuid": "47bae80b-11f2-45ca-8539-f5642d43b09e", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580892, "uuid": "3e83f17a-97d2-40e0-a0cb-70a392d0b1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580892, "uuid": "58216e1c-44f7-4626-a820-9430b3cbe80b", "value": "c4f00b6fe4b00fccb339f4a6609532e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0c6ad3-e333-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710551945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551945, "uuid": "000eb323-3da7-4d69-9d20-dc9d4d2708b8", "comment": "Malware payload (Mirai)", "value": "a5738ddd66fc89e3a601a4d0a9c9b5b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551945, "uuid": "f304a1f0-64d6-4f7f-9ea4-8984670e67d3", "comment": "Malware payload (Mirai)", "value": "04a6c768b5d23bcfd429483910d1ed0fb169f992c4a633374f09b13a8d044857", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551945, "uuid": "fccb376f-c9b4-4c10-aebc-cb9d3538920e", "comment": "Malware payload (Mirai)", "value": "77aabdc8e7ada9b35eddd4ecd2113346c6b84c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551945, "uuid": "0f518565-85c4-48e2-9037-ee7b3f57d43a", "comment": "Malware payload (Mirai)", "value": "9da113b4aa9194f4fb47a90e02783bb2ff5949ac0af83c2c1f99dd8f6e11d2d63be1900d910c10bdc8afed626a124e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551945, "uuid": "c9738d2f-ea93-4453-92f3-8bbb976527c9", "value": "T1A8C2E0E07726FE31C4206C3DE52B4D8A3A51067C91FF393664258D398EC169B63B58BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551945, "uuid": "c30854f8-1af1-4398-8841-e232f5fff177", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrr9q3UELuA:OKy4qfqoeJdXWgKL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710551945, "uuid": "c38a137a-d0a0-4df4-bcb0-3500965510db", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710551945, "uuid": "88f718d9-4b3b-450e-b9fd-2e2d3bd91518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551945, "uuid": "8f2b367d-9e30-45d2-b150-a412e781e968", "value": "a5738ddd66fc89e3a601a4d0a9c9b5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ed8195-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580405, "uuid": "ccfeb567-2d5e-4e3e-83d9-a9f5e4147311", "comment": "Malware payload", "value": "97ea920703b02168ba7c4f8f6806b6e5", "object_relation": "md5", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "untagged", "colour": "#31A000", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580405, "uuid": "e9b6b0e0-a93c-4876-87d8-02b54fb1b47f", "comment": "Malware payload", "value": "054fdc081768138551076367db4c0ad19f956defbc2125d5b65c97c6b290ad28", "object_relation": "sha256", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "untagged", "colour": "#31A000", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580405, "uuid": "4b10574c-8c2a-400b-ab05-2212c35e4807", "comment": "Malware payload", "value": "23b5fe156233dce4b5506333bf18f017423e1167", "object_relation": "sha1", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "untagged", "colour": "#31A000", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580405, "uuid": "aa6eaa9c-d1a3-4236-8c22-135082fc6a12", "comment": "Malware payload", "value": "b53bf7082ceb12a4c48e5daec2e4c66aae29f2dd7e1af4f0524f3006e844b16b103227e36b15bd3b3b831c23db4eb94a", "object_relation": "sha3-384", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "untagged", "colour": "#31A000", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580405, "uuid": "8421e883-4437-488c-96ba-6f62ac88eab0", "value": "T177E1CD201005633354B6D3B7F5FB1809F973926A1186A0DAB6CC11893F327786EF6EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580405, "uuid": "931bb302-8cf7-450c-b35f-012f04082b48", "value": "192:a8clDQNlG1zO+0+hvxNOe+xik0eZRMF5upbMKof+JSJxpJlghXpGS1vJ:osNSEPvsg3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580405, "uuid": "cf23df25-3622-4d65-8e14-defd052fa605", "value": 7266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580405, "uuid": "cc19a0fe-ee9a-4076-97d8-6f8d7044a7b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580405, "uuid": "fbce3524-fcf3-462e-83e8-597d23b264f5", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9683d06a-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595499, "uuid": "9b3b5ae7-1e32-432a-ab23-3603c7da7b52", "comment": "Malware payload", "value": "723d4ec9b96316f6cee9b13385dec258", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595499, "uuid": "9ec91beb-9795-4147-a030-3a198ae50c64", "comment": "Malware payload", "value": "07b391f7054b12b41d761814de92aa19210e5d7e10494f78db69db8ca31104ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595499, "uuid": "5796ea17-f276-4ae8-b6fa-1ef421eb5ace", "comment": "Malware payload", "value": "21aa422ddcf3cd8d4ba783e5b2ffa657a3476192", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595499, "uuid": "3a9cadcd-f075-4143-b7d0-0f31b63a2ecb", "comment": "Malware payload", "value": "d58e2990d3cfb1d7f0a3a2ead2adfb4f1c2b37337d0c7a3a4ac912a74f2bc2020b59e8dc2aa340192dca271dbb9c51e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595499, "uuid": "b2880fc7-39d3-42b1-a2d3-ca5d879c02ec", "value": "T173B5BF0F7687F456D59D2D304128C4283567AEF84A7359B63B083AF9DABE3432E19723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595499, "uuid": "ba08f625-f426-4bc0-a50c-b67af24cfc46", "value": "db4bdde4cc5d0cd4c96736880c453906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595499, "uuid": "414ac3b1-89dd-4334-97f2-056bd95c7c8a", "value": "24576:dNCbob5IENWT3ujffuFtxojmxxGGUkkMA/siPQ5S8UjeuCUuD1aq:75I0WTaffuFzsmxAG+sX5U5kD11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595499, "uuid": "3775ecde-1449-42e0-98c9-8c9a6b991b53", "value": 2470116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595499, "uuid": "5132fd07-41f6-4245-a830-35ca86ffda53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595499, "uuid": "dddb777f-44fb-48b0-bae7-cccae33a7d71", "value": "SecuriteInfo.com.Win32.Malware.4084.26184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329d0d08-e333-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710551952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551952, "uuid": "18803090-0191-408e-a584-4635acf1d1ee", "comment": "Malware payload (Mirai)", "value": "a53f6b80602e3c42581cfcec18256457", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551952, "uuid": "9a240ce1-41ee-4fa2-ad6f-a71fa539700e", "comment": "Malware payload (Mirai)", "value": "0abe2bc3838860eec95292a8c29d13bd2fc3ac798d0a371a3cc8cd92801e215c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551952, "uuid": "00659300-d92a-416c-90c6-5328e0cbec7d", "comment": "Malware payload (Mirai)", "value": "8d18065e6ddaa8f277f035b3663ba3daf4b3062a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551952, "uuid": "f6c14722-ffa8-40bb-b516-86fab664212b", "comment": "Malware payload (Mirai)", "value": "a15c71b97ea0b3642dcede21ec4282ac81281bdf2f265bda64a8c06674cc856594877797fb3d2e5a7934ad98c0131298", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551952, "uuid": "96021685-75e7-4578-8d40-85534f5e4618", "value": "T15CA2E019BF2C868BC8323A7855D9E6D22257FD61F2DCCC0D2940C15FB1A33A96870F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551952, "uuid": "0c392825-96b1-4625-8be5-9acba9249c9c", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT8:M98o08kxofBE+ZkXaITbp2F2TWul0c5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710551952, "uuid": "04858ebf-9c48-4382-9bd2-29b6f297b12e", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710551952, "uuid": "5000e5dd-612d-445f-af2c-c1134d6d14de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551952, "uuid": "a6999433-305a-4015-b901-87a63e0bcabe", "value": "a53f6b80602e3c42581cfcec18256457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6153aa99-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710549883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549883, "uuid": "ff2ad78e-35ca-4035-80d3-72763285adc6", "comment": "Malware payload", "value": "6a3dfa7ed0547c89e85632af9c34004f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549883, "uuid": "0c3f8e82-b071-42f1-87ed-99a25f2112c0", "comment": "Malware payload", "value": "0be0ffbfeecab971339e51c2c5862542467aa1c745f388aa892e6f2442f0c2c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549883, "uuid": "0ebdac93-c47f-4a5e-8907-9de5a4c2866b", "comment": "Malware payload", "value": "a5b52c3c1aaa0adf5b34e924b347f3a39946fde6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549883, "uuid": "ac41141a-4e5b-48d1-96a5-925068713911", "comment": "Malware payload", "value": "23aca827fb73d3863905c75ff6231ba6e6923304f8de2e24ea2abac48aefb3418ca0df818accf2dad0fc7cc375047f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549883, "uuid": "3283e7f2-2fbf-4230-a518-014002f4603b", "value": "T129F2E121A22FED12D033517ACA6A49C86B9937A4C6F736E134253368D6DA41552D8FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549883, "uuid": "7703df28-f24c-4d7b-b89c-05b429955a58", "value": "768:JC7gJypNRQ2deN3p7HuNipZqx5T+oi5jay3hQzj0vOl51Uus3Uozb:2FQn5rTUT+obyRQzYvKUzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549883, "uuid": "f24fd16b-91aa-493d-b87b-558fce516894", "value": 37108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549883, "uuid": "5777382f-5a55-4fa7-86bc-7a53825e36fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549883, "uuid": "7b59d227-c30e-41ff-a9fe-e5133d711587", "value": "SecuriteInfo.com.ELF.Svirtu-AA.23796.896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b261ba-e34c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710562878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710562878, "uuid": "c1ae2da3-098c-4bd5-97cb-fa6239fc7e75", "comment": "Malware payload", "value": "7087bddd9016174c0222a847a36eb9d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710562878, "uuid": "15c18231-f22b-4ff2-b4e6-4c0c1195ef97", "comment": "Malware payload", "value": "10fd6d375a30b6e01133a01dea74df5a7c729aef7677aa5ee5bbc36e2a7ba251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710562878, "uuid": "0cab50fe-a30c-4e68-98e5-00532c848465", "comment": "Malware payload", "value": "991a3ea39160dc40a480fdc299d9286a000a2917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710562878, "uuid": "e1d4de5e-d55b-459c-952c-f684e1673da2", "comment": "Malware payload", "value": "53159296a704161b67e69ed366286ed02a079884805aa14ecca3a441ee0346d104b052adf3de19029c3cdcf109c5b3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710562878, "uuid": "5cb5eb94-fea3-4b23-97fb-e86d7d2a83f0", "value": "T14885017742D8D77AE194213D828DE4A224A41DCDFBCAD9C2FA767DCEA5FDE034210612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710562878, "uuid": "c9545a21-9e25-423f-9a4e-0217d1b89d29", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710562878, "uuid": "3867ed40-ec8b-4dee-aea7-a36ae82ee084", "value": "49152:Koe4NErAuWkNfg8jahiIPYPwd+YRHm1TN3PJS:KoqcLkNf96iAYW4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710562878, "uuid": "ced288be-ae8a-47f5-b2c9-f94c972f5976", "value": 1852680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710562878, "uuid": "00932966-f8b1-4600-a2ad-733517c38cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710562878, "uuid": "4d06e896-4162-4388-8edc-ff89911cf277", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.22352.5298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44051e95-e388-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710588489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588489, "uuid": "23f5d55d-5225-4ca8-bef7-0e687d1951ca", "comment": "Malware payload", "value": "94767cb04f27ee8506780ad68da2ad8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588489, "uuid": "711e7494-606a-4ecc-a527-6ccc887a9d63", "comment": "Malware payload", "value": "1222c9bdc80b28b073689d9267c7dba317a94165d062e36b79191497f359668c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588489, "uuid": "28dfbb9d-c796-411d-89cf-25123e1a9aac", "comment": "Malware payload", "value": "2eb3f5c8720d42adc842091a1be43888c1bea810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588489, "uuid": "0c980e6d-e49b-42f5-a4ad-ab580f84294a", "comment": "Malware payload", "value": "562026ba5d4ceb56ae5a47dd10240346e8bc8343010bfbe05b9031a5ccaec3a776fe1525f14dedf80fc6ae04b388a948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588489, "uuid": "d2085a17-f4dc-4849-96a9-b1ce529a22c8", "value": "T16B643A0632066CBDCD5AC978838785637A2074CA0FA5F9DF41C6923D2EB7AF46F35A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588489, "uuid": "9b708629-cd7f-4f1a-817d-b7848e7f3a39", "value": "a3186d0575764a50cb9bb49f4fb3cd26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588489, "uuid": "6d5d4af7-543b-4455-bfd1-e782e4977a30", "value": "6144:sjjxcL/maeDc0fecU1AKILmbe1pC1J3lL:sjjx3I02cWA4sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710588489, "uuid": "6bf54f15-aae5-4734-9899-2d7d8e6534c8", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710588489, "uuid": "4edd4c2f-8e48-418f-8e31-d780742a0ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588489, "uuid": "e333a8d4-1e9b-410d-b850-110f85a6f5ee", "value": "SecuriteInfo.com.Win64.DropperX-gen.18063.10738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc3db8-e387-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710587950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587950, "uuid": "545415a9-c0e4-45b7-a336-4175403b4515", "comment": "Malware payload", "value": "240cfd484cafe50062014206fa66c33f", "object_relation": "md5", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587950, "uuid": "a95f4679-9e1a-45fc-b662-85f8c874078d", "comment": "Malware payload", "value": "1294581eb6a0434867e3d715d73ec0c892530719e82b5e2825a57f8c05436d47", "object_relation": "sha256", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587950, "uuid": "c9046df6-4bd8-4605-9b94-5ddc66ba6c5c", "comment": "Malware payload", "value": "cc984d8cea40149830f9ddb7dadaa83c0a169fb8", "object_relation": "sha1", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587950, "uuid": "3c7fa2f1-2281-4e2a-a8b8-aace3e94dfb3", "comment": "Malware payload", "value": "4bf8b0d336df0dac3293bb111a6ba36ed4900f99b23e5e54f13157ef4c4ea9997ea7dd2a862441943d443456e23b8b76", "object_relation": "sha3-384", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710587950, "uuid": "3e0750b0-3105-48e9-8010-938552562e78", "value": "T11B62939E6208041D4A76F379DB67D00EE26232271EE18549BD8C04E17F765B4A2E2FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710587950, "uuid": "f815552e-d7a4-4030-ad33-29f3ca4c1755", "value": "384:+oUp/yZhbRWD7l8BFzo54fX3YkbG3HD0F:QGhbRWD7lKzoKvYXD0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710587950, "uuid": "02035a6d-2438-43c2-9e62-c162fe0e77da", "value": 15743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710587950, "uuid": "7784f1dc-1608-4a9f-a092-ddaecc3eccbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710587950, "uuid": "7feafb1a-a155-4c02-9994-8fd1e2383b2c", "value": "background.js.deobfus.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998058cf-e3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710625998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625998, "uuid": "c092cfd2-0405-4585-baa0-c69f252a516b", "comment": "Malware payload (Gafgyt)", "value": "3c593c173e8b1e1a07b4e9e991df9b11", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625998, "uuid": "23fa386d-3f35-40e8-a2d0-3aa1c87485d1", "comment": "Malware payload (Gafgyt)", "value": "16bbb930b6527c6df202ca148414516f610fedb1fed481b7c514665c135bfa8c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625998, "uuid": "e207b2fd-14f8-489d-848c-f747548fbfda", "comment": "Malware payload (Gafgyt)", "value": "e7248456123d125fcfbfc3bb85d27a7fc9e2abf8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625998, "uuid": "7a943b2f-7d41-424c-b684-537e9b746ef4", "comment": "Malware payload (Gafgyt)", "value": "addc5efb25a9c85183c85cae3eb53dc802cd52036a1e5e41a26aeb1ad67d014633b0f953857aa0d0fe4573fffc1e97f0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625998, "uuid": "93da8438-15dc-4d54-90d4-d1d9f6fcccd0", "value": "T1B2E3D733B2E18DFAC14652B026EFDEB29C31F1FE0672312B23A41D605F2D9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625998, "uuid": "44a2b939-b929-46c9-92a1-f5f8a9689147", "value": "3072:syUyaJ3LUQEWuZI3zKZPhJbphahZtwktUm+QVOXFNqOPPe:+3OI3mVphaDtwxm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710625998, "uuid": "e23d2f89-0ccb-4db9-8881-44b0cd719c8c", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710625998, "uuid": "90d2a0c6-8a17-4a58-bceb-14f2eef4b33d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625998, "uuid": "eb1dcfbe-37dd-4e47-9291-e53a1d320377", "value": "3c593c173e8b1e1a07b4e9e991df9b11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61eee2cb-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710549884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549884, "uuid": "fd342b88-a9cf-438a-a18f-e8551004f936", "comment": "Malware payload (Mirai)", "value": "c9c4cd771a21c0bd9d1acccc81144246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549884, "uuid": "f3aa0841-f3ab-453e-b5b7-7a723e43ab28", "comment": "Malware payload (Mirai)", "value": "1971b93fff01aef0cee9ac2081499ac6e19011c70d663089869b16c2f194517c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549884, "uuid": "59d7b9f3-0e92-429f-a2b6-d7b7b752f25e", "comment": "Malware payload (Mirai)", "value": "faeedb58539868d805296c1f124d0290e77ca100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549884, "uuid": "d8395c78-d96e-4364-ac48-0d85714393e7", "comment": "Malware payload (Mirai)", "value": "edd242440fa3da06d2a823be3e039229c10418c535314a24dbc7f627dbb90db7895b5750c008e0a677a4a141c7ed4ec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549884, "uuid": "8403a03e-4ca8-4114-a685-835ffb4898a5", "value": "T10303F1C2C139BAFCF43774B12A6864A0F541B0C7BA8A47BD6D0769FD8865E313922B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549884, "uuid": "ed998c5f-6e47-4664-82f0-4bde2d838ab1", "value": "768:sjaaK+UcPibNIAyMbP/bkXGTD3Y+HtRMeHzKbKm0y8rRXYdFRU8U2Yx0rw9:yu+URRVJPAXW7HtRVHzKb7iN8RU8gj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549884, "uuid": "a3f5a643-1ad1-44fb-971b-3931d239fe5c", "value": 38540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549884, "uuid": "88f1934d-b8a0-46ba-a13c-cb1c87e8f360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549884, "uuid": "91935af3-0243-4d7e-b066-14e1b4d76d28", "value": "SecuriteInfo.com.ELF.Mirai-CBI.1549.20822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd02a40d-e387-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710588369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588369, "uuid": "617704f8-cd92-4b4e-8ba9-0aec9bc9bb86", "comment": "Malware payload", "value": "83e5d8ae4bda535c4b5e28ce87e0c611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588369, "uuid": "96c93625-5397-4a56-8cc0-4dba60e2a8d2", "comment": "Malware payload", "value": "1a1995a69c93bb3c133ac5736cfa024f9c27646eed2ed16aa0ee223399e6d1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588369, "uuid": "965741f4-55a5-479a-aa8a-76fa5e4e2a51", "comment": "Malware payload", "value": "9d2ac8a2ee5867917cf4d2f65b18069a1ba0c08b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588369, "uuid": "6e97950b-acbf-4ac5-bc8e-50d0bdb9a9e7", "comment": "Malware payload", "value": "57fff0a9d51c665ee963013522abd9619dda62cea3114a51c330214a4b35daa01aa2fa703963c739079349364421e6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588369, "uuid": "a19cbbf8-3bb1-4c63-8ae4-dfc1973c6542", "value": "T1D1B53372BB9F9414C928DB35CCE56C4CEAB843DA514BF013329F81187A12B57BB2B6D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588369, "uuid": "4434f446-e4dc-4a16-8f8e-e06dde49c5e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588369, "uuid": "8c4eb5ab-5b4d-4b50-872f-9cbd1b9e9ffe", "value": "49152:4qlTwDWvksxtwD/nkgx42Xre1FGFJmoRe+pB0E9C5m+ddxLxWU+zEEA:PlTwDWvDOD/nhR74GFUqe+C5mWRWU+pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710588369, "uuid": "bf6b4689-aa5b-4351-ada6-23099203076c", "value": 2460296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710588369, "uuid": "8be3e864-5cf0-4df6-8cb3-c06e92b0da36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588369, "uuid": "9fe4bc61-7869-4f98-84c0-09a907f39eac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637f827f-e3c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710613452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613452, "uuid": "33ef9500-2089-4837-950b-8e6dc5541254", "comment": "Malware payload (Stealc)", "value": "eeb28727205780a0ed8410123df31246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613452, "uuid": "7788d9b3-c438-4695-bd6f-831673493a65", "comment": "Malware payload (Stealc)", "value": "1b23924ab205a7532dc3a59baf5be855930d77445a1206a2f90729f8381a52b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613452, "uuid": "01bd77b4-d9b0-4f77-b473-9523599aadb3", "comment": "Malware payload (Stealc)", "value": "9be33cc6ffa33839895e37a9238842abb9eca98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613452, "uuid": "9bbf9afb-b930-4327-8c47-635479b7464d", "comment": "Malware payload (Stealc)", "value": "6fa7383a3f18d67977343d140674e0b163a74585a6e5068b1b5dcbe5c4df73e3f4fb082ee425f4ea9bf61d32f3ed31c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613452, "uuid": "392120af-48c9-417d-b7cf-c742554fcf43", "value": "T13826AE07B684CE00D15E2FB3C6E97514D3B65BC16316EB2F3A813F991E9333A058669B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613452, "uuid": "f27ba436-7970-4377-a84c-5da24587802c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613452, "uuid": "319697f2-963e-42b5-9ab8-2a98539cf128", "value": "98304:V3Onp203cNaeexH+F3o8OvqvqHQkiml9PQd:V3Op2mBeexHW3o8OCqfFQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710613452, "uuid": "6484b9dd-86c8-4448-b100-a20ec496e454", "value": 4567384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710613452, "uuid": "a44e292f-11f7-4a28-a552-4437ec076678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613452, "uuid": "3c99aa1b-8a72-49cc-b1fe-b76e7d600c9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae97c6f-e36e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710577467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577467, "uuid": "5d6a9345-d3c8-4c42-8fcd-46a851318d41", "comment": "Malware payload", "value": "ace635ebab11042b1736de08c41f2215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577467, "uuid": "0530edae-ee42-4847-8fbd-4a1377de927f", "comment": "Malware payload", "value": "1e6f7a404ba135309be6c1f0ee22e5822ddde2308cf3570a7b4dbac85f83edae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577467, "uuid": "ad05feab-bd83-487a-b656-5b48502fe61a", "comment": "Malware payload", "value": "5dfc40504cc031d266744f57043225d8febb2e2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577467, "uuid": "4210c2c8-3589-4033-829a-1e2776df34a6", "comment": "Malware payload", "value": "9fb7192381e5f2d70a08228cc0c5a4f03c708b41a0ccae23ca807c935e2b2467e4cb1fc54703aaa6f5b7a7253864ea65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577467, "uuid": "82353486-8340-44f4-9ce1-1f9f4b03beb5", "value": "T146633A32A764847FE185053241594F7F997EA83132392047FBA4ADFA3C749E7C50AE8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577467, "uuid": "5c2a9989-519b-46f0-b09c-32002f499329", "value": "c4b8b0aba9f9c876ca624bdbda64d516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577467, "uuid": "8a47632e-2947-47da-86c4-49a3db9350dc", "value": "768:fepnjAK/y7yXdQxlVfnHKQtV7eSHs1Iqzy7NIaH/f74tFGXnedGiB9G12uZFHQzV:fepnjAK/yGtQNqydHjq6j4tu/2uCoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710577467, "uuid": "4bffe1b7-9ec2-4947-b788-c0ce4c7bc075", "value": 69992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710577467, "uuid": "b70466dd-0a15-45fb-a91f-069cbd78e9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577467, "uuid": "78b36220-8247-4f4a-a8fb-96d164af06e4", "value": "SecuriteInfo.com.Trojan.KillProc2.22760.6230.19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b59d98-e333-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710551981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551981, "uuid": "34ec2251-a077-4d6b-893d-45954c7a5c8b", "comment": "Malware payload (Mirai)", "value": "83ad912aa131a27f3a939b336e918a0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551981, "uuid": "bb08e42f-7cf6-45cb-af62-19b5ea140750", "comment": "Malware payload (Mirai)", "value": "1ec9cdf39a37adaf7c6a1a9a56a908d68e0336462b47d0e0f105e8fdd04abff0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551981, "uuid": "3da42446-03e1-4aab-9ad9-9bc40aea97b5", "comment": "Malware payload (Mirai)", "value": "5f464d447230cbe54edd0cc61b71ea174adff648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551981, "uuid": "99217d58-c33b-48be-9fa9-2d76454fb5ce", "comment": "Malware payload (Mirai)", "value": "5717562dfc917338d8bc2ded6e7332460c146e31aed97ad2273116f783b6ed4c68320b71e579b01a266ec7ebb3e9bcbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551981, "uuid": "e500df53-b7c1-4c4a-8753-d79f9549f382", "value": "T135B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551981, "uuid": "26c7d6af-b2e9-49f2-be67-2d1263f86cf4", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg16/LWy:c9sSyzz36YaWWgg16q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710551981, "uuid": "4009f23d-2588-4668-a041-e6cfcc1a308e", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710551981, "uuid": "742ce7f9-91c2-40c5-a5f1-d65a5c1245f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551981, "uuid": "da215363-e8ff-4c94-917c-88610695a360", "value": "83ad912aa131a27f3a939b336e918a0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef372a1-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595513, "uuid": "265e9dd6-d6bf-4043-8c03-2cfba4720071", "comment": "Malware payload", "value": "2e542f8c5068f13f367000883278fea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595513, "uuid": "386a0d3e-ee88-405a-912f-3f18abf7abee", "comment": "Malware payload", "value": "26a4c1a7d5306ad5339536945199e9de6544988b1356835a22ce1c4b189b9c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595513, "uuid": "5f90229a-bda0-4d65-9f41-4ed203fe2f3b", "comment": "Malware payload", "value": "d85b95bfe0cc1aa57d6974f5a1ea9f630ba3610d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595513, "uuid": "3902e196-4a32-41b9-9b1d-ef51cceaf0f7", "comment": "Malware payload", "value": "1be139a590ead6fed1b28ec191cff031dbae1219be8f4538b515ac45b4986b0b17a1be4f32d47f440dff95f10c8b14ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595513, "uuid": "00ab38e1-e98d-4117-8265-e6ede12202fb", "value": "T19D853302E4C894FAD0805DB9AC33EE09A6339D376874D6E871EF7B184F772A7452E641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595513, "uuid": "7d870101-3805-4c09-8815-3c0cb1be2c53", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595513, "uuid": "01d09910-5e1c-420a-af56-acf41973349c", "value": "49152:iYo+KTrv7g0IdmUi7phI7rlCFGbWz56e+KogX82NpR7:iYK/7gLIUi7g7rlIibe+kX82p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595513, "uuid": "7eb84711-088f-49ce-85e8-dbdbd4fa8f91", "value": 1770837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595513, "uuid": "b2ae609f-25d8-4fcd-abf3-cffd98be987a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595513, "uuid": "b5e6573e-3439-4b38-ab9d-6111e4dbc944", "value": "SecuriteInfo.com.Adware.StartPage.20254.3071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d24cd2-e347-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710560865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560865, "uuid": "e6d298a4-46be-43b8-adc9-b4371b2ae69c", "comment": "Malware payload (Gafgyt)", "value": "e1330419858571ddc48b14ed09d711a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560865, "uuid": "3395ab0b-c481-4bd2-9df9-756116a6d0ed", "comment": "Malware payload (Gafgyt)", "value": "29070bba6df11e8b97d916627526609309071bab0629a97094df4fd2285664d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560865, "uuid": "2e495f7e-726a-47f4-b1db-0349d43a6058", "comment": "Malware payload (Gafgyt)", "value": "3f9865c3a6c888125d42466c5d4ef93f721601a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560865, "uuid": "e655173a-4555-493c-bbde-514a875bb31c", "comment": "Malware payload (Gafgyt)", "value": "d155df2908c14b4c70df19d9c4d261ea1d9fa1d0c552695594d69ed6d4d3fe1b66fd26c38923c36c192a85244acbf6f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560865, "uuid": "99aad5f3-3a00-445d-a35c-08d7ab81b1f1", "value": "T1C4C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560865, "uuid": "b27d1401-af5d-4154-92c2-166f9d966a3e", "value": "3072:6jVlyaL5JCrIpv04sebttiEiTmP46aQyfPlfKsNb:yoCJCN4sebHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560865, "uuid": "77f4ff13-21df-4fd7-aaca-ef46dbfe98fe", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560865, "uuid": "e394eb51-bc32-4f40-adfb-2850f420c24b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560865, "uuid": "d82239ad-bb0e-4bb5-b596-16380ec187af", "value": "e1330419858571ddc48b14ed09d711a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8ca0fe-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571753, "uuid": "14049a15-de4c-4f68-963d-57f60ce1a150", "comment": "Malware payload (Mirai)", "value": "cf4fcfc3358d9013eeb00f85f6dca228", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571753, "uuid": "bc492c6b-8cb4-4287-bb87-aa105c442e93", "comment": "Malware payload (Mirai)", "value": "2a16fe741f97ad072be496c32f96f5f482477b546090f46e069f40142da3f784", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571753, "uuid": "7b460106-ae24-40c5-912d-e44133b3aaf9", "comment": "Malware payload (Mirai)", "value": "d6ef7d8c05ad581e1154e7c02ed899de09024f8a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571753, "uuid": "39ee8ca7-ee01-4ff4-839b-b7786254a491", "comment": "Malware payload (Mirai)", "value": "a0ad1edc746515877180328d69f62572178181c9a45650d9b65b0e1b3bb861b415914a131e0d206126ee910818933fd0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571753, "uuid": "f96567fa-95e8-4ce4-8705-fab34ecc6dc0", "value": "T159D33B05D8909767C6D227BAF79E428D73236B68A7D733115A28AFB02FC1B9D1D7D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571753, "uuid": "e296fcc0-60e8-4e55-b65c-45e62edc8f5b", "value": "3072:IVfyQ+d+pceQGftb3za5fJhWOiwTteOHg45hLMO3K4G5ZZPMmydQCYMhEFg:ub3za5fJhoIH75hLMO3GvkmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571753, "uuid": "0120ccba-a201-44e7-ae7a-241819d8554c", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571753, "uuid": "e95fe2af-1459-4df0-ab7f-048996f034d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571753, "uuid": "42401a9f-4c97-49a8-87f2-f77e503507d9", "value": "assailant.arm6-20240316-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3362c22-e35c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710569804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569804, "uuid": "9d94bd91-8901-4853-8699-1e9fc13d7061", "comment": "Malware payload (Mirai)", "value": "890351798a32e8618afd1e5321d43ab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569804, "uuid": "43325f36-5918-49b6-8bdc-0a9f027c65a4", "comment": "Malware payload (Mirai)", "value": "2b0d96e0813d17062eacd208c02246fbd3169153e5e8d9e56339921aef78c664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569804, "uuid": "9c2d1a69-08a0-4d97-ae0a-fe35c246ad09", "comment": "Malware payload (Mirai)", "value": "5747dbd899574b83eecbec96dfc6d310140d12b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569804, "uuid": "809168d4-3f4c-4959-a47a-a31c21ae1e6d", "comment": "Malware payload (Mirai)", "value": "74bff7deca95bc52a7687449e194018b4041850e834523bc327056ee207bcd199de240e5ab3c5eea2a867f10f7511d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569804, "uuid": "4255bb8e-a7f6-4f38-861a-625f2cf47ee5", "value": "T10315120171C2D1F2C853457211699F31CB37B37B075899D3A7A06EAEAD262F2B73B189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569804, "uuid": "87e5a5e6-a3b6-4bf6-810c-0d4f5a44547c", "value": "6d378b6ff06c71c5e5db2ed4c0703c08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569804, "uuid": "9b390cdc-1963-4f0f-9200-5eade1f1db74", "value": "12288:R7sRowUy7oneiornbBDa222OUYxROhxSIfIkcibNb4WfTyQOy:R7zwUKliornbB4HxiS6Ik/Nb4WGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710569804, "uuid": "7ea2de37-2770-4ec2-b5be-62169c711619", "value": 897424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710569804, "uuid": "8d15858e-a0db-42ff-be60-6f1d07ce4139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569804, "uuid": "d853074c-39d4-4af6-99d4-24836862b289", "value": "SecuriteInfo.com.Trojan.Zpevdo.3966.23931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ad3a0f-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571736, "uuid": "0bfd603c-ea2e-468f-b525-3af6bfbb9222", "comment": "Malware payload (Mirai)", "value": "b42b930bf1d8fc55977d1311bd98a3f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571736, "uuid": "d36806bb-5ac7-417f-bb25-c247ba5b07f5", "comment": "Malware payload (Mirai)", "value": "2bd178f402177c86bc4a67e466c356255170a718a0fb5cb899012c8761862f46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571736, "uuid": "2592be7b-48fa-43af-80f0-327ca1d9c5c0", "comment": "Malware payload (Mirai)", "value": "cf2127e7cb375cf286ad1ace0e4fa4b354d13091", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571736, "uuid": "1386382d-41cb-40d7-a7fe-393b27e72349", "comment": "Malware payload (Mirai)", "value": "1ea756684006c7dd67200beb00b1c7ce960d7eb250f4be19eca58a5ffd95baa53c098fac63bdf52adfa932fd05e5c99e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571736, "uuid": "c5b71197-b991-4571-ac98-c6e6957b7bac", "value": "T19FE3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571736, "uuid": "a21b4ff5-5466-4e91-8f3b-ba6a9c53f17c", "value": "3072:OaRBoUm6Oq+lozZ5hdyrzhsURxuZq+1uPNd5R:OaRBoxq++zZ5hdyeURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571736, "uuid": "9ea3e8f8-1df2-4210-b701-80fb22f577b0", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571736, "uuid": "07c9fee0-134b-4ad3-8c91-e1da596a32bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571736, "uuid": "026e2e9f-84c3-4097-904b-e9b58a5df522", "value": "assailant.mpsl-20240316-0648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c26eafc-e35b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710569175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569175, "uuid": "7e41b688-e159-4211-be78-6f981c796989", "comment": "Malware payload (Mirai)", "value": "72a1f3e676faac35a1f4a9367fbe1da3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569175, "uuid": "026b39dc-0a22-4348-b057-87a180334a86", "comment": "Malware payload (Mirai)", "value": "2db5e3b902eff3ee7de9f45e0774d26825342f4838f7b0f4ecba2e7cf1d3db58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569175, "uuid": "20518b57-5120-488f-90d9-112808747e29", "comment": "Malware payload (Mirai)", "value": "8460b78a76f8cf4bd448ef1641fc3359dd24c786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569175, "uuid": "e1853709-ece1-4478-a198-3c9b344977b2", "comment": "Malware payload (Mirai)", "value": "03f31bd717b7bcd65a74eb7940660dac3111c58246555900c7dfbf740fb79b04a865f779718d5122d0c5cd5595a6b3b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569175, "uuid": "d47ae201-d56a-4083-bf25-1b8de20c703f", "value": "T18373D715FF550FB7DCABCD3705A9170239CC558A22E47B3A7934D828B65B20B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569175, "uuid": "28720080-4fa5-44c4-a0a7-36ace3f0954a", "value": "768:sD7fxbOUL+goKPsJtNqhCeF56eYOiKfrwwuaYbZdkWFXi2U7n/eYYTEOCwnWIk:snxbnn8Y56vO82wZdn+n/nYTvnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710569175, "uuid": "4837238b-66cc-405e-b55f-033de74c1164", "value": 76384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710569175, "uuid": "765623a7-5350-4323-8554-e4ea11b7c360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569175, "uuid": "28180ef0-4355-4426-ba5c-7063e7fdc3af", "value": "72a1f3e676faac35a1f4a9367fbe1da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc26d1c-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595508, "uuid": "f78e0086-ae1b-4e42-9400-42d5580da684", "comment": "Malware payload", "value": "b048cccb210114678f49022c055cbbf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595508, "uuid": "ab76874f-7fb2-42f0-a225-6b6e64d35451", "comment": "Malware payload", "value": "2db7adb9410c7a48f302aa6f7526eeae15c81803fef125767cc103ece3e3039a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595508, "uuid": "ebae5d4a-4809-48be-a74f-fe375a901ea0", "comment": "Malware payload", "value": "7f769a21ed13d26f88d50c979b0c2690bad76f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595508, "uuid": "e878a4d6-6c19-4e7f-a853-6d8821b6175c", "comment": "Malware payload", "value": "e91b08f0b2e4a3f84942fe5cf98c958fb65306ea651fb3cb83045f7d5f129f25c5e13ba0299242c5288f872a1355c7dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595508, "uuid": "dbdeda67-baaa-46ba-8dc8-c47bcbaf6539", "value": "T1D605BF91EDC780E0C51524701253A36B9F39A5672970C6B3B2EC7F59AF0F2E077BA681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595508, "uuid": "de376217-3f05-45f0-aecb-6ad69052ac91", "value": "6144:d0fQcD3DPArIWwM+B5Nlx9pVhtZtMHTB8zcoIVxCt9T72pmmKo26jGQjvW83zgwV:d78zvwxCnammE6l53jZruW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595508, "uuid": "b9ba22e4-88c0-4a0b-b9f2-7f4e881d8756", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595508, "uuid": "062e53be-2df2-42dd-86e0-15cd06840203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595508, "uuid": "2b46cf80-3014-4938-9da1-4479e0d058e0", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.26740.32694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9514e631-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595497, "uuid": "889aeb5e-e1bb-4dfc-8138-8ce4354b196b", "comment": "Malware payload", "value": "a3dff1e21d6483cec5a9764c81d314fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595497, "uuid": "4e339d1a-e93d-49ad-8528-7b509f86865d", "comment": "Malware payload", "value": "2e84451617b5138758b6cb2459cbf4e1b2ad2b42361c95b0cd74dcabd09f5d0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595497, "uuid": "b5873fa9-fb13-4a32-88b0-ecee5c7402fe", "comment": "Malware payload", "value": "bd129812278e5a2b185d84fa3dfc8e3a27504f56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595497, "uuid": "2fcb42df-0aaf-46ce-959d-e18212161023", "comment": "Malware payload", "value": "dabf14d65d458d92b3e61f51d86bfde4c8dceff2f05e7b70f67ae7d7793204150e32b2f0ae940e5929609ea8f610bd2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595497, "uuid": "b9631888-72ff-4652-8a75-cacf968ee1cc", "value": "T1F4034B517D8344F3D38F233154EA6B375E7E675006A3448B9B66E982EC739E2E13B202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595497, "uuid": "082b93ca-c694-4652-a25f-2e5931673068", "value": "6d653b32e0efb1ff87f3cfe21a9d8db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595497, "uuid": "6867ce6d-1fe7-4897-bb74-a4c20c7b1cd7", "value": "384:zn16un4mTr0x15nWvs7bV3P7qgX/dC97ylxyxqD0rQoLgdu4ulPkHttA6gxm:zH3Tr0xH/bV3P/o7jxEoEdfHttt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595497, "uuid": "702dd60d-84a1-497c-abe3-ada70a24efc9", "value": 39084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595497, "uuid": "5d338590-e004-4649-affe-f18bf1ea143f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595497, "uuid": "5f855e7e-e6fd-4ad0-827f-4def665a51fa", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.30872.16301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4811eaa8-e333-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710551988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551988, "uuid": "c82ee4a8-4d0e-4359-a450-f7031698a58f", "comment": "Malware payload (Mirai)", "value": "29bdc8e7d7c5f3d2f0a808d281c77738", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551988, "uuid": "9cb2accf-d6f6-4df8-8e6d-9a06ced76215", "comment": "Malware payload (Mirai)", "value": "2fac22032d4a5d676660fd11e0ccd8c8d01d2f04f90a7612f3502e6595b5d772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551988, "uuid": "553d8fb7-65ea-4866-9a2d-a51473368f76", "comment": "Malware payload (Mirai)", "value": "ff23cc39f2655f4433b0bc64d8f6088bde6171d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551988, "uuid": "31557f68-38f1-4647-99d3-dbe0958e2051", "comment": "Malware payload (Mirai)", "value": "2eebfb8df0e044decabc6d2ff48ed8de6eacf4e5ec5ce0bef09c640e322edea791df648640f90db9545714f974a40b7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551988, "uuid": "843578b0-ea7a-4f49-882e-ab84942c1fae", "value": "T11F230271850E9EB124303C72DA95D7937AF12AB1C6673023DA280A3C6F657231E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551988, "uuid": "a890fd98-a837-48bd-9859-08d8e8a2509d", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3e9q3UELbUXfi6nVMQHI4vcGpvu:gECFd+A6YHAxDLRQZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710551988, "uuid": "0bc33bf4-ec24-400f-b258-aa974e71835a", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710551988, "uuid": "1af69f4a-29cd-4aa3-80a8-d3bafdcda87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551988, "uuid": "87540a80-9465-4650-b1f3-2266b79f8e91", "value": "29bdc8e7d7c5f3d2f0a808d281c77738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bbafd1-e3d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710620521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620521, "uuid": "eeebd46e-e0c1-42ee-a644-a9f0766a95d6", "comment": "Malware payload", "value": "d7e5d6f5a756b8124539bef14bd23b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620521, "uuid": "48a85f4e-35b3-4fa4-8fa1-16c8f6ef3283", "comment": "Malware payload", "value": "364869d21728224ca791600ee44d1533da54c5a65284d134a27ab203e52d535f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620521, "uuid": "17faa179-2c5f-484d-9896-a11380014d3a", "comment": "Malware payload", "value": "6f60abdccc11359e31c80d175d5871a754f47224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620521, "uuid": "f192f3ad-b417-4c4f-ae59-9f3e85c1ad65", "comment": "Malware payload", "value": "d26fcbe1443747ec17e21500853d63498dbe2cec9763876a75fbafd4c1d4e7139865d0996869e1921728f5fae3ba5b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620521, "uuid": "d8e37329-f94d-46c8-8be5-182d4e017757", "value": "T13FF63346DA0FF0BAC45A7D332B444958FA1B2D5C2E31615C3B85FF9F563B086EA61B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620521, "uuid": "bd771fb1-b355-478d-8792-0d950add7675", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620521, "uuid": "ed3e9aca-4083-473d-91f5-b95e4a446c0f", "value": "393216:KJjPeXePFUEyFeWfH8bRmIuYBS/t7Qh4C35GwC75IDEBO:jOdU24Iujl7QqCJGwCWDEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710620521, "uuid": "42e65778-b9ab-4d7c-9038-2db78ab6747e", "value": 16281320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710620521, "uuid": "959ccfc7-48fe-437c-ac02-ea22c55d4f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620521, "uuid": "6430784f-2195-46ec-97c1-99fb60fc349e", "value": "SecuriteInfo.com.PUA.AdFind.3338.8695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37cb920-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595521, "uuid": "8f4d2eda-11ab-4e01-8b16-6e868aa08cf0", "comment": "Malware payload", "value": "267ccd263a9d11c2c37c91abb5b8ec2e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595521, "uuid": "7f98d6b5-dba7-47e3-9463-5a98aa1d581f", "comment": "Malware payload", "value": "39d39d529439f25002d277af0912b327ee2e7b46ddf24fa2cc11313032cab394", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595521, "uuid": "c6826bf2-059f-4b68-a9ac-76744beb25ee", "comment": "Malware payload", "value": "13c4ced2f88023dbb7f09b273805ffdb7d4b019a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595521, "uuid": "319dfe1a-60eb-44f4-9b66-236cbaae0ce6", "comment": "Malware payload", "value": "538286d17c12df86705c24cede8e9bd42ccd38a70c9abf91b8e526f2ffe9b9d39b57f0e13db051b046fafd283c255f56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595521, "uuid": "f34e4944-1d28-423c-bfd1-81192f9265ec", "value": "T1EE44239B2799ED2CE8DA0030C697EC861955CD302E271F2717ABB56CADA71847D36C3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595521, "uuid": "d8eee88d-7c05-4b9e-98e4-79772b4ac335", "value": "03d03098233d92be592ddb98abd68eb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595521, "uuid": "f4ff7262-f108-41f5-8925-0925234bb6ab", "value": "6144:uDeMmN/YFJje7S4hnmDIdpI0aDnErqPFdK+3ZhCk/7cCdB:QRk/uJjeSG48RMb6ML3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595521, "uuid": "d061cb35-916f-476d-bdc4-e5ec0ef54515", "value": 272883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595521, "uuid": "2a909c0d-97ba-452c-bb75-e08e51ab2f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595521, "uuid": "35110001-170a-4d06-ba0a-a9e5c0613928", "value": "SecuriteInfo.com.Trojan.MulDrop4.64255.6616.6807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7f6332-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710580909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580909, "uuid": "658faa4a-a929-4e32-b18d-458a1f7f872b", "comment": "Malware payload (Gafgyt)", "value": "311b8ac8e8a7a264a9ae4ce8128ecd8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580909, "uuid": "b5e766a6-2a76-485c-bd0c-08a170551b68", "comment": "Malware payload (Gafgyt)", "value": "3afe742062fd38e028dd95b826a99e6321500f7b85b0c25e4723bc421f27a8eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580909, "uuid": "6979c3aa-65f6-493e-a8e2-2f4f0bf84d4d", "comment": "Malware payload (Gafgyt)", "value": "d47b78e3727d9d27e4f782bf7f3d49adfc9802c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580909, "uuid": "fea0fe58-ca80-4193-9e13-d0b1853b2f0b", "comment": "Malware payload (Gafgyt)", "value": "62c87e25aa00145680eb0deac499a372d05dd75d8cf62a473f63fc25d4471ea60cb610225caf99081914931523a71e78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580909, "uuid": "7b6e6081-5839-4cc3-b002-7d1bb4b87c20", "value": "T16CF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580909, "uuid": "0b940e0e-d04c-43d2-b2b7-e1d957933d33", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBpYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/nYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580909, "uuid": "ac4d9135-345b-4d4a-bf45-5b799453483a", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580909, "uuid": "6cac7a9f-1efd-4ce2-93aa-a48a80d8c8d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580909, "uuid": "c2170e04-365e-426e-93ce-caf5d74a5fe8", "value": "311b8ac8e8a7a264a9ae4ce8128ecd8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b0df5e-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595529, "uuid": "223777ba-676e-4196-bb6e-182ac8090989", "comment": "Malware payload", "value": "4d8840f9070ca26fe1404bdd3cc5104b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595529, "uuid": "9db5423c-5d91-4e63-a10a-e293cfcd0fb5", "comment": "Malware payload", "value": "3d40ce9c0f0e9e2a7bebf30f033f9458dbdef52f4bec1b6a2de8d295b6e0c3c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595529, "uuid": "5db3d531-1d54-4b02-9509-edca5ba5a3e9", "comment": "Malware payload", "value": "ee4e867527a07c32359dd019a248e16add9fe2ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595529, "uuid": "ad3e1d7c-1782-4b68-a8b7-90ea897f5d25", "comment": "Malware payload", "value": "07f5a366f09b2f708d369f47e46f20da17f230ae069432d62dc8232025cc37c1e7b25d2befb185b89adc0635094072c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595529, "uuid": "e673457b-f896-4525-a612-8a1cb2f0c396", "value": "T187C3395367E05616EDFA1A305BB25E348BB7F9B07638894F0490670E1CB16A1CD32BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595529, "uuid": "06083a9c-47ad-49fb-8204-82bf03f37ba2", "value": "1536:6+ozNXVsokDU6FySc4MnnvjBh37V00umTumhIv8zQ7+:tuXVsokDRMqQBhLBTumhI0zQ7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595529, "uuid": "1bbb8a42-ecf3-4860-86b1-e388166c1d4b", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595529, "uuid": "b38f31c0-3324-4384-b731-d16d34404e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595529, "uuid": "f4e20315-b052-4217-8813-6a93ce17ee09", "value": "SecuriteInfo.com.Trojan.Crypt.24280.1173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4816c256-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571745, "uuid": "2d5f2f10-ccf3-442b-a862-f2029dbe3fb6", "comment": "Malware payload (Mirai)", "value": "02bda3fa1db4aec1f0e1a43bf5f81a70", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571745, "uuid": "0c32d5b7-01f5-430c-b516-16f34beb3feb", "comment": "Malware payload (Mirai)", "value": "3da6bbafdb139a2862dd64cc5c88e662c9c4fa3ff1b2741da415c3d491daad66", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571745, "uuid": "0d6890d2-5fff-42bd-8584-48d581cea685", "comment": "Malware payload (Mirai)", "value": "12de9b434ae63eafc4055d280923189180b2c176", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571745, "uuid": "a26e332f-e493-48cf-b00f-14f034470fdf", "comment": "Malware payload (Mirai)", "value": "8fe06e8641ba7e4b5a78952c954d11b0cdede22b7889fdb0f742a1c3e53ca45d8678af1b3260b59880e8bfca5063ebdc", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571745, "uuid": "bf9f4096-7a77-4424-937c-84655392667a", "value": "T13AA34982A780D5B3D19306F6129B8B150133FB3F4A6B9EA6F35D3CF48B109C57261B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571745, "uuid": "d67fde12-ea69-4035-84ac-45999ff18878", "value": "3072:dUICodUWUh917j8mc2deiPUDAZURyPf55hVT5vxinf0OzTyoQQub:tdRu917j8mc2H5Z5Px5h1Vxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571745, "uuid": "c5254584-078d-48c6-91b0-2a23414b7c58", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571745, "uuid": "71232bdb-12a5-44ee-a0bb-d95b6722c6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571745, "uuid": "b7cb000d-dc24-487e-bbb1-d0baabe43888", "value": "assailant.i586-20240316-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9549f64a-e384-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710586907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710586907, "uuid": "6c1ad431-d1e2-4358-87ad-7cdaa7332cd9", "comment": "Malware payload", "value": "a0af1cc1265b96de8699a4daeab236a7", "object_relation": "md5", "Tag": [ { "name": "pw-022024", "colour": "#688463", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710586907, "uuid": "39c9a6cf-f6ad-46cf-b667-bac9ea415d92", "comment": "Malware payload", "value": "3f79fff587d4eaee9ac530408280987e1317bacc7ada5acb163cffd618b9d932", "object_relation": "sha256", "Tag": [ { "name": "pw-022024", "colour": "#688463", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710586907, "uuid": "255e8dbc-cbb0-4d31-953d-30370e87036c", "comment": "Malware payload", "value": "9123d4abce7af105faa7c32c3a2ea5ad4d219d2c", "object_relation": "sha1", "Tag": [ { "name": "pw-022024", "colour": "#688463", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710586907, "uuid": "44a82ee9-880c-4cdb-a878-7d2e9a945470", "comment": "Malware payload", "value": "4c027fcf43b50aafca54f51c9bcc14d043381d4c4ca3a602bf272a58b52ac31c7c9f0d4930f1b214fb6a86ffff4d5e81", "object_relation": "sha3-384", "Tag": [ { "name": "pw-022024", "colour": "#688463", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710586907, "uuid": "912fb6ee-99cb-4cec-a939-0505231154b7", "value": "T150842393BC6C5A1F0ADCAC40EB69F17DCEB774562F66C6174DC8168B005BAC98802B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710586907, "uuid": "de6a55d1-5167-444f-9bb3-af147ff1db6c", "value": "12288:1fDgARzJdLN4iKWGBc2FW2JH8IhnscBhl:1rtRln4HW12FW2l8+7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710586907, "uuid": "c383d7b3-4bcc-470e-988d-58120eee15d0", "value": 404274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710586907, "uuid": "c511accf-aeeb-4819-a75d-3b15a91746dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710586907, "uuid": "240f998d-52db-4471-8d42-5edcd0081593", "value": "AI.Gemini Ultra For PC V1.0.1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0db59ab-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595516, "uuid": "270fde71-d428-4a0a-a13c-a52f6ee6a53d", "comment": "Malware payload", "value": "f184912ce1023f19e0dfaf6bb36f008c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595516, "uuid": "dad4aa55-3e39-4be9-acf5-54a780af2698", "comment": "Malware payload", "value": "40254fa55215e68f1e637babee17c92bed84e877d954fe6b49b628e73ed7632f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595516, "uuid": "22889daf-2b19-42ba-9181-9d788c16b9aa", "comment": "Malware payload", "value": "b690eb2fc76d0c086455a293144231588a57f3dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595516, "uuid": "75cf2fd0-c263-4c83-a6e9-eb75064d075a", "comment": "Malware payload", "value": "97612f21fc6441ea92121ff4629ae17493ef9cdfbb4d13897b919a7e7cdd224495a1a37bc2e985ddcd900dd0e926f975", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595516, "uuid": "706e23aa-65c9-47e8-b64a-3aa5e102e00f", "value": "T10F92BD767FA03694D848127525DBE56C4BEA8139BA7D240438BB665A3731032EEB2C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595516, "uuid": "77a27a6c-6313-4c5d-9b25-b6ae6569c824", "value": "96:YXa8BCMg6AWlHlu6KpBJhZo1XRLqV9M31eqMam:y/XlqV6c1am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595516, "uuid": "45a33a64-fb5d-48d1-bdb4-0b9c5a7331d5", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595516, "uuid": "4ea02cc4-bd3a-4f5f-b40f-70c88b0cd702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595516, "uuid": "8d46fd80-b7f4-4da2-8151-54db0ad492ec", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.11183.30490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ab7a9a-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710580524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580524, "uuid": "78897c14-755b-4371-a59b-c098fa520c47", "comment": "Malware payload (Gafgyt)", "value": "20634cf9c67a64e67a6ec4835d175ad9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580524, "uuid": "4644dd08-02fe-4760-a4ec-c3579db7259d", "comment": "Malware payload (Gafgyt)", "value": "405df0c7d82a46b693fcecf5d1a404ef62d2b7a4270b74e9a953f0091b796435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580524, "uuid": "a2b9bf34-8ddd-46db-a9dd-b3721302fcf0", "comment": "Malware payload (Gafgyt)", "value": "49a22ff2914594c796a7c0bf70ea2667c2d65c2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580524, "uuid": "6d92427b-10d9-407e-a048-84b791aca3cd", "comment": "Malware payload (Gafgyt)", "value": "8834d135db8ad63ed09b72fdffb5f9969c29cb5fb86f7598a9877d232485ce15cc9e773879cc8709e3b2ce3d94ef9311", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580524, "uuid": "3544fb5d-c853-486a-88f6-46494df90eed", "value": "T10FA32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580524, "uuid": "97c125c0-2c81-433b-9bdd-19bf8c04f201", "value": "3072:VSx+i6mqaObhN3nPNKV+qKmZuqQ4DPwXXtse:y6mRObn3nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580524, "uuid": "ec7309ab-862b-488d-997e-2540771d73f2", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580524, "uuid": "3a0357de-c3d7-4732-bd35-18c500d3a37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580524, "uuid": "eb6b70cb-6b29-4212-84d0-a5e149a32363", "value": "20634cf9c67a64e67a6ec4835d175ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d373cc96-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580569, "uuid": "d4eea79c-2eaa-45fa-85a5-b96356f620b7", "comment": "Malware payload", "value": "a0b61cf69094067a3821fecc7e4ec881", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580569, "uuid": "86d4e6e3-b067-4f65-a7ec-257daff6a2a4", "comment": "Malware payload", "value": "435ee009f58bf0a8b7b2369268ef64cd76f34b9b824092ffa8338c6e8b76a954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580569, "uuid": "c165efe0-7b13-4a5e-8d8e-670267f22ee4", "comment": "Malware payload", "value": "4d8feb42b5f4bc9fc7fb22d74314bebdb2f51c78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580569, "uuid": "6ef4fc37-9ce1-43ce-8772-88fdf94e06d3", "comment": "Malware payload", "value": "9f4fb404317bb8f335b97a84a6416f0e9633d06372f0e69c99d4c46246550b16dddf9ce1d260278b955adbb63459c5e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580569, "uuid": "c7562ef5-bc27-40ac-8227-6976d9f9c19f", "value": "T10C933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580569, "uuid": "c712c8c4-96ad-4efd-8c5c-0f47eda9d77a", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Jl4umXxVqDrstKfz9e:Q97vk51RcG7A/l4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580569, "uuid": "d0108218-703e-4d26-b32d-d9f8d3f6ecda", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580569, "uuid": "93abff8d-4fbb-4db7-b550-e0bf1634a80f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580569, "uuid": "9498a5a4-2088-4ea2-9d01-26af8efa7527", "value": "a0b61cf69094067a3821fecc7e4ec881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2632f9a-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710580540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580540, "uuid": "8a2303b0-1b65-4f93-aa72-f3b977b094fc", "comment": "Malware payload (Gafgyt)", "value": "0a3a0b7cac987aafe01d2183af08d155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580540, "uuid": "e6401128-169e-40ce-8864-097276954793", "comment": "Malware payload (Gafgyt)", "value": "43c413fc69699686198213fded639f5a4f0d9a2542504c89d80efb3e4ebcd44b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580540, "uuid": "7da851c2-840b-4022-9349-f799ef8b50a2", "comment": "Malware payload (Gafgyt)", "value": "ac460cb4ddffe9bbcbbe946a1666243cdb5dd101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580540, "uuid": "e7a728dd-02cb-43d7-91ef-6aa8505d5723", "comment": "Malware payload (Gafgyt)", "value": "ca5aba1d13b10031dd83e1ac8ef2309435bc254851552ae448438b49a99d2b82405d5843f67a7fceffc09f49b8a0ccf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580540, "uuid": "e6dc71f8-dc56-4813-9970-1e5c08b51676", "value": "T149B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580540, "uuid": "7847a209-6c56-476a-85dd-1acf0c24b2cc", "value": "3072:MSY+46m1qOzssuFPPKNy+AmkZrQAhPDCXFke:06mgOzJuFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580540, "uuid": "a3dc18f1-4b3a-458d-b522-921def0a0d85", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580540, "uuid": "1fa99239-df5d-410f-9b2d-da0785ccf9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580540, "uuid": "023dc374-13ff-4953-843e-76f93be2fe51", "value": "0a3a0b7cac987aafe01d2183af08d155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9faf9b21-e3c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710615701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615701, "uuid": "0947cecb-b857-4da7-8a93-d57c9c5aa95e", "comment": "Malware payload", "value": "3b8a99273669239bdec3bd8436e51ed6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615701, "uuid": "7b251b85-1a2e-48d9-b86e-644bef92791d", "comment": "Malware payload", "value": "46e0043900b33ba2246667042cacc7d0b656e97f47bd74b866951f2c08aadf53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615701, "uuid": "4c104b21-d607-4108-aee6-3c2598d7104c", "comment": "Malware payload", "value": "81d3e30bed52afec378afb0d8af6f3d25db2f42d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615701, "uuid": "ae4a9df6-a46c-467f-b3d5-d8f121ba138d", "comment": "Malware payload", "value": "223c0897adf12ebc386692fdff0b3b1c3a4a0f9214ae92e6de2919a5d4d0dfd0e44e7abc8dc18aa5b1d0637a760f6f16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710615701, "uuid": "17964bc8-544c-4277-8d73-29fb8611e468", "value": "T1D701155351905F14DC8EA032526F77C944E124BD7916904A943C72F0AC795D4AE96F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710615701, "uuid": "9d8ccb34-7fcd-4f8d-b3d2-d9afc3a0858a", "value": "12:Blnb35ifF7o1h7350l+AScdHb1KBctCVUR9lu4fKU/dYeTOxeei6TpM0XIl2bPa3:BlntYo1h7350l2cd71KetRuAKU1VjB68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710615701, "uuid": "fc571ac1-2dfd-4775-8e67-a973afc6d711", "value": 732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710615701, "uuid": "78d8a981-acf4-46d3-abfd-974ddfb95742", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710615701, "uuid": "2c4f3490-ca04-4f33-8712-9a19b9c6404f", "value": "FACTURAxlb_I_T2w(135).