{ "Event": { "published": true, "date": "2023-05-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-29", "timestamp": 1685404981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f87bf300-27bf-4d73-b1de-6d0be3582e23", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1896239-fe07-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkComet)", "timestamp": 1685354532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354532, "uuid": "7b3c134a-aa69-4b59-807f-5ce2558d1f49", "comment": "Malware payload (DarkComet)", "value": "818c107bc146a465f8bc0b10afb9503e", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354532, "uuid": "f5cf4a68-4572-4cb5-a6d8-80daa30ea2e2", "comment": "Malware payload (DarkComet)", "value": "000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354532, "uuid": "62b27040-9d67-47df-ace4-c10809e35ad1", "comment": "Malware payload (DarkComet)", "value": "290546bae044ab1989c34b5ba900f543ee3317c7", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354532, "uuid": "bb7cd771-610b-415e-a125-be98678e1764", "comment": "Malware payload (DarkComet)", "value": "80351a8e67988ece6514125560dd7b41055948377eeed0860c970a1cd97ba3957f46a989ab7108df7fb963ea0c421ffe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354532, "uuid": "0d013660-0bdc-44fa-868b-73dd4dd2cf97", "value": "T1A6C6232375D280F6D2E2193C9C3BA3DA767A7BA20E245C1D7FC81D4D9F36A923425193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354532, "uuid": "4c129014-9584-4b28-96e3-d3ee9b5e2bac", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354532, "uuid": "bb59ab3c-dd3e-49a0-b05a-ee33cf336828", "value": "196608:SLe75zkAWv1p0KuBDWq7DZX+DAqCwC4eOOkZjfr10pH/YMKJskFkiBdFt7fX1/yX:SS7WA8r0KS7DUCv4eijT10ppKJLuJ2bM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354532, "uuid": "bd713081-4791-4533-8a09-e5f078959a49", "value": 12433920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354532, "uuid": "813bb36c-f471-48e6-9785-4cb4c8446bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354532, "uuid": "ed43622f-c63c-4350-8023-bf3cbe962946", "value": "818c107b_000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358d8f40-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374000, "uuid": "99d3ab32-25b4-4097-bb4c-ee55282202aa", "comment": "Malware payload (Mirai)", "value": "03c704af0f21854be300444fe3f47af5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374000, "uuid": "7712a1df-d864-4b54-8a75-8e864ed124a3", "comment": "Malware payload (Mirai)", "value": "00454451593b2c152040a2b89aa337bd0886a307235b0b45b8b25a6c0c77ee89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374000, "uuid": "e2feab74-d2df-40e4-8e8e-2b63a941b751", "comment": "Malware payload (Mirai)", "value": "219db75d3fdb58879f80018662f453c4d3b42d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374000, "uuid": "e6083fde-f8ee-4b8b-b1ab-504b849865fd", "comment": "Malware payload (Mirai)", "value": "5f7fb7640a2a27b10d5c0dd6346f09b5781da6929ea4349bbfcf993c04b2cdab3139e6e993d54d8f6d51564437d55b75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374000, "uuid": "85440b27-775c-4ff0-b219-e408de93da6c", "value": "T1C8B2D0E8CA909707C1B038B6D23C8F515A3B54B4DAF728271614D7BDD68289533FCA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374000, "uuid": "ad793c14-d356-4108-b3c8-a8ab39b461d1", "value": "768:WHKQFH0rs3zWoDDRsjt7LB9U+Bu3UQen75:uK7rs3Kktsjt7Ibe75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374000, "uuid": "d7acbc42-edf0-432e-92d6-f64f643c3c1b", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374000, "uuid": "a2b673e0-00e3-49b3-9680-226bce9120e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374000, "uuid": "0e24b7d5-32e4-4238-96b7-8ac3dac124f9", "value": "03c704af0f21854be300444fe3f47af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c52b22-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685354032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354032, "uuid": "43cdfbef-c30d-4e03-90e8-3abc9beebfbe", "comment": "Malware payload (Formbook)", "value": "ac85688ebb0afb0d9994f6987cd43848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354032, "uuid": "ca77e852-0a8a-48e6-983b-9595a29da472", "comment": "Malware payload (Formbook)", "value": "0074ed761aea590abca0a0f0fe2d58a82f0b9cacc91cc108d122a0091329ef84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354032, "uuid": "821de237-ad15-4565-af0d-06d58eeb90fe", "comment": "Malware payload (Formbook)", "value": "24b96a93657b93b4f00f94f5b13e0f24d304935c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354032, "uuid": "7af0f073-cb8d-4508-8cd5-0275f20311da", "comment": "Malware payload (Formbook)", "value": "d6942ef63118f9cebcad197fb1437af7bd7602605ad29419974d23f232e40400054316977999c58756489a15dcd33b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354032, "uuid": "0468fac6-1540-422e-a7ec-fcc81074fc45", "value": "T169E4019139696F4BE9B9D3F8803035B083FB657A7422E74A1DC360DB766AF904210DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354032, "uuid": "a0dbb2bb-9064-4067-80ce-487537495c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354032, "uuid": "cdfc2943-6abb-425a-8b10-57257b210e71", "value": "12288:cNhmzZBEP85fp0uJcsdRs3OPVM7BXA6LYqOfAo3t9cpP5WkFfShww07EapmWdCRS:F9BEP8Fp0uJjgOdM7Bw6LYqOfVShZFff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354032, "uuid": "9096628c-3585-4fcc-b075-5657794ad0ae", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354032, "uuid": "f2718a19-3aec-4fae-a618-1705b656aac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354032, "uuid": "9cd68f3e-e1bd-4200-99b4-1e05fd1b1290", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5e2586-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346314, "uuid": "4663c539-c062-4a59-9701-e953db0a07a3", "comment": "Malware payload (RedLineStealer)", "value": "0620f47c51a49dd99a5c72c756237118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346314, "uuid": "71703858-ccad-48aa-9d62-de9d281d58fc", "comment": "Malware payload (RedLineStealer)", "value": "01926661ad0e69a5ecc8798ab502e1d5a8971b5cd9c9e4cd7a9c02122412822a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346314, "uuid": "8cac71a7-193c-463e-a604-19d22ad4871d", "comment": "Malware payload (RedLineStealer)", "value": "a622afbbfcd8605bb2bbec82dc30cd9d9ee6e293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346314, "uuid": "2e11804f-4cb0-44b3-bfe2-d6d8b885c5bc", "comment": "Malware payload (RedLineStealer)", "value": "960f2a2789e3c1e15873fb99d35e4cd81a79064ef24dad81d450a9f27c0d62dd6b159ac4a258d4dea0fd397874bac3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346314, "uuid": "07e6ec43-759b-4eff-a3a6-1c606136d05f", "value": "T19F052243ABE88163CDB41BB258F243531A367CA1CD3586BB734598592CB3AD46F3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346314, "uuid": "36fd4153-2099-4495-971f-c0b360479774", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346314, "uuid": "8087d6e8-0f1b-41cb-961c-943240864792", "value": "24576:kyV9pLjWUuPjS6fIop1z2XdE1De6nr6USBa+:zV9pLj2VfBz22o6nr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346314, "uuid": "4832d20a-da85-445e-ad34-e920858ef5a4", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346314, "uuid": "f7db5de3-380f-4f24-ac58-043b659848ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346314, "uuid": "72d02262-5e45-471c-9f42-ebc5db7999a0", "value": "0620f47c51a49dd99a5c72c756237118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b130e5bf-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376784, "uuid": "fa4d2514-b9c7-4b88-81b0-e6a60f080467", "comment": "Malware payload (Mirai)", "value": "3db07a3ffaacf316bc26f12e8ec8667b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376784, "uuid": "bce81f4c-77ff-4437-909b-cc44a4e04f58", "comment": "Malware payload (Mirai)", "value": "01d1773919124ac6ba30c4512f931adf449bdfa695f8de3f2f2bdabfc06db44c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376784, "uuid": "09e8846b-f9ad-41b4-8583-dc76e78fee7d", "comment": "Malware payload (Mirai)", "value": "00af665eb7d3326e4dab9fa16933266ec3125a6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376784, "uuid": "7278ebe2-2d83-45ee-b817-47da5caff0e4", "comment": "Malware payload (Mirai)", "value": "91a2793252d05ed8dc7740e14b3b65459e282823c5846b0afa0c6a1d4bb89f391a97fc5c2b8b5b749ab12f18750e30bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376784, "uuid": "64aef9d8-a83f-42c5-b813-d53e8f741862", "value": "T1C093D709BF610FF7E86FCC3709E91B05198C550A22A97B367A34D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376784, "uuid": "745d2490-7ca7-4c92-b022-6fb4687fe30c", "value": "1536:nSITUINkErcWGCbZnAbHcSAkaI91rFC0Za72Pz4:nSITRNsW/tA4ibC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376784, "uuid": "39c7bbbc-8d10-4561-bd92-12ed8611cedb", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376784, "uuid": "5c79bf5e-f60b-4385-8001-cb0c694c35b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376784, "uuid": "f2422610-a8ac-450b-995b-d5e54b3ad9b4", "value": "3db07a3ffaacf316bc26f12e8ec8667b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec762baa-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371300, "uuid": "358b69a3-be19-4e65-b6f7-2a9d72a7a3b4", "comment": "Malware payload (Mirai)", "value": "cafc7fa245fa7fe0edd5082d6e0ad8a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371300, "uuid": "c289807f-95a1-4f1c-823c-8c2b9d3bdbee", "comment": "Malware payload (Mirai)", "value": "01f99b401ce56ccbd23596d61d268f8756adb7b4162769b0a798fc6bc348a854", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371300, "uuid": "04c1828b-02c9-474f-bab1-ab814de0bdd5", "comment": "Malware payload (Mirai)", "value": "4224d2ad9affd6160b6ecc4c85108f5eb40c85b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371300, "uuid": "b3566727-57da-40cc-b95f-88182b753469", "comment": "Malware payload (Mirai)", "value": "5ed9f439448251ae62f57653e28368500c6a325fe26f4789622b16384a6009675c01168b14e3308718eb6445a68f2513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371300, "uuid": "7d1be8d6-3462-49bc-a999-e635dc057f02", "value": "T1B3343B92A9408E23C5D427BBF5AF018A3331A799D3DBB2068D285F7437C6A5F0D67B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371300, "uuid": "55e7c42e-ca5f-40dc-a924-700dc714b278", "value": "6144:dhQWlhrImTwCnlEvR22iEzjWtAeceDSPXE7TQLx8uexjCOjRM/9XVlLLV:dhQWlhrImTVnlEvR22AAsDP7TQLx8uis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371300, "uuid": "a21d281e-84b4-4be1-a45d-1fa008c0d5c0", "value": 241868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371300, "uuid": "92222f1c-5c5b-4e08-9a9e-3dac8236af36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371300, "uuid": "eba93297-e561-49b4-be34-f018145ecd7c", "value": "cafc7fa245fa7fe0edd5082d6e0ad8a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc1849d-fdf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685345558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345558, "uuid": "8fe468b7-830a-4cfe-9d35-ee40574f02ef", "comment": "Malware payload", "value": "59b21caf55e4f0ba2b075e0ef6c1cc09", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345558, "uuid": "fb2795bb-6bd1-4e93-9ed7-9c9e1da180b0", "comment": "Malware payload", "value": "023576f2e105787c97e05ff7abe17b1b32c52c750749d4e6196ba3132839a856", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345558, "uuid": "915694d6-a211-41b6-b6df-fee363e6a8db", "comment": "Malware payload", "value": "76283cbab4d1893b91f9535cd153198f70574572", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345558, "uuid": "3938903f-09b4-45ab-840c-ca5c7449460f", "comment": "Malware payload", "value": "fd6f869546b74586b2851d6025b90d6cf2d17d65d8d7b61690709e37b5325b7143843ef4e999e52ff88bf8e43c602bd2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345558, "uuid": "1c8e50dd-ae11-4d7b-a7a8-7147b80512da", "value": "T16B765B8B72D512ECE0DD0F331351829063E9A9363BA45EFE4A208714957B5B412EE7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345558, "uuid": "35803987-1a5c-4d86-855c-4ae833bcf66b", "value": "fe63e322309337ee09a198afe547e82e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345558, "uuid": "e3bdc2c5-5753-415c-a4bf-3148ebd74290", "value": "98304:rQk/UNWu9bLm5rGhvUIrVgPjlkhRxmtTR2g:sk/VaHmK6LeqL2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685345558, "uuid": "4b4162ab-08b6-49c4-a053-faa6ebdd69ee", "value": 7402496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685345558, "uuid": "e97f006f-6827-4235-96c6-c18a2c736423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345558, "uuid": "87fa75e3-d9f6-414e-bb6d-0042a792cdf5", "value": "59b21caf55e4f0ba2b075e0ef6c1cc09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feed335-fe2a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685369373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369373, "uuid": "e9e38909-71d6-4b2c-8692-81371fda8851", "comment": "Malware payload (Mirai)", "value": "6f77b9ec31ceb533242f4d796787a0ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369373, "uuid": "91615463-bd3e-4c1f-8c7a-64b34f3fdd85", "comment": "Malware payload (Mirai)", "value": "02c6cca23521945efa4ceb3d98f0bfcaf0d10354a08c7901225132983bed0cb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369373, "uuid": "59707687-675f-41d6-b184-54d21e40f623", "comment": "Malware payload (Mirai)", "value": "676fdf8dce034cb38c90989cca3d8765fd00583a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369373, "uuid": "0c313472-d531-4838-ab6b-b52f4c806e9e", "comment": "Malware payload (Mirai)", "value": "286fdaf68619b1a3f1171111b7e86cc6e36fcd3df0fc84919466827e375d612f125767ba01b664c664b098ffba4127db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685369373, "uuid": "c579ac21-b152-4a40-9b3a-506e256ebf1f", "value": "T1AAD32980B683E4F5CC0146B8306BEB335D37A57B512BDAC7D3E49D637C85A81850B2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685369373, "uuid": "0639a98f-eff0-49f3-aefd-08307a495676", "value": "3072:xPH/MO5f7MBb5crX/Yud/jAKNbVV5y32XzRIJ+kS0EJngRbQHCOWVqu88wHqSpcn:1/PV4Z+zAud/jAKNbVVEGXzRIVS0EviL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685369373, "uuid": "d115695c-75f9-4d96-8c15-649a73140b66", "value": 140240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685369373, "uuid": "a1342fd1-11f4-44c1-9024-4d1ebda6a0b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685369373, "uuid": "3686ced1-8985-4e70-bd04-a9b85e129587", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0502695e-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388092, "uuid": "3a865bee-810f-44b8-8e51-30f287107b06", "comment": "Malware payload (Mirai)", "value": "9298746bccecf31edeba9dfdd4aa1083", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388092, "uuid": "42104178-c1b0-452f-9ffd-66747bf1785e", "comment": "Malware payload (Mirai)", "value": "031fcbc29ce948e69f6330807721d678671df975afbc28d06f083ceaaafdd2a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388092, "uuid": "8396eb59-cb51-4eaa-a38c-93092d57477e", "comment": "Malware payload (Mirai)", "value": "2e6783557cac491ed2f06d9d0be60c9175523f8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388092, "uuid": "6886f8c6-5976-4ca6-99f1-75be54006119", "comment": "Malware payload (Mirai)", "value": "4747cbdf2307f8648f0538bf1b3a3154f1e66f6c3d8fe51cb8ab0342e5fb95030de3e98e2c8a79640f81cd3e37a9e5dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388092, "uuid": "c9a017ff-f121-4ec3-9ff5-d0a2e279ad15", "value": "T16153B61A2E12CFBCFF5C863447B78E21A658379636E1C645E15CEA012E7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388092, "uuid": "21e9f16d-f328-48ae-87ab-b97f29189101", "value": "768:M8V8ZP2Xf2iuDXvlnQvlFp8HIehsR5xbnrGVFSB/PxuwHBu2OEAqBE9H5f:L8h2XfruDFNHI+s3F/P4wINqu9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388092, "uuid": "135d3bb4-8ebe-49f0-bfe9-9af65b03f9f9", "value": 63364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388092, "uuid": "8a1f3711-e725-4b5a-8823-626762bf40ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388092, "uuid": "f381bdb3-9670-4008-90a2-0c7595dad065", "value": "9298746bccecf31edeba9dfdd4aa1083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a13b3e6-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346627, "uuid": "aa936d5b-540a-4cc6-9e77-109f98a26476", "comment": "Malware payload (RedLineStealer)", "value": "3ba7d8e0c3d6bf4fa1c1c5dbae8c524d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346627, "uuid": "c8e06bfb-8a86-43c0-bd86-025ad266d976", "comment": "Malware payload (RedLineStealer)", "value": "03507fa58cba907b90999e471ad8f144ce32a6b3b65810bb40c38ba29bf287af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346627, "uuid": "54bbe3fb-0e3c-4fde-b276-0a32b9f7578e", "comment": "Malware payload (RedLineStealer)", "value": "23f51d496f14b08c286990712715c196f5514f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346627, "uuid": "10e7897d-a9f5-45cd-b4c6-952c9cd92d32", "comment": "Malware payload (RedLineStealer)", "value": "8237f547b0bd3666ef0b0d52553e43b8a18b28d150360362a501cd441be24cb525b5daea6a34ffe5e49f5a9f94efb4e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346627, "uuid": "516dc382-897a-4766-8ce5-302a0b30baac", "value": "T177051242E6E84063EDF657B05CF3025717397DA19CB4876B2794A88E1DB3AC02E3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346627, "uuid": "85689b1a-2fc8-4a16-9a8c-6b154fe08c14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346627, "uuid": "35d9e519-54b3-4d9a-b151-64100aa3a4c9", "value": "24576:Zy5kowMqLzk9WZZGc01vJTveEnH6USWbu:M5koG3yc01x6EnHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346627, "uuid": "44d10dd8-1c95-4d8a-bde2-a92fce01ef3e", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346627, "uuid": "ae53ab48-d731-41e8-9ced-40f39282286b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346627, "uuid": "e49c2860-828b-41c4-9abe-4550dacef40a", "value": "3ba7d8e0c3d6bf4fa1c1c5dbae8c524d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b63ce0-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374024, "uuid": "5a6cf2be-d9c0-4c13-9155-584c50c7a636", "comment": "Malware payload (Mirai)", "value": "8cefe90099fdcc64a333edbab1e3f99d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374024, "uuid": "fc20915d-3728-4aeb-b510-c993378f8ecb", "comment": "Malware payload (Mirai)", "value": "05a56cee9714f481b39ee1fba39221d7b0810a5f013daabd6eff506f7d93697f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374024, "uuid": "d9fad345-2261-4f11-83c2-6ffb87df6385", "comment": "Malware payload (Mirai)", "value": "a430a490c8032dd431bf024615d112e874d6b9d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374024, "uuid": "1a33ef19-6074-4c2d-b04b-54f3297401ad", "comment": "Malware payload (Mirai)", "value": "5b977b6485ff9d805283c591ddd0bb1e12d6dd2175d9d0b050678e98ff2a7260992a5c97ad449a5b29a54c566dfbe232", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374024, "uuid": "60dc676a-0b54-470f-94f5-10b240e13a5a", "value": "T184535CC6B8119E7DF5CBE6BE84220D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374024, "uuid": "c872807c-d813-4313-ac6d-1506d81a11d1", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8t:N1GjR8EVGOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374024, "uuid": "3b31e531-27ab-492a-97f8-dbd401e7bc01", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374024, "uuid": "0c54c438-1ff5-4a2b-9467-473421cfee4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374024, "uuid": "fba2c0a2-2e5e-41e3-8a3b-b296e2457a76", "value": "8cefe90099fdcc64a333edbab1e3f99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839bee99-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363393, "uuid": "f81e089b-cd25-483c-b434-bd6533fa539f", "comment": "Malware payload", "value": "6b69224c28910c7aca87725e3a19e320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363393, "uuid": "23bb2332-cf7f-49a3-b89d-d71f20cc1202", "comment": "Malware payload", "value": "06cef0f60f5e3d5f83e154f0b518218a80284108656e266c2fae2383f3b07222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363393, "uuid": "31ac9e57-695b-4f98-908a-f3a71d56119c", "comment": "Malware payload", "value": "248a89669edbceca70d63740844585897d25ee64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363393, "uuid": "737b168c-c2aa-40c3-8f80-297ad06770f2", "comment": "Malware payload", "value": "0cfee2f226262f515b75ac6954435ef717f1428e002d6bfd0dbe5ba2c5d679551ac098417fe5efb2e6b4b63e22527413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363393, "uuid": "885a4d3f-bccf-4a0b-8c50-aa37e563e68d", "value": "T1AF62BF46B3EE145BE1DBB3361B334A621955B8008B2DD717D5DCE68F2C2028A2D97B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363393, "uuid": "d4b4806b-15fa-4208-be5b-33f876fdb45e", "value": "db0bad9f17d5c39211372ed6dff15a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363393, "uuid": "a831964d-ddcb-4ee4-91f8-4fcd2fa1102d", "value": "384:x45l9n4QHyLWDRhjRXAGF6cFcAVi34kJw9Msngr:x4JnKLWDRhjRI9AkuMuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363393, "uuid": "4f22bfe3-6b45-4690-a607-cc63ecc0fbca", "value": 14856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363393, "uuid": "a525932c-23c2-4172-9d35-6d6e6f4cd1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363393, "uuid": "49c41751-0629-45e7-8f48-e7f13a339faf", "value": "SecuriteInfo.com.W32.Nilage.gen.GSA.32317.28404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c557d19d-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685348471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348471, "uuid": "e8a5ec9d-380a-484e-af06-218a3a388086", "comment": "Malware payload (Loki)", "value": "d9c567f2ba8a1793ff8928fb5ab552ac", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348471, "uuid": "2d56e7a8-9c6e-4513-8769-b92b0a42b642", "comment": "Malware payload (Loki)", "value": "0709f9e2f76a07b22aa5361179d7120bd8127fc42a0f5c289f73e8f764460092", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348471, "uuid": "a41a38ef-2318-4e0f-97f6-0f9a0c88eb21", "comment": "Malware payload (Loki)", "value": "845e0d61b4235e98eabc3283127f5df172bff299", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348471, "uuid": "f0da52be-b453-401e-967b-3daa7738e332", "comment": "Malware payload (Loki)", "value": "9446be43a066ea9b5dbfbb42e7ed4e3c6205f71f3af47e0f04d007a93704f6f65aebcf6f01f036df17962fb579004055", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348471, "uuid": "a1601b98-51c7-4e76-b94c-1f0a588dfc21", "value": "T1BED4124427F3872BD83B47FD207159B003FB668E7A21F7564E83B0E8AE16F515A01A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348471, "uuid": "699161ee-ef01-4455-9825-cb0a1b56e3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348471, "uuid": "129f6117-8c78-40a2-af1b-cbe903712949", "value": "12288:IHkmFx2iqNhujGjUmhUo5B8kI5OnOdSHV502kiuDx5yhEh4:IEmFxUFhd8kI5OnBV50xi45+Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348471, "uuid": "d958cba3-9242-4e18-a915-7d6239ec13ce", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348471, "uuid": "acec1062-19a0-4ef8-90a3-77e2ab458b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348471, "uuid": "617e3690-d4bc-4faa-b049-2c4be52800f4", "value": "02708799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec707570-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685387621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387621, "uuid": "6d7a9b28-9312-46ef-add4-bec02d9c51e1", "comment": "Malware payload (Smoke Loader)", "value": "eb392eb1b3d33e2559343d530a1b546d", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387621, "uuid": "778cf312-702f-45b5-9156-d45001e2aa1d", "comment": "Malware payload (Smoke Loader)", "value": "0769315bba7b57606f1949f13c30f2e193bf0ed18d8fc7b37a7f11721b124091", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387621, "uuid": "22f0b14d-bce9-44ea-b681-0f09c966e472", "comment": "Malware payload (Smoke Loader)", "value": "b0b63af55d7c53ec15d287c835b3876b9fdebf15", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387621, "uuid": "adced592-0ec9-462f-8fd2-27c5cb5b5265", "comment": "Malware payload (Smoke Loader)", "value": "d4fcd08249e453b7688047ddb9fbc8820b3c7d4b4197133c2c06724c077b9709ab324cb993c2b50ca8c0d65f147d1c79", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387621, "uuid": "ac0947fa-028a-4750-bb11-ba0275effa5d", "value": "T122643A12A3E17C61F5274A71BE2EC6F8771EF9604F5937A71214AA2F49712B2C272331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387621, "uuid": "bfa7a505-60b3-43cf-ad23-7b66b6b823cc", "value": "d0fa90ab077085f07c566a80dea00339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387621, "uuid": "bb8d690b-d102-4526-84ad-17a7fcf4b920", "value": "3072:EXHXAk6Cm3stxdS45BKPkBxxQ7YafNK4br2jmONzG6Bv7rqzSRvXfpS:+XFk3sLsPkBxufNXbr2jdzJv730", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387621, "uuid": "8efe130c-9d35-405c-beca-2305a768129e", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387621, "uuid": "568f84c9-b3e9-4ef7-84ff-5ee1992a2433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387621, "uuid": "b00e9b9f-37ee-4f55-821f-835b82516793", "value": "08475899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d0a6a-fe77-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685402481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402481, "uuid": "3181fbbb-115a-4168-b774-eec1954e7790", "comment": "Malware payload", "value": "17c767b00496002ffe1657bfb699d43c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402481, "uuid": "aaf00a25-931d-4828-89fc-9242af74b702", "comment": "Malware payload", "value": "0797a50effa1c0ceb0003e24f6eeb28cc98b6594696118e289999bb70fe48e4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402481, "uuid": "38401c4c-c05d-48e1-badb-f72233d4de52", "comment": "Malware payload", "value": "fa3ff23bed94399990c7af2c4748b3c8c3493388", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402481, "uuid": "de50fd12-a133-4d85-b01b-cf6098856ed3", "comment": "Malware payload", "value": "eb7890632de845c046b2cd5886594312e92b6de93a50cdcbd23f4a84338b4a8c7f3207dc4bbe7c7ba0f2370f86e06cca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402481, "uuid": "4cd806ed-ce80-48a0-8da5-c879d434edc8", "value": "T14DF412079BE80532D9F2137019F6079B1A36BC626834836F6B81AD6B0D73BD5187277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402481, "uuid": "82870313-4af3-443d-a566-31e617ad9b94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402481, "uuid": "52d51e69-d7f6-4610-8324-3c58d4c87bbe", "value": "12288:dMrZy90jAlcpX+vePaGekVZKb6SRF5ePEfjG9cjxtAjNO6M23FA:Ayr+plyak24F50Ga6dtAjNXM232", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685402481, "uuid": "64b05c65-224c-4ad6-a269-a374b481dbe8", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685402481, "uuid": "10783f43-d566-4947-bc50-ccc7e5c01e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402481, "uuid": "00bb1fd3-26fa-44f3-9664-723dfd9a56b0", "value": "17c767b00496002ffe1657bfb699d43c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab2611e-fe1d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685363942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363942, "uuid": "c7e96969-8a3e-435a-bc47-ae3a08786163", "comment": "Malware payload (AveMariaRAT)", "value": "c5f9705e5682c03412ec7ca32e22c17c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363942, "uuid": "40146599-a839-4c32-9e42-4e71e090725a", "comment": "Malware payload (AveMariaRAT)", "value": "07dd531c1198ecf78a9d85e26db1f642de2c06d7234f46f97941afbd28bb742f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363942, "uuid": "3b6eee56-fcfe-4e28-9e11-ccde42ce5c66", "comment": "Malware payload (AveMariaRAT)", "value": "4d9a5b318e609512ee049f37b89cbcc52d93ad8c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363942, "uuid": "183f36f5-82ac-4796-b30d-a8f99b31f917", "comment": "Malware payload (AveMariaRAT)", "value": "e2c4cb89d5a3de0c2d75e9e6b0d8be11dcfa885b058bccc0b79494595292ad5f3177320c162aa767607d60d355c748d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363942, "uuid": "9b068573-5ada-45f5-8bbc-f777a82bffc7", "value": "T18E24F00777CEDC96E4B2D6F11F360A570E6659076463520607F8BA2BF2BA4879D0BF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363942, "uuid": "2679ac4e-3e5b-442e-ab9e-996722cade6b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363942, "uuid": "841c39a8-483a-4085-926e-20cee8aafe5a", "value": "3072:6fY/TU9fE9PEtu0bzFrdlCvsJQ+NAPyY50ynTp4ExUmMnheVhgZR2dihmTV9J189:MYa6YzZdlC0G+UsIRxU8vbiC1/f8n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363942, "uuid": "1c74f58d-ec9f-43bd-a482-72ccdca2e3fe", "value": 215339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363942, "uuid": "136e1017-7351-49fe-a22f-5f81d8cbce82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363942, "uuid": "a6edc982-0a1b-4049-934e-15cbfa32ac19", "value": "macrigan2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ea25c0-fe31-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685372573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372573, "uuid": "f32313a9-4ca5-4d08-b05f-d14aa92411c4", "comment": "Malware payload", "value": "320ac8c2679982d9e1653ecd325c86ed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372573, "uuid": "a71b49f7-9814-4587-95d6-d698a9202c15", "comment": "Malware payload", "value": "08b26356596d9ba296acac45e59a70d46a377deaf0cff142da0066bcb24f9ffe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372573, "uuid": "7e56b703-ab35-491c-b523-50317d891098", "comment": "Malware payload", "value": "7ade5c2d857f842bf2abeeae4131411203838f64", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372573, "uuid": "1ce4f924-98ea-4daf-bc57-71964b2e7a2a", "comment": "Malware payload", "value": "3388adacbb136300ab3299a4c9d9150495f2cd65b47c8ffe0f8b2c8e803111b7e5975e530e0b76a8d26f022d5c0ec482", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372573, "uuid": "2fe054de-0f44-4034-b219-848e096c592a", "value": "T19CA17DA9A0C53011FD7DE0F86B132C8974A4F246D261920BEA5022E46D71D61B7DED94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372573, "uuid": "1387ad1e-2608-4dc1-8ead-8d2b3111e45a", "value": "96:Aq6RIl+0sdfF50RLYpUTOObmXdEWurhnmqQLkFhxn/pvuDa6K2:eRC++qpsK6NmJLkfBpGDa6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685372573, "uuid": "75a1f918-acf9-4112-89f7-14d5bbcf799a", "value": 4714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685372573, "uuid": "7dfe7969-aea6-4c3f-8bf0-00691507e990", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372573, "uuid": "d59ecb2d-9bcd-4fda-92b3-ef02687591e2", "value": "e1360e96-0f6d-40e2-b558-f6ac858386a9.tmp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f8c9a4-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685353999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353999, "uuid": "65859a60-1378-42c2-99b2-9887437e1209", "comment": "Malware payload (Loki)", "value": "270ea03e47cd4b98478524b51302e134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353999, "uuid": "46796209-1b90-4109-ba00-ce0123e6694b", "comment": "Malware payload (Loki)", "value": "0a9e8eca4c463116ae91b67d3d0a4cbe3fc168edd87e8ac0cbeb47a4e673e380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353999, "uuid": "8ad6133a-adb9-4ca1-bc8c-17f06a64ee0b", "comment": "Malware payload (Loki)", "value": "a2cc618852770496d13ad831cc15502e93ef9d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353999, "uuid": "a8a7d354-d8a5-42d4-8dc8-d391362e8d08", "comment": "Malware payload (Loki)", "value": "512761ae09348b467f5f2d65a32cd7dad4066ff343bd856798b0a8504eba11df887a8888e2409b6eb139a21c9c33c6d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353999, "uuid": "ac10ed04-b65b-4ea7-b8de-006467fe65e8", "value": "T174A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353999, "uuid": "4be41c9a-86ac-4063-8654-745ba0b925dc", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353999, "uuid": "f28e2be2-207c-4b06-bdc7-461fdc354514", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685353999, "uuid": "84cd1132-815a-4f53-b0ba-7ef1995bcc42", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685353999, "uuid": "5086e758-cbc7-4a01-85ee-78cb1b1cd669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353999, "uuid": "426fd802-07c4-44c2-baac-a2ee58685fc2", "value": "0a9e8eca4c463116ae91b67d3d0a4cbe3fc168edd87e8ac0cbeb47a4e673e380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9008c18d-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363414, "uuid": "2cd31c03-87e9-4580-835c-2e6b50b5ef28", "comment": "Malware payload", "value": "29db1fa3bfed0b4339b942d33c8011c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363414, "uuid": "6f89a271-fab5-424d-8a9d-de197182cd2a", "comment": "Malware payload", "value": "0c5e1b9faa77fd28ca1cb6c854957313e840d5b26c0e04205028259db70361f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363414, "uuid": "a68e04b6-a687-4679-bede-ea48e5317be8", "comment": "Malware payload", "value": "07b5828c0a7d02675a75da08112176296fbaba18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363414, "uuid": "4a78136b-243b-4b20-a387-a2aaf8d4d6f2", "comment": "Malware payload", "value": "77dd28100d8dc1c9087e00d861b2ec5a2338d66cfad82b49814c6207e998139603f609bce564faa41a4147c5fcc72420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363414, "uuid": "fc22dc16-c69b-4605-819a-eb926cb86558", "value": "T1BF14130CDAC80A67E6265FBBC1252CB6D588C300DDC51B54BD0146DA5F7EBCBA30EAD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363414, "uuid": "966b0fe3-7bdd-43c1-8496-42dd1df8766b", "value": "3a0e19012649d3a8d2e905687fbe9cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363414, "uuid": "df69306c-ec4c-4f31-ba00-61be107f7f24", "value": "6144:Eclb0DeIvMLZG6ATvP9Feh4h6q1anPjGlnCuY1W0:EleEMLAVP9Ah4oqeGr70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363414, "uuid": "d10412a2-238b-40ad-a4ef-21a36090812c", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363414, "uuid": "2421dfe5-be5f-47ef-b0a5-d2da90cc2b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363414, "uuid": "4ca00755-76ee-49c6-addc-6175d1690727", "value": "SecuriteInfo.com.W32.Heuristic-162.Eldorado.6192.4141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685d61b9-fdbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685322116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322116, "uuid": "5e4d31f0-2953-4ea2-a7a6-eee1e90adadd", "comment": "Malware payload", "value": "9921df5e68e3894ee5d27a6c4bdbc3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322116, "uuid": "3a47b526-0dc2-4fb1-a54a-1d0064269726", "comment": "Malware payload", "value": "0e3a26de22f9f1bf3839f752f84304fac5d5e5af4b9b302bf7a4d26e24ff4496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322116, "uuid": "ca941c17-edde-4410-9ae0-c028c12eb3bd", "comment": "Malware payload", "value": "a8e01b8c4525ed8baa4c21b8b9e1d7002e43a37c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322116, "uuid": "2e2fc03c-fde3-4fc4-a67d-00d54c05b2b7", "comment": "Malware payload", "value": "4f0e75f981c16f105ab972d8568276b57d8ffccdbb1f0c2ce68af808d0936a7b198c398ae80ee24da5e03e50a8cf5430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322116, "uuid": "c4f88a3e-7003-4fae-80bd-52b74bf8ca17", "value": "T12F5184078600C03EDE9401B441EBDED212FB6778A38FAAE79FD4511269525FF6CB0461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322116, "uuid": "22b7b4c4-d0e1-471e-8d21-f53a37548d26", "value": "48:SUDdU9yfFGxOgw4txVrAus1hQqEktq17RZ/Q3WVLLmh:NDbtKOqtHAusyaGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685322116, "uuid": "8d845215-ee30-4fc1-a62c-7e55cda9af79", "value": 2788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685322116, "uuid": "23035a98-bd2b-4276-9786-eb9faf1def6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322116, "uuid": "21778ca7-d9bb-424f-b60a-3b02d51ed467", "value": "bmsJRyJN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad9b77c-fe2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685370465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370465, "uuid": "d7b700c9-0a29-4826-878a-d206910faa63", "comment": "Malware payload (GCleaner)", "value": "1835b641b0e0009bda11d7e4f29c8431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370465, "uuid": "306bdf95-2f46-4276-be27-ffd65b1d44d5", "comment": "Malware payload (GCleaner)", "value": "0f41bd199f9dced09ce6af8dd974a67322ef3d26722a2d719bec4f2e595cbcf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370465, "uuid": "b03f46d6-619a-448b-a581-457e5d5f0841", "comment": "Malware payload (GCleaner)", "value": "6823cb3f7c8e2b62222805e5af0efae33cf2eaef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370465, "uuid": "57f9a4e1-2917-499a-a140-ed5a100ad3ae", "comment": "Malware payload (GCleaner)", "value": "23ea28dfec6d9105045dca508ff74fb7955328a5dc2e5e5f82e667e07d08f76666b477ff845e6bdb7489859da4b9857e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370465, "uuid": "35a51e3b-d20a-4bb0-b8cb-fedebd1f857c", "value": "T1D3A53335B1498A3EE793CBB34E258A860D3A713185F54D9C310D6DE30B3A663B5A7327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370465, "uuid": "6aaca919-b2d4-4f3d-a987-ccb546589718", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370465, "uuid": "b0bf949d-c2a4-423a-9134-6b75e92174ee", "value": "49152:WijJycPs8aEooAu9TM9r853Vga4GIrEVEus8wuw:WijJy055x53Vj4GXq59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685370465, "uuid": "44c811c7-1c8d-48dc-ad01-20eef5ba84c6", "value": 