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0f300e-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595507, "uuid": "98a87b3f-97b3-4e58-b8f6-6ddc51482d2a", "comment": "Malware payload", "value": "da1b0070e7cdc88c735f4d42faef777e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595507, "uuid": "d6077bd4-91b7-4a74-8b94-0a9996da5b7f", "comment": "Malware payload", "value": "47ba26014a231d45c544476c2f8ac6f33ee0a6557002356e0914c2a856a3f3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595507, "uuid": "4d310d7c-d55f-4e00-943f-5c6b17571e3a", "comment": "Malware payload", "value": "199976f3b7fc106e6ed19cc9c68e29fa4cc31c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595507, "uuid": "88b4c1ac-ab0b-4a66-864f-3c62c0e217b8", "comment": "Malware payload", "value": "127d46f4426e53f693599e8c2ac92d762bc95da299e82b950c94be42568ec45a2863d1821424a087a447b9ccc9629eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595507, "uuid": "9b3444f2-7569-489c-b1a8-fb18d6666b34", "value": "T109D48D6AF6F380F6CA29113109BA2735E67997490B12CFC7635CCF185D3A1A1AE3F125", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595507, "uuid": "9458cfa8-61fe-4bff-8797-aa56f4c60aee", "value": "386cadf5e570f57f0a1e8b1969c4e7f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595507, "uuid": "b550a2f2-25a5-4774-9753-de785511e089", "value": "12288:UeCykFmJ/RC2CBJfqEJWrGs4HKORPRTAj:UeCbQ/c2CB//HKORZTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595507, "uuid": "3adc8189-1bdd-435c-b6e2-d95f1e15f166", "value": 599189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595507, "uuid": "ce4e5db8-a50d-4bb5-bec3-e413bdf0d65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595507, "uuid": "01caf930-f5d2-4e5c-8f06-119c16554c66", "value": "SecuriteInfo.com.Win32.Application.PSE.10ODIJ9.8369.15495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3beeb9-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595512, "uuid": "3b511cb4-22d2-4931-8ee2-11a18074f429", "comment": "Malware payload", "value": "e9d374ebba84aabc19f3d084e975883f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595512, "uuid": "61b6bb10-9826-4428-9c12-9b9b5e6a19a6", "comment": "Malware payload", "value": "483f0aecc756f535a173f5990a1fae8f49e9b582a9cd28fe1d1eb5560b4e25eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595512, "uuid": "420ef994-f6fc-4330-aab6-a4b34f872efb", "comment": "Malware payload", "value": "d9be22b16024924e8af2320e5c5137757688d079", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595512, "uuid": "9d3e996c-0e19-4119-a76c-e620de13f25d", "comment": "Malware payload", "value": "742e88731d5af63f4f79fa7fcda8091b74bfd35073f698a09a608c90ea028df3c1412f18953655b94221d98a34313012", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595512, "uuid": "e846c56e-913f-4673-a3a0-aef8a93d2f26", "value": "T14A452352BAD8C133C0DA017A4929831F95BFA9B0CFF9474347905B8A6B165E6CD3F22D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595512, "uuid": "807204c7-99d6-476d-a803-2c4d7e6238d3", "value": "a5b62b9c502b9aff0a3602a5798a619a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595512, "uuid": "597903f6-c036-4340-9d83-d33d42849218", "value": "24576:ZKZ8fg52/Ob/fYh1K2a8FeggTz14ZAb0zp132vYYzfBpDIANNSsiihEsSCxs:ZK84EmyFaP1fS32g+6AzS8hEsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595512, "uuid": "f4594e89-bf2c-4fc9-99c4-23783865ae4a", "value": 1193547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595512, "uuid": "20c63c22-eb2f-4f00-880b-65bc8cc8c301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595512, "uuid": "21de5b78-a53e-4282-bd19-3a6aee608467", "value": "SecuriteInfo.com.Win32.Trojan.Patched.Y@susp.28746.22595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a433ccd2-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595522, "uuid": "9155fd61-b9b3-4dae-8af2-f581879ba6c9", "comment": "Malware payload", "value": "e96e47c2f03a82f460f886a5a8a668e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595522, "uuid": "baca144e-1322-4542-90af-d90e4e2df528", "comment": "Malware payload", "value": "4af796b21001a52512a97e1f1c4d748410c490b2ec21b36182f48e5fbe4a4898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595522, "uuid": "89c9b359-ab28-4fba-9f34-f0885282cba6", "comment": "Malware payload", "value": "a6c57b62c5316516d94654ffb0650e2773ccb5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595522, "uuid": "746616e3-144d-493a-96e6-da32c9cdc4e7", "comment": "Malware payload", "value": "d7cbe355c886f20e8b97d6767c86f0e12dcded9ee39de7bb611de1e4dd605ddc322d6601e9c12b39b900b6be7696ed20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595522, "uuid": "690cc853-a8e5-4fe4-ac96-1a80fddc3f66", "value": "T170550202E6D270F1CB4625F1067E373BA6799B4A1325DFC3D3A4ED619E32281D53B229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595522, "uuid": "bb8b4664-201b-4f11-bd6d-30314baf911f", "value": "24576:CQjEvkmTmMpBkShbLo9wKmZKwBSSQLrHLopShlB1MKXitYEVJn2:CQQvC+hhbLLi5LbLopkBnXitYMd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595522, "uuid": "01112b0c-c799-4ab7-918a-7e4563461d33", "value": 1351808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595522, "uuid": "60c111ef-94eb-42aa-9b91-43cce16d95e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595522, "uuid": "eec9e69d-f17e-4870-a627-bc768a14486e", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1P18FW.15429.14637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b813b7-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710549882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549882, "uuid": "e8d5ff32-4454-46d5-8269-47cd0f84ef9a", "comment": "Malware payload", "value": "c8ad67a104a9a90e348aaea1dd445687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549882, "uuid": "a3016ae3-30f6-4646-9d4a-53b2a03be73e", "comment": "Malware payload", "value": "4b23cce2d544b1ddcbd5da5360b2aa2ce909c043437945d020dd4461470f808b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549882, "uuid": "0965bba8-45bf-4288-84a9-e7b67fcf9d64", "comment": "Malware payload", "value": "803434b1bbcab5c01a44c0fee2c7b72b79a8974b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549882, "uuid": "a21add66-0c46-48d1-b6b9-2e90b7f6ebe4", "comment": "Malware payload", "value": "6b7b7568a0bf1baa1a841751a49d69b7ac849afd55fab04d13231dc299b8a3f9b7a62069292d1f99dde203fbc04f04c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549882, "uuid": "9427c9fd-d986-4329-ad7f-f3b81a673ea1", "value": "T16B03E063A48B9836D2F0587FD70ADC4A2BFA4FB0F6C532911D12888A305377497E4BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549882, "uuid": "f7e19d42-5908-4cbd-b6da-9db47265c91d", "value": "768:ADgqYnyXlfmxMLyqJ0WB3X97/RDLW2nZK8yyQIcBWW9zs3UozYz:Agny1fwmyqJ0WB3tduYZFWzsz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549882, "uuid": "03944442-5e53-4266-ad10-9dad34a0e2bc", "value": 38812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549882, "uuid": "1e994117-911b-4d91-9ea3-adf4491f9864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549882, "uuid": "3ea228d5-7d68-438c-a586-1baf63a0dcbc", "value": "SecuriteInfo.com.ELF.Svirtu-AA.6556.17049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bd656f-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580548, "uuid": "921040bb-b83e-4851-813a-9e31a2f73058", "comment": "Malware payload", "value": "4c6047d62b4718c1edf79c0c9a700470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580548, "uuid": "800563e8-9768-4ce2-a52b-a05e67cd1769", "comment": "Malware payload", "value": "4c0bded363246d0e571fded8ba1067fb7d7d2e4ce3ad800092293138a9cd533a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580548, "uuid": "ee5c8415-1264-436e-ba81-9e535d3c7357", "comment": "Malware payload", "value": "ecb1817971c5c869694aa46d8a92eb286aef94d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580548, "uuid": "5b87e537-69d6-445f-9a16-42b96bd5ffa0", "comment": "Malware payload", "value": "1abe114341214c1663af1269fd6fd463c3a195256395fa4aa565cfb0e91d0c850885752e418affbfe6a72b0a3acde52f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580548, "uuid": "c684e8f1-5452-46af-a567-f69ded3b8131", "value": "T184C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580548, "uuid": "5b261866-2815-48a9-abba-d94421b9ad4d", "value": "3072:ekYPUfsgnsb0J2ag/VfOkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0OkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580548, "uuid": "a2e58b89-9aa7-4a26-b47f-4085bdcb4305", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580548, "uuid": "c384ceb8-6768-4790-a62f-c4f38ce2364b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580548, "uuid": "af7fda75-b1fa-40b4-ae38-e1190768f046", "value": "4c6047d62b4718c1edf79c0c9a700470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6f9935-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571757, "uuid": "047577ed-0a70-4cab-a82f-d52fcde1c5de", "comment": "Malware payload (Mirai)", "value": "352a0ff552145cd2eb7858a94161ba75", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571757, "uuid": "fd119f5d-1363-4bf6-8156-71083f1c7fb0", "comment": "Malware payload (Mirai)", "value": "4c2c904a3161090b849f3512ce20c6f0c4183f02ccef607583692bbde5ed0b17", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571757, "uuid": "455f6b90-4840-49f0-bdb0-2f96601fcab5", "comment": "Malware payload (Mirai)", "value": "9be952e37f531743ea64e381ec0740bf0abdb317", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571757, "uuid": "9aa5771a-ceed-40af-816b-d43a0d15fc9d", "comment": "Malware payload (Mirai)", "value": "c4909f9af98cca5bb744b6e56fdebb00c80778c912e7650db6c66dc9cb55d10cd573830e6741c36b70a53172c8604c3f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571757, "uuid": "a1a172e9-4e8a-47ca-abc1-f2ce1d074d08", "value": "T161E3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571757, "uuid": "bcf2a5bf-84e5-4357-b78a-773deeefe8a7", "value": "3072:MzBM1x2GPyaT/f5hKGE6aWURxuZq+1uPNd5R:ENORf5hKGLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571757, "uuid": "a60e7556-5d5a-4bb9-88a5-2e5057e686e3", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571757, "uuid": "fd5a6846-b576-4d29-a888-22a520bcc1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571757, "uuid": "6fce92da-4a13-4f70-ad9d-ae7f59fbb1d7", "value": "assailant.mips-20240316-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfdbb8a-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710580692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580692, "uuid": "f59efb0e-f259-4d2e-9367-9c23007bbda3", "comment": "Malware payload (Adware.Generic)", "value": "d0d4b05c2b9b7cd1b056cd619580c854", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580692, "uuid": "33623dd5-96c6-4414-854d-68c2cbf77502", "comment": "Malware payload (Adware.Generic)", "value": "4fd594d6b504845b7e05d9b129bd36b2f7fd9dd71403b4a3a3d0c3b7a882f4e2", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580692, "uuid": "c3530a0b-35c4-4a3b-83a6-6166f70ed57c", "comment": "Malware payload (Adware.Generic)", "value": "31e772d20daa64b497622da4a54743b829f32bd0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580692, "uuid": "4475e5a3-3221-4d08-adef-708679ed83fd", "comment": "Malware payload (Adware.Generic)", "value": "8aedf7b6ffe3c4b9730a18910cacad0268eba925331f40fd24fff37d38696db92ced6b3e8b48dcd0c291991c9c83b1ca", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580692, "uuid": "071f53be-68c1-4c4d-895d-e07a0ee06906", "value": "T10706CFFAAF5760EFC4E94671C5725E30587AEE51641F8C3A0FE0344CDBB68AC1A2A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580692, "uuid": "f19703af-5130-4aca-bd12-9c4159cc7e5a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580692, "uuid": "9d04c65d-f273-4e5b-a431-978f42c630fc", "value": "98304:skLyNo01VA4hzP2ixt4RAamul5hmN5JmX7b5eNoy12:LKs4RPx/4Yc5OXeHa12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580692, "uuid": "3c6d2458-4ba1-46c6-acb6-646d3062223e", "value": 3831240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580692, "uuid": "c8f259f1-418e-4577-88f9-e2ebb33ed3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580692, "uuid": "9c4a5a75-babc-41af-a254-ff9520acb335", "value": "InstallDefenderUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e983db2e-e347-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710560849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560849, "uuid": "63f91d49-28e7-417f-b6be-25004a3a4fad", "comment": "Malware payload (Mirai)", "value": "bfc7f6cfefb057236f76c939fcb83901", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560849, "uuid": "72c01926-9de0-4564-ac95-a61fb0d0613c", "comment": "Malware payload (Mirai)", "value": "5325f8f66a6aabaa507fc02c1d402b6620be02877f6276f9c1e9ae828ce46033", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560849, "uuid": "6927c02f-68f3-43b4-beea-d5b24ceeeac8", "comment": "Malware payload (Mirai)", "value": "66bc78a84695085db0accc0bfae118463b1e607c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560849, "uuid": "af3252ea-7b56-4b28-a4fc-bd1e189ec5ab", "comment": "Malware payload (Mirai)", "value": "310dcad4f6a26da121331858f6db78816e74d787d58b76e55be880675794283badd7a77beca8fafcb86cac406dfa3e31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560849, "uuid": "4ddc88f6-4e92-4ee4-ba41-2148f9529cb7", "value": "T1F8E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560849, "uuid": "0767a389-907f-40f9-9441-829d783de831", "value": "3072:Cv/WwsLgaq353qHiCOvhOp6qkDQHbeskmhxQwoVSUNu:KPLaq351hOp6qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560849, "uuid": "cd23d966-48fd-4e3e-863c-f2b404211ebe", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560849, "uuid": "c7c54f8d-c600-4219-a5a9-3e1c4c2c662c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560849, "uuid": "160343d6-4316-4fa1-853a-c975e6c0571e", "value": "bfc7f6cfefb057236f76c939fcb83901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc76ffc4-e348-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710561203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710561203, "uuid": "73c6aa56-1990-4b5b-9815-9e158151cd16", "comment": "Malware payload", "value": "8c02dd7abb7632bd09399eae59ce60e6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710561203, "uuid": "261d9687-f7cf-4327-96b7-d6144bc032c5", "comment": "Malware payload", "value": "5601c6c97ab6e5bf0e6b5550c4bf067366e9d1b9f202e345b7fdfdd17f3a0486", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710561203, "uuid": "c5d4c0b0-ed59-49a5-a157-89c58653bc9b", "comment": "Malware payload", "value": "759d4e1a119d584d51adbd23d62b1fb119315c9b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710561203, "uuid": "ef49d0b9-2d1c-45d1-806e-9a8d18dda4b3", "comment": "Malware payload", "value": "4a1e90c8a652ec0b08101f37ac3085b931ce125c503a059a38520c6ea80fb978b3ff9897ffdea8043061dd207371cc3d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710561203, "uuid": "106e81aa-b127-4de0-8417-41a6ea74af93", "value": "T1239402055E1D4D23EC8372F06A64F1A14836FF2894A1EFC6F74150CEB9A636B65F8236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710561203, "uuid": "c142ff35-c55d-4e89-afea-6eb270031e9c", "value": "6144:/liMqOup/A33wdHkt2+RGqZPsU1rBiH3KVaxdyR/aEfQ9hbbAIiOGMorfUtV/J1I:lqOupdt05M69reasxdyRSpNkCoLUJzgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710561203, "uuid": "65c633c4-05df-4dc6-96af-f3811f503037", "value": 423136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710561203, "uuid": "fadf6020-cdba-4234-b7c1-2259e08c4c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710561203, "uuid": "b35506ce-2511-4d23-a23f-94332dbd4d30", "value": "8c02dd7abb7632bd09399eae59ce60e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99215654-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595503, "uuid": "b5ec6999-0739-42b3-953c-9e553eaf627f", "comment": "Malware payload", "value": "641dd1e498c32280e4650185a27f071f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595503, "uuid": "c55010ee-752e-4c8c-a999-91c72cc143df", "comment": "Malware payload", "value": "5a0dd473002905bf1633d2e7b3b0d45f3ec977a42ac55585956f9cb7cff4efd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595503, "uuid": "f471f1aa-4654-4b08-9914-8d3515c83219", "comment": "Malware payload", "value": "21e66c84de92f524fb956d31c3369f10840de537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595503, "uuid": "33ba16c2-9eaa-4225-bcbf-8c4af0277cfb", "comment": "Malware payload", "value": "ed91f91ee73f6ddc4c7e58527886ea605bf304cb3e5a71f2b08fd4e25d7cb8b20c7b998793fd2200e88ca41cae5d2349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595503, "uuid": "9109145c-db2d-4f87-afc3-948a770eef1f", "value": "T18F05CF1C3FF2F25BE193C2B28812D32926FAF4909E318947F0DE130DAF55555EA66B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595503, "uuid": "e222171c-6b8b-4bdd-9186-e895256becf7", "value": "12288:f28ZO1lzjSYfYpKjymkUthHXThYehw700yxF4GFQGmbOkmbOkmbO:Ollzic31YjA0ygGFQGmakmakma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595503, "uuid": "3f955d33-2326-4786-bb43-9ca11c9ce103", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595503, "uuid": "ab5a6287-acf3-431d-b127-94d0267d74f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595503, "uuid": "31f3f518-7fa4-407b-b2ad-c99e47b32b93", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1316161.17520.25276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a26fea9-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571749, "uuid": "a7b550da-8f79-44db-bb15-82d831ec73d6", "comment": "Malware payload (Mirai)", "value": "dcf9fb458ca7f5bbe1f60d9106db4769", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571749, "uuid": "2097af75-05ec-438d-8b54-c9c7caadffac", "comment": "Malware payload (Mirai)", "value": "5afac188a5741fee710f74e5e9a17b74c317bd4611d212ce32ec6bdbcc9490c1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571749, "uuid": "15d61a46-d942-4217-9b59-511e101725d3", "comment": "Malware payload (Mirai)", "value": "02b3e0600ec88ae25f7b3af2b822765108c2c3f2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571749, "uuid": "e800a4eb-1a1a-4f55-b1ac-626614a2c2ed", "comment": "Malware payload (Mirai)", "value": "08e6de85abab523a35e935bd999eeda58851529c8eaed22189d4a2a658556754ecdd3bf0bd4d15d5f5da675c5bdc0a16", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571749, "uuid": "d735b94a-92cd-48df-bfe9-67d0f66cd460", "value": "T178C31A05FD404B27C7E227BAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571749, "uuid": "5dcc81e2-d96a-4224-8ead-1901eebd9597", "value": "3072:SJDZ+6lJQTnoo3DKOzmGfcX5J5hLuhu+6+1AzfqojwQQRh6RYAvZR:RmGa5J5hLuhucojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571749, "uuid": "6bc47171-22a1-4db9-9ccd-084de549d227", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571749, "uuid": "7ecc222f-a5fb-4476-ac1d-3612c83b9517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571749, "uuid": "3d2e5c8c-131e-41fe-8bb5-8a7702b8cf94", "value": "assailant.arm4-20240316-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83f8d6f-e32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1710549680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549680, "uuid": "d2ef930e-d8f7-4f59-925e-3af4c57cb3a7", "comment": "Malware payload (IRATA)", "value": "0426f0f7d5c8ccac04f8e30077d7d1ea", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549680, "uuid": "7e10c68e-ade6-4526-b029-66ff3dca5f62", "comment": "Malware payload (IRATA)", "value": "5bc930ea8c6d53a3f9d4081a99d604bde58b5503aaa937c969a26c01d0f86c05", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549680, "uuid": "b74129db-57be-462e-b545-e5fbeccd64c7", "comment": "Malware payload (IRATA)", "value": "724612f75ec32a0bc96cb8a389044f3fd54bc39c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549680, "uuid": "c51123b0-a5e9-4363-b01e-6044d55f2ee5", "comment": "Malware payload (IRATA)", "value": "d3df210d90fdc62b0bb0079fe52489e3f352c6fb8809c1f3b37bc459f853797460a0d6cdbb42b5fa35a92f82d80a8718", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549680, "uuid": "3a4e3989-1f30-4120-a308-87ae4defe1a7", "value": "T186F59DDBFBD4A91BC4F39332D27652A2510B4C268B87DEC75D04363C29BB5D01E5AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549680, "uuid": "a0e65ccb-f807-4afd-b598-f346786efc63", "value": "98304:Bl4wny2QuzEoTwr5qox+Jh8kVflKouoCxn:B3hQuz12OlEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549680, "uuid": "1549640b-5c80-44e1-9544-277c04e8017b", "value": 3579697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549680, "uuid": "cc067357-026a-4cee-9c1a-adc0faba17c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549680, "uuid": "930dc241-8c76-41f2-8e8f-09d5ec03b865", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c008bd8a-e3af-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710605447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605447, "uuid": "c0bfcdf2-b2af-493c-9150-8783bae17d2f", "comment": "Malware payload (Stealc)", "value": "407a0ad99960af1965087969af233fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605447, "uuid": "cabea2a1-cde9-4f5a-a538-099ea2fc0aed", "comment": "Malware payload (Stealc)", "value": "5db3ec41ae7137a8fa030fbf8d923a3f3faa0a75a01f3399944caf28b03acde4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605447, "uuid": "58ff7a23-3575-424c-b21a-911d67a435bf", "comment": "Malware payload (Stealc)", "value": "caadefaf5abd654f5c33fa495113cd34c07a0c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605447, "uuid": "e8c226c4-00c7-4a91-8966-7bca4c049f58", "comment": "Malware payload (Stealc)", "value": "8d861e85671816d38df708b3cdd9d1917419ddc926ab3e9a86e4c8205f3aa509989de4acc9e3700b2464f71f420416ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605447, "uuid": "bcbe5b05-27c9-4021-9e60-a1839658c735", "value": "T1EF24AF0177A2D821D661CB304A66F6EC562EBC80DEF5514FB2C43ADF1DB17D0897A32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605447, "uuid": "d56fef75-864a-4671-9fc5-7f3b6ba38636", "value": "4579d21a0e9605f673d9c393af3cdfd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605447, "uuid": "e056b35b-f7d0-4c68-a1c2-441dfb6f2ffb", "value": "3072:g6Dz6hKHzisJhMR2nE4ynBQIjN6Wwe9w1RBeg8+/yGNV:hDKSzBGjIdekRBeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710605447, "uuid": "2bd2619a-e6d4-45a5-bb15-43ade4c1f8b4", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710605447, "uuid": "caf812c8-95a4-4264-9afb-833702a44300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605447, "uuid": "efc48522-8f04-40da-8a60-fe382805eadb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa973850-e3b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710605841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605841, "uuid": "a4b9ec2c-5c0f-46db-a680-c9af44ba9659", "comment": "Malware payload", "value": "69074ee0f881ea1c249f175d02087515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605841, "uuid": "a67f07b7-4c31-4d4c-978b-8b01b95daf9b", "comment": "Malware payload", "value": "5dc94cde8d00d485b40e186efe0f35ced963410dd4d420afbe889f0d52b9809a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605841, "uuid": "9b7925cd-aa13-4a12-ab26-793aeeef7e15", "comment": "Malware payload", "value": "7bab60a272c683e02e1c8eb18bc72f2a4253d108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605841, "uuid": "fff10c5e-4066-4375-9173-e01ba0471ac6", "comment": "Malware payload", "value": "96143ddf40ce9fbdd424c864f01d283f3a2dc7280281087df80746a6f75d2f4171dee4b80e98715e7843adb55efeb4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605841, "uuid": "e69b63ca-15b8-495c-9ea4-82b516db90a6", "value": "T15E663382FA86559ADD32FD792527C660D721BC324CE7DE6B34387A7F6D33060616C20A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605841, "uuid": "44f904ac-08b0-4185-8730-0f160aa19b08", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605841, "uuid": "0e6877e4-d41a-4b68-9798-b17b2c3773dc", "value": "98304:0U3vcw1bj3HAvH/830OmnIAfJxZUgujjOMFoIIungptW6WvlSBu0OLZmWPg8gIWA:r3vzv3hYBrumMFvlkY6EowvYlLtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710605841, "uuid": "990f4a8b-13c1-4510-acda-ebccd5e8408d", "value": 6958744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710605841, "uuid": "3cb89b75-f61a-4508-9649-309b3d6ad95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605841, "uuid": "17d717ce-8b96-4cad-8c1a-130ed42327e1", "value": "SecuriteInfo.com.Trojan.Inject5.2862.27803.32505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acd6c5e-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710580689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580689, "uuid": "abd58958-5708-4d69-b0b5-8d38ab079ba4", "comment": "Malware payload (AgentTesla)", "value": "dd1db1edbaed7878b1d5454ffdf56063", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580689, "uuid": "f1071d84-c8e6-427b-aebe-d9bb4636d83e", "comment": "Malware payload (AgentTesla)", "value": "610224addb5b75398e556cf9780a9ad26891fa1754cbda12637903560d15dba4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580689, "uuid": "90114fc4-49de-409a-b3cd-3017f5666b18", "comment": "Malware payload (AgentTesla)", "value": "26c96fcc597261a9ae8bc3646067dd5213eca17a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580689, "uuid": "b4ba6d66-5456-4417-81ec-2c37405291eb", "comment": "Malware payload (AgentTesla)", "value": "49cfa643d664a5fb67a14787b8ce38f2cfe2c36f0abc156ba736dde52c17e3c313caac832d8441ad88f228007740ed2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580689, "uuid": "e175a495-7592-491d-99a6-87c646d5b771", "value": "T18DF42338A4B0967FE97D07785AB3F46D163B587A781CDF2C9FC800CEC8986564227E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580689, "uuid": "f312b0a2-4a5d-403f-bafb-503db5b84666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580689, "uuid": "d4d5649c-d41c-4cf9-8f00-71c5b9ec0455", "value": "12288:IHwg+jQteNuSJDGJSKVSKXhoFAZfOiOyFQthJT3tCWX8CuVhh6wr3bbXvTZsrbN2:I+jQENuSJSDXhoFAZfOi9Fm7cWX8CahU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580689, "uuid": "6bb73a72-d417-4c83-a453-1f906653137c", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580689, "uuid": "9045fec1-ce46-42e4-ac50-d1d92af55a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580689, "uuid": "3c4f895d-24b0-45cb-b452-152e8ff0ccb1", "value": "Invoice202403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d79f1c8-e378-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710581659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581659, "uuid": "3da75f84-e5eb-44ce-a9a1-71565868254a", "comment": "Malware payload (AgentTesla)", "value": "e118c380a2f2245ab6e3affef9bb8547", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581659, "uuid": "4d84eead-2b97-4c06-a4c5-1b5d7dd923c3", "comment": "Malware payload (AgentTesla)", "value": "64f5053d65126a4df7f1a80b72c580e09695502a42d7ca7445601170ca845771", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581659, "uuid": "cff2dff2-4c5d-4096-b60e-1b7215a9eaef", "comment": "Malware payload (AgentTesla)", "value": "0fa063133a50c1bf2fb9d9c37a2d69859c1a5363", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581659, "uuid": "5d35e46a-6755-402d-b1f3-b7d8d8cad4e9", "comment": "Malware payload (AgentTesla)", "value": "dc05363ec06352bf5534c794391c4b11a99da3345ee8d74788ed6ff066725ee44f684ed0ec073203b873a03d7c4682b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581659, "uuid": "cc34db32-2c3f-4f5f-ba04-0ad6afba312a", "value": "T1FDD433810C6CD8F9596DB3893B8C800097998C6E4F3FBBA772C2559BD1706AE50B71BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581659, "uuid": "8a745a41-90fb-414d-92fa-e57d6a8ec8e7", "value": "12288:L4Z7opJ8DsCQnE0xZrfI01qF0FTByVphSAfgwprf2B44pHFwBMCmAQx6:LIMAF0xfIMqFcTBerfJ12B4olR2Qx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710581659, "uuid": "d6b8f619-510f-4021-adc5-caef537dcda9", "value": 640061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710581659, "uuid": "fc4daee0-4281-455f-907c-fa05f863d332", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581659, "uuid": "601f70aa-212c-4e4e-9747-dcb98def5dc4", "value": "PO439 Enquiry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c59983-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571743, "uuid": "6c296307-8ada-426c-917d-74838e48a373", "comment": "Malware payload (Mirai)", "value": "728b3e853d6c6fe5fabe4bc41d4d8d82", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571743, "uuid": "4c9d5990-b9f5-405e-97e0-0f41c8ea2f5e", "comment": "Malware payload (Mirai)", "value": "64f94fc125223e2412b1995b15c33236d5e17276d05372a5b1824197c5d1a18b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571743, "uuid": "b623ad8c-d839-46cb-82b1-96fe0d1fd4dc", "comment": "Malware payload (Mirai)", "value": "9870170bba9562a7cd3c8f92ad8c5af0c751c33f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571743, "uuid": "44f313a0-e7ce-45ae-8202-10de8a995ff0", "comment": "Malware payload (Mirai)", "value": "8d4bc456f5036d66fbfa69aefee8f00c3a794b0e633977f243431a82c650358ad66ca78711fbb631c9418dfb0f97b80c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571743, "uuid": "0dd77465-4790-43ff-b06a-9ec712aae7fa", "value": "T121044A05DA809B17C6E23BBAF79B428E3323975467D733058928ABF43FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571743, "uuid": "47d6a89d-7464-4e37-90df-de2fa2e4c9a8", "value": "3072:0V/Yb/dnp+eQPGp+37T/a+Brz/5TPibksbfh7r45hLaq3zVbYM/9cFommw3Bq/1A:d+v/a+BrzBTPAbfhA5hLaq3z+M/9cFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571743, "uuid": "c384a210-6897-4781-9328-e1ac9b9c1c37", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571743, "uuid": "4f38c7e1-8a4e-4338-ac06-829376d1cbdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571743, "uuid": "e05cd993-5843-4d84-b57b-b5d840137a1a", "value": "assailant.arm7-20240316-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58973f7-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595524, "uuid": "245d4755-83f9-443c-9f18-c5a3e5082cd2", "comment": "Malware payload", "value": "93694918d7a9c6ab6ef60c6ae773129b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595524, "uuid": "57c0150a-6309-460c-b541-a2b7beac7646", "comment": "Malware payload", "value": "65f90903fbadef3138d1c07a075b2fdd0b5b6fb76afe7fba3ac01155e9a5fd5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595524, "uuid": "18c92e41-78b2-4066-bf3b-64ed12f250a8", "comment": "Malware payload", "value": "4b30b9105766202de89e7b0d73592c7251399ff1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595524, "uuid": "a262226e-0d2b-4858-8a47-f93e91d56799", "comment": "Malware payload", "value": "6636dcf5f667eb267ae3da754721e3c0e3a18d97c46fb3f34edc6d81624a64e7e51482d0eb342220f0f97ad68ea7c356", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595524, "uuid": "2237af7c-89c2-440f-bb0b-6a4281b12b2e", "value": "T162B49D43E69240F1DB49357115BF7B3AEA7D8B8A0138DF57E3A4EC625D32202E51B21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595524, "uuid": "9488654f-8f12-43c2-b14a-e5ef4476039f", "value": "12288:LioDQDqUiv1Jtoomkq0BjLX8v517fuZ2Xff:LiNqUiNJqow0BGhff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595524, "uuid": "6383ddcb-4a88-4780-af89-01165f86d1ff", "value": 532939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595524, "uuid": "395664c0-eca4-4929-bb7a-11a42c5f825d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595524, "uuid": "c3c377de-f7e8-4b58-ba66-88b315ec8c29", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.16530.8105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cb1b15-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710549887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549887, "uuid": "5b004c0b-5a67-4ce3-8d3e-3a24f63970ad", "comment": "Malware payload (Mirai)", "value": "ba3d669c0cfef1dc146f51fcfc1d0def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549887, "uuid": "d6824fc2-3888-46aa-830d-9afa2b98fb50", "comment": "Malware payload (Mirai)", "value": "68c1fd6a37a0111aa97ad84c518afb5dc6858f0d1e8f499c0a9eee5909c5e344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549887, "uuid": "9f9b3af7-12e0-4fff-97b2-b7e86576ada5", "comment": "Malware payload (Mirai)", "value": "a7e451a84108cec7566e8a0517a38c194e55bf66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549887, "uuid": "7227d3fb-b328-4bf6-b260-e40a6b82e0fc", "comment": "Malware payload (Mirai)", "value": "80ccc6c3d46d9a904068ff0a8bdce99d77e42eee5dc7857b4b9df417cc1f688cb88a96222c78f1400b7701e8aa1d1ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549887, "uuid": "be268ffd-fc38-4117-8931-263997e657e1", "value": "T11913E112A336DE11DD316E7AAC7C4B84A7E18B7D81A734BB112899BEA0D084601FCDD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549887, "uuid": "5a3f80ad-2e8d-4b72-9cd0-f884b58d80fe", "value": "768:m5MLoTouRmad8fWDmBUzltZoo0oYN3lO3dn2MrjYgwigBuQnbCFZZxbmO9q3UEL2:pLql8femBiltWyYxlidzrNgBuQbWrCL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549887, "uuid": "d3b54aee-c697-4f81-8286-27b52d300911", "value": 42012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549887, "uuid": "9dd8515b-43e2-403e-a355-b755e1c8b176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549887, "uuid": "ca36c7cf-a9c9-4d79-8b3b-5029481032ca", "value": "SecuriteInfo.com.ELF.Mirai-GH.16597.24230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc94ace-e390-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710591941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710591941, "uuid": "7ed57209-306d-4a7c-9104-ff19830f3d1f", "comment": "Malware payload", "value": "7d070c4aed47e3c53aebf3103b312a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710591941, "uuid": "e6d3e3d9-5462-48cd-a03f-611a9d99c050", "comment": "Malware payload", "value": "6a3dec4a59a44939182a2738a536dec75650698e5f405c3eb7cf79ea8e1b2806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710591941, "uuid": "78f3a692-de51-4ca6-b759-da5bf27b1592", "comment": "Malware payload", "value": "faf07dd14aedc56d9e4826e366c8de9606dddd98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710591941, "uuid": "a313c1dd-83d4-454d-89fd-989f5e2a3f41", "comment": "Malware payload", "value": "423c03bece8775caf5476e5698467e972e7ab5ab4f71edffd91155bde2e8357ec3c8c6e3062edd8f4cb83e5ab7d90003", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710591941, "uuid": "e0081b8a-af8a-474c-a558-db302e8c2515", "value": "T1E07633324BE4DD22DBF9163BE011EFD013F8EC5C1599B986030C327F4B68A62D56BA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710591941, "uuid": "1b986506-0a3c-4dfa-8874-646724757e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710591941, "uuid": "1ba4baf4-a04b-4555-a85d-ce2bc4e2a5ea", "value": "196608:6HqpcyCoR7n2TPDeiRLbg9Hoen/HpgmpQc:6HcdR7n2TPCiRA9H1n/pgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710591941, "uuid": "89414b32-9e19-4d52-a776-221b7a6ec51b", "value": 7162368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710591941, "uuid": "25d7ed86-e42f-49aa-82e6-d40f73b2ae8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710591941, "uuid": "98576950-af02-4625-b31b-5d6eca6efe92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71414481-e3aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1710603167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710603167, "uuid": "e456810b-253c-41f8-81fc-c7f0e7be8846", "comment": "Malware payload (CoinMiner)", "value": "c22fcd1a23d0f202cd0602f15ca4a3d1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710603167, "uuid": "f7b5b57e-7f3c-4fe7-8330-d9e332de98c1", "comment": "Malware payload (CoinMiner)", "value": "6b8277813999b908fc38eca68db5249fe0b76a8f652cb1a5a21d073247ed7dc4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710603167, "uuid": "a02df9e3-485d-4c13-8991-57e298aa299a", "comment": "Malware payload (CoinMiner)", "value": "e3f5a2ca3265ecfc9e36ce4eef23fb3d41cbf99d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710603167, "uuid": "e4a39743-c9c2-4346-acb4-bf4141505431", "comment": "Malware payload (CoinMiner)", "value": "5ad3d9b0ab347a05f0ae4fcc72b857cb7c0e467ac07fe8c04aaf9c955b812493e8f143aaa2912da0c99a29f72a972905", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710603167, "uuid": "0912267c-c0e8-4c7c-a4a6-30df27964bb2", "value": "T172D523F75D83B7DDE018EE3812529C6A8C023CA5512E68CB95ECD31F5462EE6C97AF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710603167, "uuid": "3823f940-8907-48f4-8927-b82063a29b60", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710603167, "uuid": "2d452fd7-ee31-465c-a9fa-a31e1a1d24df", "value": "49152:99C8dqVA7aZ2nUxr/gnpfey/Unv526GlrIGOalQ253bjoEygWC:99C8d1eZ+sjAMR2xIG1lJdoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710603167, "uuid": "c5ba7247-2e6f-4791-ada7-4b586abccc9d", "value": 2871296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710603167, "uuid": "bd628f71-b538-4d54-acee-ad67307f2a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710603167, "uuid": "bba6e803-a4ed-4c84-9489-33ed757ea493", "value": "c22fcd1a23d0f202cd0602f15ca4a3d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff27526-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710580563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580563, "uuid": "e5ac9fcb-4eea-45b3-b2a0-d26d8a6ec61b", "comment": "Malware payload (Gafgyt)", "value": "5d81e9763779f3bf7d75235585b5a562", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580563, "uuid": "7d6a12f7-ce46-461e-8d5d-0f6b37d76e68", "comment": "Malware payload (Gafgyt)", "value": "6d81f36a216039f29b004d92f4bfb680cf57b28111942a97dab6dd0c565ab32d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580563, "uuid": "f54ce514-f272-4881-b888-fbeffda34dec", "comment": "Malware payload (Gafgyt)", "value": "f44412a0fd6b4386c09bab20b074348c4bcc6085", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580563, "uuid": "3ed3d76e-ecb1-4c12-aa55-d113e108c8e5", "comment": "Malware payload (Gafgyt)", "value": "cddf725b5c21358fc8defc3dca7b52349d9d11990b910effa5d9dc5278ecb2630dd7b6b059ef735cf937aeec63d1dbcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580563, "uuid": "34f8432a-1f1c-4390-87ff-67875f9856ec", "value": "T1B8833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580563, "uuid": "9f95bdca-6f08-429a-b48f-f20065cfaec4", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LwWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YU2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580563, "uuid": "c6630c62-2962-49c4-af25-b14104d5c541", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580563, "uuid": "88ff77e5-3b82-4f62-a429-16cd87826fec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580563, "uuid": "475babd3-d0a4-4799-a116-39a143f9d058", "value": "5d81e9763779f3bf7d75235585b5a562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb487d89-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580555, "uuid": "42047c7d-54c6-43fd-8da3-498ab63875e2", "comment": "Malware payload", "value": "52b44556007be7563cf37ded5a9c9a73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580555, "uuid": "bda00885-7e2e-4758-9e65-971567991c81", "comment": "Malware payload", "value": "6fd25111e37a1493167e927d50b75cb766e871caa3379b358d2d9028e1425586", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580555, "uuid": "ae65d4e3-bbba-4017-9bc6-5b0034f904b9", "comment": "Malware payload", "value": "cf188978ee21bbd015d72dd3b3dde131798ad11b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580555, "uuid": "152538b5-2bba-4507-ab23-a0f744ce413c", "comment": "Malware payload", "value": "32783279de4e93fff823f74617a6575a45955e4458aa10ccf928f26796758e6fbeb160337c3f47348a2e9cad0729d69a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580555, "uuid": "5c2e5512-f600-44cc-8bc9-c894526e1b86", "value": "T1CFC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580555, "uuid": "7865818e-e37a-4b21-8faa-351675657beb", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBemEdWfRZrmW+IFj:Ted0W0MZQHod6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580555, "uuid": "30584fad-f4f3-4a93-85fd-cedad7932f9e", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580555, "uuid": "ab730a29-b2d3-4833-9309-55342944cae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580555, "uuid": "c77bddda-100b-46df-8583-ad38d58c2454", "value": "52b44556007be7563cf37ded5a9c9a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62b3535-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595525, "uuid": "2ddbd079-f796-41ae-8eac-da3046272d27", "comment": "Malware payload", "value": "f039bd252cdf307a8c42c7a7547e95b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595525, "uuid": "8a7f679e-97ef-40ca-9ed8-db802eb3fd64", "comment": "Malware payload", "value": "70540018e5f4d5e3253ef086595b46e3c9f9f33926384f70bccf888a7f3e07cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595525, "uuid": "36fe3504-f79c-4e4b-b80d-b8d3d95b01e7", "comment": "Malware payload", "value": "5aed322cf180e4a77fc4e048f5129f1cdf29ef2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595525, "uuid": "bbf5b6c6-bd58-4496-b2c4-5bca5fd47ed3", "comment": "Malware payload", "value": "546795702f21bc16d1612adaaedcdc1aeb1606d311f7fb55e2e903b384a9cbafe3710a9de4cbd4db376449d39a3b16af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595525, "uuid": "2fa76889-3df3-4a24-a312-f3546c498e97", "value": "T1FDB33B11B3E08933E4B25F38A83AE36D450EFD917979A09B27BACD19B938150FC50797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595525, "uuid": "5fccc6f9-3f2f-49cc-b484-4fa8d155bf07", "value": "3072:0rmPSUAcsNYzQrDi3IF0FB0GstUD1km4slL:VqtC0DiNLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595525, "uuid": "1d5276eb-65d5-46bc-a967-c7e77cb6177b", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595525, "uuid": "b4da1882-aa36-47b4-aeea-b6a05b631fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595525, "uuid": "e5067e9d-a68f-4769-ad56-c293382772bb", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.22834.15056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10b0506-e3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710613233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613233, "uuid": "83503876-1f64-4c1c-8800-b91fb5ce43cd", "comment": "Malware payload (Mirai)", "value": "a6ea5c94c91c69295eb0032d72ffab15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613233, "uuid": "c4a1d21c-8afa-4162-b63b-d8025493bbf9", "comment": "Malware payload (Mirai)", "value": "708a2aa11eb0b6d09705f0c808faea106daa388e724e13a111b6de175a4eb358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613233, "uuid": "f25af8e6-a03c-4fd3-8b95-ae24bc9d7a91", "comment": "Malware payload (Mirai)", "value": "9baf82b514654a598a2b33c1b5c562d389672650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613233, "uuid": "84651077-693e-4b0d-aa2a-0ec6b0cedbb7", "comment": "Malware payload (Mirai)", "value": "c5751ea8068698e42264b56dcb8cea37da188f72ae4013abeb81f6ef1b27479e6edb0db4fd411018b0f4ae1c0fa6553a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613233, "uuid": "79bf0fe0-5b0c-41bb-8bfe-a0a4e9720a4f", "value": "T12AF2E0CFDA692C67C86D5CBAE0CC5B312D8920C2B5CA8F5A33294C95722F918B7DD470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613233, "uuid": "3ad0f06d-bab9-4a7b-8100-d2ac5ae65bda", "value": "768:sIKbeD9HZjFj4b2Feahm2rL3N9gnFqv8p4FdBC40fCOgklA++ymNiVEuMmycSWm:JKbep7EomkIFq4WBCYOgwLe6ExB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710613233, "uuid": "798a4d21-c5f1-46a5-af0a-b11a497a6143", "value": 35928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710613233, "uuid": "df88905e-13fa-42bc-a2c7-fd5165cfbaec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613233, "uuid": "da13bfe2-318c-4392-8ebb-d59cd7ba67f7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412a94e3-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571733, "uuid": "c43efd57-3d9f-4d6d-b687-3339f8b62c6c", "comment": "Malware payload (Mirai)", "value": "699a411792ded9c8866de7fc3a817d50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571733, "uuid": "2b3160e2-6d9f-4bef-8346-6502f8aa1c3f", "comment": "Malware payload (Mirai)", "value": "728a6f09a69083622579c22f1f993e6e884c8b98a38112675c06b9e689005281", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571733, "uuid": "7bf7113d-b7c0-436e-bbdd-22b2800317f5", "comment": "Malware payload (Mirai)", "value": "b49bd2dfc84ddc11217559b70b2aaf38dbc24a8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571733, "uuid": "7e73c539-b87e-4a74-ab90-d79aba8e8971", "comment": "Malware payload (Mirai)", "value": "96d825308d54a6d0d08252963ba41dc1696402bf6334d47ef3a784c2fb686f64abd8b2ce2f8599dac9b2bc687b84998b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571733, "uuid": "81cf607e-1401-4b4e-88fb-377ed3d894da", "value": "T1E1B36C176692C5FAC08342B92BDBA1618823F67D0B36331773D5BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571733, "uuid": "c5fe78fe-a2d7-4d48-a119-ed38a956c9b5", "value": "3072:Zt2nlia9qRBFZm4z1EYfcbJIphawfuJv03CKPCNVOXinYuM8R:MsVm4z6YgKphasqcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571733, "uuid": "2ee54cb1-c180-4799-94b0-d47cb86a575b", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571733, "uuid": "de88e38b-b95b-49c1-b8e0-82c40ac3ca02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571733, "uuid": "772224c8-6d0b-4a68-a661-aa586d2c8001", "value": "assailant.x86-20240316-0648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d1bd2d-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595501, "uuid": "a7322703-e8f6-4daf-a59c-9cd502ea1c91", "comment": "Malware payload", "value": "97ce304ea40a44ec22ee24be20b8bec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595501, "uuid": "b477adb0-c09b-40c9-935e-afb66a5c9436", "comment": "Malware payload", "value": "73c8a7b9cff3917c61c431f37cdae3777481e59d9f828a6ee9fcac6b4b82baed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595501, "uuid": "593cb84f-f5c8-46fb-94f4-8c3c31662bfa", "comment": "Malware payload", "value": "4deef8976881c1d6d48a944bafe7a4dc97590638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595501, "uuid": "e22fab1d-9443-4047-a8ab-a69396952beb", "comment": "Malware payload", "value": "404109d2438da6efaf211ada4b73cf1697beb267668f767d049fbce7aa4d2cc8620c1a6fa6e2c40c88af056e5249a403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595501, "uuid": "6c1008bf-8dde-4c2e-a8bc-b1e486299c88", "value": "T144158E03E1A280F0E7553671267E273AFE78DB861534CE83E3A4EDB15D71252A63B11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595501, "uuid": "d9709827-ddba-453b-9ef9-5cd12ce16b2b", "value": "12288:BgCBf65AhKZSCMzU8WpzV0ls/ofvIkaWDuzpDiUXj0EKWQ88m1+HNyriag:BGMKSFzU8WpsvIkNGbv1+tyeag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595501, "uuid": "eec8b0a3-883b-4dbb-86da-cdcef31ee7ca", "value": 952846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595501, "uuid": "48f35e57-4321-4502-9a67-8068b0e476e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595501, "uuid": "924e98a2-beda-40ba-979e-eb77ac3411c1", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.4592.32240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f164ee82-e386-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710587921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587921, "uuid": "278d6d44-5bf2-4949-8fce-2ba851ee9595", "comment": "Malware payload", "value": "93184c1e02220665a5f9ca7af9c7e38c", "object_relation": "md5", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587921, "uuid": "52577291-58ea-426b-92f5-debddc9756a6", "comment": "Malware payload", "value": "7526da006b81d1ed279828ca66069b83815c13551d8125872306c20b03f60c3f", "object_relation": "sha256", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587921, "uuid": "6e865135-4e14-4161-9347-aa23ea938c20", "comment": "Malware payload", "value": "6ce03c4ff3e84659472a651f393a83e643f6d11e", "object_relation": "sha1", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710587921, "uuid": "9ab45f9d-85a1-4efd-acd5-17fc3ced9398", "comment": "Malware payload", "value": "53b34bc0e98ec8f880006f3f099aae74fe8fe05d9a6c972dc8655ef601a2b1cb23b8e141b5b7884ff00798dc78eb2452", "object_relation": "sha3-384", "Tag": [ { "name": "browser-extension", "colour": "#966E56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710587921, "uuid": "6afdd26b-f398-4a0c-bfac-025f39194723", "value": "T13272BAEDE395D88B5DCD6B53AE2C9D9A2072A33B43CD35C3E359FB8C11A81DAC148491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710587921, "uuid": "9897eb15-fcd3-4173-b167-d91676c3930b", "value": "384:LnGhPrx26Qd21FXzRZIx1mynV5B1yPcCXrn5vSgm5:LnGL2vd2fd+x1mmtuckA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710587921, "uuid": "a1bac2c3-205c-43ef-abfd-7c34c9a55b9f", "value": 17208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710587921, "uuid": "e723d03b-1530-4b2a-bfac-d4733a824713", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710587921, "uuid": "0677554e-6379-425e-80da-04d1f6310420", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf64600-e390-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710592205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592205, "uuid": "b4694179-533d-4d19-80d7-c295fd4a18c2", "comment": "Malware payload (DCRat)", "value": "4e7660273e2eddf85cf5f7597e938e8a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592205, "uuid": "b536f9f8-9354-4671-ad98-d421efa69933", "comment": "Malware payload (DCRat)", "value": "7628278228fed876751a80efc5ad902e6eec1f83518753f7c474b543d190870c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592205, "uuid": "b975a09a-3d5e-4784-a479-d1b4a2a3eb63", "comment": "Malware payload (DCRat)", "value": "8bfbea9347f7935019d235741584d76407b0e2fe", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592205, "uuid": "63c18966-e885-4dba-8d21-7bf4108a6829", "comment": "Malware payload (DCRat)", "value": "cf45ff379fe3cb7606a1a04876fa72595df4c9b9be4083180897b474e06db8fb1ebb801e84a08dbdaf480bc95bd833bc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592205, "uuid": "1a4801e5-b803-420e-9d1b-6cf75b63246c", "value": "T176455B067E45CE91F0191233C2EF454887B0A9516AA6E31B7DBA377E65123A73C0DECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592205, "uuid": "3bcc2de7-3e90-42c8-9dc3-ea0e47431995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592205, "uuid": "3ebfb8fd-7e25-46d0-bdca-2d9c9c9492e2", "value": "24576:I0/2+tGs0yHvqxM1g5tRovSdKaBh2z5bHfe:t/2G0FquvBM5Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710592205, "uuid": "e60f884c-e17f-4007-b6e0-c98c1df5156e", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710592205, "uuid": "204bd1c8-3428-495a-8f44-4d3a3cc9f7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592205, "uuid": "1d26350c-bfe2-4abd-b8c3-9e88973b2c39", "value": "4e7660273e2eddf85cf5f7597e938e8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5185180d-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571761, "uuid": "9b7b126b-a778-493f-8497-996c8a5dc9df", "comment": "Malware payload (Mirai)", "value": "3a60d568d3eb588df6d6016ec36461b6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571761, "uuid": "04efd64f-d4fe-459f-aabb-aec216d5ab32", "comment": "Malware payload (Mirai)", "value": "78dc6e1d4fbb80814f5c6d7a7da57aaac32a50a97b9963461ff0a19834246d94", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571761, "uuid": "879b87b4-83a6-4e06-9898-a207115d435e", "comment": "Malware payload (Mirai)", "value": "3c7490b086e6d5df1bcc5db58bb7eeacc0f63e12", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571761, "uuid": "6130e264-8ae6-4c55-b246-9d2b614edc6f", "comment": "Malware payload (Mirai)", "value": "fefea528c7cba785691c330dd58f85291e6b59d18316e141825ffa64b60d71477709ccf9fce64dde4288f1286353cf67", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571761, "uuid": "51bf48e5-940e-4246-b3e4-dbf624c90e91", "value": "T1C2C30805FC404B27C7E237BAF79E438D773666586BD73311AA295EB02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571761, "uuid": "8745b6ef-4a6e-4e8c-ad79-c993961ad17e", "value": "3072:0JDZ+6lJQTnoo3AK5nnyXxfWW5hLFCuXUSP4eoC9DQlD6ObAF5R:7nyBuW5hLFCuVhoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571761, "uuid": "89ea2e3d-4f18-45af-a3b1-1a2fae425f2e", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571761, "uuid": "553f5d18-aa88-423b-9af6-47885de8125b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571761, "uuid": "a00187a6-8dee-48c3-aac8-5b1f9c5471cd", "value": "assailant.arm5-20240316-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44196469-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710571738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571738, "uuid": "1106daa8-55bf-480e-97a6-318f9f8acc05", "comment": "Malware payload (Mirai)", "value": "9fdc37074d1f968f8005afb0e4ad448b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571738, "uuid": "d10870a9-9591-403a-8b36-8ea76ab132b2", "comment": "Malware payload (Mirai)", "value": "7903a38d931b30a6c582c6e818bae5b328420f5c4b3d150916fa74288c7dde38", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571738, "uuid": "5d2e8028-8c1b-4f9c-94c6-219b8dc75f6d", "comment": "Malware payload (Mirai)", "value": "1c8ad5cc074e082336ba24a3e7f814355f050ac3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571738, "uuid": "f6d2326c-28b6-460f-9dd9-a654cea6fa5c", "comment": "Malware payload (Mirai)", "value": "47273fe89aa3e3f5a947ba4dbfeb47a94dd03cdc268a2d177c98919f90ac26a86b8fa66aca9bca1106fa07f8db185867", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571738, "uuid": "7d4c0c47-5726-45bd-969b-9cb3d00b9a26", "value": "T14EA35B86D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75C7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571738, "uuid": "26417220-6e4c-4da6-8dfd-e96f75693ee8", "value": "3072:uLOqjPQP39VjGWX98732V7kGyNVg5huTQ7FXnf0OzTyoQQub:uJQP39VjGWXW9NVg5huCFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571738, "uuid": "042a6319-f3ff-44cf-97c6-c9a13d6a32ff", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571738, "uuid": "8c8dbaf6-13cf-4024-af5c-cba7afc7c1e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571738, "uuid": "ef9c7aa2-92bb-4421-aa56-33973886e624", "value": "assailant.i686-20240316-0648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a041562f-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595515, "uuid": "7bfaad15-b865-43a9-89e2-11025ce8ad6e", "comment": "Malware payload", "value": "1416fb62c95abd0a2f9cfaa00cef7def", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595515, "uuid": "9c53e569-d040-4a9e-baa2-70089a170d74", "comment": "Malware payload", "value": "7b49291f7c14012de5a6196bdc14ccbb891f526e8e49ab0e306b28ebc5294d14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595515, "uuid": "d0f82dbd-99f5-49f1-8f3d-a0fcd308fe82", "comment": "Malware