2158354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685370465, "uuid": "bfb546a6-25bd-46aa-8b4a-57f25ee6fc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370465, "uuid": "c4ed54ae-dbb7-4f45-aa06-1c9781eeead2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9a672e-fe39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685375837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375837, "uuid": "def5f30d-a985-4cdd-ad83-32c50017757e", "comment": "Malware payload (AgentTesla)", "value": "cef63679d9b9da5a2c716929a496bfdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375837, "uuid": "b7e173b8-817a-4d1f-82b2-48f86e1e1eb8", "comment": "Malware payload (AgentTesla)", "value": "0fca2cfc9c5e64e93003c8a42ab67001aa5d6019de910d889411acb2eaff9e0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375837, "uuid": "ef7c573e-51d0-426e-8cbd-bbd7f2f2160c", "comment": "Malware payload (AgentTesla)", "value": "b153198a940d001903db339f3bed2cbc902c5354", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375837, "uuid": "7032e695-83e7-4877-a71e-d32326e4b905", "comment": "Malware payload (AgentTesla)", "value": "a92f4ffdf163cea20f9823b666f8c1f2d6fb48211cdd833d75ee44e5986019205f5a7633141ac3c48826603b37f02c44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375837, "uuid": "10abcadd-5f83-4e6c-bf88-77ee3918273c", "value": "T173E41265367D7F86D4BACBF84421397413FBA62E7032E7062ED7A0C722A5F420941D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375837, "uuid": "23a2a3cf-fc08-4752-8e00-c2df0fdb80ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375837, "uuid": "ce7fc41a-0c3a-46fe-a830-bfcf16994164", "value": "12288:kjQmzZBEP85lmuwC6CCS2tgMG8jLUZUO0AJhR+:C9BEP8DwC6VlHTjLUZbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685375837, "uuid": "e329d98c-c6d7-4b75-97ab-21ad63d83f43", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685375837, "uuid": "b5b55620-2e91-4639-bc38-4536fe13f2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375837, "uuid": "0cae4afe-13c3-42dd-bf63-2b63262d46fa", "value": "rOrdendecompraPO.043-2023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706e04ea-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685371092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371092, "uuid": "8bbf4758-3044-47e1-a3e0-be04e7aeb166", "comment": "Malware payload", "value": "4821d4aa2f840149a552749d01e1603d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371092, "uuid": "757b04fe-b181-4b0d-92c9-9e8b5ad9a6e4", "comment": "Malware payload", "value": "10d6f6ad99bc474ed5064017d933a4db4398f03af539a7bf4d49dd7d7ce03a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371092, "uuid": "f746f968-edda-495e-82ea-02891d11ce9a", "comment": "Malware payload", "value": "605c450dd52e2199c72d069c91b67c4be3c38772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371092, "uuid": "6f996d84-84bc-42f0-8e80-4cd36fa99271", "comment": "Malware payload", "value": "cd2fbf299da2c002375f1051ef0110eae56d4e4bd302eddc356cf382f4f08f7f263557f6d4eea6500a52e668af9e84d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371092, "uuid": "3ae96a55-e0f3-47ca-87c3-071b140ec7eb", "value": "T13C36BEB173499B9FF2E71070F88DD90BD6462FE281005240ED68797E8572EBE148EF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371092, "uuid": "aab28fb4-03d1-418b-9eec-b231ad30b440", "value": "c13e91ab17b8d0eb3dd79ce039b26e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371092, "uuid": "a0a7ef36-8e80-4df7-bfea-2d596bacb05c", "value": "98304:NFYZSMHYuI9QWQ+76KkoRvyL7tz06JE89kqioNX:NMFI9Y++9o4kqioNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371092, "uuid": "02f485e1-3f0a-41be-b8bb-d51efca51b78", "value": 5060624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371092, "uuid": "4e21eb59-b126-4096-a137-f27672bb7a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371092, "uuid": "165c391f-2c31-44b4-a0db-bd201abe0a9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e850845b-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685387614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387614, "uuid": "75f07750-4106-4438-ae50-024e76f87ebc", "comment": "Malware payload (RedLineStealer)", "value": "216cb886d1a5593810acd276ff807a41", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387614, "uuid": "030ca77d-e306-42cc-bde2-55a8ceb1b420", "comment": "Malware payload (RedLineStealer)", "value": "11280f3474865d29d61d811c5371528f94fa415a62507749ddb892a1ada3c1bd", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387614, "uuid": "52885070-c888-4a0d-8f17-4f4f2e337246", "comment": "Malware payload (RedLineStealer)", "value": "cff101502fa36c052400151b6b928b5301aab748", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387614, "uuid": "f77cfbed-791a-41de-abc3-db8167c836c4", "comment": "Malware payload (RedLineStealer)", "value": "4e0a874c5a0977d5ca5a4ad3dce35335a7927e1247fcf4dbbfcbb128c5eba1d601352201ed1c58001fd844c8b5dce2ea", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387614, "uuid": "e3c5f451-bed4-4a5f-901f-fea4539cf396", "value": "T136E3D524279F8930D6BB493D6CB25CD076BCEC52A942D34A4ECCF0593A73B80DB116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387614, "uuid": "af4e5873-ac56-408c-9bb6-e18e0796a3f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387614, "uuid": "c7339394-3c19-4714-b488-dd5a2037b22e", "value": "3072:LV+m5chQmRSZsBxioW/JruNFmRsZhCZR8e8ha:LjEx6U3ZhC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387614, "uuid": "08cb4fc7-76c7-4ad1-9ac3-9184a34ac7c9", "value": 148554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387614, "uuid": "ebabd886-286b-432b-8d8d-b0c54faeefc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387614, "uuid": "7ec10c48-e401-40f3-98c5-5b2e4b4d26eb", "value": "08426199.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad68b78-fdc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685325207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325207, "uuid": "b6ed617e-a28d-499f-991a-fad38f673f3a", "comment": "Malware payload (Stop)", "value": "1425edd8c25f476644a1ba44bcd79186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325207, "uuid": "f820c33a-f0c9-4267-a862-7366ac3d06e0", "comment": "Malware payload (Stop)", "value": "120b279e341697ce08305141de64d4c035dbed496fc65f3a9dd69f8595be5218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325207, "uuid": "fbc6490e-1c4b-4493-9680-412b5dccc2c7", "comment": "Malware payload (Stop)", "value": "d74b0b11b8d23fed673e0edc13c690b098d50836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325207, "uuid": "9b664951-1a4e-44d8-8963-3ecfb2565128", "comment": "Malware payload (Stop)", "value": "503125f6984a6875213c53eb76eb06de469410e60b33719946739c8476f9041726b9a0c50e45b735d1e4e53e534eaf0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325207, "uuid": "b1df1eb2-08bd-4bee-8171-8606133edf87", "value": "T123F4CF4392E13D55E66A4B729E2FC7F87A1DF6508F193BEA12285E2B04B12F2C573710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325207, "uuid": "041de843-b01b-43bf-86c2-04695e08c594", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325207, "uuid": "27c576fd-6418-4171-918b-42cfdfca6a62", "value": "12288:XoISHFImiNKyLM20dlCmnIyuDmluf8sru3YnhFnn/eREn3SgdWE/74B:XoPImgJ0d7XP4fU3YnhF1niMWE/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325207, "uuid": "91b825dc-72fd-4292-a9a6-8e5a0ceac313", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325207, "uuid": "5c14f5d0-afcc-41a8-af07-aa31f811b1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325207, "uuid": "c819cba6-cd20-41c8-8813-b58c676cf172", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91574a3c-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363416, "uuid": "0b284340-a309-4295-b81e-d3b253b722e5", "comment": "Malware payload", "value": "4662dfbe036d1018014f69e9886099d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363416, "uuid": "62521a8d-2d5a-4c1f-abff-4b61cf20e26e", "comment": "Malware payload", "value": "124287a2a5fdbf680e6c9bbf1ebc141880fc1b88b4099fe9026afa72c22d9384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363416, "uuid": "cf4f2664-4ba4-4562-87ae-a532fe19da8b", "comment": "Malware payload", "value": "d11f8fcac3acb2fbb126938dbd034496273d46d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363416, "uuid": "86115343-7465-4237-946a-75d24083e9d4", "comment": "Malware payload", "value": "71ef10bef19b42e2a626784ffec1da983fc29896d5c17b3ec43c076717c729500f84a9f1a63a42b88f39dd10ec0d4968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363416, "uuid": "802383fc-59eb-4c98-9164-0d8de2f7173e", "value": "T1D7F36B2232E0803AE4FA127518BD6BA59F3AFD314B32DA8BA750755E1C71DD08D353A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363416, "uuid": "56c8d4c0-2af5-455d-87cf-829cf4fed105", "value": "fd2edb8af593caaf43ff8e7f6cace3ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363416, "uuid": "4a69fee1-6369-47fc-9a82-2293b338ebce", "value": "3072:jAnlOa5QaMLy1qDjuckP9RWZWJp/CH4zioDAqn7Sbni+AsXOYQRz/:jAnlOa5QaESqCX6HxAsQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363416, "uuid": "f93cefed-7a3b-4589-a3b5-92e849437583", "value": 157451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363416, "uuid": "2690af72-3fc5-47a2-89cc-d150dae51893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363416, "uuid": "4720ba54-7ab3-4766-be3e-94387104cb0e", "value": "SecuriteInfo.com.Trojan.Vigorf.15933.16772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e7b920-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365332, "uuid": "121b08e6-e56c-4df8-b847-e138178b30cf", "comment": "Malware payload (Mirai)", "value": "c8fb52e7dab4d8174a8ca9ce0310bd3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365332, "uuid": "c3584564-4a1b-4884-83b4-30958b1800cc", "comment": "Malware payload (Mirai)", "value": "12467acb55dbf2474c53bdbde2059d756615f8a1a35f920d95b222558a73b65e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365332, "uuid": "c8c4a16d-2986-4065-a61d-2373b1cca144", "comment": "Malware payload (Mirai)", "value": "02d9129bba51170dd897c0778c6c402fe15a2c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365332, "uuid": "f210d0ac-4226-496c-9f02-a41efc557eec", "comment": "Malware payload (Mirai)", "value": "e47d25752334685a63c1075aa99d4cc924764e11f344e168c3266c0be9badc610eda39dbe96a4741b88dedd9e43388a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365332, "uuid": "bbd8fd03-5fca-424d-a304-54e9d8803bf5", "value": "T159E33A56EB808B13C0D2177ABADB82453323D764D3DB73069928BFB43F8279E4E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365332, "uuid": "f29d612c-e166-40f9-85cc-64880e3fbbb0", "value": "3072:UBAVAeD6Zm0aaBZX+Rv2F+kxHn156MKrGa0xVmmlaTqXsB:UBAVhDQaaBZORvkxHn181rGa0xVmmlat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365332, "uuid": "f286ab89-0eea-4100-8b73-10ec63cab374", "value": 151050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365332, "uuid": "06c43e6d-826e-45e3-8145-6c6021f83848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365332, "uuid": "e6b18bbd-0c63-4f40-ac08-387b59f88579", "value": "c8fb52e7dab4d8174a8ca9ce0310bd3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10774ab8-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388111, "uuid": "df0ad977-f42a-4784-961a-df1c60479eef", "comment": "Malware payload (Mirai)", "value": "812135783671b1c329babd47807a4e3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388111, "uuid": "4f42717d-2fba-49ba-968e-9f91301df221", "comment": "Malware payload (Mirai)", "value": "1341daee2377d29afca7f78cdf97e950846e50b7e86553ab801bc22ac21dbbf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388111, "uuid": "8abdd528-29f7-4cf1-ac08-933d251f1e0f", "comment": "Malware payload (Mirai)", "value": "958b359ffb27a8f7c2daef53cfb6e7d61de6c77a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388111, "uuid": "a6940af8-8e15-4863-9a52-466c291d9d6a", "comment": "Malware payload (Mirai)", "value": "54b57c65b7a3c0148a4eafee792ae74b0705c486d1dce50175ade261879121310e1ae77ea492cf538d69b81986a3cd78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388111, "uuid": "b1f11b6a-c56f-4606-b8d8-d1af1d543329", "value": "T192137DB6C42DADD4D109963CA8358E781F63F009D2631EFA5B8946A18047EBCF7193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388111, "uuid": "c32624c5-fdea-42af-8383-98d0d1a2effa", "value": "768:jNayTXwtlXEHgINbIb2eBEey2odoyrKgLqNc9JC9omcOnC6:jNayTwtl0PwEFl2BqJhzUC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388111, "uuid": "2eb60250-e675-495c-96d4-37d74fb699fd", "value": 43348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388111, "uuid": "5f3ee9da-ed60-4c4a-ab7c-57a5c09c700e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388111, "uuid": "dfae2097-f9c7-44e4-a04f-f3e29c8ef719", "value": "812135783671b1c329babd47807a4e3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8457c352-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346644, "uuid": "67d0c39b-1af9-401c-87e0-50e2b497c266", "comment": "Malware payload (RedLineStealer)", "value": "9e9e568a431af9ecc94888fde2bc271f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346644, "uuid": "29b294ab-ebad-47ed-ac2f-0c300b8fabfe", "comment": "Malware payload (RedLineStealer)", "value": "1470a91a9da4caad46ad78a43af037e521ad3d739f04a2052caf6c54523617a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346644, "uuid": "39bb453e-4446-45de-aef1-21adefeb532f", "comment": "Malware payload (RedLineStealer)", "value": "c8420e16ef3ab6eaa7501bbc9b4e02568f392598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346644, "uuid": "157deadb-82e1-4056-90a7-41264a1c6f78", "comment": "Malware payload (RedLineStealer)", "value": "eec8da3839990f41908ce53efe463b4d913874ccfef830c37845a30cf42533655750e3a9c1becc5199cd2f1c4f878868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346644, "uuid": "8f511dd3-9d17-435e-b9a9-ec941a0d7ec9", "value": "T11F052346ABFA4023D8B527B0A8F553971739BCA2D875872767440C0E09B3BD4EA7172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346644, "uuid": "a6d29efa-469b-44c0-85c5-1a2631af88e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346644, "uuid": "76baa4b9-366c-4e70-b9f1-b5332b102a9e", "value": "12288:oMr0y902O5eNKTk/06Z92tICLPLiLnzo8ymCpQ5RKEfg9hee7nWEQ3USBt+MS:cy4XIM6Z69OLG2+zveUnH6USGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346644, "uuid": "920da530-5834-4646-aba5-7098c3c23988", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346644, "uuid": "92cab949-6466-43ab-96d3-d76ebd09756e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346644, "uuid": "2458058b-ade6-47dd-8a81-23906091c3cc", "value": "9e9e568a431af9ecc94888fde2bc271f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3084aeb-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377217, "uuid": "0e5a104e-6258-415b-8e50-f00f4fe8ea63", "comment": "Malware payload (Mirai)", "value": "3f5778082e6bedde0e5c223b2bb15032", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377217, "uuid": "ac364ae2-26af-4e3e-a8b7-99b10b1b0acc", "comment": "Malware payload (Mirai)", "value": "149fd8d8bbbf90a75d7e4c0c7d1465b3225683502ab5bbda87b08fdf5c8c8d1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377217, "uuid": "7d509029-56d9-4095-88e1-c9e8d2705ddf", "comment": "Malware payload (Mirai)", "value": "82363e57e0dbc42e5d6d46d11f8d6a186edb57ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377217, "uuid": "680e52d9-627a-40b5-b666-fc49ddc660b9", "comment": "Malware payload (Mirai)", "value": "48ef83473fdde42bc699355f2396c29f2ca110066a90f8c897835bdd2e82ee2cdf29c7a4b69c1068330814463f67c630", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377217, "uuid": "b989c59c-f348-40d9-a484-dc0a689e6850", "value": "T141B39DDBF2470260C86246F007CB4BED3E2323815F27C5E76C6A257969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377217, "uuid": "a366e702-7dd3-41cc-a35d-6a97c3920650", "value": "1536:1u27gBY2SSpHP9pEFwiLShWnwg1A/LWK:M9xSyv9HiLShWwg1Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377217, "uuid": "f724d63d-71ac-42e7-b716-204311a5bbbc", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377217, "uuid": "6f78ddf0-87c2-4680-84b1-2628d7d09ec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377217, "uuid": "5cf0a280-9fca-496f-90ed-8827c3930db5", "value": "3f5778082e6bedde0e5c223b2bb15032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8258c3a1-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363391, "uuid": "4ade56c0-6b28-4eb2-98cf-7aeb6d401153", "comment": "Malware payload", "value": "d9c62b2e2b3b0cbf1453d04b27df6152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363391, "uuid": "dce2de26-bab9-418f-9aa6-e20d13419bfd", "comment": "Malware payload", "value": "14ce92a16a06a292b732c49efdfb63b7c7506a1fa669a9b4c83e4a91c87c40c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363391, "uuid": "0f51b5bf-dd1e-444b-899b-9e7a5036589f", "comment": "Malware payload", "value": "b1e34c18e9d5df4d04f727d97f35aa7d14c2bb1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363391, "uuid": "6b1bf1eb-e67b-4695-b4b6-93ab24a8ff46", "comment": "Malware payload", "value": "7aacba279a2d2c328a514ec31e5abc74ec62ad2ef32cc7c9a5caae93f16d4cb245ee27b0ac5fc2fef63d8e5699a5a515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363391, "uuid": "777b7b4a-9ab4-431c-bddd-3b22e7936c11", "value": "T14BC1DC232A124CA6E50340F29A437B1BFB1350A0436211B21B677C4FAA3E7C094B9B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363391, "uuid": "52e023f2-bc81-4be4-8492-135b67eeb4f9", "value": "9f992c7674ef3c0e47579302d855f8de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363391, "uuid": "be07b427-ba41-4d4d-8cbc-551b3c02e785", "value": "48:OEPf+kSuWBoKIuGP0e/MKkB++aJdNcFte:nP2+Wf2DkU+aJEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363391, "uuid": "c42bdb1f-5c06-472a-9e27-168f649f6374", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363391, "uuid": "93173a03-0ba4-460c-9843-c04d6b07bef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363391, "uuid": "2e5f03c3-d4f6-4ae5-8000-089cce856a3a", "value": "SecuriteInfo.com.Trojan.Wacatac.15571.26196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f681ff51-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374324, "uuid": "1bfeeb17-1b5a-4149-9c5e-16e29e8f9938", "comment": "Malware