payload", "value": "511420caf14897f9856c8d0396b44f54188216c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595515, "uuid": "985611c7-a5b2-47ac-b6f2-44430df5079a", "comment": "Malware payload", "value": "baecebeac6d1b7af69a88fbdd281bb569e8e4707b9148941d0f8e4ac18d356f4f0b8191bf1ea30252984b52976358c10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595515, "uuid": "93b6c641-8393-4222-ab4c-c7e042d80426", "value": "T13C644A83273782F9C1D708717D31F21FF2B091126D69E87AC7D0688596B297D7A2C39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595515, "uuid": "044c10d1-1d5d-4a47-952e-4cf02a8a2a95", "value": "3928488066195d0bd09395041885dcf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595515, "uuid": "9a58d4b1-b426-41c7-9d72-88a98bd25978", "value": "6144:vkzM+StUx4l4lt+7Su6EnA8p21yV0bI38RNOve7dl2zFwoh7ol:MFx46t+WuvnA8pGyMI38RUykzio1ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595515, "uuid": "7d41fb9d-3946-4ae4-aa61-c1106ae5f2aa", "value": 329363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595515, "uuid": "7d28867b-b7bb-465b-b896-0079438e9ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595515, "uuid": "01100fb3-3522-436a-872a-3ee235563d33", "value": "SecuriteInfo.com.Win32.Malware-gen.12560.24012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972240c2-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595500, "uuid": "f1b51581-9a2a-430c-a265-896d84ab9a49", "comment": "Malware payload", "value": "f55527108daa507c46ea57d5727f5b61", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595500, "uuid": "dec691ce-7673-4800-87bf-af2a0cad4973", "comment": "Malware payload", "value": "7b84fb02c2c75d9cd1c7de8fc0c1cd9e3658cc1f3bac1e47638d314483a944c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595500, "uuid": "e7952c99-2ec3-47b7-a4df-f097ad66b915", "comment": "Malware payload", "value": "14dbb91efb91e9e8b8fd26086d60698fdb0ced00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595500, "uuid": "8dbd79d4-e7e8-4298-904b-3c485bcd81a2", "comment": "Malware payload", "value": "d27e5572c2fe52f6adada60eb9ee74c7c6247d63363d7a24d7cd0a3c9d27f973ac4e93a8dce81f46af49b2f5a2f3a880", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595500, "uuid": "1949762f-85c8-4e57-8018-d4d1a85c7e45", "value": "T119737E0136D095FEE6E60230BE6967B952FABD359DE1904FEB13398E2C71851F43930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595500, "uuid": "27e856f4-9b10-498b-b82c-1699e7a632ab", "value": "9f55706ef180760fb1dedfdf02729634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595500, "uuid": "83e1a0fc-817b-4a3a-a660-d15be9cf5082", "value": "1536:+RmJhso9kEYYl0MvS1yaj2plNJ+jaFYdemZ0ToQ/q0YrvXnNw9TPkXnNw9TPCVrN:ymJhso9ky0Mqxj0NJ+22QU0fWXnNw9Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595500, "uuid": "7cb66e01-6778-4054-826a-db7c4f533682", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595500, "uuid": "fac4f2a9-2629-42e1-ae5e-3e55cc649116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595500, "uuid": "5ae19e0e-b1fd-4520-89cf-b4eec70b3925", "value": "SecuriteInfo.com.Win32.Application.CNSHelper.A.21578.15500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4df4f59-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595523, "uuid": "b653100b-3c8b-4fb8-9416-17d95a4a39ee", "comment": "Malware payload", "value": "d329b990a386a6b9e1255890c766f0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595523, "uuid": "1c58af94-b7c6-4e35-acc9-02f375c4811f", "comment": "Malware payload", "value": "7bc8c2dc4de3772ab122103ca8874e99e85647f9ac28bab4644ba90e14d957d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595523, "uuid": "6c0a033d-5963-430d-a998-620f50f4599c", "comment": "Malware payload", "value": "73beb067c2d84dcd4877cc18d3bd5b1a7c8d3c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595523, "uuid": "362ea424-2225-4c79-8b3a-df2092b1c3e7", "comment": "Malware payload", "value": "143b01a5aedf5d7a9da45d4785f152703791ed4403fb5da4d148f3f85dbaf4fee28fa51c69dfbbd067b21eef45664ea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595523, "uuid": "105e89b1-e976-49be-be0d-760d6e8d7019", "value": "T194D49D12BBF690F5CA1620F009BA6736F5B5BA520B12EFC35354DF2C9D32581963B13A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595523, "uuid": "5c281ac5-8e2c-4f2d-bc27-98db5dabf60c", "value": "0924e7ba3d9b66b98d30316d340e5bc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595523, "uuid": "e0f7b2d8-504b-40ec-acfd-6e222b1da96e", "value": "6144:dUlSWbOUNoAF0a9Ss1rCw7JikmuLes2cL2LxWYqsvVeVmhIlKXT47AMwTWh9:dASyNoAFrgY7JWCqLxWYVvVeIhIle477", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595523, "uuid": "23bbc6f0-0eca-4716-961f-a2ef08226e29", "value": 613213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595523, "uuid": "1a750f89-bc35-4502-98bd-70370c011dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595523, "uuid": "75556179-24e0-4eaa-9cde-4e65e4eb9ebb", "value": "SecuriteInfo.com.Win32.Trojan.PSE.BKGLI3.11692.4491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947f40f7-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595496, "uuid": "2818b55b-368d-494b-94e3-728dcd62f857", "comment": "Malware payload", "value": "2f47c8a8f8e79a3f23675d22d87ca821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595496, "uuid": "d04474c0-24ce-45c3-9dc4-45ca8b3612b8", "comment": "Malware payload", "value": "801b3512bbdad0c6fdb69350371070e2bca3081c26895a3c6abaf8ac51cb1298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595496, "uuid": "554ee013-caf5-4c70-a34b-698bdeaac1de", "comment": "Malware payload", "value": "a620894919a9cfbb2f922f1f98ab2d373719dd4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595496, "uuid": "b137c184-3450-4a51-87cf-d3a20c0b75e1", "comment": "Malware payload", "value": "760b1f012eed9bf3d454f44ff3b17438c4c820cdcd62fc7ec75bb3eb316b96bbfa8d716ac08df6b892fb30ce1c78faa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595496, "uuid": "713de8d6-a290-489e-b88d-b8ad361ed8a4", "value": "T159D44A6DB6F0844ED06716749C2BC6E4DD2FFE402F286887AEE41D0D9B3C681B551BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595496, "uuid": "82bf6aa0-25bf-4f67-b6a6-6a916409df1e", "value": "6144:G1j8Egi/+RKIS8uXDRe3vmlrDe5MtlfifF3p1AIWGqfXtpvi0tS1BTS2V1yBYAKP:gobi/CF5uz437KfG+S6S719AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595496, "uuid": "987ffd90-4225-414e-9d88-6f585bc8ba1a", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595496, "uuid": "b72501cd-4ddc-4021-a02e-e48816d1a210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595496, "uuid": "4104f0b3-5178-496a-aa73-f5c6daf5e28d", "value": "SecuriteInfo.com.Win32.Evo-gen.14439.29159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b299c9-e346-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710560037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560037, "uuid": "5b639a0e-2bc7-430d-bfc6-fde5e595c157", "comment": "Malware payload", "value": "d68dbf7168f0149919310942e42ba31b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560037, "uuid": "1b39415b-79fc-4b29-8d61-15c68db1a93a", "comment": "Malware payload", "value": "808e7694d5c3b7ec6b49b46aaaa002027e70d49bcce9578ea89f0f833f2ce620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560037, "uuid": "b629b772-718d-4760-b32d-b0ff3363c93f", "comment": "Malware payload", "value": "79aea685449258a25de600b54849c1e58bff3a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560037, "uuid": "d3998fd3-b3d6-4100-8d59-f75df282ae14", "comment": "Malware payload", "value": "91734a67b3d2dcf5ab6fdb6677d6d8b3d01a81873d4f1bbbb691a9633192f0fb18afa9ebc43d59438ffdd98ab546be8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560037, "uuid": "9bbba6cf-9cf9-4f51-a4df-3699742a6063", "value": "T1ECB4BE22BBD4E07BC16705701E5AE7BDE9B8A7609930410B77E84F2D6F70A419D39B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560037, "uuid": "d2d64dcc-37ae-4e19-9d78-d8e46658fbe4", "value": "f1624e0be16e0f5d8f824978aaef79ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560037, "uuid": "ed14eb94-1bbd-4984-a0c6-9ecb65ed95a9", "value": "12288:+aFCW579OLwY3kxs79yyZ60midhZp07iot/sxBuK8:LY474l4s79ylNifn07io1mBuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560037, "uuid": "156f5535-0adb-4e27-996a-40f84a2aaf73", "value": 502216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560037, "uuid": "7db883a9-95a7-400a-bac6-8190ac7b4d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560037, "uuid": "f9486df5-9c7e-40eb-bb1a-64c6fa68e98d", "value": "SecuriteInfo.com.Trojan-Downloader.NSIS.Agent.29168.11120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc787fc-e36e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710577471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577471, "uuid": "b3ffd9a3-6c45-4fed-97e8-692e8c0af229", "comment": "Malware payload", "value": "7f308f2ea086a7069dd220bcac557f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577471, "uuid": "76259f6e-5b12-4c57-b217-0ee59a11332b", "comment": "Malware payload", "value": "8113f2e2dd600e231e2dacab9fbad1915f97968ad5ebab39acec8a7451d5ad3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577471, "uuid": "32aa18a8-7110-43b0-b4f8-23f428c86240", "comment": "Malware payload", "value": "64a1cb9be4b4dee2959a58f4dfdd7a5b68ff6a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710577471, "uuid": "efdf1d0d-d3b5-41a4-ad13-4ad3312deb5b", "comment": "Malware payload", "value": "076f8be3636efbc426db6158f2117d8f19e3daee0144d7f09daa9884b4ccf4fed23d76bdf5d0d11df74db8b1d066579a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577471, "uuid": "3f3afca5-22fd-4da4-995a-7bf56b4acc3e", "value": "T148A5E00273D1C036FFAB92739B6AB64256BDB9650133852F13981D79BC701B2272E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577471, "uuid": "6c1a0998-0e15-42fd-b4c5-c92950960da9", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577471, "uuid": "cd4dfe9f-da35-4fb6-90ec-9dde02a3d791", "value": "49152:Jh+ZkldoPK8YaCzp/8csXX/SUC5GMPyv1Ku6D6h1PttkG:q2cPK8YGdX/qO1eDMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710577471, "uuid": "f9dcbd7e-27fb-4b7c-9b22-0d693060dd67", "value": 2099712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710577471, "uuid": "bc291ced-0c71-43af-a8f0-1046ba596f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710577471, "uuid": "2828c31f-0def-41ac-abd5-3948f45ce3dc", "value": "SecuriteInfo.com.Win32.Malware-gen.22883.4656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378991a4-e333-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710551960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551960, "uuid": "c20a22a6-ab5e-4067-9e82-17cdd70db348", "comment": "Malware payload (Mirai)", "value": "d80b15a2df286cb02ab3f5780552f616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551960, "uuid": "278c0139-8fb4-4026-9625-c4efc1615dd3", "comment": "Malware payload (Mirai)", "value": "81284b8b0fe4b6a9210234c090a55a3e41dae7d810d3e689267b0cc4f78f0343", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551960, "uuid": "a1286400-8f98-4078-bef8-0851a4aa6c62", "comment": "Malware payload (Mirai)", "value": "c5dbe0b2a0f88ec5775dbcd6abac2c5e7aad3cb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551960, "uuid": "e3fcd7cd-756b-46ba-b374-54e9e1e3cfd5", "comment": "Malware payload (Mirai)", "value": "a54b8fe778fbd5ef945a468c8f5ab4cbcc9ef0d695b7eeff24cd8743aa76aab5d4b58ac31e842b9f06b7d4e758b3321f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551960, "uuid": "8202487b-b93b-4ad1-a6f2-96563a77d1ac", "value": "T173A2D01172A32D56F3EC2C3DC96E8357F9A60BFC80F6327679455520C94D24A3E3CA8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551960, "uuid": "af6195c8-5fdb-4764-8cb7-e6f8d90424a1", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjBhymdGUop5hy:vvQn4j+ZO5fKAlxVs3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710551960, "uuid": "1acb016e-2258-4251-8ba9-ce884c69f000", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710551960, "uuid": "e35e4bf0-fce7-4d04-a9d0-7e8642697e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551960, "uuid": "69642693-8c25-4c0b-a426-23b68d95e2e2", "value": "d80b15a2df286cb02ab3f5780552f616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfb1fda-e3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710613094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613094, "uuid": "9b13d1e2-df6b-40a0-93c7-1ae55a08d43d", "comment": "Malware payload (Mirai)", "value": "06f15e94359ffa70e13fe25b2025071e", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613094, "uuid": "d11a82bb-7c7a-416d-9e3a-d0e07545f612", "comment": "Malware payload (Mirai)", "value": "84c6525efd47c387ef6e14d8e52e52ec6acaad24ca66e7bf34091a90023ca5de", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613094, "uuid": "856b093f-afca-425f-b8e0-6e18b95d77af", "comment": "Malware payload (Mirai)", "value": "43988cfc49f41aca2416e1cb83a0f1a08c37d7da", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710613094, "uuid": "9346de8d-7576-41c1-a000-6a216424faf2", "comment": "Malware payload (Mirai)", "value": "72fc9dc00180f1fd59f385e8237ebd50eefd2007d3c98d114d0b03f5c0ecf513dc0b5d9352351509a1e080d02629d27f", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613094, "uuid": "636ffe28-e3f8-4595-adc7-e42808b0a714", "value": "T1ECE2E17116ACBC30C63058B8BAA48AC31FE807B5C5F1B77B320046B63B475A5ADB5647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613094, "uuid": "e51a294a-4d08-49c7-8cff-09505ab9905d", "value": "768:1iZloSl78N5WsvfgzYyE103qqOa2VSRf5XF1hN1PVzj2tw0UzsX96s3UozmU:sVl78N5Wagj203wagSF511hFzlrahzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710613094, "uuid": "098a1145-1062-4545-96ce-01a1c74b7c07", "value": 33680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710613094, "uuid": "87ac32e0-80bb-45ae-a913-55831a8e8c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710613094, "uuid": "d42c3c54-6277-46c6-8fc0-cd88c4a17171", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a702c9c-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580903, "uuid": "d0c1c27e-899d-45bd-a1bf-c33c51a3a686", "comment": "Malware payload", "value": "36d9c8762334a26049aa0b40300eb221", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580903, "uuid": "610f219e-1672-4810-a194-cb42016d9b41", "comment": "Malware payload", "value": "862b6e6279c7e5eddd12d2531d9ee3b54ab023b3b9c87dfc8990da8387b58063", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580903, "uuid": "2ebe1922-e983-409e-85f8-b9ac28be7b61", "comment": "Malware payload", "value": "9c11d42d4678de6a81f355670fbf89a0bd0d81a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580903, "uuid": "157862d2-f4fb-47e2-b9b2-ae85d22c524a", "comment": "Malware payload", "value": "dbc9eb1b961138083bc49dca049852362d8dafc725672e7db8849d46caf3c3e99e973476ac72fc4fcb39efa76f930e7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580903, "uuid": "4a569c65-d045-4eb3-9c9e-ab2e224d2e65", "value": "T155A30897F800DFB7F40AA67604D34B20B670BBE14F532622731739A6AE762D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580903, "uuid": "f0798811-66fa-4df8-9c8c-4256aa304c7c", "value": "3072:/Ir2vIBAxMyAOLRcft02OemuxVqDr78fz1e:/Ir2vIRyAYce2OemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580903, "uuid": "baee8d7a-7167-42f7-9500-7589faeb2f35", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580903, "uuid": "b45be1a5-8830-4505-b079-127843bf958d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580903, "uuid": "b1125234-3a53-474d-ba3f-2c4ed0372179", "value": "36d9c8762334a26049aa0b40300eb221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ce28be-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595526, "uuid": "5de0f020-af10-4eb1-80ab-65d67f813c99", "comment": "Malware payload", "value": "49e83beaf592b92109fd81bc9cb77884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595526, "uuid": "4f89403f-fe30-4791-9696-96c38379b4eb", "comment": "Malware payload", "value": "86a78c82d3150b67f967f415dd9dfc52e89b02c1fd36caa368b27c2e9da4daaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595526, "uuid": "5370d8c3-0ad5-461a-816b-2dfcd6e48114", "comment": "Malware payload", "value": "29905e3975cf18a066e8052da1017224d49ecd17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595526, "uuid": "201d08cf-e769-4ab0-b456-827e097d6418", "comment": "Malware payload", "value": "d0a933f8cf1e442177d32575fd988f143896963a0e4057ebe5e0ce16a77cf19e841fcb85e533be51484287f0eab02816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595526, "uuid": "dc5827f0-2a7a-4b19-bc70-c238b4a0d7da", "value": "T111A3F60A7D60BCBDF35D367078D9063A9EE1CC5189F4064E3FAE8AC95F24053A53A798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595526, "uuid": "0ce05d9b-c40b-4e3b-b551-18d60b52488c", "value": "192:Sy5y9LjlCnnnnHnnoKlnnnXfP3mqWmcstLC3DtMnHOL2iTaKUg0E+YD2XTsrz8JD:J5ytEhvCzuH7EUzYDWYH8llNcXfPGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595526, "uuid": "1b495b88-ab60-4102-b43e-e9a7b643177f", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595526, "uuid": "3f4d43c7-bd17-4f91-a88d-89daa154398f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595526, "uuid": "b5f74fff-8f7b-4af0-be00-2fa9d38990c2", "value": "SecuriteInfo.com.Variant.Zusy.429385.31688.6764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c452c451-e35c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710569806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569806, "uuid": "b6483da0-5f0f-4018-94fd-b3fb9c48a028", "comment": "Malware payload", "value": "628f34c036620374d57e266c41ba5e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569806, "uuid": "2fd855fe-e24f-4009-aa33-3d64168963dc", "comment": "Malware payload", "value": "8a1774407dade5eff21be86cc20b6a53e8c7c148f2bfd0209f3ca4f5e034bbfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569806, "uuid": "3445b1cf-117f-4282-836b-74af1d8785d5", "comment": "Malware payload", "value": "91981ccfa0d588b3159d1336e51b4bbf39b65829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569806, "uuid": "8de4624a-8ca5-46f8-a24d-da5ac5d8f4f1", "comment": "Malware payload", "value": "2cef967046e0326177b5c99f32a774aecc150838ffe406098788ae956fcc8526fcb77957b0432429b8fe70f18fef3196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569806, "uuid": "8de86d59-0b2c-47cf-bc41-de6193dac1d2", "value": "T1EC762374E6A64EBDDE2796FCD08E40E7A65BBDE303C4017317F085D18AA53D0942EE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569806, "uuid": "6ee6cc37-d921-4912-9cd0-eab9726b7902", "value": "2bf1fc659e1e270e26d98d8a21b8f037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569806, "uuid": "1747bdf2-dae2-4b98-9487-ffc6816dfb03", "value": "98304:4Uvc0p5at/7rTM9n8fl/tIi5A/K83k3fYChTkxAPljwl5ShlnAb3u7luu:xvtC9TM90tFYk3XPljwlIhmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710569806, "uuid": "49ff3661-81fb-49ac-8f96-afd6005bae59", "value": 7331280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710569806, "uuid": "63eebf45-84e6-41a6-9d14-384393b5017d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569806, "uuid": "6916460f-749d-4ce9-a52e-0708d0bf879e", "value": "SecuriteInfo.com.Trojan.Siggen22.49613.19028.20311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bd3d4b-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595498, "uuid": "88af1807-142b-469c-9622-93a5b266623b", "comment": "Malware payload", "value": "58a89e3578c90f16eac617b4492cd8ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595498, "uuid": "c51258ec-806d-4112-bc4c-65a918d8dafd", "comment": "Malware payload", "value": "8ba29fd620e32ad6f64a0768d7939fa5d43a9a1a09f2bef6331ec34162e4c9bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595498, "uuid": "811b41ab-e1fd-449d-b3aa-c877fba6e4bf", "comment": "Malware payload", "value": "f7bee213dfd4096bff0f07cc1d630e3cddd3b86b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595498, "uuid": "ed97af19-11e8-459e-87c5-1887b921426e", "comment": "Malware payload", "value": "6412efed1c01475151fcd4d6545830b4306f3765eed2fea8050d950286ac454bea01ff78389327330a04cf4bfa42ca33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595498, "uuid": "4432f34c-6397-4745-96e2-459c26dc7500", "value": "T11954AE12A3F38507ECEB017007169B365EEFB5202379A9A74E946CCC5BB46425A7EF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595498, "uuid": "cbbf5b7e-a27d-4e0c-9c6d-5012cac02601", "value": "6144:n/Ze7X8QzHRGSq+DAB4QXq5MwyekqoLyAAtMk:nAL9HVZDAyrhlkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595498, "uuid": "dcd6a7f1-4821-47d1-89d3-412df05293d8", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595498, "uuid": "614ed477-22d4-4166-9cd0-7f299093a4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595498, "uuid": "ead32604-c597-4831-9a5b-3acbf2c93391", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen2.21785.3740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9747f8e-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595531, "uuid": "02dbfaef-93ec-4e8f-a16b-3b5bfbd1fb52", "comment": "Malware payload", "value": "fd5a4965db3e6dd2bad9f07ff8c01e83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595531, "uuid": "fbcbc96e-5094-4d9b-b647-91f563d1ce6e", "comment": "Malware payload", "value": "8da160020fb0e761379b6bb9090201ed9a4975f6e276a32670353e7c085da364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595531, "uuid": "49af44ad-8eb0-4858-af52-296dd4c4444f", "comment": "Malware payload", "value": "ad30848ab6405bec2c265e9eda16c604c8f156ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595531, "uuid": "472c3820-72a9-41dd-affd-befbb9a4ffbe", "comment": "Malware payload", "value": "71fe50c5b49fbf984c59a7f292ac9c3100239d25de7e44b635821a639c74beb3846d74446a7a68c60d16fb9ac7c09950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595531, "uuid": "afd6a779-feef-4fc6-8a9c-8252bc7b2e95", "value": "T150B55CD33750F406DDF109B246B28F77AFB7E15413A856AB84983B583A17393890ECDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595531, "uuid": "6a2012ef-be99-43dc-b3c0-8948a401b277", "value": "768:Dhy3VBUPAZwnu1bcGTdLTMRi9hrHtsfP4oiAK6LNt8XSsn6Jig9ao:DAVBUPAZSu+G5LYU9tHzZ6ZtiSsnAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595531, "uuid": "6620b300-a0ef-41ba-9d85-fb0214b622cf", "value": 2437120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595531, "uuid": "64e7f5d1-8c2b-4261-9fd0-fe097ea831ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595531, "uuid": "d1154eef-2e81-40ec-b21a-d322ac3b4b7c", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.3095.10154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ca7014-e347-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710560841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560841, "uuid": "eeb67508-85dd-4b5d-82a6-4cdb564656b6", "comment": "Malware payload (Mirai)", "value": "feaf6ee9812c6633721f1dfa6c113f49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560841, "uuid": "19e4bcf6-6a28-4c5c-9d0f-cdede847ede0", "comment": "Malware payload (Mirai)", "value": "90535f31d7c717f3f5c67b7d1fb15d76d830cc4a38de40ba79fd9be8e7770d2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560841, "uuid": "ee83e3a6-3c77-4379-a9d4-bb4cac5670ea", "comment": "Malware payload (Mirai)", "value": "86bd117970c36eeff2889593a4ebd0c4220c644e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560841, "uuid": "b586eecc-40b4-4005-9b9b-672e647bf490", "comment": "Malware payload (Mirai)", "value": "8db551e181f8cff3b509e1bd5ed2d0a4cedeb797d595f7f7a3628f360bd25dfde954d1a1019cddd0a807c0377cd0334d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560841, "uuid": "29d4ea41-a4c7-47e3-aa7a-b7cd0c05585d", "value": "T1CBB32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560841, "uuid": "30d8bab9-6e73-4645-a8de-21901b926328", "value": "3072:pC/4rdZHsXsZwwR9mNk5mm/QcuLmHniPNb:pCwrvHwsZwY9mOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560841, "uuid": "a8379865-e589-47fe-ae6c-4530124c29e8", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560841, "uuid": "b1bf1c51-73a1-4127-b118-e02d0447a154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560841, "uuid": "eaef89cc-207d-49c4-a723-2c44aff46be6", "value": "feaf6ee9812c6633721f1dfa6c113f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d1f753-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595494, "uuid": "8b986671-c128-4b5a-8a7c-f2fff3fc4926", "comment": "Malware payload", "value": "a4208bc45c86c46c03809771787dcfa3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595494, "uuid": "1d4cd9f0-833e-439c-9325-25dfb8ff870a", "comment": "Malware payload", "value": "9930b621e6ec122914a706b8884b3a2179524b851581f38ec14a70b046e127df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595494, "uuid": "f1682094-16e6-411f-aaa6-7528261b6409", "comment": "Malware payload", "value": "1f99364559acc497947ac7ac3dbf23265d28051f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595494, "uuid": "90c8c14d-0115-4ee0-955a-cca6438fe99c", "comment": "Malware payload", "value": "b2ab790304867d66b863fd1bf34315af6e8a7326fedf9e7c5a22bae165914ec375180a590ba329715d895a83c600f5d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595494, "uuid": "f4bb932c-28fe-4004-add5-9fbf534db749", "value": "T1B1331A01FA4B40F8D587F9301445D23B7E725B599304C7A7E1BDCFBA8832562A8B52FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595494, "uuid": "dce3a965-6c39-41a3-b68c-b23b71d86765", "value": "768:K3NX4Yl79HbtC0MBmpPO1odyY6KrDhh8WNTKliKHGata:K3NX4Yl79HbMB1iVh8WwZta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595494, "uuid": "18140b89-ef5e-4edb-86bf-9b26f77f15dd", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595494, "uuid": "c73d1e05-519f-4c73-a33a-2d697c3d777a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595494, "uuid": "8ce4b2de-1d7b-45f8-9e69-eb79d063cf5b", "value": "SecuriteInfo.com.Trojan.Crypt.25823.31483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76c011c-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595527, "uuid": "0acbccf1-f90e-491b-b414-927e364ec605", "comment": "Malware payload", "value": "733de71163ae7804aa53585970c68753", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595527, "uuid": "d9ee08de-d51d-4394-8819-4587bbdc2836", "comment": "Malware payload", "value": "9c3414bdc728d55d9ee6a4f7d6de28bcc063abe763200225d1db8475396fcf5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595527, "uuid": "8099c888-8d30-4746-92e7-8b9979a51ec9", "comment": "Malware payload", "value": "03b589f10914b7458bd7da8bdd0cfe8ce77d4ced", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595527, "uuid": "8d33510b-1a54-4880-a7bb-05166125badc", "comment": "Malware payload", "value": "86ec2e3d477cad7543cff8a64b6dde52714cee5dbcdb3eceb3810866596620fc5844c2e32e1359e6164310cb1f8965e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595527, "uuid": "938f3913-b576-424c-8da5-373491b3c2e2", "value": "T1B3E2B523B141D1E3C6412B3449BDAA317676D58327225BBF5B08EF79D823AD6DA3F810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595527, "uuid": "f023066c-80bc-4ec8-ba9f-166bcf9b6053", "value": "192:59D5/xHpbrejCppE1MNFj/6+9p7kqH2la824UVcTV:/5/xHpbrejWFjH9p7Z2w8ecT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595527, "uuid": "b6ba20b9-d195-4ead-b117-2b922c9451f1", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595527, "uuid": "0dc14556-36df-4737-89c5-b5a12977bf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595527, "uuid": "115ac277-5600-4e99-979a-461c7db49023", "value": "SecuriteInfo.com.Trojan.Crypt.6430.30537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28227f84-e3a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710599179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710599179, "uuid": "83d31ce5-2175-4182-8300-e064d884dfcf", "comment": "Malware payload", "value": "53aea748b56baa8cbd1aabb4741d624f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710599179, "uuid": "e5344619-a850-41f9-a95e-d039bd30e172", "comment": "Malware payload", "value": "9d64db1aec913c975d6d0bf1b12c28a9385a2397c3d40143ae67d4ca2f278cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710599179, "uuid": "ca82494d-cc00-40f2-b69b-703c3aca418e", "comment": "Malware payload", "value": "0110fb00d964693c811faac312c6d05bd9c3136e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710599179, "uuid": "6850a3be-3a7b-45ce-aaea-00a082204d91", "comment": "Malware payload", "value": "5d3e2df38c28c2629870dfec7195bf5ef1d6247e50f668d1d0152349c222f41d17c75002c82fec8c2a23e1a708395b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710599179, "uuid": "dbf1cba6-c3b1-4234-8f8b-7a97d8284eda", "value": "T1E6474A02FB919ADAC664913689EA43917771FC181F279BD36A04B37C3C767C86DA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710599179, "uuid": "73fe52cf-691a-4e8a-bc87-e96408482fce", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710599179, "uuid": "7ffb1958-0e1c-4137-86fa-a60c2ed36c7b", "value": "196608:ABlFOyPsEv0uTK9ZAt9MIAfeLrE+m11QTl4uawgkUltGySZ:ixswjgFWlRjOltGySZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710599179, "uuid": "16d64635-8218-410a-9258-97b82bed1628", "value": 