payload (Mirai)", "value": "fb81dbd549c4923f95f3f169d181e604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374324, "uuid": "1a81ecd8-f61d-4d32-9102-f15003652b4a", "comment": "Malware payload (Mirai)", "value": "14d771756a6cb2ea4b3e6db11fd3119913caee86c1a442e1817ae6a9c965eef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374324, "uuid": "fb271864-ebd7-406c-acd8-36d5625ea4e9", "comment": "Malware payload (Mirai)", "value": "1e6b5abf647f67569e774f8c3300c149cd0fbf39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374324, "uuid": "02c1c17b-a2ee-49ae-b8d0-5d6d55fad546", "comment": "Malware payload (Mirai)", "value": "7d3202de04b8f518476d74946cc17b073d62779ac628ce5094dbf6bc9744cbf132a6d4b1e9d62da13413eb91bd648191", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374324, "uuid": "c6461813-b159-447b-9b9d-05d419d3c61e", "value": "T19ED2D07096A818B6C6640AB2F17C66C4BE470F7CF9FE28901200D7AB7881D567DFD9C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374324, "uuid": "a79e89e7-f44b-493b-8524-13b3b4ca8aaa", "value": "384:kot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNETRwmdGU5eT6NuH:k8soTAZ3alkXLvFh8nNEtw3UQeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374324, "uuid": "859cc245-6696-48b4-a3c6-95aada1c13fb", "value": 28312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374324, "uuid": "d69aa2dd-10bd-4c44-ba30-391b88729917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374324, "uuid": "51963bf1-0030-4507-8faa-d59792b37101", "value": "fb81dbd549c4923f95f3f169d181e604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30245db9-fe1d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685363683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363683, "uuid": "4c73f014-7470-4725-a99f-6bfd1dd7a0ca", "comment": "Malware payload (AveMariaRAT)", "value": "aa39d097f6a70f0de3014026c22a4b9f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363683, "uuid": "a5352f21-a938-4baa-9583-a62f83b163e3", "comment": "Malware payload (AveMariaRAT)", "value": "14ef41226f7b85fefd60d3fe5762108540aa0daea19d5b6d4a55764270cc6e0d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363683, "uuid": "ceccb087-df77-4d69-8a3c-cf5a5ee71e81", "comment": "Malware payload (AveMariaRAT)", "value": "5b6943d9fc76f937220fa16bf883f8108b1e6836", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363683, "uuid": "d2f3a10e-8075-48d0-984f-866d8e7bd8ca", "comment": "Malware payload (AveMariaRAT)", "value": "dd82c5f7d47bcb7087b46db60e8a64a587018379bfbba2d1ea7a6d8cf0ac735f87f360dba515aaef879ec4b79c95bfa6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363683, "uuid": "92960a16-3d1e-4a01-88d0-350f8460a2d0", "value": "T16D35AFB875047DD62A7F576BDA96ACDC03A617639ACBA4CC8074B7C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363683, "uuid": "9bee1dca-835b-4842-9444-4c741704afde", "value": "24576:m5lducKCeh5Oa0OE3VlWJ13YD3/KiRkDYK25uf2S/kZ51S5Xt5:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363683, "uuid": "eff304e3-e3ba-4dad-9c32-8a3b15e5b6df", "value": 1105754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363683, "uuid": "e96cdb3b-e70b-4753-87fd-6fe1550d77fe", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363683, "uuid": "84f9e4ee-0f4c-4e29-b161-1fb2f233896b", "value": "Updated Pricelist%0A 26-5-2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073819b3-fe48-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685382083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685382083, "uuid": "db5b7f8b-f0c9-49c7-81da-7ebf0421a774", "comment": "Malware payload", "value": "04664dc26f6c3d38b9bcc30bb5499425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685382083, "uuid": "bec57543-322d-44a4-8f84-76d9ca256ee7", "comment": "Malware payload", "value": "177d59213401a20ce1b5a9ea171d8aa50e5302a33368af2212ddde32ae86dc11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685382083, "uuid": "fb40d3e6-0af9-44b1-be37-57f1f72043fc", "comment": "Malware payload", "value": "f0b42be55bdd5f5c0e7ce0ee3f733a2e5e0c978b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685382083, "uuid": "b8357ce3-4d85-4cf6-9c4a-385a5af74284", "comment": "Malware payload", "value": "4a64f1d6006a287ede290982ef88a5dfe72e4600ebcbdf1ce859222958cf01ae43f5a74a896b13d0eb5601c0ac55a329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685382083, "uuid": "fbb5d407-09a9-42c1-9b2d-02254d563685", "value": "T12E64BF2523A8ED46D1B403F56A31D198D3F41E482C36DA63AD35B7EEF5F1B210C866A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685382083, "uuid": "056ada5b-5318-4c9e-b4e3-12b9dc2df8fa", "value": "3072:FK1FZ3gS/umMXfkpE/kxHIfSvr66Jq+8Kj/umMXfkpE/kxHIISvrP6Jq+u4Q:Pmefn4ofQW6JeBmefn4oIQT6JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685382083, "uuid": "45b7a01f-43a6-4ad2-bc5e-ee0e4c7fbcf2", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685382083, "uuid": "53ae2c64-6c7b-4da6-bcaa-797e5411284d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685382083, "uuid": "e5063582-471f-44dc-9feb-b6518cea8ad4", "value": "Yim.Launchpad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d734b4a9-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388444, "uuid": "ea51d44b-4c1b-45c1-b4d5-5765629d2e65", "comment": "Malware payload (Mirai)", "value": "2544204646f454529094e198f19b09b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388444, "uuid": "1acc09f2-02f5-45bd-932b-942f1b54c5ba", "comment": "Malware payload (Mirai)", "value": "182c0b8cd469f3f39287e13370730299a9f18c142f430d507806e33de765f0a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388444, "uuid": "0d63e561-e9b6-4010-94c0-414f68f59fbb", "comment": "Malware payload (Mirai)", "value": "118a0a84f002005ee0c108b31d62995c1c9e1ae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388444, "uuid": "bb147987-48cc-4284-b191-603c073b01e5", "comment": "Malware payload (Mirai)", "value": "767658c8afe5a85a57e5f6a383f008e11f46d3112c4bc55d57a6664bb2a987f5551b0bd0ffde8c3c1c49cc2a85f0a2f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388444, "uuid": "6740c27e-a7c4-4731-8823-028d451780f2", "value": "T166E3F856F8819B15D5C111BAFE0E128E37231B78E2DE73129D246F347B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388444, "uuid": "04f6ddb1-cda6-4f64-938d-0494a92eb67e", "value": "3072:dhqT3JUZvAiOX3WE8r7haaCZ9Zn+g5V3iVCNO5g:dhqTZO1OXGE+4ac8g5VEIO5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388444, "uuid": "e8ecb6d1-20c3-4e08-ac44-24f79d47adbe", "value": 145872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388444, "uuid": "b8bb4065-cc75-4441-9c1a-0918e05a19f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388444, "uuid": "c6d730cf-d9fd-43b3-9ca9-134ea44a316c", "value": "2544204646f454529094e198f19b09b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c307ea1-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391191, "uuid": "ac4ebc60-ac87-4988-9de3-c2850261f6d6", "comment": "Malware payload (Mirai)", "value": "01aefddfbb2e079ca5e75ac1fb7240fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391191, "uuid": "4e5b86e0-d0ee-4901-9cfd-660572620db4", "comment": "Malware payload (Mirai)", "value": "187a79803bcdb94a0fb475f9f552810dbe7b801163d18fe21844756a6ab8cf57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391191, "uuid": "a496274e-8752-429a-a3cc-7fe3454e6021", "comment": "Malware payload (Mirai)", "value": "812684d32a0a6c6875771020f1202140696ee5d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391191, "uuid": "3baecf93-f578-4f47-83ed-da69109dc718", "comment": "Malware payload (Mirai)", "value": "058e1fd8a434d94c79efeb848e58cf97fef8b420053e175ea2d994fae14ea63aecf6000f7600fddc24719764efffa4c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391191, "uuid": "e36e1d8e-3e4c-45ff-8a73-87caa84b5553", "value": "T1C403E14C6F84EDE0BBD01072F92E024563A3AA7C81DE7A012D1F5F4396E5D96F29990F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391191, "uuid": "38e53210-3f6d-4f65-b83c-4a22514eeddb", "value": "768:aqCtE/zHmw6W/A1aFDF4EtFd4aPs9FkGLEDsIIPM6CAwplY/Akq3UIYcW:aqGELHmwu1aFDFjFdWrkH/orCAwplYYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391191, "uuid": "ae2243c4-3ce1-4746-908a-9718c3346d4a", "value": 37856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391191, "uuid": "f8d82ce7-3dc6-43df-bbbf-1d54cbdae622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391191, "uuid": "9403647a-f16a-4f5c-91a7-7263da0eca0a", "value": "01aefddfbb2e079ca5e75ac1fb7240fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81054ae-fdf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1685345416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345416, "uuid": "418f5116-fc6c-48c6-a2e9-42e3a41c147a", "comment": "Malware payload (N-W0rm)", "value": "5ac529b84bed8f7e3428245e47a78667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345416, "uuid": "065137b1-0f32-4218-8c84-67f6d285693e", "comment": "Malware payload (N-W0rm)", "value": "1989d2f3db46b9c5c949f4b8498cda2a2fde7b08e4c5d1267950debe82daa2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345416, "uuid": "50019f89-ab1e-470b-a50c-20c371f4f434", "comment": "Malware payload (N-W0rm)", "value": "3da3922f429143ccb6d0c3224e3d189c9bb31fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345416, "uuid": "38128bc9-c3ed-48a6-b634-9549cc2be7dd", "comment": "Malware payload (N-W0rm)", "value": "120f9a662a46747d50323fe5ce68b78c4557bb0eec124416d2ba0d4efbabc2d8dcc0cb8f9323512341f9e5995df709c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345416, "uuid": "ed296ce0-39b5-487f-97cd-7dbda63b24ea", "value": "T19C547E73DA0494E5D01172BB32B20B396EF082B63C758577B7A4CEB42D51E229F17A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345416, "uuid": "61cbcf18-8d3f-449d-867f-8a7af5173b79", "value": "63aeea402114f0fe8f3c32369627c6f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345416, "uuid": "b2aef19e-a34f-4344-a5da-b9b70a28c626", "value": "6144:sbFMvcdKa1rEgjpI+tK9/DYag1dNqaFm:sbFMEdKa1Jjl89/DYayT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685345416, "uuid": "98d9b113-0d70-4911-ab78-2ab644274bd5", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685345416, "uuid": "1fe48fb5-0378-4694-bb97-4c693c3ffdc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345416, "uuid": "c733faa7-94e2-4fe7-b25f-c9d6e97327e9", "value": "5ac529b84bed8f7e3428245e47a78667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237847e7-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685348629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348629, "uuid": "b52490da-6e72-4c1a-a0d7-d3c418d773c9", "comment": "Malware payload", "value": "bbc6bef20cff5db83b06464215f99378", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348629, "uuid": "771cf15d-117b-4008-9716-a93e5c32b2de", "comment": "Malware payload", "value": "1998cb65315d3f5fe9684f5f387a78901c16a1044b0dc8ceb073754be52c2b75", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348629, "uuid": "3bf8817b-ced6-4e72-a71a-9238246a1343", "comment": "Malware payload", "value": "8e62d16b31483c401d628ced3d9f3fcfef56e5a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348629, "uuid": "0636293b-f0eb-4d9b-9cd3-1d7360d93dd8", "comment": "Malware payload", "value": "feb9fc8d56bd63eab9b2982a36810d026365dff549d17f07c864613d2a1548dc0593bfaf3a042b4e3e62553b2b520008", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348629, "uuid": "331170f2-d283-440e-854d-95d264a9338d", "value": "T1B8436C2271A5C072E86355304874D6A25A7F7D215BB482CB7FD802BE5FA13E08E393B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348629, "uuid": "04ec4507-4951-48bd-9352-72cf1d149136", "value": "3ecec5aed439f99491c96edce0499b6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348629, "uuid": "ed76d21e-0a3c-42b2-80e8-5c9277558f58", "value": "768:NBfBxHIaFYc8w0N+1uhwHncQRaHqe8keh3pEDhmnwLHm9Vd9KQ:fBhIRyM+EPGagkMbd9KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348629, "uuid": "03cc76d4-53a9-4693-a638-6aa4e68b56bc", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348629, "uuid": "cd65c511-0366-42a4-b10c-69a3836c182c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348629, "uuid": "621e26f1-4249-4efe-ae64-f11f533e70b1", "value": "06234999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c441ba-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374032, "uuid": "0e3841ff-149a-4f29-b8aa-5788de407d6b", "comment": "Malware payload (Mirai)", "value": "611fd0d3de1ba08580f9b231f21e279c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374032, "uuid": "1055e7b8-34c6-4aed-8a2d-cfc3ea206a2b", "comment": "Malware payload (Mirai)", "value": "1ba51c1c22dfc2fda88da44ec8cab8ecb9670a1398ca4dfccefdc790a2c4da4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374032, "uuid": "27bfb205-ccad-4202-81a0-ab362ad8908a", "comment": "Malware payload (Mirai)", "value": "7b16df8c54cd39c6a97a52ce46974eece7f0dc00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374032, "uuid": "df82b5e3-f252-41dd-93cd-291109d98a1f", "comment": "Malware payload (Mirai)", "value": "da4e59fd40d7e8244e5e89903187d4b5d7c29194d536cd336d2877e9564759cb53d0f57ffd7cfd7b221e96121518aa2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374032, "uuid": "4870a74d-73cf-4914-bca1-47509c99feba", "value": "T1C8735B0277580A47E9625EF4383F17D093BEF99025F0F6892A0FDB194635E73254AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374032, "uuid": "72ecee29-8be4-43a5-93f6-71debb1ea397", "value": "1536:aypg8ggwfDnXbU1c/mjH9DP4RFZcI6a3wQ:ay51S61EcIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374032, "uuid": "96578129-dc3b-424b-b9c6-ce49102c53f6", "value": 77112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374032, "uuid": "c956be9f-2950-45e2-96a0-5b02aa7d0433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374032, "uuid": "0768f7ff-3deb-4b45-a06b-ba8373adb49c", "value": "611fd0d3de1ba08580f9b231f21e279c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ecc88f-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346625, "uuid": "b0bff8fa-b759-469e-88fd-7165c69bacfc", "comment": "Malware payload (Amadey)", "value": "846a384302c6d3ae68c809326fa2e773", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346625, "uuid": "e975da0a-9a04-412f-b11b-e4b2998632f6", "comment": "Malware payload (Amadey)", "value": "1c1ec0a331c256360464c67d965d530e81238cbc44c4e0a73ed41c2c2afcf181", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346625, "uuid": "b14e9689-7e30-42eb-ae5d-8d992c712253", "comment": "Malware payload (Amadey)", "value": "92c7e9b56e2e5026d8a81a8e943c6c0da9c392e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346625, "uuid": "624f5b4d-5927-4300-b46f-764cf168abb0", "comment": "Malware payload (Amadey)", "value": "1f494b4942f7f5c1b0e9e249aa8f9cf10adfd24aa4b36c9f2520a5eacfca784368b5ce66174c40a12eb4e746469d0e83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346625, "uuid": "286b3a99-8289-4d86-8376-75e33658b7f6", "value": "T13B352246B7E99573DCB657F4ACF7028306357DB48874832B3705ACAA18236C1A93837B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346625, "uuid": "a1ca336a-041d-4a0c-a8dd-85bb3b3f24aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346625, "uuid": "efc124da-12a4-4d8c-8c27-e952be2d60f1", "value": "24576:kyyrussqFX09/BzvpSW0KG2etKHBUSm3g6qEVDIotNp:zEsqFEzpSo8tKHC3g6qEVkoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346625, "uuid": "f74f344c-15ba-455e-8702-e757a9287bad", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346625, "uuid": "18ebd0fe-5e10-40d5-8c44-b6f41153af25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346625, "uuid": "6aa4ebcb-9327-49d5-b0ed-f5bc678674b6", "value": "846a384302c6d3ae68c809326fa2e773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c63ee83-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379675, "uuid": "f3981857-e5b3-4642-913e-ae0cc25de421", "comment": "Malware payload (Mirai)", "value": "4888908af35e80cec7d47528fd586c46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379675, "uuid": "29727f58-56b2-4e1d-830e-0e2c2524d9ae", "comment": "Malware payload (Mirai)", "value": "1c245d3e951bb6140b0f4a5a70a6477fe372e442922e6a0359c7b29a51f315a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379675, "uuid": "c01ccba9-9f5a-4a6c-ad10-887871a3e9e8", "comment": "Malware payload (Mirai)", "value": "54eeb6dee050ea7b124c4e34764b4f013b213d97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379675, "uuid": "2454e5ad-9b78-4700-91c9-22611e89f229", "comment": "Malware payload (Mirai)", "value": "8c4cbe425579be790b0f5b33117c95e935a9d1a33c95d50c307de44ffbc82f0fc4a3cf054872f147305a8fe3e8a3b4fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379675, "uuid": "7d1e7ff0-86db-4a88-94f8-7c653f3e439a", "value": "T1E6A30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379675, "uuid": "5c3a2d8d-d97b-41f1-b8ea-a6a7bff62f0b", "value": "3072:gjtwgA6UlYzZveohR9kIEVfdGZmmFVcqq0G27ZT:gjhzt3mIEVfAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379675, "uuid": "632dc942-b998-432b-8328-a8104c5c9ab6", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379675, "uuid": "fcb9253a-3cdf-4be2-9b0e-b0605a74c023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379675, "uuid": "06399a45-ff2b-4d38-b26e-5609099b33ce", "value": "4888908af35e80cec7d47528fd586c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c0f3d4-fe67-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685395775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395775, "uuid": "a1810790-6a9c-4722-a520-db67b90ea668", "comment": "Malware payload", "value": "aa258ab9a5af439e9547c29ea03b3bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395775, "uuid": "0821c9ef-650f-44e0-80c0-cbc33568aecc", "comment": "Malware payload", "value": "1cb6b3bb34473e436d31c35c23ab793d957ff39a974cd3509ff4600dff26ce5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395775, "uuid": "1db5f8fe-3604-443f-b5e4-7b30ff970e49", "comment": "Malware payload", "value": "1b0fba9aa44e0b7ac0f7ceec8f25a3de50bd7e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395775, "uuid": "186cdb5b-0915-43d4-ace7-c18eadaeed1b", "comment": "Malware payload", "value": "3d2529f91d10a071dfabbd521c1ddc091554c12fe06024a687a2cb2913c306b0da0fccb16b75653b19d3aeceea4eb62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395775, "uuid": "f0dcb800-e3e7-4e1e-9593-d0570a836c42", "value": "T155B3F606D2B2699AF4856B714D3F0B96A1BF61237A5A77F76FD61C03DC35C06CE0022A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395775, "uuid": "42c44256-0a0a-4e6a-bcde-c87247609e00", "value": "768:fA+zwinfL9H41l/6lX6Iy8n02MPSv4Not34idnj04DVT/RgIBsjq:fjpfhw4yrKv4uP04DHgU2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685395775, "uuid": "d781e6fa-6cc1-4870-83dc-4dbc78969027", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685395775, "uuid": "f8ef09e0-f0d0-4bd4-98fd-e82fc6a15ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395775, "uuid": "988dab9d-f4b8-4910-9d49-91e6eec6a947", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.31352.29004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e5e416-fe27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368202, "uuid": "48571754-8c0c-4d90-8c01-24874f6217c6", "comment": "Malware payload (Gafgyt)", "value": "880cd14129b0cbd4796ed9e5992c396f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368202, "uuid": "7d8684da-69e0-44e6-83ff-1a7233a2c106", "comment": "Malware payload (Gafgyt)", "value": "1e8bf6c9fcc927d867af55b0a43bdd99c5df6e0b7a32b2907e17b3b9029968b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368202, "uuid": "b12c54f6-9c6d-4980-a2ab-2f68674506ab", "comment": "Malware payload (Gafgyt)", "value": "f3d7fa59a7cde7154f2befc1bc9f726a5914c6f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368202, "uuid": "f3e74bc1-8bd0-4ae3-88e4-a69dd426f74b", "comment": "Malware payload (Gafgyt)", "value": "1cd28ace10cbee98545e31b2d9ec7a1c81d73bf0db5734d6bc8f8f1c7a1028493a5550b841d393deb04cc222eb101dd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368202, "uuid": "92f82726-360d-4bbb-bd16-497bb4b0d9c7", "value": "T15D831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368202, "uuid": "5055abed-7183-46be-b7d5-51a5b9b83525", "value": "1536:BQOc40ozMPjej5qckA39ikRFaInrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BZrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368202, "uuid": "383cba3f-2b72-4fb5-a79c-00e56a09083a", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368202, "uuid": "0826bba5-8a61-4f2d-a232-7783770a4d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368202, "uuid": "0666a76c-1e55-42b6-bb0b-3dbea1212caf", "value": "880cd14129b0cbd4796ed9e5992c396f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec80e8b-fdfc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685349802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349802, "uuid": "d819d13b-eb05-4960-88cf-e1d6e16cbbda", "comment": "Malware payload (AgentTesla)", "value": "4ddfcaf4794dc757f9f4806af87b233d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349802, "uuid": "817a0fc5-51ab-4794-be55-76b98be6cc3e", "comment": "Malware payload (AgentTesla)", "value": "1ed23ba2f4f0f91fe3ef1cbb68126fa47ca460aa8d77da6f0c345cbaea062292", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349802, "uuid": "2e26d8be-40e9-49d4-8234-5dd544c58adb", "comment": "Malware payload (AgentTesla)", "value": "c1212aa57e211329d943e8d3cc7ec63eb373b218", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349802, "uuid": "15b4ed6b-81b1-4983-b250-2999109ea662", "comment": "Malware payload (AgentTesla)", "value": "eea73bfb64df6486be4ac134998d5481d644ff91ae522dc0bca85ba82358cc2667bc1be6f0ef072fb0a59e043e61e98c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349802, "uuid": "be10eb86-916b-479a-81e1-2323b791f0d0", "value": "T1B5F4537C9BBA237BE2B7C36447C9B45FB180A573B1057BE5B09203448A21971B5CBD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349802, "uuid": "2ddb7914-1414-4469-a67f-38cc91443ec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349802, "uuid": "8afb669f-1de2-47c0-acc2-bb23dcc11c9a", "value": "6144:hGssRdsN2GhNY66TM30YpPogpAtHT5FNam89wDEgjGCqbFdipOS4bra9Fq9E5DRO:hGmN2iNzk09pAFlFM93wqWpOSEsSwRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685349802, "uuid": "d54df9ed-f3cb-4c4e-8582-7d106421f3e4", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685349802, "uuid": "88307776-96b8-43fd-87cb-990300bfa61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349802, "uuid": "84ca0f2f-d8e7-4785-a23d-72b6bb954031", "value": "blessed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1317ad26-fe3a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mekotio)", "timestamp": 1685376090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376090, "uuid": "bc9fb64b-4df8-49fa-ae8f-bd806385eeaa", "comment": "Malware payload (Mekotio)", "value": "c09604fb3828f58ac82798c973b2c832", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376090, "uuid": "526c1b70-e89a-4fe7-aa83-609f71965d5c", "comment": "Malware payload (Mekotio)", "value": "1f194434e5a6acb65ce43e204817d8ce35ecc0bfb4952fb76115061999e484a1", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376090, "uuid": "5cdf9a99-0a8e-4601-a107-3a078fff3df7", "comment": "Malware payload (Mekotio)", "value": "ecd8e88ba9bf64208947cb5ba0cf766ded0a5e6c", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376090, "uuid": "6100cd6a-db75-47bf-82eb-cb8a1358208f", "comment": "Malware payload (Mekotio)", "value": "0740b362abd67e91447a2469e4cad10f55d0bd0f4bbf3e549b3958e5799b1958b14700b236f3eb33d652181a228d94c6", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376090, "uuid": "a039869d-89bd-4dec-82da-01c760c05e55", "value": "T13D5623117AC68535D1BE42B00A1AFBAE34B53968B37140AF66D45BCF28F23D056B39C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376090, "uuid": "f8c74a3c-4f43-4bae-a975-1e7e6659bdb7", "value": "98304:3YKGHev/Opm4EduNe6Ef6aJD7qLKpIKxsPBJmSJltXJpxivestNItMgA:fNnullQXXpIKxsP7xTtXTSt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376090, "uuid": "eff6719a-47c5-419d-ac1b-3439d3451466", "value": 5922304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376090, "uuid": "bfabfe5b-7ec7-4b07-9a86-961ff44876ac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376090, "uuid": "9a145bdd-ee2d-4627-bb56-b6397c64cdb3", "value": "SiiMarzo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e4c75c-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377195, "uuid": "35a764dd-b365-40c6-9fb5-fa7053bfff76", "comment": "Malware payload (Mirai)", "value": "0e257e171ea8fe922e0aef24e264812a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377195, "uuid": "c626056e-ee02-4860-a600-3cacbc39c4ed", "comment": "Malware payload (Mirai)", "value": "2032c79092417154a576487fb7397e4a4101422172e490fc4a8f13dba5ab145f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377195, "uuid": "d21cdcea-f0d8-4f7e-9302-a21f723c4a7b", "comment": "Malware payload (Mirai)", "value": "bb3e8bef664b46b59688a7fcf3735a5cda472fc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377195, "uuid": "fcd8f373-7eea-446f-9e6a-5c9540d830df", "comment": "Malware payload (Mirai)", "value": "c6a567a7824d22cef47b4e56fddb2ee45fea9ccc016bf1e23196b9e89268d29294629024974a26c5e7f99200c1c12af7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377195, "uuid": "9d881d71-c0e7-48e5-9098-ed17cb76990f", "value": "T17EC2E1E0830AA892CD3098B4DDE595C71692CFFCD0393EE3269D4F1E66878C7575462B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377195, "uuid": "e43a74e7-041c-49d1-ac9f-21b083f77056", "value": "768:6eFVPf1vHN6meIMxAZ1oXO56wtd9q3UEL3i:JPfZtDe0ZgO56NLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377195, "uuid": "945aae27-4135-4b83-bf9a-b11fea050c5d", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377195, "uuid": "5d5abea9-1a48-4296-92ae-d6b992bac15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377195, "uuid": "352cb753-df65-4c30-a463-5bdd226c9897", "value": "0e257e171ea8fe922e0aef24e264812a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858ffab9-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363397, "uuid": "4e929660-f388-47a4-852e-32f3acd5653f", "comment": "Malware payload", "value": "4cf1413f29e25dc88caec3efa37d8a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363397, "uuid": "6b35746d-607d-42ee-a87a-1d89fc152a9a", "comment": "Malware payload", "value": "2065b1f9385624ee1968e170e0e0124aed055ad99ef2d9b2194f252ebe65c72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363397, "uuid": "b6106483-2478-4941-b3f1-bb156407d358", "comment": "Malware payload", "value": "56cd1692456bace0cce3faac1fcdf811cb859e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363397, "uuid": "042b642c-61a7-4ec5-b3ce-b3d383d7b056", "comment": "Malware payload", "value": "870c319031c223350b836474a3ea17ac9e13cc6988866bcdef5f996a8e13d56f86e9155223c80fb300749f246a8d8042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363397, "uuid": "0c6dd183-2299-496d-9043-4e9c4e72fb99", "value": "T169B47E32B2E1C437D163263C9D5B92AC9C3ABE106D2978462BE52D4CDF3D781752B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363397, "uuid": "cc33ff62-730b-445d-aacc-27d562374e87", "value": "c44dd2a7f45b7a98f929733287f8eaef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363397, "uuid": "bd39f46b-b75d-4e4d-93a3-42d10943bef2", "value": "6144:W6sf2/vKWovHY3wqETGpE1oab9q5qpHiwfHJh7dUT+8UhM0igc/i77db+UPhwB4B:w2/vKWQ4kK5ihh7a0VcgkUP2B45Gaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363397, "uuid": "a93bc3c8-e80c-45ce-b924-2cad85258ed7", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363397, "uuid": "218bbb44-9c5d-4a91-8aa3-0ead5cbd99f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363397, "uuid": "d8d94be8-6fbd-428d-80e6-ae6dc95374c4", "value": "SecuriteInfo.com.Riskware.XmasAds.22242.20700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c8dcb1-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685348423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348423, "uuid": "34725087-311d-4ef2-93eb-c468eb89c63d", "comment": "Malware payload (RedLineStealer)", "value": "918aa5a1903e565b16d79a70f79e5b89", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348423, "uuid": "a2b647b1-e71c-42f8-a2f1-c72ce95faf16", "comment": "Malware payload (RedLineStealer)", "value": "20e9795a1f628c93790bf5f2d07c4424ade61aaf8d8a0ef8e2ddb610cb6be19b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348423, "uuid": "2384196c-480c-42bf-acb5-b30777878c24", "comment": "Malware payload (RedLineStealer)", "value": "7e2a8400e2807c133969045b687079bdda44422a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348423, "uuid": "e38f25ed-a441-4a11-a37e-28ac41cfcdd9", "comment": "Malware payload (RedLineStealer)", "value": "4bd0f258ccb6a450f94b3ba58b166614a5e5669069baf521e40414e83cb57a9d888142ecd3f810b9b71074adf287b4ed", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348423, "uuid": "cd53fa2e-d70c-4dce-8dee-9f585c8979d6", "value": "T1EBF3D568364B657EC96F883D9C600CD07A7CAC662203A7479D8FB0E8393B7919F151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348423, "uuid": "54189932-12b7-4d61-9f0e-ec68b36a696f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348423, "uuid": "8a7c54dd-6b5d-474a-9a30-b8b5883ee229", "value": "3072:R4O1/jHX8WNS1DSE6RZHSSSSSSS8SSSSSSSSSSSSSySSSSqSSSSSSSSSSSSSSSSf:R9j/SuHbp9Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348423, "uuid": "9e6d65ab-b913-4262-a672-b2c6da41cb34", "value": 172570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348423, "uuid": "cea3cb9e-21f4-4421-ae50-93a92f446875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348423, "uuid": "6b128753-7208-487b-bb1a-021b0534039e", "value": "01754499.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3deb5e6-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346321, "uuid": "4fdb79d9-04cc-40dd-a39f-65c40c3fad3f", "comment": "Malware payload (RedLineStealer)", "value": "0ecae9597d58882e436a04bd4e8e3446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346321, "uuid": "c319589b-3705-4e00-8187-67993da99a2f", "comment": "Malware payload (RedLineStealer)", "value": "2183f21a3859733974b0901a0cdd25a76e828308a1287f52bca448351c14c8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346321, "uuid": "5e73084e-d8fe-486b-bdd4-3df5945bf176", "comment": "Malware payload (RedLineStealer)", "value": "ae28211e16d9ff93ac46235273edf325f8069d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346321, "uuid": "aac29411-3de6-48e9-bb5f-93a51497df6c", "comment": "Malware payload (RedLineStealer)", "value": "464ae016cf866fbd691c7ee5b3ee065dce4ee7894821c98b22a3dee8fa70e03f940014a38bf6a61aa6e766cf9b1157f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346321, "uuid": "b7ee1bf9-36ef-4f2c-a40e-60fff142bd00", "value": "T187051303EBD85166EEB547F02CF307471B72BCA099B583A617886D4A19F3984B97072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346321, "uuid": "c211b2dd-0715-49ce-97e1-056378593301", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346321, "uuid": "4f2e14aa-d189-4cd8-88fe-371819a297d2", "value": "24576:py+IIeGEeCCFjyoiAVyj5e3nP6USebP1:cTINCCFjy+Vj3nPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346321, "uuid": "f2839782-5f9f-4bb9-ad1d-97769408ded3", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346321, "uuid": "ea79a1c1-1f1e-4ce9-a2e1-31b6ca3b177f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346321, "uuid": "eb5328bf-032c-45dd-8a2c-456d31752fce", "value": "0ecae9597d58882e436a04bd4e8e3446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74647f0-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346327, "uuid": "7f64d013-5e9e-4e6c-89b3-c96f036b9ec0", "comment": "Malware payload (RedLineStealer)", "value": "42957ccf9127d2d3419e7007314f44af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346327, "uuid": "a2ce1e7b-8527-42b8-8299-c4b543ea78b4", "comment": "Malware payload (RedLineStealer)", "value": "22606de12e81f8a97bd940a12d05c9c81d877d06a55a3fa9ca6ef3f93cc43523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346327, "uuid": "0f60148a-46a0-4f8c-8d1d-88679409428a", "comment": "Malware payload (RedLineStealer)", "value": "22f20d3eeaefd1dd362e66a841bcac03ace2ad23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346327, "uuid": "99ec098c-af5d-4228-8712-f03016be1673", "comment": "Malware payload (RedLineStealer)", "value": "324e94258bbf040c2d68b69f8c8f812384900088278de3fccd19cff574dfad62598c74c50bbc0216a9c906c00bcada92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346327, "uuid": "b381b8e9-6e7e-469d-82e2-555fe8188ef9", "value": "T1B0052217F6E99477ECB117B068F602971B337C618CB486E733494C9A0CB3A946A7432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346327, "uuid": "1b972ee9-83a4-4780-a443-df3d44692c78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346327, "uuid": "0be4962a-074f-46e3-9856-ea042aa152b1", "value": "24576:myA2eOR1BWjuTTSmZQ+mQYaBePn76USDEC:13j0SBZ3KPn7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346327, "uuid": "bc87a533-a1ea-44b9-b2bc-fc1db6247545", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346327, "uuid": "64dfcb39-d4b0-4859-becf-bba12814d9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346327, "uuid": "c650449e-16a2-4db1-bdf8-299ed40e7a75", "value": "42957ccf9127d2d3419e7007314f44af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b5cb31-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391182, "uuid": "7a3981d8-a700-44f1-ad9c-a447e2d4792c", "comment": "Malware payload (Mirai)", "value": "608ef03517033a38dba0585d8577e793", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391182, "uuid": "123011a9-8d2a-42f9-89cd-0bb263b0e0a1", "comment": "Malware payload (Mirai)", "value": "228ff4d21374e14e53750a3f3cd5290541be1eb381a0ecbc67498179b62f9b8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391182, "uuid": "ee78749e-056a-4146-9f17-40ef92fe7a1e", "comment": "Malware payload (Mirai)", "value": "ed1e1e1849d6b4dc8f0f1ba59912b324732910ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391182, "uuid": "46362c8b-9fa8-4e54-b09e-e8b37247ac4b", "comment": "Malware payload (Mirai)", "value": "2d9c119956604c7ebf2a3477512b0c0c2e86e021cc0f6adef5da1ddabe0629c011e5febdf231b210d034009e889e298e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391182, "uuid": "aac82735-fe44-4c91-92d2-ddcae7ad7a09", "value": "T199E2E1D07B86A4D197F09E33CABD5D45C23F94B1E57970A21B004B3D654BA436BB8C36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391182, "uuid": "cac0a40e-01c1-41cc-9e6a-c57aef0e76a7", "value": "768:Le7kwibr+g5ibYCycqA0YjDhfJi1nCRlY3UQ:LqibrV5ifeYjDxuCRlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391182, "uuid": "6c6072b3-4336-41fc-a497-250da3d3af5e", "value": 33396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391182, "uuid": "fb4a8c3b-b368-431f-8cac-899917b2fc8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391182, "uuid": "31de6f6a-ef4f-43a3-94ee-2d00631d521f", "value": "608ef03517033a38dba0585d8577e793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f59672-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363417, "uuid": "45911fa3-ec8a-40e4-ae46-42a79e512c61", "comment": "Malware payload", "value": "54a96d051aa03a90ba34fe5060af5d9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363417, "uuid": "aef2d39e-10da-4325-af8f-d5de109b8248", "comment": "Malware payload", "value": "22aa4b074eee9c6354f9500f4354c558195b073972cbcf60a3674d3abd6e779e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363417, "uuid": "6ccde8f8-e0ce-482a-b8cd-c6257ebfed0e", "comment": "Malware payload", "value": "bb4e22c19e6d7250f95ac9deee1c5078a4753159", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363417, "uuid": "50522b31-83cf-4dff-a18f-3e2c56abcb82", "comment": "Malware payload", "value": "2cde71d55b85c2e5fd7323bde64e5dc831559eeb64866dbd2abafc928be55bf4dab998c058138aef24f9b699fb968676", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363417, "uuid": "33a31f42-544d-449f-af73-7ecb7b024cff", "value": "T15AE2E118DD58A3D6F70721BF125CA8AFFB49E948AC254B081B63C9493FF7C649908E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363417, "uuid": "28da3029-ffb5-478d-ab5a-3890cf250319", "value": "e315b430aaedc695b061b1db8516018b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363417, "uuid": "8c69079e-141b-42c4-ae36-1ea953565bae", "value": "768:xXbYqkr4x1Sk4vBn+egK6S4qCrFTKN40s82RTu:xLxkEx1/e5OphDx9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363417, "uuid": "6df67a23-5171-4680-ab99-47ca042bdd78", "value": 31152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363417, "uuid": "13c43718-2625-470b-bcea-64fb63f0aaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363417, "uuid": "d63eb3bf-0d7c-4ca9-b345-932b8c0e8f7b", "value": "SecuriteInfo.com.Variant.Symmi.18751.21036.11548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27877a2-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371310, "uuid": "c41e1d2c-01fc-4599-b943-5b0091929796", "comment": "Malware payload (Mirai)", "value": "e667781c3cbb41141f9e6535b29171ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371310, "uuid": "e5d743f9-9562-4740-9e0f-b5704b24efe8", "comment": "Malware payload (Mirai)", "value": "23a261a3b21a6068bb38abaf18cd55a74f510d8ca3e694093d05a136c92ef447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371310, "uuid": "c1e6962b-5cd5-4436-ae7e-3c74ca7df43c", "comment": "Malware payload (Mirai)", "value": "32928700d97eae8b9234de3a57ab41e284e0620e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371310, "uuid": "a91edf68-ab47-4335-bdfb-23f8e7d83b6c", "comment": "Malware payload (Mirai)", "value": "15b413ce4d12fc92aa6deb692f8145ac5dee138e2f391dea9fd8fa90ee20cae4c3bca6f7eb3a9b2a032ef971c2522cef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371310, "uuid": "760f6ba6-b97d-4345-b542-304fd72c0cc3", "value": "T157F33A8178929A32C6D523BBFA7E108D332553E8D2EB71029D201F6877C695F1E37B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371310, "uuid": "85430785-0c2d-4835-92cf-c66d471ed368", "value": "3072:K3Dg6rXjP4M9OU1/Glo8kE29ItFEyA5LxRM2W9LydxnqT:t6rRUo8ZWRYZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371310, "uuid": "3c98ec58-f683-4461-b464-3c18269474af", "value": 164988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371310, "uuid": "964073d2-0e97-406f-a57a-6660fb1c3855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371310, "uuid": "1446c596-4531-4bfb-8d7d-9f0144cd67ba", "value": "e667781c3cbb41141f9e6535b29171ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e575f038-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685348525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348525, "uuid": "a3a7fdf1-f296-4755-a7b0-9777a0a123e5", "comment": "Malware payload (RedLineStealer)", "value": "991188a17dc0ec39eba4c2acfb1de94b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348525, "uuid": "2bcb3cf9-f8fc-44d5-b309-5bf4e28fb93d", "comment": "Malware payload (RedLineStealer)", "value": "24dee27353810b40cc9ba92be44366d2d349c439eeec6bc05f52b5f439d31b79", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348525, "uuid": "929227a4-3d18-444b-9a8f-db2f751fcce6", "comment": "Malware payload (RedLineStealer)", "value": "6819a4a2ed3fc23ffc7509a0390ce7bce4ecd730", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348525, "uuid": "d9ee0d21-8f69-4130-aa1d-0d0bfa5778a5", "comment": "Malware payload (RedLineStealer)", "value": "28cebd9bce0d57cc869e3deac24121df988b64bccfa36cab96adf926c31a3686538544ff15a3c88256f6c97b66b20ed1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348525, "uuid": "3ca94efb-7b34-4462-a643-bff4cb20672e", "value": "T139643B03A2E17C62F9164A329E2EC6F87B1EF5504F5977A72314AA2F04702EED172735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348525, "uuid": "a5265af3-263b-42c2-ba41-bb13dff54342", "value": "1552eebb89b3841e6a330c0c93657732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348525, "uuid": "80020f6f-9d9a-41a4-b7e5-f66961f88af4", "value": "3072:MuNGCapZ6cLLFDL+zpucmKbT78QbrOwqAi8E/mbdMD82Z6rfdwXTc1rfwP:NGpLXFIuz6T78wpTg+bdc8Y6LS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348525, "uuid": "e0576c41-cc41-4ca9-89d3-322e39e68e53", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348525, "uuid": "58cda72a-8d9d-46e1-8de8-f42b123c5d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348525, "uuid": "c35f6bfe-1731-4dba-a1c5-0a862245d6f8", "value": "04271599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87777e03-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363400, "uuid": "b42c7bf7-62ae-4cb6-b30c-ac07143446c8", "comment": "Malware payload", "value": "9871facc35a9eb2cf4aef5bec42b2b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363400, "uuid": "b79aa25c-d059-4b83-8a12-74b2f3df5fe4", "comment": "Malware payload", "value": "250bb002b2c0e45ba99bfb023a4b4fd26074a7789bb8aea3c2baa993fb2ffd87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363400, "uuid": "c12aaf37-7065-4612-9861-aa4eeb4031f0", "comment": "Malware payload", "value": "5c7da6f1e69fe399e2bd414600ef80df593ba864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363400, "uuid": "941200f2-4b41-4f77-876d-99acef0d6451", "comment": "Malware payload", "value": "780eb515453bcaa8dc8268e21cc7dc61ef65b3dc99219aff649eb8113e6e442df927a159cce0a3efc8f200f0d28ec3e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363400, "uuid": "c70ca58a-9c95-497a-9326-cc06365fc397", "value": "T15D128E736E6AE563D9E372BA573E852475A80D320B9402484D4EC1E7B39318446ECA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363400, "uuid": "08990fe4-a5e7-472c-b331-583b647ca66b", "value": "81fb733f5e9a8359be9c5ae8210289a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363400, "uuid": "24a17180-4806-4af1-bab6-ba2eb1951b4d", "value": "192:nLzpMCCdhMWlbQnL+nVvzGBTQuS9kpCvfKkvx919NHB5:hMhMWJQL+VvqBpSv/x39xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363400, "uuid": "17af4245-6258-4ba3-8f04-f530fb7f08f8", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363400, "uuid": "a0e3e76d-b397-4f1a-b25d-4efed0c70418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363400, "uuid": "755c36b0-a857-460e-9e12-beea08281852", "value": "SecuriteInfo.com.Trojan.WinKill.29.5359.7798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7abd336-fe67-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685395774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395774, "uuid": "5b43724b-6b56-4547-bf4b-81c1d93fef19", "comment": "Malware payload", "value": "70882777c75456874f4febfac0212cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395774, "uuid": "3cd853e6-48f5-40a5-a9fe-94d2ffa871c7", "comment": "Malware payload", "value": "2584a2b410683390bd887151a82baeb90d3042215898a9f4399e33217afc633e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395774, "uuid": "bafa3f17-ec5f-4a11-a599-ab531f27f5b6", "comment": "Malware payload", "value": "42c50431480d50a42305b800086b15ae5e179e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395774, "uuid": "85685842-ec1d-4ec5-a51b-6afc062a4ffb", "comment": "Malware payload", "value": "2b619a5d352532e7d81cec46d906faadb36e2914befe19d9524e92543ebd2f65910e8667f1156a9ff9e9be3cde8af3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395774, "uuid": "274fa5b0-3381-41cd-b9f1-8a020d936923", "value": "T1E0E2E113F3FA8613E0C421353B23954461A4F95911994F932B3CA4AB5EBE7F31DC54E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395774, "uuid": "80cbb8d1-b7df-4293-bb5e-02f577cb03b0", "value": "fec66859a47303bfee9b93034e3f9784", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395774, "uuid": "729f207a-7ef0-4d70-a5e3-66b538e70f33", "value": "384:/Qq7ZWX7rQrMma0a+rr6utNlOvPM91zuCRYVvrk2+QpZKl8mQkJZQUjMWEgUBVQ:5tcfQXzVrTtNqu7m1WQmlalUYtBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685395774, "uuid": "51d2efac-66fe-4d88-9ce0-75387778b7e9", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685395774, "uuid": "4cbec6f7-a1eb-4620-acd6-a33ce19e544c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395774, "uuid": "b32af532-be16-4728-8849-9d2a9b4a8274", "value": "SecuriteInfo.com.FileRepMalware.21390.5656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd76d7bf-fdb7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1685320219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320219, "uuid": "2abda4b7-6fdf-4c65-bbb1-c25fb697225f", "comment": "Malware payload (CobaltStrike)", "value": "ad6829c265e5c56ea5416e8570b36629", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320219, "uuid": "b82475c2-efca-40a3-a116-161bc184eeb0", "comment": "Malware payload (CobaltStrike)", "value": "25d0bc682d25a43d97a7e010deeb8dfdad80ff9562084333cd6fb99ce8907422", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320219, "uuid": "db88d460-5628-4a82-8274-03e5093ff87c", "comment": "Malware payload (CobaltStrike)", "value": "f537e5f0ab0376e46d09b162cadf0d654212e470", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320219, "uuid": "01af48ca-9248-42bf-b5ed-9ff5b20bf95d", "comment": "Malware payload (CobaltStrike)", "value": "67e7a69a937275c8d436af365e21b2a45637c8131c65585dc75fd1c779c7ff89cb7b90f683af4cbbaadb721307c4977a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320219, "uuid": "a1144529-edfd-4907-912c-67ec0989ce0f", "value": "T18754AD1B670E36F3CABAB07A0CF97E76491AC33D539EB0637516AC42B7C40D8491D989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320219, "uuid": "98195486-0e6e-425c-b6b9-0ba94cd0da5f", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320219, "uuid": "d8763939-5e54-4803-abc6-8f1af0b3c356", "value": "6144:zWj2P5Uf9x3Fg+KLXcPX6S4vHTT41YNW5D4EeYCP8ZTg9XboP+8ZMCDw:6jfM/Q6S2v4aNWp4CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685320219, "uuid": "739761f0-b0c8-4629-b2eb-ad81c15667a0", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685320219, "uuid": "109d53af-4534-4a5e-b97e-a6267c4aeb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320219, "uuid": "5f7af85f-0019-41cb-acb3-cb16dc4f6f45", "value": "ad6829c265e5c56ea5416e8570b36629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33007130-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391175, "uuid": "cf7562b8-c77a-477c-af09-96d4637e1b7d", "comment": "Malware payload (Mirai)", "value": "8a63716720326408f151c088893a45d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391175, "uuid": "54282173-a626-4688-8d85-8ffa8b874091", "comment": "Malware payload (Mirai)", "value": "26dfc52524161a530a0035bb0892a75ddc6f0c082e6532f9ce88351abc7d0894", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391175, "uuid": "04e009b9-d79f-4c89-a573-c793565c92eb", "comment": "Malware payload (Mirai)", "value": "ea52c5d7284fdf5995c87025be5d115f08e410f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391175, "uuid": "576fa3ce-92ac-44e9-9bb5-709a97888d80", "comment": "Malware payload (Mirai)", "value": "5ef3bdd6844d14c669864fa4f778c1e5f2b0deac26eabbc4146bbd41c9ef0f51a614fe189a9b934bbc90d59ce572b30c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391175, "uuid": "8202f11b-3dfd-4d8a-9da3-66042d47c960", "value": "T123D2E121A6CCD076C2B42C75E7FF4A082753557C7EAD64A257281238F25C8C93ABF5CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391175, "uuid": "9bbc4b79-b652-4e26-94c4-bb6008562234", "value": "768:zxxPr4P1hlJccu8sJr7+EXa14Q/DPsgdazXY15e3U3b:tqPhJJvu7+aa+ADhazS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391175, "uuid": "c0651ad6-d2d7-4bc3-86e0-410907dd9b63", "value": 29448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391175, "uuid": "53add49d-f8e3-44e5-8b8a-13a1db9c6fec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391175, "uuid": "7bdbe9e1-7e42-4ff9-9051-8d6e614e6169", "value": "8a63716720326408f151c088893a45d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef072d66-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371305, "uuid": "82899abd-c999-4014-8396-08c8476c8787", "comment": "Malware payload (Mirai)", "value": "8718ffa9e34a36fbc8a21ff321b67b41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371305, "uuid": "97c7cc05-0979-47b7-b0db-6c1a360708de", "comment": "Malware payload (Mirai)", "value": "272ca9de8ec3d385d852a8b3677700db69fe84ee98e18829689a46370ab0425f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371305, "uuid": "2c03e704-e82e-4a0d-aba1-e2d4eb2391f2", "comment": "Malware payload (Mirai)", "value": "d6d35a0099ca6c1ee57382d92036abdb2164e1d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371305, "uuid": "cf0eacc4-69f1-4b86-b4b5-d5488e1cda35", "comment": "Malware payload (Mirai)", "value": "c9daec041c18a24c3b2d0c411924a39d0e09453ace3d55d08d8c704b6a8b03260c59597315906e9f67e70bb1cc937708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371305, "uuid": "32b1ef16-c5d6-4e9e-878f-694b9ccec66c", "value": "T1EEF30A8578818E21C6D523BBFA3E008E3315A7E8E2DFB1528D241F6477CA91F0E77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371305, "uuid": "80855e9b-cfcc-4b96-8faa-a31b61a89b71", "value": "3072:yCfu6JN2mEvjZf4O8dNyzMXSr9NUdYD7HV0ceD4i/rvygXEX0Oz9pV30JDTnnZQ7:yuu6JN2mEvjZf4O8dNyEW9NUdYDcTvRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371305, "uuid": "6621f90d-a620-4117-8f21-17670ef3e6d6", "value": 169392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371305, "uuid": "ce7ee5cb-d3f3-478a-8254-1734ae2b4d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371305, "uuid": "a1702b32-707a-4363-b028-96c75b1ee5fb", "value": "8718ffa9e34a36fbc8a21ff321b67b41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ff7ecc-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346323, "uuid": "01e15c8c-8564-47b6-ba89-5e7a56ab1247", "comment": "Malware payload (RedLineStealer)", "value": "3741c3bb5035955219005d591e991e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346323, "uuid": "33d2f96a-7022-465c-a6d2-26d89fb61c0e", "comment": "Malware payload (RedLineStealer)", "value": "27adcdd884e4a13528c9d2f53cf2b545e6252958998b9fe79c3330e684985727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346323, "uuid": "06aa97a9-fc62-4ca2-9eba-4b1a091ab954", "comment": "Malware payload (RedLineStealer)", "value": "96dd737a5bfb7345bdfc05f0c43314ed1324630f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346323, "uuid": "30870597-6931-4b53-95ad-99471250779d", "comment": "Malware payload (RedLineStealer)", "value": "57b2f48274756cbb01b7c1b5fd56aadddd5863f299d3d6265087aacebc2b932b86f57e3ac137f666178302f9b3abf906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346323, "uuid": "44971741-f651-4306-882b-a354c8bcb262", "value": "T19F352306AEEA85B2EEB41BB048F612C71B31BEB12834935F63855C5E1EB35D0743536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346323, "uuid": "b862317a-659d-4683-8952-a64875fe0fd6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346323, "uuid": "c4f800e6-76d2-4f4a-a038-1ff9463c7b3e", "value": "24576:oyW3hPd0l7Gd+nWPg/zbrdnbvUSLvd+mu2zy8yiEqQuInpaKtlP/:vW3h4Wo/HpnbVdpMbqQuInpakP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346323, "uuid": "e452da9d-9a5d-41a5-bdb7-75f30138ce83", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346323, "uuid": "80279ecb-7c28-434c-963f-44911548f5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346323, "uuid": "ca932040-28ae-491f-b398-017453ca6826", "value": "3741c3bb5035955219005d591e991e9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68337d1-fe2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SocGholish)", "timestamp": 1685370404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370404, "uuid": "2b3c465f-c36e-468c-b4ba-2ff9106876e4", "comment": "Malware payload (SocGholish)", "value": "40524da3c28dbc9f5e16ebb39fd3fd24", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370404, "uuid": "d5904c56-0e54-435a-afc9-4a1749a45ad1", "comment": "Malware payload (SocGholish)", "value": "27b73a52474de99c15d82bb960ba6ca26aef66e4044d24a0629f7f944cf1f2db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370404, "uuid": "aeb50555-3ec5-4cb5-95d9-88992c6e327b", "comment": "Malware payload (SocGholish)", "value": "160a8a6887a062a0894b18d54c0aaca23f4af07d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370404, "uuid": "ae714a83-2c04-4584-898f-fd2285732367", "comment": "Malware payload (SocGholish)", "value": "1798549e3b79ad2283c4ffb544312d3ec61ef462a56de9b5571774ebbc4d1c9339878a0cfc8b0db1cc61eaf2d13a7467", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370404, "uuid": "c8209f0b-7e91-4c79-a5e9-cfcaf6545141", "value": "T153C1416053D11508029BDF7EA7093AE4E6199D6A7CB00906E4007FF9DD5A310FFDAE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370404, "uuid": "368f9bec-6741-4d76-be5a-43785013ff76", "value": "96:uUFWSOfdaG6Vu1YYCsmAIx4RH/In2HCodZTVVhInOHZXBQXLnEiHjbNW7mM9s:jFJG6Vu11nIxwfIn2HfdZdInOBB8DbN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685370404, "uuid": "735377ad-ab6e-4173-bf20-adad3d67fd68", "value": 5958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685370404, "uuid": "aba52596-9529-4679-9fb5-345f9c345f86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370404, "uuid": "76f81adf-166e-4270-9acd-fd7f2d22d8b7", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8066a6-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365339, "uuid": "df5e0784-3b59-4e74-99c1-459d99ff3997", "comment": "Malware payload (Mirai)", "value": "3ab704fc4a0d91684ce371120ad533d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365339, "uuid": "beafa765-8917-45c0-bc13-007d529bb8ca", "comment": "Malware payload (Mirai)", "value": "2853333fd48e46173e8b29020966aca7c24b87bee818ced5c09c117a2bc3e0a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365339, "uuid": "014a412c-2c48-4385-9cf8-aa6dbd8aa9a3", "comment": "Malware payload (Mirai)", "value": "68a316b050c0fe2ccd22ad53f81de25ad31c666c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365339, "uuid": "59e3aa66-f5f3-46db-b090-a7b641cc994d", "comment": "Malware payload (Mirai)", "value": "01f109eea2511aaf58b5b7d2b9963b19923481aa109fa8cd9b53e121e77d013b70fe1ebb235f69dcff6be23819555748", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365339, "uuid": "081d7c38-8e03-4446-bfd0-414c8a318e22", "value": "T1527339C8E683D0F6FC0704742027BB3F93309562C029EF93DB9A9D52F913A1156177AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365339, "uuid": "05d67ad8-3494-446c-8aee-cbf3712b7e3a", "value": "1536:333uhVq39FpCJmayQBkepO+FFIKaRJqm:33+Hq393CiQSepO8IJqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365339, "uuid": "db243812-85ab-4d08-95fb-dbe5e8a80232", "value": 77420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365339, "uuid": "1a488387-000f-4128-88d3-f1b5fe11aa46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365339, "uuid": "f4983220-a1d1-4c43-a367-0ff2cb8fa8d1", "value": "3ab704fc4a0d91684ce371120ad533d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84985408-fdbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685322163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322163, "uuid": "063b9bb5-a0a4-4384-bc25-8b151ffb966b", "comment": "Malware payload (RemcosRAT)", "value": "04c330fa2d1ba82908c50e135fa636e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322163, "uuid": "5c11f093-18ab-4fa8-8a9c-4d739f180cb9", "comment": "Malware payload (RemcosRAT)", "value": "28778047d8ce310f9222cfe6886b23e26f5a8816db55011267e508ebd21b5986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322163, "uuid": "283bde07-688b-44dc-9547-7e6696eb5a14", "comment": "Malware payload (RemcosRAT)", "value": "6d2f8cae54d9ea8287aa65b49ea8379755c27558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322163, "uuid": "1d91b7f3-9051-4d5a-9c7d-03902be9277b", "comment": "Malware