26864124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710599179, "uuid": "3852186a-a920-487b-a046-b7dce45107e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710599179, "uuid": "8271b3e2-f4c7-437a-9f84-d91fedf80b00", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51073b78-e3db-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710624159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624159, "uuid": "3da30b6a-24f2-4884-b01f-da3ff52fa351", "comment": "Malware payload", "value": "788a350ae4859b61e1c73020147c55a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624159, "uuid": "040e6452-08f8-4dbc-afee-e932bfc2bec0", "comment": "Malware payload", "value": "a12af2b43a1fb6b334ad3883a5eddf6cdf5011ccf7f954ac678a6349b0bc3039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624159, "uuid": "2ba1dc47-3ee4-4fbc-895d-c467f4995680", "comment": "Malware payload", "value": "c2c1a115e5fee641fafe34214157e785d4d67f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624159, "uuid": "0edaa87e-8c1f-42f3-9fa0-c58c53460184", "comment": "Malware payload", "value": "90108c3fca4b5c531b06b83204b76e33204b27ab3c9be008abdf78ac6f3e194d372d25f6237788529a1dcc785af70755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624159, "uuid": "d9ee1c66-df32-4811-8526-1edee679cf44", "value": "T1F7F6333C81229C88DCC0DEB1CC053ED9DE59FDB9D06A2A266C9575BF887D9345BA34C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624159, "uuid": "112adb16-a577-4c0f-9c1a-4f5aa187dd7d", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624159, "uuid": "8f95557d-5fb9-4214-87fb-3e884f19cc25", "value": "393216:s7xQCLKrUI+2K1Qd/+ejmLR7UodsJ6L7AtqKhIpwFSnCEVgP:YOLKe/jwUodf7ALhIEbUgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710624159, "uuid": "fe22375f-a5fa-4f71-9f2b-5f11ac161f56", "value": 15638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710624159, "uuid": "36de6828-ff46-4765-a2ca-a3ea5849a972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624159, "uuid": "49988482-3f66-46d9-b810-c96b61be4910", "value": "SecuriteInfo.com.Heur.15050.3134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd82bde2-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710580532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580532, "uuid": "a36df293-65db-4b6b-805c-d00f6bf72eae", "comment": "Malware payload (Gafgyt)", "value": "d80d8b7ea8f1425d40974784a1b61ec2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580532, "uuid": "59d5f27f-d083-4775-977e-3d79a3474796", "comment": "Malware payload (Gafgyt)", "value": "a4304f8b3dbfad8e748be86bb84a226090d1314bd2c9376bc711073de5b8bf78", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580532, "uuid": "7c900d8a-dd05-4fee-a3fb-f83203f3313b", "comment": "Malware payload (Gafgyt)", "value": "a529e8e89ba9a10cea76a942539bd08dcc6e5fb9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580532, "uuid": "cff664d4-ac25-4dff-80d7-38092428d980", "comment": "Malware payload (Gafgyt)", "value": "576cd51a3914219dc3328afa6065fb13656ebb1e1100c38014c0fc5dc0d40ce695ab4448a5975a67848bf8133b932174", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580532, "uuid": "32f368e8-6ba0-4708-84ce-f63aa8426928", "value": "T185935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B73D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580532, "uuid": "5dc1c8a5-2d5b-4257-90af-8e62b9881ad4", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3zyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKDifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580532, "uuid": "48b3fe5f-748d-43be-8fe4-34e62124dd16", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580532, "uuid": "3286be3e-d207-4628-baa9-52531986f270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580532, "uuid": "18c07fba-d32d-4b2e-9474-39381b3b00cd", "value": "d80d8b7ea8f1425d40974784a1b61ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523600b4-e3db-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1710624161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624161, "uuid": "1df999db-9bc8-474a-b183-e78b6cb730ad", "comment": "Malware payload (Socks5Systemz)", "value": "9b10a29569abdddb99d729e07f51d62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624161, "uuid": "b76b7fd1-67be-492a-bb3c-26f0bd28322c", "comment": "Malware payload (Socks5Systemz)", "value": "a550df762611e5384f725b245f433687a508e5fca325d5cac656e9328abab4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624161, "uuid": "25eaf21d-dc3d-495e-94f3-af4988d17a9e", "comment": "Malware payload (Socks5Systemz)", "value": "c152b192772a1fdc2dcf17faf4319fb0173ce55d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710624161, "uuid": "4d2ed9fd-363e-492f-9e5c-ccb147f31c26", "comment": "Malware payload (Socks5Systemz)", "value": "19ffbb2760f6147bc42e0682e85805bc09b729f95be0b1461102e740f6b77570a6ff690ea612d1cc523847e36088cdba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624161, "uuid": "1c6a38d8-39f4-4c95-9171-dd3580a4efb2", "value": "T19824AEC132A19864D163C73059EAF6EC962ABC90DAF5455F32973B1F1FB17C088B2726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624161, "uuid": "e03f23e6-12a9-405b-a527-5db5cc649c54", "value": "06de3ee8f2bd808cd7150ed6cee11120", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624161, "uuid": "349c50d9-9eeb-4711-a095-b8241ccfddab", "value": "3072:PMCZ3MKPMkeED9EqQvbMaOnrDN08QKuV9w1RBeg8+/yGYV:kCZ5MiD9EqQvZOG8QKOkRBeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710624161, "uuid": "80b3faaa-46b3-4985-aa59-5b1868c6121c", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710624161, "uuid": "814423f0-94e9-47d2-8f0b-add30fd960df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710624161, "uuid": "215850cc-b6e8-4618-aa8c-51b9a646cbac", "value": "SecuriteInfo.com.FileRepMalware.15116.31352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afef3df9-e334-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710552592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552592, "uuid": "fd6dd7f6-2a13-4d8f-930d-10eaa0f5c1c4", "comment": "Malware payload", "value": "23147e704c6915d233045ef5e834cdcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552592, "uuid": "c7ab2679-061a-4cd6-b4ba-66d9ae41c714", "comment": "Malware payload", "value": "a7dab0cff6d752ccdccca1fc017c7fc43dbd1c591ac0f22cfde626a45190360a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552592, "uuid": "3c32c573-7509-4659-9caf-17e3287b3b3e", "comment": "Malware payload", "value": "cb36a4ded6d9b3726447121694220a562f8b7bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552592, "uuid": "42b7140d-b04a-4aa1-91b7-4def390e60a0", "comment": "Malware payload", "value": "d555fae8f8e00c92da1d9d271774f7dd70c4c8eb95736f8e9871b0ba13e0e47c698b786760ac4ec1172bcc52ffbfaed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552592, "uuid": "7c502cfe-8a3a-4110-92be-e132b018754e", "value": "T17A3733409E6E207CD9588438EA0EA47897A3EEE28CD04DD3D5E0FD49DAA43F856F54F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552592, "uuid": "e945e018-1028-4d54-a43f-843b617dd650", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552592, "uuid": "227d4caa-5c1f-4f2a-ab3d-cba4dd7c8ad8", "value": "393216:gkEXv5wSBtbMwctbd2sr51Loq2sQvnp9BWaycCQA0EZVyTCOnLVaJJCg8h6jQDc:gkkLtbMwcf2srroqagay50EZ8TPuo6jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710552592, "uuid": "043a4a30-074f-43fc-8496-2df91bde31e4", "value": 22817588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710552592, "uuid": "2939b079-2a22-4d28-9765-000e4dc02cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552592, "uuid": "98bf3ff3-ec9c-4c6d-9f8d-50302a74b060", "value": "SecuriteInfo.com.Trojan.DownLoader26.36535.15638.7846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62908c1b-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710549885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549885, "uuid": "b39d8b07-e5be-47f9-bb30-de4391582e95", "comment": "Malware payload", "value": "3df72985621d28c60ecc6ba1e8491563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549885, "uuid": "1b97d3bd-6a24-4d68-a518-98f9add1d0d9", "comment": "Malware payload", "value": "a821427b7e65dde09bf5e4094aaf9e2f804603bfe49beae7531495204431e7bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549885, "uuid": "4fc5d602-b992-4293-a7c4-7953b06e992b", "comment": "Malware payload", "value": "81c7cd48e7637131682d6f821d90dc8a887aa911", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549885, "uuid": "6a5937f3-d6ae-4203-bf94-fb8a36f1378e", "comment": "Malware payload", "value": "11df38cf41a897fcbb27d718a431c17f601fe5fb01ed81797d1d49fdf71f8d5dab43043a52c44e373ccd6233e2c2fcca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549885, "uuid": "d9c3cf5a-f583-400e-ab69-b38d7f10499d", "value": "T17613E14A57022BACE425D9B42F7443E02A6447F1FEB6CD417B24CBB38E935687487DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549885, "uuid": "0703a36e-442d-4ee6-b00a-19939d406785", "value": "768:En42NdW8/RudR3PdXgVBSy7YJsP0RqbPju9dXnqJz3f/7AQ5VpJgGlzDpbuR1JL:E42Ndz4b3FUBdqsP03RAT/75bVJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549885, "uuid": "f8d2c105-d85c-4f94-bd64-b308a45af887", "value": 41512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549885, "uuid": "a3d507f0-520a-4ec4-bc82-b5e7233712f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549885, "uuid": "2185bc8e-9319-4780-b286-82f339986ace", "value": "SecuriteInfo.com.ELF.Agent-BQZ.28038.9840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504d62aa-e3ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710609984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710609984, "uuid": "49f62818-9de7-4d55-8826-5025f4eb2ae8", "comment": "Malware payload", "value": "87aa10d6caaa4985c1d51a1d20b75d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710609984, "uuid": "2e5c20d3-f15b-47ff-ac79-62287270e4b0", "comment": "Malware payload", "value": "a9ab51e23d0afcc596c4805f696493d673db18283b966679d92a6c134a5f946b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710609984, "uuid": "fcf6d513-8501-45e4-8ff0-bd86b103e8ce", "comment": "Malware payload", "value": "7d0a5359135f2c586b94b3f7405f31ca8c0945d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710609984, "uuid": "5d974503-f9c3-4b34-a330-95aaf4713378", "comment": "Malware payload", "value": "e408007249695e860893b3b343b6d1de2f250c6f9e28da92f2a83d4c586724fcdfdc7372daa3a1dd5603a70fac55856c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710609984, "uuid": "990393d2-14ce-4055-996e-a16ddba565e6", "value": "T151F633712A612876E3FDD2351194C407567AAC4CE7A8F5BA02F822A90FF77770B37A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710609984, "uuid": "8e56365e-61fc-4743-896e-e81d8f1e6784", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710609984, "uuid": "01922808-642a-4ad6-8d74-7babe34ec593", "value": "393216:mQ8OgG8fUqjmu0DbMe1+TtIiFGuvB5IjWqTzmNSoP:mQdGffK31QtIZS3ILmSoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710609984, "uuid": "2f4b4790-4040-441e-8ade-083af2ce66ba", "value": 16336804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710609984, "uuid": "7b3896cf-1921-44cd-90cf-894f4cca0446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710609984, "uuid": "d7bd0e3d-a2d5-4f27-8f10-cfc78143c440", "value": "SecuriteInfo.com.Win64.Evo-gen.32605.13708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9871f2d8-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595502, "uuid": "d790d79a-7379-4f9b-b579-aee29a8187b4", "comment": "Malware payload", "value": "57d2d634e06dc65fd4d120d81129e058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595502, "uuid": "1251200d-4276-41b5-b9be-e405eaa81a83", "comment": "Malware payload", "value": "abda1670d26650b788b6529399a84f67a2acff2f8f49216bf239546e341cd2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595502, "uuid": "7aa1c3e8-5eb0-4184-9706-f28aaded410d", "comment": "Malware payload", "value": "e09ba56dce8a4023f73f7e2f507004a4248a25ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595502, "uuid": "d8e094a9-4ef9-4346-bb6c-c780001d6b08", "comment": "Malware payload", "value": "6e5083e7284f4c761987f77f6f288c4df239fe793783e202f79904ec52b2896df5454950ebed8827e0931777007d3d73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595502, "uuid": "ce20e433-3898-4113-87c3-b8b674125ba5", "value": "T124535A17BAD18876F0A19FFC2C30F6D9AF27BE301E20264963540FA94C217A14C9936F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595502, "uuid": "1ea69d61-dcab-4336-8afc-c5f7ceb767cc", "value": "768:8Z8qCFwTLkeOJKvQ9QLIEUBf+Xwc7gN4UtqK25G8x:8gJgLIGXwc2Mx5Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595502, "uuid": "12e29dd0-fd7c-4076-9160-784808963366", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595502, "uuid": "b78c9096-5622-4bef-a10c-365b1a8f2232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595502, "uuid": "0793383d-45bf-4ef4-be0c-46f148f98490", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.31434.19371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0a0bb0-e3af-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710605177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605177, "uuid": "a384039f-6156-4103-9dc6-7c43edd7c621", "comment": "Malware payload", "value": "547e4fb629a2249d9c123254ef3042e0", "object_relation": "md5", "Tag": [ { "name": "erg", "colour": "#C4CBC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605177, "uuid": "a3c6a0c5-1698-4882-9116-82d491dc2df8", "comment": "Malware payload", "value": "af5086d88a322f101c7f772e1af59652a8170038b9935aa677e26ae3f2ba43b0", "object_relation": "sha256", "Tag": [ { "name": "erg", "colour": "#C4CBC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605177, "uuid": "4a2954e9-5365-42ae-8a2d-688ca20b5a6c", "comment": "Malware payload", "value": "7ee7fa3252f06af4c114af46f2ecbf33392c33c2", "object_relation": "sha1", "Tag": [ { "name": "erg", "colour": "#C4CBC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605177, "uuid": "ca0c004a-9c71-40c4-aaba-c6ff0e62b7d3", "comment": "Malware payload", "value": "2598ab6107beb64cb8d3818db9ca1767a818221664c04a0a534f07a84b1cce77f39a0f4aa53520edd37c802b8b05b028", "object_relation": "sha3-384", "Tag": [ { "name": "erg", "colour": "#C4CBC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605177, "uuid": "2abc35b9-f131-47b0-b1af-992096ab3fae", "value": "T12F046C1927E62166F0B22B7099F602834E367CA3AF7592BF1784947E0D33A84D571F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605177, "uuid": "78e93b6b-be67-4ab9-b719-90c61d7f7b25", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605177, "uuid": "f810e745-2d81-4565-83ed-69e44097e2d7", "value": "3072:tMobR7ezAjLOZvmX1S5GWp1icKAArDZz4N9GhbkrNEkkO8YQ:KeR7eammqp0yN90QEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710605177, "uuid": "ba3bee83-657b-4f8a-be0f-76fd0c941a66", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710605177, "uuid": "37f20909-71e2-47a8-9a90-a1b613aa66e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605177, "uuid": "66492dd8-d1a2-46fb-921c-7d42980c13e5", "value": "e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaa8a84-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580937, "uuid": "dbd8f327-2baf-4803-afca-9590c7833cc9", "comment": "Malware payload", "value": "f2c6fe8aadb48298c2b2a824d147b62d", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580937, "uuid": "7eadfa9e-e21b-467e-bd59-e9ee529d5565", "comment": "Malware payload", "value": "b0461d9e349a4932c3c1d594e1e5222f9eeafe5a6a6a526a25636114576e5652", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580937, "uuid": "b7c1f160-efab-44b9-abc1-c4671c93cae1", "comment": "Malware payload", "value": "ffee98a00c7824bc2a8462dac412b1a0be56f52e", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580937, "uuid": "4ecb3aed-8ae7-41b9-a725-3b40e8110932", "comment": "Malware payload", "value": "8b4435421259b91ac4c95fa98af83114bf0673ddf483a00debdc0248a806a889b0638fa2bd10edbf9fe850281ffbfcf0", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580937, "uuid": "fdbcb3a7-822e-42f6-999b-de9a545cb7db", "value": "T151D0974F3E3E413B0B03AFCA0166C88FFD2140402282EE7080A2DFCD72249216CAC372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580937, "uuid": "666b3090-0eff-4c8c-9515-971508588e7e", "value": "6:U2OCUMb0kGTek8ES2KdVRers9qCCcjOctuCDrOctupeWp:U2OCUeGTeEdKBeY9q3UOIuArOIu0Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580937, "uuid": "865b7ffa-e2ac-42a8-b828-af5edd457ce3", "value": 270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580937, "uuid": "b3b3f02b-c241-4223-afc5-cc0cc964158c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580937, "uuid": "87c53579-3f6f-4016-b41e-bc261f2448ac", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adadb5d7-e334-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710552588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552588, "uuid": "94fc669a-413a-417e-ae0f-efa8d7458fc5", "comment": "Malware payload", "value": "895e6ab696385230c6c1622f6473c22e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552588, "uuid": "8db89486-2e08-4d7c-b079-481749073676", "comment": "Malware payload", "value": "b14596ed4072d55fe447dababdbe0d03a6c41873381d1f2de66e159702269a3b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552588, "uuid": "ba38c768-0945-400f-ab1e-381049fa4762", "comment": "Malware payload", "value": "3890dd7f09d8efd502f068c7119609365b7330d8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710552588, "uuid": "a300fd94-6ed3-4821-aa57-1216b4d29660", "comment": "Malware payload", "value": "06009fdcd6f9f344b6c3f61c210c9725e715ba093ec96ee03f0381e69c1f1dd3dc0ad7258fce2ea4dbebd601b82ca630", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552588, "uuid": "d119f538-f967-4fdf-a3de-bec4145dd65d", "value": "T1AE26E02176C2C13AD57E0172AA69EE5B553DAE730B3100CBB3E87D6E5AB08C19735B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552588, "uuid": "4f4da673-d16c-4218-b37b-70308de9702d", "value": "98304:6mD+Qmq79H231gByygnUOOcdtzzE4DUjNQ:BN7kwgbOcdtnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710552588, "uuid": "a6a467a4-d078-41f8-9640-7532eef8259c", "value": 4840960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710552588, "uuid": "2b7c3e76-138d-47ae-be40-591940e7a429", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710552588, "uuid": "b7fd4419-18bf-4478-a089-5d6a64ff33ab", "value": "SecuriteInfo.com.Heur.17968.23747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80c0877-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595528, "uuid": "6e73026a-60e3-4af8-aa34-7a9a3f6a8a5b", "comment": "Malware payload", "value": "c328130f2155c1845558ff0f7952a1bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595528, "uuid": "9551fe6b-4327-4246-8555-11ba2f3cb497", "comment": "Malware payload", "value": "b1e89886040e651b5090dfb28b89aec44ab1b421d2f9ee54e6af3c1a01d9f875", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595528, "uuid": "ae664a51-bc6a-42d8-a899-3c5e0841f2c5", "comment": "Malware payload", "value": "2ee7752164f1a19968910c41109b7c27fa567ecf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595528, "uuid": "9bb421c7-da81-4c72-96f6-a42c2c517a3f", "comment": "Malware payload", "value": "6cd522e25c00f3670384ae66041f2df3462eb2349f0ccdc5cd1ba7e1b7efe03d10d8a2e39d39e8dfb4c23cfbe7f99b5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595528, "uuid": "fb35b767-a0e2-4611-a13c-e21eeeaf7494", "value": "T1EA44239B2759ED1CECDB0030CA97AC8A2495CD312E170F27165FB968AC672847D27D3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595528, "uuid": "d4f00011-a430-4f26-bb64-f9dca7b5e2f3", "value": "03d03098233d92be592ddb98abd68eb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595528, "uuid": "83c7d099-3dad-4d05-a0f6-e4ee6a3ebcd9", "value": "6144:uDeMmN/YFJje7S4hnmDIdpI0aDnErqPFdK+3ZhCk/7cCZ:QRk/uJjeSG48RMb6MLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595528, "uuid": "7b8a3f5b-a1bb-4a54-bcfc-6b6e87ee07b6", "value": 259547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595528, "uuid": "7cde49bc-33c1-4422-842d-95da8704d15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595528, "uuid": "3c776ed0-305c-4713-aeca-0430e37723a4", "value": "SecuriteInfo.com.Trojan.MulDrop4.64255.20840.1163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4db2e7d-e3c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710612730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612730, "uuid": "e1d79673-ed4c-4bc6-97c6-94326cb814b6", "comment": "Malware payload (Mirai)", "value": "1c0a875c7cff55726c532158e598edd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612730, "uuid": "efab040c-1a2b-4502-b992-98044a0d4568", "comment": "Malware payload (Mirai)", "value": "b3798bc3e39886f80ee106c24ae2e45664991592967166dc877442064a4c8c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612730, "uuid": "ba2ae1b7-2c28-497e-84fb-12f2b712f1d4", "comment": "Malware payload (Mirai)", "value": "b1bc6750ccaa43fa1115fae8b61a8f05d63f0e29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710612730, "uuid": "9a1da8e8-30b0-4da7-bf81-2dedc00f74de", "comment": "Malware payload (Mirai)", "value": "fa1af25425d58a1a00897a21b4685140f024af1d0437cf01e4fd5047bf7ddd56cc30671ab850de908d8ea68739b34398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710612730, "uuid": "7ad37399-6182-47cb-8dad-2c0e8da16342", "value": "T1DDE2E1ACD0D5D57BD181F03DE95CA1CAD884CCCCCB2A9382761B9AF495BC862D901D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710612730, "uuid": "f25157e0-1f2c-4759-ae41-66a26bf6cb22", "value": "768:Qhuo+pVDcRzgAzoA7hq61aEJ3J8yLA32yc30:wX0IR5oANj1aEJ8x77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710612730, "uuid": "8c159b31-96c2-42d9-ae9f-7151f530369e", "value": 32308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710612730, "uuid": "6d72a888-4621-41aa-97f2-b32d51428179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710612730, "uuid": "fef7d088-5ec6-4bfe-a950-a2ae788a819f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d6b7d9-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1710595520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595520, "uuid": "0c7c7cde-1e35-4ef5-b080-8907514b8683", "comment": "Malware payload (Riskware.Generic)", "value": "8f7a9d0a1d69b29b754683d14b0adf1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595520, "uuid": "5b00d636-7fa3-4631-b0f4-fac3a5560e3c", "comment": "Malware payload (Riskware.Generic)", "value": "b4c5d677cb5d7405b5c01d9893b4a2e3535de2366f8aa0fd8f7c6f4878c4b452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595520, "uuid": "e0b7b91f-3041-444a-896a-e294d0272892", "comment": "Malware payload (Riskware.Generic)", "value": "670916a6916cdd35630a198190066d0ba1aaa810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595520, "uuid": "1798f622-22f0-4af7-ba42-7de3d7d064e5", "comment": "Malware payload (Riskware.Generic)", "value": "473ed50665ab99c25a7b646d3538263439ba75df5b02ec6c89d1b61d589ff862a203c5852913ee8fafb4b25ff9255c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595520, "uuid": "47807e9f-f282-4b69-9545-7d7d33b3e3fc", "value": "T1FBD4236E073AE6F7D6A163B85B9B82F3BB52AC470C84155F13C13E6E27760D2620744B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595520, "uuid": "c5c3fe59-75ac-4848-b4c0-4a2f02848971", "value": "47ec383a598b02bce9a4388f38424cbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595520, "uuid": "7794dc23-344c-4709-86e1-07f0b58c5f22", "value": "12288:i0ugNvXU1ozs6kMvgkEByHup1z3Avxl7WqE8rt9plh7G8qA3Uw8K6sqVUH:V9topeg3By+3I1LE8DpvynA3U7SEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595520, "uuid": "87d1cd12-3c24-4b33-9e16-5961914fc534", "value": 655318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595520, "uuid": "a98bac95-b117-40d2-9de3-c8fd6a8d0f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595520, "uuid": "42d0610d-bdd4-48b1-aa10-3dd7afa9d818", "value": "SecuriteInfo.com.Trojan.DownLoader5.404.23382.24035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c67cbd4-e35c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710569578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569578, "uuid": "214646c9-72b9-4f47-b28a-2cdd03003bed", "comment": "Malware payload (Formbook)", "value": "6126547ab734fb6d59c9689d6e97e0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569578, "uuid": "c73314a3-55dc-41fc-abb0-35517189801f", "comment": "Malware payload (Formbook)", "value": "b7128db8d1ce07b5f67c861bc3bb5e78e80563fca8c6862bf799247683e7670f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569578, "uuid": "9740792f-a38a-4e96-88d4-d0f05d0d1c52", "comment": "Malware payload (Formbook)", "value": "dc62f31b70f43717215f671363249430aac93350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569578, "uuid": "ce3f457c-46fc-45b0-bbf6-f003d4fb47d1", "comment": "Malware payload (Formbook)", "value": "0af1f47dd4541de32ab4aea55db1cc88440039b893a1863140e4ded489f7382393739a3991c65997b1d571bd974baac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569578, "uuid": "7f92926f-b5a1-46c0-8b43-bf527823b83c", "value": "T17CC52201AF988570E515FCB91784E739E64B3DA63A10BF422D80329769F37D0BF07669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569578, "uuid": "0c3b532a-fae7-4b89-9d2a-13ef59511cbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569578, "uuid": "24f3de40-43af-4920-be36-81165f2fc6ad", "value": "49152:bu5meHYWZgAeRrncr4Er3we2sNh4hOtNTdFf4H444lR:bSmceZcMEPdHh4H444lR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710569578, "uuid": "082a6d06-4329-4036-b3a1-908f3513c793", "value": 2659568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710569578, "uuid": "b72dd058-4bcc-4e10-b698-2d1f43289632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569578, "uuid": "4d1b61da-baea-435d-aea7-b442c450c15d", "value": "QUOTATION_MARQTRA031244\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0ceca5-e347-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710560857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560857, "uuid": "9b03be8d-52ef-4622-9dde-6645047ae460", "comment": "Malware payload (Gafgyt)", "value": "ffebbf39b6c0b097446e2ba3d543def4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560857, "uuid": "02724c0e-e2a6-4873-97e3-d39d76b21683", "comment": "Malware payload (Gafgyt)", "value": "b941f169e64445269cf68a83ce229de307ae90a4773ec20c5df00e8373726d41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560857, "uuid": "2e90a02c-8574-4a24-9b0a-b0210c774ab2", "comment": "Malware payload (Gafgyt)", "value": "b2f1d67c280669e238700d7059217c9a02510efc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560857, "uuid": "c7183ae0-9c0f-4193-bf7c-c3ef50a3344b", "comment": "Malware payload (Gafgyt)", "value": "6e9b305d89a1c6b91daf28d32be8f2d26f65e9847929fcefd692687fbec5d370288f90548470fa0b0b6030738b2fce9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560857, "uuid": "fef00454-507a-4313-b104-d33d4008a496", "value": "T152C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560857, "uuid": "43b337b7-e2e6-4bb7-be49-83042463ab8a", "value": "3072:4jDy/+mh1vtbPIKa4bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa4bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560857, "uuid": "7d008f25-344d-409a-84ba-f7726dc60555", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560857, "uuid": "a097bbcd-1edc-43f2-8ab9-79a8042d225a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560857, "uuid": "5d9f4962-694d-4dfc-9aa0-bf8234c2c14c", "value": "ffebbf39b6c0b097446e2ba3d543def4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c3f5ab-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Blackmoon)", "timestamp": 1710595504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595504, "uuid": "021bda18-9b98-45cd-b90c-6bd3cce04948", "comment": "Malware payload (Blackmoon)", "value": "39fcd811dbe670c3cd8ccaefb3227bc8", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595504, "uuid": "35ce0427-ed67-4e7c-ac9f-ec19afa9e410", "comment": "Malware payload (Blackmoon)", "value": "bb61f8cb40a34f975e1bacd26d533e1e0f312fe138b0f93f607a8d1077ee6a5c", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595504, "uuid": "d78fee92-84ec-4628-9fb2-c732ca87cb16", "comment": "Malware payload (Blackmoon)", "value": "3df2db5dda9d7c84b83a8b78c077297ccabe1b55", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595504, "uuid": "013bcdf8-1f2e-40f8-9f73-18c538c71a47", "comment": "Malware payload (Blackmoon)", "value": "e98dc96293a51fba590c44aa28c3a9ebddf5ffedd1f3f9a27d3950a28ea42521efab0f8dc3ff4d34eac37e63e9b73d95", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595504, "uuid": "9321a260-0fb4-4edd-be7b-6cc977e13981", "value": "T191346D33AA8340E5DFB4167210FE477E2F77E261097D095B2B4AE9D42B537201F9BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595504, "uuid": "9fa570b0-34f2-4a1c-bbf2-173e21db776b", "value": "1536:3Fv/oX6cIzWBkkxzsdljavTACv3XzTlYZ0M9dAx:3FXsizWBkQzsnjzoiZr9dAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595504, "uuid": "366109b2-5724-45c3-9b42-76f339b65bf2", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595504, "uuid": "96767b1c-6da2-4f6f-a03e-7f599aabb2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595504, "uuid": "61b4e5d2-11ca-4e68-9f19-535a7d653156", "value": "SecuriteInfo.com.Win32.Trojan-Stealer.BlackMoon.D.19512.31326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c670841-e360-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710571377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571377, "uuid": "dd1cef59-0c6f-4c0e-88c2-2b4eef88d17d", "comment": "Malware payload", "value": "68d21e42ba35dc6324c75da71233ea14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571377, "uuid": "717cd7c3-b081-4f7f-9206-67796b47145a", "comment": "Malware payload", "value": "bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571377, "uuid": "df7bc9c3-4447-4f06-b4d5-45895e8dd89c", "comment": "Malware payload", "value": "f5c5c50336d9239e1765bd1f8ca50d9c3c27612f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571377, "uuid": "3a585c9f-f7ac-400e-b03e-77c17965d536", "comment": "Malware payload", "value": "056f007ce24d1f587b47f03e1f2d89a59cb35c7dd8e445ad64eac3a384c5b72bcbbd461b03767554fde5ffc67ec54728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571377, "uuid": "866522fd-95c1-4b69-805a-902b96fb147c", "value": "T1138312DA1AB386D2EA4D37BBE3F901577E437D840719FB5D5220E6F0BA768D01E42680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571377, "uuid": "e28fe1ab-612f-4300-a749-df62003a9c2d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571377, "uuid": "380a9304-c723-4675-8655-b0007842acb2", "value": "1536:qn/9ecG8JnbijvBWya/1wpdN2YWL2MRxisBELCjTV1ExZ47pVUdsRGhSF:q/MPCbMvI9idspL2grTye7rUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571377, "uuid": "0f2c4740-937d-4075-9759-f938151759eb", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571377, "uuid": "09265dc0-a607-41e0-ab17-1f66f0070e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571377, "uuid": "f0486c0a-7da6-4839-8d37-796e90923ad2", "value": "MBR_Experiment_No.