payload (RemcosRAT)", "value": "ef5380ccaded88ab1747e3512acb3db2162e73e2fe2c4559af0e8f38b84bc21346c977db78fdf090bc6dd60bf94ee0a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322163, "uuid": "937056da-c42c-44cb-82cd-01dac16fff01", "value": "T104037D242650D03AC8426475443D81F29F7E6E3211AAD9D7AF952F325F322DEE73E24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322163, "uuid": "7b6232c8-366f-4e5b-88e2-faf4477978f7", "value": "768:8HaGmJqj/DkKqn5FKwQE8IWlReWfDWf9zTjaCuGiyqV:sfqqj/DMFv8I8ReUWflaCoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685322163, "uuid": "c51bd075-185b-4c10-9e1b-4e5436781b73", "value": 39304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685322163, "uuid": "760802da-4a73-4ae8-903b-6cb43989f4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322163, "uuid": "22a055c5-5a8c-4a2e-a82c-a1f69d3c5243", "value": "HkWLmQWt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f677654-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363413, "uuid": "fbc6746a-8c60-4dc9-8b16-dbf724375d64", "comment": "Malware payload", "value": "5cc5c3b6eb0cdf7723063c7cbc6b1d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363413, "uuid": "51f7e370-9451-4bef-9420-22a2d61e9c5d", "comment": "Malware payload", "value": "28ea56764ba571be3959aaddbcbad09c47d959945e760683fc767ab17ec7f6e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363413, "uuid": "9715e02a-9d9f-4501-bf17-7ece4ec38eb6", "comment": "Malware payload", "value": "0c7e032253b064ff49b9f56b86bedb46b3a28fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363413, "uuid": "279dab92-4998-4390-87f1-522c4c8a10f4", "comment": "Malware payload", "value": "a9d61ca78e8cf8719ff184caa8df5578060313c6f43b9c83284881eec771f15bde0a94cc0c9269b8848201b77126078b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363413, "uuid": "6700ba24-d62e-4d67-91a9-e0268c2dceea", "value": "T14253F1C1F75F99E3C9516B72CE79EA588BB4A2818E310AE5BC934F053F2D2C87443952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363413, "uuid": "3ff1d749-fea6-4f08-a0c9-6f13ff6c234e", "value": "06122351ca4de697e7b6ec29aed515c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363413, "uuid": "6294fcbb-aa96-4cb1-a7dd-1a1b6a4aca9f", "value": "1536:wAXHj1HPfsTV98UdHP1J1VIMKI05/eqkGhoLe+cBt:wAT5e8gHP1Fp05/Vd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363413, "uuid": "d347e090-ef4e-4a81-a5ec-8bd99835c9a4", "value": 61018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363413, "uuid": "86d1e060-f73e-41f5-ae7a-5e504e6b2cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363413, "uuid": "34f9159d-66dd-4961-af7b-bc5fa4171dda", "value": "SecuriteInfo.com.Trojan.Packed.47751.7463.16442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdad1ce-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391138, "uuid": "2f64d0cd-d265-4b78-9774-e17a93665b2d", "comment": "Malware payload (Mirai)", "value": "c1781b6440c32c3cd3b5af772eae3b6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391138, "uuid": "88eaad16-34bd-4702-9781-ace49a86f042", "comment": "Malware payload (Mirai)", "value": "2afe3f14f806f1b435e2c7c0e82e7e709c8abc4db41b92dddac0fd5df7accb7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391138, "uuid": "162cfef2-9216-4228-9898-3e2d84a2b05a", "comment": "Malware payload (Mirai)", "value": "f32bb16ada1982fd1b2957687b325c0e654f8749", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391138, "uuid": "9c2821c7-9ed1-43a9-9e2d-2a0667a51e32", "comment": "Malware payload (Mirai)", "value": "beed69ae5fef1946cb6e1a23e4d1ae220ea32e12d4b56e0f6ee43419740eeb30ee76b85dd3a7160d5542cb0abd74867f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391138, "uuid": "ab088966-bdb0-4f2d-9196-79ab8f1064a1", "value": "T16843F1EAD608E7E817900F38EC7E0E03A2B85FBDD29AB11076009769DE52DD7B1C5453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391138, "uuid": "242e3b14-246c-4b45-99f0-2f305abf592d", "value": "1536:mmRRqYI3gyfg/cTfAfVIYftVufrX51x7kDEc3Slge3:mmTLyI/cTfAfmdhc3Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391138, "uuid": "f489306d-379a-4e7f-bd81-b49109f6d98d", "value": 57876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391138, "uuid": "3226b812-5005-491a-9183-b58bebbe0844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391138, "uuid": "26a9cfff-28dd-480a-8a1b-4c71fb6b82c7", "value": "c1781b6440c32c3cd3b5af772eae3b6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b4aa06-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371296, "uuid": "d3294171-021d-4130-8d33-c2343191bf2e", "comment": "Malware payload (Mirai)", "value": "b30062b73f854a034ce4e4d92bc843a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371296, "uuid": "22f7bb4a-5978-4f1b-8cf7-c8e542f10941", "comment": "Malware payload (Mirai)", "value": "2b628baeb8492359ba88b307bd001993b7a106d2493b16ba610793686d0d4103", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371296, "uuid": "e455cbb4-870f-43d0-9dc7-190d7dd92021", "comment": "Malware payload (Mirai)", "value": "8712f932243ecb91ed2fc45e0d2ee8d43e0e985a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371296, "uuid": "f025b471-d144-46cd-9b94-e154e46d1fdb", "comment": "Malware payload (Mirai)", "value": "256eef45e08d23f95068cc0c84b5c4c83724172a6bda56a17fd7fd87f2c987551ee807d464ce71d8530069df6373156a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371296, "uuid": "50bbd942-8aa7-4769-92ba-ff9160d13733", "value": "T102A3E7917882662AC2D123BBEABF51CE336067E8D2DB7126CC211B547BC651F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371296, "uuid": "dcdf5d98-0496-4261-a7d3-bfea6d048b02", "value": "1536:W19MfCQ0qxDApxfL2qGrFMUUuYTvZcBef5jctEk/Uv9uVsrTJ8S898rhrzNdgfUV:o9MfCWtEgQuWTW/GrpKM2As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371296, "uuid": "340c7a21-8e7f-4836-a8e7-e6c1fe5dee70", "value": 99660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371296, "uuid": "f0eb1181-4943-4152-b17f-8453e0f5fcf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371296, "uuid": "d4987ef4-2459-4e21-84eb-0fdb380aa0e9", "value": "b30062b73f854a034ce4e4d92bc843a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cbd551-fe36-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685374421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374421, "uuid": "73e31005-9744-4268-b4fe-7e2cca502683", "comment": "Malware payload", "value": "506a7e5dc688e859e35c5d9ad80da7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374421, "uuid": "96b423a0-318c-4de8-882b-c15e281c3056", "comment": "Malware payload", "value": "2b92aa316747f10d26b41fe859e5b9e260922f14a160a946425fa908e6c81a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374421, "uuid": "adc95384-e7f7-42ea-8306-5eac4a2b83e6", "comment": "Malware payload", "value": "974c4374ae62f170c249ebb33bcf17cfe69175f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374421, "uuid": "3c8d6519-47ad-4eb5-a71b-082ebd792afc", "comment": "Malware payload", "value": "27f208031f7f191ae97807910d91221120a07d68fff467f6fe6039a06df59cfa11a6ba93a1bc2b0042863a3dd14f78b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374421, "uuid": "9adef04d-4763-4b00-b6df-9cb72f327e6b", "value": "T1B122098EBA664DE9D71983318A77495AF034BB006752B3CF33BC82391F12791742978D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374421, "uuid": "9603f2b4-c0fb-499b-aa66-e85ab91e7804", "value": "0158ef0cf5d4c6b3d788cbd7fed14f1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374421, "uuid": "16fe7293-a0a4-4eaa-9541-a293d0886ca0", "value": "96:NrDLrn4y3JGTxx/geDDyygJN2A5BcY6sPQdf7nx1nArbzAm73Q5tfqXU/Erx9M9:xXkycTxx84A5BW7xBAV3Q5tfqXU/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374421, "uuid": "8a4f1f23-052e-4384-b223-b7a26094f08c", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374421, "uuid": "72f1f976-56f9-4dd0-aa45-7e2364e44141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374421, "uuid": "b3ea5018-4fb3-4024-bf06-aa1e7738dcef", "value": "e1360e96-0f6d-40e2-b558-f6ac858386a9.tmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c476841f-fdd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685333437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333437, "uuid": "5e6f8516-0d82-4ae9-b01f-b4937340c1bb", "comment": "Malware payload (Formbook)", "value": "977ca943b2b23eabe980340cdf3a51ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333437, "uuid": "1f718c54-7a62-4b2a-92e0-bfbc45919d73", "comment": "Malware payload (Formbook)", "value": "2bab4b4ef0cd5ce5f2dff0ddcbdfb7295c0d141fb4c88ec305268b24a3e23a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333437, "uuid": "8059cda2-9f4f-4e77-b1c5-f8c7db9d1616", "comment": "Malware payload (Formbook)", "value": "72fef42c1166f638579e4dd6e9ece02e971f7661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333437, "uuid": "130fe08c-16a1-4d71-b883-9ce159c0be1a", "comment": "Malware payload (Formbook)", "value": "0757957e7a80e20ec3e34449a15e9a589e4ed806f9ba721b30138990dac88a97c0780b7dc85cb7f9855993e7277c63d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333437, "uuid": "81a89f37-a2bf-4f1d-980a-a105241a6cb6", "value": "T1B16412E8BEADC0B2C56442314D76CA146E74DD276A60831B5B94FA2FBCF6681460F337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333437, "uuid": "e9fe1ee7-24b2-424e-823c-8f7367dbb573", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333437, "uuid": "31b92673-577e-455b-88d7-9c2d5cf854a3", "value": "6144:wYa68PTTMMBDq85HKaZWLzS8aC4nb809sgxbTfi3qU:wY6PT4M9Z5qaoLQCA809sE63qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685333437, "uuid": "9c869a82-f64f-484b-860e-e3f2452e397e", "value": 309267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685333437, "uuid": "72061959-773d-46a2-9e3f-1eacdcab5c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333437, "uuid": "8d30b52e-9309-443d-b96d-a8d983a9792b", "value": "4013831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963ea6cb-fdc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685325629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325629, "uuid": "aea420ec-bea6-404d-ad98-4da7d70ef38d", "comment": "Malware payload (Amadey)", "value": "4b06fd9edeb3c240e4f981e5e4c6eb72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325629, "uuid": "d47b24df-e3a6-46ce-a60f-4917e519f969", "comment": "Malware payload (Amadey)", "value": "2c66234b9da7d38b672802f73954bb705fa6957e52602291c9bc15502f78f29a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325629, "uuid": "e6084b83-fdfc-4ae4-a7f2-0da5b40deb5c", "comment": "Malware payload (Amadey)", "value": "efa8887e3dc1374d6d44bc9a89d86a4f5ca3247f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325629, "uuid": "e991f821-9906-4932-997d-f7cb22dbc393", "comment": "Malware payload (Amadey)", "value": "11aa5381eaedf4d5ea2a90256d0a6b2c55ae071b68b9a7b0ea96c7bbda4d1f771b2d630851d9fc56770dc0dd2adf612e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325629, "uuid": "381aa335-8a4d-4d4f-82ef-65f54b5ff9d9", "value": "T1D7051342E7E94873EEF42B7099F205831B35BCB14C7046AB670988461DF3A94ADB536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325629, "uuid": "c681a284-389b-4c46-ac2d-4ac4da4915c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325629, "uuid": "5aa22998-bdd0-463a-9ff7-410d1bd4e22f", "value": "12288:NMr5y90qrzfGjgh2yofF3iH0H88L7jk6BM83lelCidFLGxsf2bheeBnwEQ3UStxh:wyr+qBm0d8L7Xlebns9eenZ6UStjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325629, "uuid": "7ed46f92-d38b-4cf0-9286-2fd780ab6cd1", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325629, "uuid": "d5ffba51-ee90-433e-8f52-2dd179cf58b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325629, "uuid": "639bce58-5f4d-4bdd-a6af-d38448976b92", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4e7212-fe27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368211, "uuid": "38e9db5b-0384-4cf0-9930-49b4b615ed74", "comment": "Malware payload (Gafgyt)", "value": "ed602bdfbc36c747fd4154f176d43f98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368211, "uuid": "86f04c2e-4c3f-46c9-9e70-81765d88329c", "comment": "Malware payload (Gafgyt)", "value": "2cf079b6ef9d520ec72fe94f7f91d3bbe74a840768a572c4dc0a0101c283311a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368211, "uuid": "5865f3bc-c29c-4fa7-a672-db4ab1f4505e", "comment": "Malware payload (Gafgyt)", "value": "d83fe3aed2dd3c89d200cc2010d73f31109357e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368211, "uuid": "778bf1da-ec19-46a6-abc1-50666bed16be", "comment": "Malware payload (Gafgyt)", "value": "4c00729eeb63218cc18524d1a1f4483ebabb2563dc600727519328ef2cf9b9b781faeb8334c4f00ead37a2f3a4c76632", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368211, "uuid": "a5823c88-a123-470f-a01e-2918c474e245", "value": "T136B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368211, "uuid": "001f0e71-61a2-44bb-82e5-d496a7a3ac23", "value": "3072:R/4tNF9U4vvYKw6J73x8UmkiSFxfKxbXe:BUNFK+Y8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368211, "uuid": "b647179c-d697-482f-90a5-ed6670f8cce1", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368211, "uuid": "428dd966-0200-44b8-bbfd-4f27bde73f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368211, "uuid": "8429a973-f43f-4fff-abc0-f464afdca2d8", "value": "ed602bdfbc36c747fd4154f176d43f98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e729b7e9-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371291, "uuid": "ee0c3c4b-3ee9-4e8f-aea6-380a4103ba5c", "comment": "Malware payload (Mirai)", "value": "23b0d70bfdda179697a264e0fba51097", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371291, "uuid": "594be777-d980-41c9-86e8-bf9c0035b505", "comment": "Malware payload (Mirai)", "value": "2d024fe9f11263204a3a8ad114abe0b221c9ae3b2f46cd61ac7a90577a01696b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371291, "uuid": "f9e7a16d-b999-44cf-adf7-55f448a353e3", "comment": "Malware payload (Mirai)", "value": "ec11e715d932c0bc28778dbf68361c46adf7f7ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371291, "uuid": "dfd57818-e247-4266-8a74-351ce85818eb", "comment": "Malware payload (Mirai)", "value": "0e65779e4672d92e00fde104ab307d62fde388c134290660b02778803cb8edc125a7210d0a15abe960e50faede2c2391", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371291, "uuid": "7d6a3140-bccf-4624-8f5c-c2baceb19fe7", "value": "T18EE35BA5A8021F2CF98AA1FD542A0F18A92153943193071FE5A9FDD3FC7315AEF0AD91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371291, "uuid": "5b2ad516-8900-4ca4-8955-f4bd40d40131", "value": "3072:6ycSNuXjdTbSj8tnYtYOx5h53arKsBPGpxpWz8/ny2:gSN8TbSjSnYtRf6rKSypWY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371291, "uuid": "65c157c6-e649-4de5-a890-ec07d6576386", "value": 153172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371291, "uuid": "38aa800a-2f7e-4e86-b9bc-f9eb599ef29c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371291, "uuid": "29fbf72f-36b4-49a8-9c3d-12352b08dcb3", "value": "23b0d70bfdda179697a264e0fba51097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88b17fa-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377199, "uuid": "a2f91429-788d-4c03-93a9-da9f14249426", "comment": "Malware payload (Gafgyt)", "value": "89768569225fef4e6e1a73aec866505e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377199, "uuid": "eed4d0f5-a2e9-4770-8776-472fc8b55bf4", "comment": "Malware payload (Gafgyt)", "value": "2dfae8d348bd96ed519d052715414dfaadcbd69a005e1f749ba37c174bd39a8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377199, "uuid": "2b5f54c1-1a84-4592-93a7-d8064369f2ac", "comment": "Malware payload (Gafgyt)", "value": "31452c0584c96c290994597c87d0fc1666425439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377199, "uuid": "e1b1a74e-8932-41cb-b985-359826e827c4", "comment": "Malware payload (Gafgyt)", "value": "9a567df519eb96c08a44cc881f7b5adc5b95be25c5427a506cdf9a74e7e6c92119e5ce46acd72a5c8a125fe2e2fa83dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377199, "uuid": "3d20003f-1bbd-4c51-8fea-6f6b2d7de8a9", "value": "T1BAB328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377199, "uuid": "ed3ab509-4679-4f11-9db1-2d0cdfaea717", "value": "3072:WD3l+XQzPeV91310pWud2KakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWC2ypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377199, "uuid": "7e3b88ac-7af5-40e7-934f-c3e9f32e872e", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377199, "uuid": "31491eea-67d7-4c5e-bcc1-3bd996ae26b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377199, "uuid": "3ece8601-2a03-44e0-bd98-f6425600b748", "value": "89768569225fef4e6e1a73aec866505e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40566550-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362422, "uuid": "645c58ef-3d72-495b-b5a6-c416ebc443d6", "comment": "Malware payload (Mirai)", "value": "884e496ba2184f950905eec0e44687c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362422, "uuid": "ab32e235-b6e6-46bb-acc5-aabc61d790aa", "comment": "Malware payload (Mirai)", "value": "2e0d72ee2761a8ad9c81afb09548e536aab1cd0500bf683d937a11687518f076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362422, "uuid": "cce818c5-3c0b-4e18-95a2-025dc52c300b", "comment": "Malware payload (Mirai)", "value": "33d188e80d544c68edac10dd25b4a5d9723c6b9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362422, "uuid": "33d37828-de2f-4e53-9dc0-b83af79224e0", "comment": "Malware payload (Mirai)", "value": "a66d8c6e26379e4ea79f9635f681ead7124ee21306194beb2b44c43f980688d9181bf4de54be4756085d6e4aaf2243a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362422, "uuid": "2ae19e56-5fcc-4f49-bbe0-c56afc63ab6c", "value": "T1E1533CDAB801AD3CFC5BE6FE80160A19F931366065A30F179697FCE36C321B65D1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362422, "uuid": "088b61c0-3682-44f0-88a2-6a89d0cabcc9", "value": "768:HeBaz0tMQaaZ261DmbgiWJNS5LhZFGG9kdZnCI7PLzTaT+9uQ8yhh5Cu7VqntyPg:HUfi5Lh7GG9mNtH2T+MQ8yheu5q4PGhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362422, "uuid": "30d7f418-e029-4cc7-ba3e-f60b8750bc38", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362422, "uuid": "cccc583c-f38e-47c4-9a5c-cda403a87742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362422, "uuid": "f8cfdbb9-94e4-4724-9e2e-2eb7599cbc56", "value": "884e496ba2184f950905eec0e44687c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93942a4-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388421, "uuid": "1d72c974-86d3-4b62-af22-d3506c33b5bc", "comment": "Malware payload (Mirai)", "value": "610f09a7967b57ab51c0c41058774b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388421, "uuid": "70964e5d-1459-41bd-939f-7849017dc92a", "comment": "Malware payload (Mirai)", "value": "2e2d88642184f388c30b3b93b9ce3951eeb6079c7da0b388e59abc18399ff6e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388421, "uuid": "6afbfeee-1ce9-4b65-bde5-bc06c88010bc", "comment": "Malware payload (Mirai)", "value": "4f3a925980ac1161fcbe7ef8dd0e459ab5052f1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388421, "uuid": "3ffb6f4c-a613-44d7-98a4-5f806a73f5d3", "comment": "Malware payload (Mirai)", "value": "16d2d1059d768bfa00cfed98d21bee85ca6db36d5eaa02c2f317a9bfb112b9b341452a250b8773e8273af458630bb280", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388421, "uuid": "c9fc49de-674e-42c9-8b93-6976846a6d77", "value": "T19604C61AAF510EBBDCAFDD3706A9070235CCA41722B53B753678D528F54A50F8AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388421, "uuid": "126ce5a5-a5c8-41fb-958d-a993ab60a2be", "value": "1536:jl+iUVa12sqJ29x6GXH309E35g3BcAIDrl9o8UL7LsxO/y6XHLNW0BLG7Jgmp:jlXUVq2sW+0GbdD5CpLjDHLNrBq3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388421, "uuid": "e847c411-7678-413f-8430-cf8df16be120", "value": 177436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388421, "uuid": "725ddd8c-24a5-4871-8e46-9e8464b0230d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388421, "uuid": "bb214f36-00bd-4dc4-b42c-ae5a7d780345", "value": "610f09a7967b57ab51c0c41058774b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2134eb46-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391146, "uuid": "f8d5008f-fd79-495c-a2a6-c8797875cffb", "comment": "Malware payload (Mirai)", "value": "a51686c132d858445987dc990b31203e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391146, "uuid": "fb59a3e6-88a9-440f-bbfa-775b4f696b09", "comment": "Malware payload (Mirai)", "value": "2ecb8699297bfb34e7153d8f026b977924251d35e150282b7c5035c9d5d02fdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391146, "uuid": "693ab6b0-5c64-47b2-80f4-514886e0715e", "comment": "Malware payload (Mirai)", "value": "881fe3a9602537c841ce4d2d384898ab949fc1a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391146, "uuid": "7c1fc76d-f409-474b-bae6-2b721e1f1d2d", "comment": "Malware payload (Mirai)", "value": "a2be07fa4922d2ac8d0be26422c61b492377ab637629a1ae648758cb1f60f943d94b1d574d1fa06fce3f30d67a3c7fab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391146, "uuid": "bf2712fe-9917-4478-8e9f-3a913a819746", "value": "T1EEE2F12151F99BAEC4E7543E1CE7360D2136561E70202EA1BB2CBC3A79B3F0A775924D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391146, "uuid": "35d328b9-78fb-4ec3-890c-2c398115d72d", "value": "768:r3uRGSh9vJ0c+K/ZoZF3AoUyXu+jzuNH4+FuoI7nbcuyD7Uiyq1:buFhf+KOZhADGjzuNY+Futnouy8Zq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391146, "uuid": "ff40be90-3e4a-4d47-b0f1-8814993905f7", "value": 32976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391146, "uuid": "83e64d43-a9f5-4442-abef-e24f9cbb1321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391146, "uuid": "9b903e35-3f15-48e0-86b6-c6563bb78b5b", "value": "a51686c132d858445987dc990b31203e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63c2335-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388416, "uuid": "78d45ae9-ba78-4a2f-9b3c-9338d24890cf", "comment": "Malware payload (Mirai)", "value": "c75fa7ab1f3cb62ac584e75be635b13d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388416, "uuid": "e2b063d6-3f90-4c47-933e-2933ef72192b", "comment": "Malware payload (Mirai)", "value": "2f6851f68c44de422185d6ede675a47b2238832d857334133f8e34dd1dab9b4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388416, "uuid": "463e972a-c608-4304-9490-9a4af6d4b92b", "comment": "Malware payload (Mirai)", "value": "a3b8b5c761bed06de678ecffb55652ea8efc1c29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388416, "uuid": "8fee5e51-2a33-4825-b152-2c6f46c5e1eb", "comment": "Malware payload (Mirai)", "value": "86a6d528304f6cab66f526599a6683e24da5bcef43fee5357e7e5c52fc1dd166324e068eaa81918b7690f22d1d69dc55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388416, "uuid": "20071388-756a-444f-9e78-bfa62b726fd2", "value": "T125333A21B9392E17C4D0A8BA62F74758B2F1265E2AE8CA4D7C730E4FFF1094065572F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388416, "uuid": "2a52f677-d234-4448-9d73-e41c259faf24", "value": "768:1yjovA2q91XgemUSKUJ/DQzIG9fubhQhO+CO1Tb:YjIA2S1X/mUStJ/DQsGAQRlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388416, "uuid": "933d70a8-7893-45b9-b6e7-459467d48071", "value": 51788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388416, "uuid": "9bbea39c-d803-4bea-9074-8ab0c708b950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388416, "uuid": "ae3cabcd-6dde-43ec-8070-fdc5f8d9a757", "value": "c75fa7ab1f3cb62ac584e75be635b13d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4577cffd-fdc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685325493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325493, "uuid": "2046f926-4be9-4951-a647-f2b936669b71", "comment": "Malware payload (ArkeiStealer)", "value": "40baa5d920652df72ba2f3c9df27ffe1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325493, "uuid": "0f5321eb-fff2-4d3c-b05f-f45b1b5dfd3a", "comment": "Malware payload (ArkeiStealer)", "value": "2f740d9a143bb448ba25e581a4dab70d53ed3d689ce99c50e00e731a6289d656", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325493, "uuid": "2b64566d-28e1-42fb-8bb5-e964a9d1b762", "comment": "Malware payload (ArkeiStealer)", "value": "5460dc33bddc0edeaf5f25f94cbf2ae122c8a76a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325493, "uuid": "7ae57b2e-9018-49e1-b738-7b66031d34c3", "comment": "Malware payload (ArkeiStealer)", "value": "2093429152c79fc2645f0307944a1afe2f3769ac528dd3dfe43791cf173f1bdb8f3dd2b07b4f3d0314fd618ed051fae9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325493, "uuid": "08af6d13-8575-4e71-8365-a6bbdf4c4c51", "value": "T140846C1392E13D55E9668B729E2FC7F87A1EF2608E4977B912189E1F04B03B2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325493, "uuid": "905a5f6a-217c-4b0c-97d8-0e3c9f2e5516", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325493, "uuid": "00cbd7ac-36de-4445-af01-e0d877bf8ac7", "value": "6144:A4DCc05XgqrhyfjUbgZhvTNhUTcCZo6B4w5Tval12qlxyJTPCiq:Y5wMIQbgZtTch7ml94V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325493, "uuid": "439222b1-0d0e-4cc1-b5cb-901780d2a79d", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325493, "uuid": "19c38c74-9e7b-4b78-a932-81e2115e4cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325493, "uuid": "a6fcbadd-88c4-4ce8-87f1-e5f07bcf912a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ad8cfe-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685348599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348599, "uuid": "0adda61e-b225-47cb-baf1-a5d2201f4cfd", "comment": "Malware payload (ArkeiStealer)", "value": "73ac9dd71f3c7d6537a07f0aacfc9cba", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348599, "uuid": "008e27d2-bea2-468c-95db-a2f5aebdda8b", "comment": "Malware payload (ArkeiStealer)", "value": "2fee2c9f4a0644c7857db7c4a4122a59267dfb2b8cd2268727d85bcd6626ea5a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348599, "uuid": "ca661889-f7af-4c87-a56d-8cd7b7689f3f", "comment": "Malware payload (ArkeiStealer)", "value": "5f30cce0fc21874584b1518d6d43faf099ba00f1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348599, "uuid": "2766ff14-eda0-433c-8919-58c16d75bf1c", "comment": "Malware payload (ArkeiStealer)", "value": "53a7d8d0ea1df84f32f96e296f126fb19e9eff67a2807b29284e11c3794125b2755951e95a2dd11ea4b503b469fb34af", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348599, "uuid": "884485b1-8d3b-4b16-9239-c43726a934df", "value": "T18CA47D13A2D17C64FA264A729E2EC6FC761DF5504F5A77A7121CAA2F05B03A2C17233D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348599, "uuid": "adf4747a-c70d-4adf-b760-c9372ffe5ad2", "value": "1552eebb89b3841e6a330c0c93657732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348599, "uuid": "2d7d830b-7f4d-418b-be46-c93d8ca16a94", "value": "6144:AFpLrWcHsQawit9tIOFrMtx2dUmGr83xDwWuUor2d5w:AF4Is3nFVMtcUmG8xqr2dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348599, "uuid": "e4af9009-fff6-4e7d-ab05-5b1e1178ff0b", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348599, "uuid": "256a5616-8311-482f-8315-758b0e96960c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348599, "uuid": "b9daa86c-e787-40c9-ad27-7ced713bda6e", "value": "05539199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9a0618-fe58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1685389208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685389208, "uuid": "997abfbb-aba6-40e5-a1b5-b1a7813383fa", "comment": "Malware payload (LaplasClipper)", "value": "4a72623c69e3f6c2a0f371bd69ced3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685389208, "uuid": "19483f1d-e41e-486d-903f-e41d93d89ecf", "comment": "Malware payload (LaplasClipper)", "value": "303edb02103ab4fa8a3e3475d11a565e022eb198152e2f9e7e32fa8f961a9070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685389208, "uuid": "798a1f6e-d56b-4fdf-9798-06259c25697f", "comment": "Malware payload (LaplasClipper)", "value": "faa57b7b7a42027b155965052daffc9ec84532f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685389208, "uuid": "9f3cead6-1ee1-44ce-9a9d-4d8f365c0b1b", "comment": "Malware payload (LaplasClipper)", "value": "eccd9f17092c404b68c440dfab78eaa474df3727cbf172f9d50e89d60b7263748f4aa050a14105c985443ec1faa4bf74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685389208, "uuid": "a4889ec0-8a6b-4bdc-9e3a-629b35fa5ac2", "value": "T19EE37D1DA79CED11D77C297E91D1802803F4D9D5A623EB6BAEC873D82DB3BE18409607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685389208, "uuid": "ddcb3dac-3c29-4422-ac93-ccb0178c9858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685389208, "uuid": "146967cd-d30e-42ba-9152-348325649f27", "value": "3072:uhmpd790ZYtYNELivndRvHKusvoh9Ept5DQz0Um022227UxUX2Uj2K2000U2U2Uw:u0pJwE+jvH0oIprDE0Um022227UxUX2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685389208, "uuid": "e9e0c101-7ac0-4072-a754-798ba6902cfd", "value": 152672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685389208, "uuid": "ba4681ba-783d-4bae-bbae-6c7be8a7d9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685389208, "uuid": "ace1f91e-d16b-423c-bc2c-1d7572c19d98", "value": "4a72623c69e3f6c2a0f371bd69ced3fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b042fa84-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1685354019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354019, "uuid": "dbf7fee5-bbb5-4cdc-a9ad-ac2907fed990", "comment": "Malware payload (DarkTortilla)", "value": "138ccbac80e4fa3a32fff780f76d9bce", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354019, "uuid": "b914d5ae-d83f-41b7-9f95-1c50b1d3f8a1", "comment": "Malware payload (DarkTortilla)", "value": "30a4f76c8c40c3c6dbc1de89c7492b926109bc6915f1f9df71036d1202709986", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354019, "uuid": "6bb89698-c8c2-4ed4-8543-83506ef195a3", "comment": "Malware payload (DarkTortilla)", "value": "564f5f54d7a4e5d4054c7acc8b631d3700521aa4", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354019, "uuid": "396e097f-1c84-4d15-8a09-a9f614b8dc8b", "comment": "Malware payload (DarkTortilla)", "value": "78f66c25374911e031c7a9e5061e38a4067d324da0d0eb025f78e07848cff5dc305de17f86acc79e2470034cb0f99f96", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354019, "uuid": "b8e0b7bc-2431-43e2-90db-60c1fb05ecf4", "value": "T1F1951431D5A71E07F032B63EECD2B372567CF5A16B1FA5B615802B4A7A0B9C0CD81636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354019, "uuid": "367518b0-7a9b-4232-991d-4ed7a2f8b4cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354019, "uuid": "08a5c8c2-0e7e-4735-b422-a097416433b4", "value": "12288:C0Hef2besfNRcrPNWdLBOr8GN54GiSdeiFIEENR8qECueOvl5OIDbo0JdOO3Y0uy:uE9sl5XJdOmBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354019, "uuid": "896b9405-c700-40b0-b23a-bd3fbd8c5a5a", "value": 1902592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354019, "uuid": "f93a4c71-874b-43a3-b12c-d59f57502ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354019, "uuid": "a81f4a47-6ffa-4aec-beda-c853021c2519", "value": "Pago_43442300000000000000000000024765753734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eedc72b-fe28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368459, "uuid": "5f8bc0a1-99e6-407b-87e9-72711b397e89", "comment": "Malware payload (Gafgyt)", "value": "655c3047e2c1f0ef46157123ab81ec85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368459, "uuid": "6f224300-1836-4932-be86-4e7bcce529c4", "comment": "Malware payload (Gafgyt)", "value": "319d45cfcebbbcfaa08e743667e76bd66d76d20c253dfd2991336567d06e7a19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368459, "uuid": "8e21404c-d428-475e-8d19-4ace76e71667", "comment": "Malware payload (Gafgyt)", "value": "1608365e19fc71796736a82be54b336e71626d96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368459, "uuid": "13c2de9c-eb3b-4654-beb9-fca6aaeffc3c", "comment": "Malware payload (Gafgyt)", "value": "51aaf96a14c1004bba391dc692a47c17f15fb2a49bc71c513ab5b31fc9d3c05d9325053f3f6f23e718c67d48c17e39b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368459, "uuid": "a576a657-810a-4832-948e-d1556b086251", "value": "T1DBE32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368459, "uuid": "4eb930c3-326a-4ff9-8a75-127f8cfe7819", "value": "3072:fuNaNpF4uVN++dkhnxLQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnZQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368459, "uuid": "1076f523-6ac5-4088-bedc-2e067a4eb11d", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368459, "uuid": "c2c0a9b5-6181-4a0f-98a1-01d89723b657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368459, "uuid": "aae0e7b5-d7d3-469d-b2db-2960dc73063a", "value": "655c3047e2c1f0ef46157123ab81ec85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1def3d-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363404, "uuid": "4905cafc-2c32-4a37-bd1b-97baca1283d5", "comment": "Malware payload", "value": "162e00b2d212b5056d24d558f4f955f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363404, "uuid": "ebe9c0f2-b1c7-4edc-af7a-b9f4a3e85c81", "comment": "Malware payload", "value": "33055496ef477d626f01fed5ea89334cad9890f7a3f29f939e38488967d06350", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363404, "uuid": "8fe52e0c-4692-44d0-844f-81953a7a8880", "comment": "Malware payload", "value": "d8d691f2de136ed7ed5a32538cbd1c257b4e0818", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363404, "uuid": "39f19c65-7442-4aac-86f7-a92801a3464e", "comment": "Malware payload", "value": "35848e343d5827efcaf4a7b87a744aeedc1520ff24ad6d253070693f627d4d6574419c541fd3e0e1f2a753c3e9f85d58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363404, "uuid": "a90d26ef-da3e-405b-bc0a-d8ff90a5cac9", "value": "T1B0738C01F0056C10EA25097BAE1AD8B9876773FCFD1DAF0638DA8D5A3D678D0EE11B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363404, "uuid": "4ae4e394-a8f1-4a4c-a075-385ebf910583", "value": "768:ESJGKURRqd9ei3PfFVUvvuvWbhnZkHei7oOsc5YlD:ESDd99rWvhbh+ei71Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363404, "uuid": "c1f11aeb-347b-4635-a80c-96c8d9bc4555", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363404, "uuid": "957b881b-d437-4c99-a19c-13f7fca4822d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363404, "uuid": "2f218620-a9e9-45b3-9068-a72870cbd07d", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.24599.20437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ff0ae4-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365625, "uuid": "9acb4d81-bb45-4bb8-8f38-214bff02c41c", "comment": "Malware payload (Mirai)", "value": "d531eceafba2ffabf7697498795a7f50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365625, "uuid": "6f031f96-7b7d-44e4-9622-f44c243f4311", "comment": "Malware payload (Mirai)", "value": "33a5037f5a73ea076e0963f51d99ee37c2fc10d91202f88c00a7ba38ea22bf24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365625, "uuid": "4efd1962-5d07-44bd-9561-cd487a760e38", "comment": "Malware payload (Mirai)", "value": "b20321652db956e353d9778134e7fed44e66aef3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365625, "uuid": "3175bc7e-0d37-4e33-b307-8498532204a6", "comment": "Malware payload (Mirai)", "value": "837297eab620de7d2d8d4716f46f5d7b60aa505d0d2db11cd3a973bb36484dc344709f8de4ba3b621a5a574d1d074fdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365625, "uuid": "3abdb7be-d986-49c9-aa2b-7a601de91967", "value": "T10E933BD7F800D9BEF849D7374C5389097270E2A14E621E73B717366BEE361A4192BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365625, "uuid": "01a2652f-8a45-4610-b640-4fb8c71b573b", "value": "1536:xlNjh8h7hKh4EcHK+L8pgDqTzrQeuacWjcW0JcWcBqP4DV6HPDFS220xLcHJhtqW:ANEGEB+pqXrQeuacWjcW0JcWcBI4DV6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365625, "uuid": "95782576-5830-451f-bd39-593b43abd6a3", "value": 88904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365625, "uuid": "15fdc1b9-461b-42ea-9701-8fd7f17ad908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365625, "uuid": "1e85325c-9e07-4d1d-bc62-35dd397eb27e", "value": "d531eceafba2ffabf7697498795a7f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc028db-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377158, "uuid": "eabb7021-a75a-46e7-aae7-00972914cbb3", "comment": "Malware payload (Mirai)", "value": "28f2d15a7bae63fdb620eccf7a05f38b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377158, "uuid": "656c284b-dbb3-4f4a-b795-711ec968b5b5", "comment": "Malware payload (Mirai)", "value": "33a99c61e56fe78994777d4bae62862ec22e2e7e1289c1546913c1cad0728217", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377158, "uuid": "08fccebc-69ca-47f8-ae8d-a21ae80b5e6d", "comment": "Malware payload (Mirai)", "value": "68f89a0704af09b90fa0052a5f4d907fb4d6b18c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377158, "uuid": "f3d50ecd-b5f3-49c4-94cd-6f0a4b7d10af", "comment": "Malware payload (Mirai)", "value": "bd4cb0585cc9840cf8fedaa418c7117111b4c19030daaf6b9784fab50339db5ad8b8643cc599a25c949ad3aabc6f3d61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377158, "