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a195c079-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595518, "uuid": "34ead587-a6e4-48f1-8a86-566bf27b5e59", "comment": "Malware payload", "value": "aafb09bd35d4f72e15203f29b8acc990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595518, "uuid": "e5b3c7f0-bec1-4e68-bd01-3b1f8d0b66a4", "comment": "Malware payload", "value": "c3e94475e3dc15e57ac1f8ca8eb35abe90f4295c7d3a689d613e5cddb315ed5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595518, "uuid": "70becc60-1194-4db0-ab08-fe5ba0b26280", "comment": "Malware payload", "value": "f09f567b52e58e266b8ee33cb7dd430ec5369a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595518, "uuid": "33e42773-d584-428a-a7cd-533187cd559b", "comment": "Malware payload", "value": "ed645dcdf1aaf4ae9540bc34e980258f00833e8003c9a5af4ff5d3aa83e759822a0df3a9acba724e1b2a9ca7ee0df60f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595518, "uuid": "87f9ab0b-8123-40d1-9d10-00568bc22ccc", "value": "T1A285BE57F1C240EAE946663058F76B3ABB36AF851E389ACF461DFCEC6B331D21029151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595518, "uuid": "13971907-5b8f-4082-bf70-bbf330043c85", "value": "24576:StjIOoygRHiZiH5LPJMkcnUYjI35NMBHkpEqbGqiD/2MF7:StbghMkcc3MpkzGqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595518, "uuid": "cbaf9a48-2a5e-4b36-ba30-11162a5191de", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595518, "uuid": "3f7eb879-4dd3-4050-9f71-bf6de06ba9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595518, "uuid": "a736ff7b-06b6-44fe-8182-105f107a2ddb", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.25909.5751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162f2dc5-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710580681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580681, "uuid": "0da57a87-e38f-4512-9e2e-1bb3eb81493f", "comment": "Malware payload (AgentTesla)", "value": "29ef049d25ca17b9996e6f1d5e84c90b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580681, "uuid": "33042b99-e7f9-4bb2-838c-0d2be33582de", "comment": "Malware payload (AgentTesla)", "value": "c6a9c7ac691a8836a63aedc8008881f8a0da2af6e86f5465388d32c50768f8eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580681, "uuid": "c4be649f-25e0-4130-8e78-6148ff9b5d06", "comment": "Malware payload (AgentTesla)", "value": "9e16ed6eccf23bfcbf0f77b5d976705f3d8a8bda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580681, "uuid": "39f03f1b-02cb-4309-8909-dd9266aa0a6a", "comment": "Malware payload (AgentTesla)", "value": "3acf3ad2645d738b040d6a60d5bab69fa853dabb2fd1b254f42508d8a14dd4305588a1914678983d67d011d834231030", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580681, "uuid": "7dff0b53-f152-486d-91d8-abea3f8c86e7", "value": "T1B4E4233A4863506F6C76123C5FFBB4ADB03E54B6A50CAFBDDF980157C8994D9420EE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580681, "uuid": "95f10449-dd48-4761-9a61-650d0c4547db", "value": "12288:5xc/WZ0PrN2SfDWJOK/HSKX9QFArfOywQFitVJTytSWt8CuVPop6O73bbTvLZsvh:o/ZN2SbiJX9QFArfOyfFOfNWt8Cagp6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580681, "uuid": "fea1e1d1-00c6-4d81-ac1c-1b3d1376dbb5", "value": 711985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580681, "uuid": "f78da94c-7720-49b2-8a32-ee666520efbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580681, "uuid": "9c670369-71f1-4498-8b51-2892aba3a600", "value": "Invoice202403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1dea9e-e3ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710604610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710604610, "uuid": "faa40277-44a5-4d08-8b12-4c172aaf354d", "comment": "Malware payload", "value": "e00a16df3de4222e5ee137034dc40518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710604610, "uuid": "071f376d-630a-492a-a7cf-2fe59a761c6e", "comment": "Malware payload", "value": "c7cbb84b16234707d05b1cc73c2070ce6bc67845c17953efac21b90e72d6edce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710604610, "uuid": "c9f51ab6-2864-4a0b-bae2-3c0a95ff10fe", "comment": "Malware payload", "value": "b751812754f0f6bf170a3250360636661af09e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710604610, "uuid": "20a0fea7-53d7-4449-be41-aa6670786919", "comment": "Malware payload", "value": "2707228be25aafc6cae0b9536e9b95006c1a2812d938794b1f5a238d19275fa34c0bf7e654e33ad02cc5a26f594a59c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710604610, "uuid": "03f15bac-0833-4be0-865f-72a93ecdabc4", "value": "T168046C0923E62066F0B62B7099F602835F367CA3AF7592BF1784947E0D33A849571F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710604610, "uuid": "21f4a814-03ea-4628-a5bd-e74758bf23ff", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710604610, "uuid": "c2bde8d4-aa05-4dd6-bdf0-ddf2ab312949", "value": "3072:QMobR7ezAjLOZvmX1u5GWp1icKAArDZz4N9GhbkrNEkky8YI:leR7eammOp0yN90QEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710604610, "uuid": "b19911ee-ca14-475b-abb8-6e965a971284", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710604610, "uuid": "831a8a1b-870c-4747-b0f2-d720c34999a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710604610, "uuid": "580c569e-268a-4724-8ca2-9029a9512752", "value": "e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632fe8e2-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710549886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549886, "uuid": "def72eec-f29a-434a-9b21-50a2cb5e0654", "comment": "Malware payload", "value": "b27c35a9c08d8a073c71e6131a45898d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549886, "uuid": "f80d6c0d-786d-4b21-8dc3-1e5e21d6b25d", "comment": "Malware payload", "value": "c9910c1925472f8224254364ad6ccfad5e735273e5ba629fec6dfeccba7f4194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549886, "uuid": "c372fb53-f379-46a0-948b-0b5819c23a8e", "comment": "Malware payload", "value": "7ab15ba60a74a4d488f6e17d75fb2d1189efa628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549886, "uuid": "fa89929e-8d63-4482-aa13-51bbafb50678", "comment": "Malware payload", "value": "de895182569c892c7d7956abc8507c22afa4bb6b413ed193315c23c39b722421f6d96756871300771e871f84fbf7f01e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549886, "uuid": "30c5f376-a57c-4c9b-853f-80ce717e021d", "value": "T129B3B8227B76AF4ED576E3F890AB5000C7B22A1F30ACD1A89DC354DA51B4FC18971E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549886, "uuid": "7eb1f895-9774-454b-9d4d-25cca3083bb5", "value": "1536:tpF761LHlYG9dP1hurfM5qJPgYT0YzAF8c2zDOM8k0m:tpJKLFYMdP1MN3QYzAF8c2zDOM8k0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549886, "uuid": "dc8e587e-3cdf-4e2b-9c71-eddd141e17f1", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549886, "uuid": "47f9aee0-2108-47e2-9573-c2467755712c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549886, "uuid": "92dd6771-74fc-4ca5-b545-982adb6a2517", "value": "SecuriteInfo.com.Win64.MalwareX-gen.10788.3001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873a35b4-e393-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710593326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710593326, "uuid": "878f7c4d-3fad-4781-b0f8-bf3d40da4e3f", "comment": "Malware payload (RiseProStealer)", "value": "a3e0c3de25d865806e9deada5ddbd865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710593326, "uuid": "3e84b912-50b4-4f7b-81ea-225b0d9c8819", "comment": "Malware payload (RiseProStealer)", "value": "cff865d27b4ded60ae4fe74bc49a8bb7dc37506f5c4c19980f713bb4c53b0eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710593326, "uuid": "370ebfb2-4301-4a29-9363-bc1b1d67aa85", "comment": "Malware payload (RiseProStealer)", "value": "059de0dde1007a3c54693bc189efadad58b958ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710593326, "uuid": "6240c5b2-c7cc-48ca-8ed9-2091ade8ba26", "comment": "Malware payload (RiseProStealer)", "value": "04967e8f36a407d5144925045e6b42113ff40b807c94f0062c9a21d7340dc58fb813a2240ac4ddad9d7213ac1b3043d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710593326, "uuid": "dd4f449a-2e73-48da-bd74-cfb319d753f7", "value": "T19466222D4990C052E42A94FC8EC1E56CB7761F9901AC87D161E83FDA5DF2AE85FB13C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710593326, "uuid": "03d39963-1fac-44ec-8217-657e01a5b284", "value": "e8ef2e8a62509894a290956c31ee7c94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710593326, "uuid": "bc65db41-8220-4daa-aa0b-fb03ce4cb064", "value": "98304:UNlNK79mn+OD1MsPUBHj3EA7a6AMVfhxD8qaXq0wBKtvTtz77scPNhzL:GXJzUBD3E618Xa0wBc7tP7scjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710593326, "uuid": "7721bf0a-ef31-443f-997c-e51d165568d2", "value": 6781440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710593326, "uuid": "1ea09cd2-642c-46a9-a1c1-ac2c367abb95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710593326, "uuid": "93d651be-3cfa-49fe-bb42-d46383cc81e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6354b208-e3c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710615599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615599, "uuid": "c1f3df31-b8cf-43d6-a240-d53cbd2696a6", "comment": "Malware payload", "value": "31fd4709bb392b6b343bbf940747c0df", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615599, "uuid": "9e99caf8-2890-4d3b-a22e-954c99faede8", "comment": "Malware payload", "value": "d3f5521f8b7a186a212c11242b28739b340591b2a7c476aac8300aec8e166787", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615599, "uuid": "182f3256-f103-4d13-8a29-1b5d92012e52", "comment": "Malware payload", "value": "3d5a7707588c98c709c1e4c3b7092b8242639f85", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710615599, "uuid": "db87a4fb-19fa-406c-99ca-a02a0e77b249", "comment": "Malware payload", "value": "98507190ba5e53ae443bfff51f6751872a9714313f3c7ccc807c0af564c796df16ac1e2e7b18701fe7a5bb9cccaef97b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710615599, "uuid": "5426230a-6fb5-42e1-8133-e77b84c1d810", "value": "T149F04B92C8CDA168FDB30AB22CBC3CADA6026228B0C498810EF203404C0829E4F466A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710615599, "uuid": "ad3a1c37-e86a-4d04-8aaf-3da7958e3325", "value": "12:5j7xvPkpoZmKvyBM10iqZ2C+/sZwUiBRsHqvUwuB5fa8kltn:97lPi2taBglWlEsZRiBkkeBut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710615599, "uuid": "347865c1-c8a8-4c47-8ac2-a8be1ca1f3ca", "value": 584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710615599, "uuid": "98b63cbd-4ca9-47c0-bdb7-83b32b41f812", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710615599, "uuid": "7b7a1a7c-d5b2-49a9-a809-586968b17cc0", "value": "MS AGROS v8X0Q9d2q4G9J69434136798.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b78950-e3d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1710620518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620518, "uuid": "163a85ea-00f5-49f9-a99f-31a10908f9a0", "comment": "Malware payload (Smoke Loader)", "value": "2cb4d9235c8edfaeeedf9258177cec57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620518, "uuid": "e2064dcc-5fff-4ae8-ab4d-0b4eefa8515b", "comment": "Malware payload (Smoke Loader)", "value": "d4bd84ab6a80420dd229e9607fb50c088667fdd38e2d8bf7a583269effa68278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620518, "uuid": "138523e8-c072-4afd-8fc4-291496628389", "comment": "Malware payload (Smoke Loader)", "value": "401520c963a302e4df292c032416febec06e5666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710620518, "uuid": "532c553f-2fb7-42d2-815e-7d148ad4f643", "comment": "Malware payload (Smoke Loader)", "value": "3fa600d1dfaa399f844f924b53aa9109b510411c2404fea1b9154f9c3368aa7b23591f36199d6ea1a384fdd259f25000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620518, "uuid": "9737d9d8-53ce-4fe7-90de-91e988930871", "value": "T123249EC1F6A2B821E1E3CB704969B6FC1639BC40CDF5155F32853A5F29713E088B672A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620518, "uuid": "5c73641b-b201-4467-9916-39acc419ad4a", "value": "4579d21a0e9605f673d9c393af3cdfd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620518, "uuid": "7cd28f4f-5f34-4444-9b6e-a84e3a73d130", "value": "3072:M4GZjvkqp4C/Khv97mrvw1F0Dz1yL9w1RBeg8+/yGYV:nGlvkqp4RSTwQwkRBeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710620518, "uuid": "525e7052-8c77-49ae-b8cc-7abf27016a11", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710620518, "uuid": "5def9a04-0107-483c-9eec-c9cd8907f7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710620518, "uuid": "74d25912-0718-4489-a7fe-65e841fe152f", "value": "SecuriteInfo.com.Win32.CrypterX-gen.27433.20242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9cb0e4-e347-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710560537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560537, "uuid": "c42ec6f7-e25c-466f-8eff-8015929ee679", "comment": "Malware payload", "value": "1df66a4237cf8665f2aa486b53a4b689", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560537, "uuid": "8a6b3c8e-7f00-4259-a0a5-5682711ff47d", "comment": "Malware payload", "value": "d8f1979b2b2a3d59db7716e40738d5d2a3d557055831e54f8e1f52079dd04aa5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560537, "uuid": "c4a388c1-0c49-4539-aa15-a5ebe30e432b", "comment": "Malware payload", "value": "0142610f6ad7b269cd980c68980df887f9f43c63", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560537, "uuid": "3295591f-931c-4914-bf9c-e536349af951", "comment": "Malware payload", "value": "3137c34b21252dd294567cfb3e3d3c8f3b9236e07f7d42e19635e3244fee82ee344b8490cf26772ea5ca29a8b8af92d3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560537, "uuid": "3d79dbcc-d6fa-4523-b1ac-8dc42da9a866", "value": "T13B9402A16E6414D6F839423C19272783233B12CC9BB0EFDC3CB8A15D72977966690F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560537, "uuid": "07ffcdcd-f1f6-4a8b-b579-08758fc7bc2a", "value": "12288:k4Idok8Tk4n65KGcnb7Ez5farOLHKT28R6RNB+rUg3:NookMQinUfayDKqZXZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560537, "uuid": "217b6bcb-7ad5-4bbd-8d2c-ed5922a3a3c2", "value": 423136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560537, "uuid": "34107ac5-bb34-4dd7-b36a-293fc320bebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560537, "uuid": "606bc744-9f37-4c5e-ab73-ec7eb9a08658", "value": "1df66a4237cf8665f2aa486b53a4b689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb766bf-e377-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710581126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581126, "uuid": "7c66f4b9-f656-4046-b465-1e7483168f37", "comment": "Malware payload", "value": "3a44104fb5d035d1cd725732e94a5e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581126, "uuid": "19f207ed-cba2-4e98-b561-764a18e643e6", "comment": "Malware payload", "value": "dcb623cc7f3f21e92e4878c82ce79582fdf6ba1e5e0c76f19097d1496e6c4b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581126, "uuid": "937d1c72-d1b8-4d84-b2e2-2023f89da2d9", "comment": "Malware payload", "value": "cb3f89df88e1468bca9d5ca01d22588791884ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710581126, "uuid": "2579890f-f1df-4e64-9426-0066c4bcd6e8", "comment": "Malware payload", "value": "c1096d1e2798a049f69abd9ef8b19789ef85f5dbc26b98ccd9aaa57ea5e98e8a7337d57c11f530652b0acc03ff6421d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581126, "uuid": "60f4a5f2-f96a-4cab-af0f-b9bd801dd62d", "value": "T1D2A4D44517508D36F2BE06F590CE0039D3A1ED9266D6AB0DD88CB4E16BB335E05FE26B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581126, "uuid": "7b118bdd-467d-46bd-b9b3-11ebca38d555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581126, "uuid": "497e9484-db67-49b2-b5c0-f3860827ba30", "value": "6144:5rtQDr7b6OdSo1qwmHR91YiOU35YyaLPTTNMGL2w9BBfdN3MVqRw6aPMGGmG1H:5JQDr2oE1YpUCycTNbJBJ3MB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710581126, "uuid": "3229c50a-aab8-44fd-8195-00a69a47f79d", "value": 493432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710581126, "uuid": "e7702896-bc34-4616-824f-1e40dbad43a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710581126, "uuid": "a9dc1192-278d-4944-860b-d448c86dba90", "value": "SecuriteInfo.com.Program.Unwanted.4610.15239.20339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28ae0b2-e35c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710569803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569803, "uuid": "f3860d9d-0911-4c8c-9280-d4e0f878c3d5", "comment": "Malware payload", "value": "7a5f77de3b336fc8625f8baec41a3168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569803, "uuid": "a09c5ad3-c030-4a42-acf2-29572b07e448", "comment": "Malware payload", "value": "dd5c65c71ae25c07f6ffe19bc7e2a30d0aa71d4564dcb87097dff0b91487a251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569803, "uuid": "a60add61-e9d9-4b1e-9822-81808760bd23", "comment": "Malware payload", "value": "edce17f2566b46f3d029e4e744eda4bd46afdf2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710569803, "uuid": "0d0d1464-6c26-4c79-9989-eae4c4373894", "comment": "Malware payload", "value": "1c308e2b40a2952837a09ae7d360d7a7e4cc1039004be9574e1511fd3e4fc8c6af767f967cf4aff248be6728ab377c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569803, "uuid": "fb5720c7-ab66-435a-8ee8-0aba7e3a62a7", "value": "T16B438E477B8023E2E58349FC00373AA7DFB1AB23532462E7AB146C259FE93D1CA35159", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569803, "uuid": "0eb6793e-4d40-4d92-bfbb-61954010601e", "value": "0818438d729451edf8c455424695687b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569803, "uuid": "823b0b20-6faf-4f3d-9413-47a4cb41b189", "value": "768:RSbM2QXEMDqCIy8zeyXSX8J+vReUmZLYmlOEb83jqiuLd+fphiTWeO5XmSg5:GWqCR8ze0SMfFIE43jqTYf/iRORmSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710569803, "uuid": "557c2c0f-a348-440c-b2b2-8499e04908c4", "value": 60152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710569803, "uuid": "7071502f-5b64-43d1-bbc5-d274ca6afba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710569803, "uuid": "d3b79944-23b0-4c04-b8ac-1c14e657005e", "value": "SecuriteInfo.com.Trojan.Click3.23919.32706.27080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e735830-e3ee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710632368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710632368, "uuid": "8bc53a7f-3d48-4b9b-80b2-2d54ac258aaa", "comment": "Malware payload", "value": "48e8e436992d0d14a956bc8e69f3fdcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710632368, "uuid": "d8f7859d-6b1e-403b-a008-ef36267924a7", "comment": "Malware payload", "value": "e35bcfebaecb69ba8e40774b41bf3cde8cf9eb7aeeaa8cd9f5aad6087fad0003", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710632368, "uuid": "705202a1-037c-4019-a4de-189a6c12c8d3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710632368, "uuid": "cd5a9743-523e-4422-a065-cb740ec40a37", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710632368, "uuid": "085fe3e4-c07a-4626-867b-76b53e33a2fa", "value": 3172352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710632368, "uuid": "f776e0a7-37d3-4b62-8ca1-5bbf842b7356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710632368, "uuid": "8b03aeeb-5bff-4db2-90e6-dcee2815630c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d545eff4-e361-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710571982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571982, "uuid": "40dbe4e8-44fe-42f3-85b7-88719b33895f", "comment": "Malware payload", "value": "cc7a161c8929dd7413b92d6eaf0d473c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571982, "uuid": "e676e6cb-1919-4fa8-9d4b-44719c55ba9b", "comment": "Malware payload", "value": "e39efa0522faf090b0a070bdfd6558cf12e12dc3b20f8e6c05afe79b6505b822", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571982, "uuid": "8af2239f-bcba-4169-924a-3b3f5e877d72", "comment": "Malware payload", "value": "e2cf80297f43e3dc07505853bfcf5da60138f08d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710571982, "uuid": "b1fc6230-2a23-457e-8a75-20ff9eb2e583", "comment": "Malware payload", "value": "3e534cda9a552de231e9c3f217b88417634defa2ef37c05b0e4abf3553a41f84fc1496c7f31fa5a3805928d09edec54c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571982, "uuid": "36bd7021-71d9-40b6-b208-e853236aafde", "value": "T12A86226D4A11D0A6F41AC6BC8CC6B21873352F686CAC47D128D839DDACF69D81E7C7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571982, "uuid": "ceb95c3f-5a5c-48da-9ac6-58efc9a83888", "value": "4def7148f41037b3bc9c17dcf019fe56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571982, "uuid": "23049fc9-8705-4750-af54-1b262c46351e", "value": "196608:JXKkS1y8F5OhLAMYGJLZMqvbfRWUdWlyx:JaPOdBpkkJdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710571982, "uuid": "e8e73521-293a-4b31-ba99-ef7484664daa", "value": 8250696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710571982, "uuid": "e171bfad-8346-49e4-926c-075b64d31d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710571982, "uuid": "4b266b0d-ce71-4bb3-9794-921c1d8a216c", "value": "cc7a161c8929dd7413b92d6eaf0d473c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4565b877-e3da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1710623710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623710, "uuid": "9baa6dbe-26a5-4f12-9b3e-de4955830c12", "comment": "Malware payload (njrat)", "value": "346f911ee54e46a96044b911505a56d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623710, "uuid": "9c09e490-8ef1-418d-8c86-cba36f05f808", "comment": "Malware payload (njrat)", "value": "e414e635d5029bc5d2bd402b8444f7f338f5f68a80fb2f226ddb085a7a7c3c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623710, "uuid": "74c416e4-f423-46e2-a7de-a9f5ca96d974", "comment": "Malware payload (njrat)", "value": "c061e651c5a9a160b03a49af73af8747f8fa40ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623710, "uuid": "fde44f60-60a2-406c-a528-0193e1cb74eb", "comment": "Malware payload (njrat)", "value": "d5a0959e8667745a4fa5da256f8aa9caced66ab8f9304097d6699785cc660c60957f17aae3f58eb1dd712386ee434935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623710, "uuid": "6784be80-a7ee-49f2-9b76-7153ce238ccc", "value": "T1FA6623A3B3686298D4C6CC3D4637FDB3B1F6070A4A42AC7984ADBDC539274A5D213B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623710, "uuid": "e2a1bafa-40c8-4a8b-be5f-334131e68a93", "value": "40c3d1644d90f8e8e78a1f89fb8c5d35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623710, "uuid": "e3db08cd-d759-42ad-9587-f4444d86a85c", "value": "98304:DcLUL00QzMXKeqRUfQSgGD6fUcqfrN+uDZsNzRjzqzpfiAHR0:DqAQz9eqOISgGDwc+uQjW1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710623710, "uuid": "43741dd5-e8ee-4feb-b69a-2984f0a30348", "value": 6562816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710623710, "uuid": "c3f4bf18-0d99-485b-a101-2894cd3dd9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623710, "uuid": "8dc0b4d0-600b-4e84-ac27-917505fc61b9", "value": "346F911EE54E46A96044B911505A56D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ec71fb-e3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710629715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710629715, "uuid": "85140ca8-e613-40e2-affe-5744d4636313", "comment": "Malware payload (AsyncRAT)", "value": "042db56a76d6279a04cc3e61a3320ccf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710629715, "uuid": "0efa13d6-e8b4-486e-a498-efe10929edfe", "comment": "Malware payload (AsyncRAT)", "value": "e4348ea6b4e98e96760105b7b9c9612370ac3a338bdca989e98fff87612c4d3d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710629715, "uuid": "d56c6d09-f371-4e9e-971d-d02a41b7924a", "comment": "Malware payload (AsyncRAT)", "value": "f614ceff642b10050d047a6d6ea3791d4cf73dfb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710629715, "uuid": "cd94500a-755e-423d-864e-0455736238b4", "comment": "Malware payload (AsyncRAT)", "value": "a446b57c137407edbb5747d9b24b63fac64ad00b2c7f8321553197fc51d893120e014c11501c63692450dd7e4e467257", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710629715, "uuid": "52b61dd1-a59a-4c7e-820d-5869029dfc46", "value": "T162953941BDE281ECD74E00B2242797496962D6F94B374AE339483B9AF770AD3743B364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710629715, "uuid": "80a5d1a8-ad5b-4533-9183-e5cd8491d9f7", "value": "e874c65b9789edc59c5a8bcd5076ad80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710629715, "uuid": "a44b9c7d-2e67-48f9-afa0-7883df39a421", "value": "24576:ew7m5lrAYj8HFqvc5toC27U99ie7i34Ft5PTAGj+K1LJNhIyHc:cN8H0vc5tbq4Ft5rjj+K1LJ0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710629715, "uuid": "f6641359-9ce3-4598-9667-9e8a34f7ff75", "value": 2035712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710629715, "uuid": "0651221b-fc9f-4636-a84d-c2e2e0eacade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710629715, "uuid": "b8cad083-2c4c-4008-9a6d-a88c415bbb7e", "value": "042DB56A76D6279A04CC3E61A3320CCF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282c0c4e-e3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710625808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625808, "uuid": "010836f8-c86f-4cb5-ab23-a7f507165db0", "comment": "Malware payload (DCRat)", "value": "22829b734f1bc328d0e81b4dc1348349", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625808, "uuid": "fa6cddc9-1aa6-4770-bb44-391de182e936", "comment": "Malware payload (DCRat)", "value": "e434b8362b39f1202159b48a025eece729c54a2627c04fe927ece4566c2ca2b7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625808, "uuid": "e1ab3a6e-6186-41f5-9bb2-d9036ad428b7", "comment": "Malware payload (DCRat)", "value": "1da4cc93dcc60405efbe726be98ec93558722887", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710625808, "uuid": "c5201391-41d4-49a9-852d-68ea142e9c40", "comment": "Malware payload (DCRat)", "value": "9d8d7be6ce2a347c7f3d9abc3e0ebe7abd26665c9b8e4ca8f5b26ae0e619afcb1bb196b6c55b2bef7d2d538bd9d73799", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625808, "uuid": "0ff35fa6-e7f1-40e7-8cdc-69a29cb4bc0e", "value": "T1A606F102A5D14E33D2A93F358AD7412D52B4D7717E13EFAB7A1F2199BC013B09B162A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625808, "uuid": "4d411215-1b98-4fb0-bdad-045472d7e3d5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625808, "uuid": "98374871-5340-4197-8abe-a2f7585b410e", "value": "98304:yjx7SRuoGHpgyYX9JmqrNBXDp2gwLF87eGpth:u0IoGHpgyu94kdDp2gGF4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710625808, "uuid": "d497c1d1-9738-4650-bd76-26893485d968", "value": 3993917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710625808, "uuid": "ebb4612c-e4ce-46df-b8cb-e840ca7d37c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710625808, "uuid": "4ea0639a-e24b-4377-a39c-2353f13aed3f", "value": "22829B734F1BC328D0E81B4DC1348349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c03c318-e3a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710600555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710600555, "uuid": "cb4e5ec7-1252-4698-95d0-9336003ade34", "comment": "Malware payload (AgentTesla)", "value": "5edd8549ca4956430633e0ca8aa37ff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710600555, "uuid": "2aac331a-6080-45b1-9280-87e20f900fd3", "comment": "Malware payload (AgentTesla)", "value": "e5370b44a594192991c50908e3ca042b267894cf52fa1ed3054885d92ed8edf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710600555, "uuid": "f0ceecbe-a9f5-4f79-973e-13ea32f66cbf", "comment": "Malware payload (AgentTesla)", "value": "46ac7b9c69a7f676227f27d3039c661d41a2dd4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710600555, "uuid": "7a6edb03-553d-4ebb-bb87-2a6da71ada54", "comment": "Malware payload (AgentTesla)", "value": "9ba12d468ceae055533a5d38a2f9c8761065e25e86d7842f454215f49843b33dfb56d598d7f32e2d3ca600b60c0d9359", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710600555, "uuid": "c41f5f35-b2fd-43f5-9434-29e4446251e5", "value": "T1F0E41214E35CC85BD95E827DA4A48281233196AD71D3C7B9ACEEB868FA5B37D47103C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710600555, "uuid": "86e90b6b-b107-4d97-b177-4dd85ce905d9", "value": "12288:7tZrtbDtydEZKUtO2/AzaaJzrF21YvbnYAhmzIj:xJ1tyQKgO2MaQx8AhmzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710600555, "uuid": "835f921d-c6b5-4a16-8e52-6956c89c58d8", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710600555, "uuid": "74a5aacf-0576-4f84-a869-b43415e03697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710600555, "uuid": "5bd9956c-e72d-46d5-8442-c9a1c86e3170", "value": "quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59c8a32-e3ec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710631736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710631736, "uuid": "31628d0f-93d8-4eae-a746-dae097777637", "comment": "Malware payload", "value": "996f15c9ec686cdc65c42876e22c28d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710631736, "uuid": "bb86d83c-4e9f-4e89-bfba-4bf998230b7c", "comment": "Malware payload", "value": "e5dfc28d7465dc9fe85b0276889e4788cd9303140000157c3510e3330d955233", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710631736, "uuid": "94105d8f-812a-40e9-af16-1ab049adb15e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710631736, "uuid": "c73b2212-1118-434d-bc38-d85be0cf1610", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710631736, "uuid": "df468e60-c8fb-437c-b2f9-d061a3a0888c", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710631736, "uuid": "6d071343-5465-42ea-899d-7b3254a82180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710631736, "uuid": "70393fe3-6f10-4c72-9e91-b5a9d83b6a63", "value": "SecuriteInfo.com.Trojan.GenericKD.71762163.9101.26791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a932a476-e3b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710605838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605838, "uuid": "e6a7c0ab-42c9-4e1c-a5a4-cb73fbc50953", "comment": "Malware payload", "value": "4c1197a4e5d97a8dd8fa91bc622e5167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605838, "uuid": "dc0a7a72-9f0f-49cd-8add-26018491dc41", "comment": "Malware payload", "value": "e687543a0e8d45ab78e9208035ad606b4737b74a5371372d537c7d31993be19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605838, "uuid": "5f5aa570-a973-4c62-ba66-b4f5f77901e0", "comment": "Malware payload", "value": "2ac704d49f7f3bbcd14721ca340028cb75067ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710605838, "uuid": "f36b9f00-04ae-45cf-9ab5-ed483f1dd5d5", "comment": "Malware payload", "value": "02e9eedb992286c0c6a0ea571b7c131f42c0ea64f18f54a9b129c2976ca128a1718f0dc9b16aa2b3b3dcbf56103c9a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605838, "uuid": "2cbd5d1d-dfe6-41c7-bc3c-1c1097db7c71", "value": "T10C563355BE4940FBD562F97816BBCA608A12BD324CF2DA0F71AC352EDD331A0903675E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605838, "uuid": "85680d8f-e7f5-427e-a611-eee9e9082081", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605838, "uuid": "cf7c91c7-d990-4b26-9d34-0b29fd16d614", "value": "98304:rUjf8qu9r7bKfgrC18ZR5shjIGfXjjOMFoIIung4D6WvlSBu0OLZmWPg8gIWuNx/:4OfbVb9slIGPmMFvlXD6EowvYlL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710605838, "uuid": "c6e8677b-d069-4684-bf3f-f90d7686cba7", "value": 6186648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710605838, "uuid": "129ffb8e-f0ff-4549-b378-c65e9fb6e2dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710605838, "uuid": "0868ba1f-3996-4241-9acb-dae075d9879c", "value": "SecuriteInfo.com.Trojan.Inject5.2862.26058.26274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364f4e65-e387-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1710588036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588036, "uuid": "bde002e8-9364-4e3f-bb15-19128324ca12", "comment": "Malware payload (DarkTortilla)", "value": "ba28f54cb9597d6765f9f4bae4c7c83f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588036, "uuid": "4244fea1-1474-49ba-ac6d-06452d8e9b71", "comment": "Malware payload (DarkTortilla)", "value": "e6cbebc9c7572a0998c26479575222ea1724c65fc36eaeaf328de32e6be86ea7", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588036, "uuid": "84549852-f63a-4a97-8e37-0cbb2354774f", "comment": "Malware payload (DarkTortilla)", "value": "4a9e9dfe0df9bb49647d694f28b15af929f59d7f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710588036, "uuid": "36800f8d-22f4-4439-9228-7a5681f79905", "comment": "Malware payload (DarkTortilla)", "value": "07b149878f89b1359c085e90563cc9d6325b6672c2bfc52228689c2805c59cf155c88c5b8815ca6b40f43f584205d4af", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588036, "uuid": "16023f16-0202-4a03-b6d7-b4ccfa7400e2", "value": "T184B423F432988D0400F41895A365E98A2E64A66D5F7F9DB78F70F9A0D14FF05834AC9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588036, "uuid": "a765452a-634b-4521-b160-3c5c5e34361f", "value": "12288:fQVTToGybiWuruRPBJtWDCLrMDpaPgNW1e88V7Y0r9cX4/1VB:fO3oGvpKIDCLCpaPE8jlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710588036, "uuid": "8e88da18-889d-46d3-9e4e-353e53e1d22e", "value": 503549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710588036, "uuid": "5068cd59-2fb5-4f34-85d7-90fdbf321ca1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710588036, "uuid": "91564025-a4e3-4691-8196-e643dccec2cc", "value": "PDA bank.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64700dfd-e32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710549888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549888, "uuid": "32e42bb2-bd97-4914-9c5c-702f76807237", "comment": "Malware payload", "value": "5e5848681ed1969df83a91c6c8ae6ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549888, "uuid": "e9b6954f-a042-4019-bea4-503110dd40f9", "comment": "Malware payload", "value": "e711e618e415fabb12d7e84e6146df8794d8d0fef82dd217103a03728e700e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549888, "uuid": "13362ad5-2d69-43aa-8643-19f22d773c84", "comment": "Malware payload", "value": "305da2e10254b8776e7deaf5db9d338fcabb4bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710549888, "uuid": "2e843d9e-158e-4b4c-a396-1fae62ac6008", "comment": "Malware payload", "value": "3ec080ba9e2ae1f613512ade7abdd1ad7cfb1e9354c256fdb714a54d8681b464cc65421efef2a029bf3a6d41d7fe1932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549888, "uuid": "adcaf92d-9d1c-4c65-8aa3-46f3f1f65577", "value": "T1C784D01B6ADC9652CBC807B6E07600B582F0A921B687E3DB6C055BF86D57391EE0127F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549888, "uuid": "53ea14fe-c4fb-4c5c-9e61-115d1a92c81d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549888, "uuid": "e7cb0df7-89d4-4a89-986a-875e76a01f21", "value": "6144:iJ78nveQZij/aHhP1v886zy3gdcsF28IHkB38xF/Um/P4a2bbbMvQ:iJQnveAijid6Hzy36cs481B3s/UmP4ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710549888, "uuid": "9f63efb1-ce90-40f5-befa-fa470c82fe75", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710549888, "uuid": "5579eddb-d937-4830-9c2b-3d728b855d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710549888, "uuid": "7fa9a4ec-26c2-4912-8502-e35cecf9f739", "value": "SecuriteInfo.com.Win32.BackdoorX-gen.4152.2685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa838721-e347-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1710560878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560878, "uuid": "40f8da79-3075-487a-a55a-1ed2c2c23628", "comment": "Malware payload (VenomRAT)", "value": "170c2861fd060477a87653624322cbe6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560878, "uuid": "bc44fecf-bf7e-4eb8-9ae2-554478a28375", "comment": "Malware payload (VenomRAT)", "value": "e80be2782ae7e0bdab958f9ed74f3e1056a0c16b6074a6390a245a6a49e58f0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560878, "uuid": "fa0afc3b-e5b8-474b-a58f-92b66c7563e9", "comment": "Malware payload (VenomRAT)", "value": "fcf6770903669615c71a52dc793834b5475ea2af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710560878, "uuid": "1c957aec-1eb4-4747-bd22-a8b6ceae161b", "comment": "Malware payload (VenomRAT)", "value": "7c297ca1f164c710e753e93abb09cde4880c7a0abd916588e3d4ca87f72b118f29a62434091f72ed8a995001417fee15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560878, "uuid": "50c0be2d-f8d6-45cf-9dfa-0f88a4812976", "value": "T1BE94F101F9B1E471C1B259308D7ADA951A69F8D39B3472DB339D36EF2E702C04A723A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560878, "uuid": "d6adb3f9-069d-4646-9f91-18a26348744b", "value": "49bdaf6614ab56f1bf5b378774341bdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560878, "uuid": "72ac0949-a7b3-4b41-af74-a1969bcced2d", "value": "12288:vZcZ2tBfsL6yPqWCO6nRjEK+vD8FAbwn:BcZ2jIR5/0lEfDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710560878, "uuid": "d5cece1a-5341-45b8-8cca-6ce55f08985d", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710560878, "uuid": "04656149-aaec-4131-a8d9-cd45a257e4df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710560878, "uuid": "eefadb52-5a6e-4ff0-a1b5-4d028ee4bd24", "value": "170c2861fd060477a87653624322cbe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cee6f4c-e333-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710551970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551970, "uuid": "050d5e5f-1173-48b3-abaa-82acc5a9c30b", "comment": "Malware payload (Mirai)", "value": "b676a70615238dbff6121579289c2e17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551970, "uuid": "6460bde2-9dff-4fa2-870a-2eeab418374e", "comment": "Malware payload (Mirai)", "value": "ececc23b7bce18e0b4d6cd813a69ac270534ebac3f49fea3e0f47184e7947fa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551970, "uuid": "e0107a90-8b7b-4e73-a011-a9189792f527", "comment": "Malware payload (Mirai)", "value": "c057253a9458270381d1ce12a2a4348d177e4a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710551970, "uuid": "614488d3-1b0f-44c4-9ce3-12b03973dcb0", "comment": "Malware payload (Mirai)", "value": "d47d47f048f4fdee95e76a78126eb87ada1b93c48c75d44bfddf5b1139f6e6a47f66dad7222310b5ea09e47ab52f23ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551970, "uuid": "3b753671-197a-4530-a3f0-835c5474992e", "value": "T122431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551970, "uuid": "0e067186-9e94-42db-977a-bf749087f6b3", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwD:RqtmZPuutfbltZFBSJsBcfDSTFI+BED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710551970, "uuid": "33870c95-fedc-4f99-8833-e1dcceaaa736", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710551970, "uuid": "6feff701-78f1-4372-bed6-07b10a28775b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710551970, "uuid": "6e56c0a6-0ede-4e49-aa2c-8b6ba45b169a", "value": "b676a70615238dbff6121579289c2e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618f2995-e376-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710580807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580807, "uuid": "94d0cf95-ab9b-46f0-8132-ed98ecd63844", "comment": "Malware payload (RiseProStealer)", "value": "0c17f9020b5471997aa92ac8a9165b95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580807, "uuid": "4be2c176-e6e3-4908-9f4e-72d967435d1f", "comment": "Malware payload (RiseProStealer)", "value": "ed46b696f43c9b760f475e7a927038db95a3edb46fee10dad535d9e80d1d3060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580807, "uuid": "92f58b3f-7e4a-4b0a-a0c8-d5843cb54116", "comment": "Malware payload (RiseProStealer)", "value": "88ff69af395cd48bc159d2354022731ed58583d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580807, "uuid": "5143fd5b-32f4-492f-8aa5-e8905ca74f79", "comment": "Malware payload (RiseProStealer)", "value": "d6d48a1f9085fcfa77045b2acc9e41f9e834584f9ef5557fc2c474e3a80f9b6b8314cff7ce8b735a67486691c8835678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580807, "uuid": "6f027c98-78dc-4008-b739-344af19b623b", "value": "T13766221E1C89D118D02AD1BC9CC0E66CB7B66F4D051C8BD654E83EE6ACF29699F71383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580807, "uuid": "243f96ce-90f7-43da-9e27-03c620f0aa3a", "value": "e8ef2e8a62509894a290956c31ee7c94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580807, "uuid": "b71d8e32-820c-4fe1-b38a-feefdfbd6faf", "value": "196608:Y+gWBS+mmYwJ1nDIY+Naie7PHCkoXXOjEOYe0:TgK4mYg1MQHCkDYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580807, "uuid": "98ccf6a1-1185-4bbd-8fcf-f5022d171937", "value": 6712832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580807, "uuid": "c410c01a-aabc-4ff9-a307-c4797f18acf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580807, "uuid": "f2828153-ca33-41e8-bc5c-979a9eea51cc", "value": "0c17f9020b5471997aa92ac8a9165b95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc45b0c-e3d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710623106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623106, "uuid": "2d9fd425-af52-4ac2-9832-9cd272215d09", "comment": "Malware payload (DCRat)", "value": "152f75a3c3758709b37b26e2f5203ad3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623106, "uuid": "fdc744cb-af3e-4c06-bf4d-20948c3f6be0", "comment": "Malware payload (DCRat)", "value": "ef2238044cab36b8ee70686d0f1dc5b743d580be57bb869c0ae8e5c2c3a23bd7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623106, "uuid": "0c53d94f-7394-46f8-837e-ebb087759367", "comment": "Malware payload (DCRat)", "value": "f85ad4e571c1efd98a4919e29b086dc6163a0688", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710623106, "uuid": "71640ef7-1cf3-4a88-8fe6-8bd2234ca995", "comment": "Malware payload (DCRat)", "value": "bc1129b2acd7be4ae70066bf778bd19e4fc1df58b9fda1132d66bdb2ccf162c0993bb324ca805c5a32f30582f310380c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623106, "uuid": "5f7b078d-4bcb-40e8-8884-1db61871eb56", "value": "T10BB4B505A6960A73E0BDA7B190A3180D83B4B8E7F766CFCE7841C4E697993C88D51773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623106, "uuid": "68d97d9c-e830-4efe-9c60-58890fceb487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623106, "uuid": "dc86dc87-cc73-4593-9b25-c9a72b53744b", "value": "6144:tUwhb160KdLm39C/Al7RwqqLh1H8JfgKCCMbn2IgAhp9Ajwbj7+Msz61+:tdh16TdFqWqcH8J9Iphp9+ESj61+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710623106, "uuid": "3e7e9765-b15d-42d9-af3d-cdbbc32ddc95", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710623106, "uuid": "04b9c0db-57fa-49ea-b88f-7e79bce7899e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710623106, "uuid": "8f39567f-405e-4fc8-9d5d-2644cc657f1d", "value": "152F75A3C3758709B37B26E2F5203AD3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8bedf0-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595511, "uuid": "004b49d1-0a24-4856-a735-4e59a6244de9", "comment": "Malware payload", "value": "2d27d4ab5f6597ad0dab057ac5d87882", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595511, "uuid": "9745bddb-1b71-4a57-a480-cde57e3dd5f8", "comment": "Malware payload", "value": "ef8738d23c5dbe146c14062f75fe7f0008bef47a21300be4e6b48a96b32cf33f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595511, "uuid": "912f10c9-eb00-4cc8-b1cc-56845305fc4a", "comment": "Malware payload", "value": "08c80cdf9eef98e4575215fa240bec78c51c5356", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595511, "uuid": "1a955ad2-f0b4-4055-89cc-ba2dcb06947d", "comment": "Malware payload", "value": "b9019bfe56a117f3c095668184b272848573d90152aa93b2e06cced958ecf7aa634fb3dfb160e1551e9dd844ab0c69d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595511, "uuid": "bb7e5b00-8a38-4731-8873-3c37571726d8", "value": "T1DC55C041B5C180B1D20D5E3056EA7B7A6E789F114B10DEC7E3A4FE796E332E0E53621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595511, "uuid": "2b3e8633-41dd-416b-a48c-5d3c85e9cddf", "value": "968b6bcf9d595f6c373ddadd1974fa83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595511, "uuid": "6154898d-0912-4bf3-937b-537bfb5ae4f5", "value": "24576:R47VGJY5EOH+4GeBCI0H187FGsATkR1pq2waYsS5BVzrXzT:R2VGJY5fGU0Hm7FlATZNd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595511, "uuid": "73ac9ef0-25f5-4e43-ab84-a1f600a0f933", "value": 1289759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595511, "uuid": "07827dc2-48b0-46c0-adf5-4bf0f8a111e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595511, "uuid": "26c9429c-e242-4551-a3dd-bef2b9d309d1", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.6611.8794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8971ba-e374-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580212, "uuid": "3e9a517c-534e-44da-a1d7-769a8b164c0a", "comment": "Malware payload", "value": "fef343d19ee8793cf38d862ed93bf122", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580212, "uuid": "b968a80d-fa31-4dbf-9f99-a3f704937dd6", "comment": "Malware payload", "value": "f3c76e9165d02a2ea612f3dfc335bacf137c1ee83093e369008158787d66b562", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580212, "uuid": "51a5f51d-e8ef-4bfc-9cc5-d6a9c0c5717e", "comment": "Malware payload", "value": "f7219fdd89c5b0cf3d7f984368f827315bd77405", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580212, "uuid": "ace86832-3f22-4faa-8c68-000a6426f8be", "comment": "Malware payload", "value": "cf895e0385f761edf8c28ba7baadd389081ad2f8ac8ba8244cd648baf318937a18141c6945967159301c97bc202f85e3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580212, "uuid": "4ea2b91c-7f98-4cec-b0b5-79fa4dddad56", "value": "T110072347F714B89FC9F792324A76422568479C1A8A839B872C58763C9CB7BC09F59FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580212, "uuid": "55a20321-46a1-4116-882c-ceee713d8678", "value": "393216:RZ961l3yXCvr1q0xQWHQH9I+YCZ9b9zYINEGd6z5IS6s996:RZ9y3yz0WWHQH93x9VgIS6i0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580212, "uuid": "e61474dd-078a-4725-bc75-def7890215bb", "value": 18442649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580212, "uuid": "784c601b-5ec5-4ad5-8c18-7370d66f37b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580212, "uuid": "4f8056bc-2539-4164-95d5-9e2e3a606185", "value": "Scan to PDF_2.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a233d104-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595519, "uuid": "27861ecc-9264-4c33-82b5-b4a27529cd50", "comment": "Malware payload", "value": "1ea828253824342ba46156cde01bb50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595519, "uuid": "fabd7ff9-cd2e-4241-a3e8-4fd371926286", "comment": "Malware payload", "value": "f7bb4a131cc7f3f70ec18fb1ac0a6b028e076e6b30400597b5df3696da48aab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595519, "uuid": "118c8b5a-91cf-4ae7-834f-de0ed0d94380", "comment": "Malware payload", "value": "40e0ac92cd42e266e63d0b53c61148051666aff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595519, "uuid": "2cc57f79-1268-44df-bbc3-f99ffb4aa706", "comment": "Malware payload", "value": "7ccbb7dc5fe60dfc1143120ce822da8c40d2bf9b312b69fe57abd5fbeec3b167adb56fc011913f86b4db4364a7610e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595519, "uuid": "1934c7de-250e-41dd-8eb5-e070b063ff66", "value": "T1F4534A57BBC28876F0A15FBC6C20E6D9AF27BD301E24264AA3540FDD4C2579148AD36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595519, "uuid": "ef2aeb74-cac4-49c6-888f-a7f23a55833b", "value": "768:EZ8qCFwnLkeOdSkp9AcRQkOih6JBEUz43to+cQm8x:Eg10cR+JBEzKxQ3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595519, "uuid": "5be9b103-f0e6-4548-96b5-028f905dab89", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595519, "uuid": "6dfe2e7e-8cff-4423-996c-f67c92a01a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595519, "uuid": "e78730e1-932c-4f74-9503-1262e0c9573b", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.29292.5167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9aea67-e398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710595514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595514, "uuid": "0eedee37-2fb4-4daf-844f-8a09b2aaca2f", "comment": "Malware payload", "value": "bbc1e0b6b3af7cfba78ffeb405b15abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595514, "uuid": "2637e63e-7f11-4939-9594-9aaba28cc46a", "comment": "Malware payload", "value": "f9503338e194b3322f40ac44f8c1dc1f181daaf8ebfed8f1988da07252afa3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595514, "uuid": "8f084c21-0660-481b-a107-562097c865f7", "comment": "Malware payload", "value": "73e552febd39b46bfdb2b27244ea525a9c2d331b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710595514, "uuid": "b557d714-ff86-4bd7-b430-4c3f51579476", "comment": "Malware payload", "value": "c0517763db932b0fccb4fea213a3849c8363690ef0c6ec80eb3a4dc83e2e85796e1fb26e09a76227545026a5ec980865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595514, "uuid": "159eca5c-40c9-4be6-8cb2-2ebd356afbf5", "value": "T13E54BE01F2A18536D14B9BB05C3E91FB3617FF541EA8A14F67B8DE396E3A281AC107D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595514, "uuid": "1586f5e4-d6b3-4222-9a57-b9e2c0025c34", "value": "6144:9MAZgJpbgGhTcvj+pN1UzA1moycShMwIJ4nfNRDiYc:9VZgJlgGhIL+pNmcycShMwBf7iYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710595514, "uuid": "c5b8ba1d-92dd-4892-888c-a25abfb3cad8", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710595514, "uuid": "c7106a75-ae05-4e20-9259-1ad6dfbfd8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710595514, "uuid": "bfa48627-57b7-4ce4-b9ed-577a29ee6686", "value": "SecuriteInfo.com.Trojan.Encoder.283.15205.19741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f65c67-e375-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710580516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580516, "uuid": "9d1fd870-8c32-4123-8a7b-da4ed5935498", "comment": "Malware payload", "value": "5e6415ee56c19e5f697d1e015b5c2882", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580516, "uuid": "f362ea8e-bf6a-4d46-b0f7-87dae6fff8c6", "comment": "Malware payload", "value": "f9e0ff7f6e2050a3ef6230f1a6a2f4ec0a3e792e172b800799638678daa15c69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580516, "uuid": "6cd4816f-2428-412d-8948-9a204c034321", "comment": "Malware payload", "value": "c762aa4da254e34cf5068d6e422692f5213f81c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710580516, "uuid": "003ab2f7-8b01-4984-8416-8766f31d36e4", "comment": "Malware payload", "value": "9917ebe77c9755f8f6d39917e846f2e2f3869dfa58747e44316f0360115f8432d089c8fd837e49a979faefdbfc70836c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580516, "uuid": "a9b0e8fd-b07e-4b6f-9139-ae23c99fa0fe", "value": "T115833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580516, "uuid": "792ceafa-8e36-4f26-b9c1-19ffc297079d", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJChdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JiBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710580516, "uuid": "7f47569f-9967-449c-9eda-9cc554007dd8", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710580516, "uuid": "9a08beee-777a-427d-aa1f-2be1eb1ec452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710580516, "uuid": "2b235115-528c-4f46-bb6d-939201b487c1", "value": "5e6415ee56c19e5f697d1e015b5c2882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b83b4f8-e390-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710592071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592071, "uuid": "b083d570-5603-42ed-afc1-e209315053fa", "comment": "Malware payload", "value": "3c09c842d37391a45e6c6da823d43c0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592071, "uuid": "e9ef54e1-2f19-4eda-b387-7d312919bcea", "comment": "Malware payload", "value": "ff12d7fb90aa1213fe211e6356d78486c8108f258f754cc2f64fcc75b671e517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592071, "uuid": "6cce987e-e807-471b-a551-42f2ffae8909", "comment": "Malware payload", "value": "3409d3a9fea7fbe43f9618f5e0fd79e758c50f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710592071, "uuid": "d4992879-db08-4ec7-a957-bf7bb94e2984", "comment": "Malware payload", "value": "aa968ed79f57aa0b4f6d25521b3c2411a999bbca70093382cb8ed3da38cdcfa67b204b1ce2c929a962e975843eea2681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592071, "uuid": "55faca6d-18ba-445d-86c9-ea14124718b1", "value": "T19B663335A564395BFA5183FD2663C2D713671211A813E4CF26950F9F0FA03D9F8AB60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592071, "uuid": "d2955ccb-bf9f-4b9c-92af-3a144055c8ff", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592071, "uuid": "0a41a9b1-27db-43f2-a78b-13852e1daa62", "value": "98304:XLL15A3iE0c+EtuUFyHKos1DgAtTiMekhRO5trMRvhIrPoTh8RebpldGm:X15A3iE0c+2EH6DtT5yxMvCDMKRSpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710592071, "uuid": "0cfa9130-803f-49c3-b4c5-e75031c8d162", "value": 6564672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710592071, "uuid": "a8bae15c-8f69-4983-bd5b-cb235dd7180a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710592071, "uuid": "ee52c59a-f321-45a0-9a24-4a9b27814145", "value": "SecuriteInfo.com.Win32.Application.GlarySU.A.18845.32505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3316353c-e33d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710556248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710556248, "uuid": "f6860d9e-c40b-42e7-acdd-5eabd1ed5825", "comment": "Malware payload (Mirai)", "value": "dea50a3dc9efedf3c159f93c4813025e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710556248, "uuid": "bdf86d93-ceb5-4f97-8203-969b1c00a579", "comment": "Malware payload (Mirai)", "value": "ffb4bead50a72aac794abbaf57c4ed92527ca1d366398bf637872d79800823e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710556248, "uuid": "9f190e27-06a0-4a32-a2f6-692b4b9d3b05", "comment": "Malware payload (Mirai)", "value": "ac077bfb81c24e603fa8a69fb9243c059539cc7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710556248, "uuid": "fc105177-3697-4e1e-bdf7-33459739fa7d", "comment": "Malware payload (Mirai)", "value": "b4ec28a66876cc424819de3986b4a72ffd82dd6fc8f9d7d9193cde9ddb185c4fb5c02b10cf7e1526816c7cad2f0ee002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710556248, "uuid": "eeceafbe-f734-4e9d-8cc8-1fea91f966d1", "value": "T1D8F21A56FD855602C6C151B7FB0F434D7B2B4398E2ED7303AA2A6F7133878660E6E446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710556248, "uuid": "f72d909f-6bed-44ed-8f2b-0ce5b893dcf4", "value": "384:xr8lAK+b0gou72QR+c67/M7UCDOXfsuBLQP/KFFNIp4yaAfAziodD1np9Fx4e8H7:xrBPoyKc67MYMWkP/T+AfAGM1nAk9Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710556248, "uuid": "4de2e695-f268-4c9d-878b-4ee6cbcefa6d", "value": 35620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710556248, "uuid": "f87ead23-baa1-4d29-8b0c-5d6e20edb413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710556248, "uuid": "7a0d078d-7d7c-449b-837f-bf1e3ac2278b", "value": "SecuriteInfo.com.ELF.Mirai-COW.27803.2439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }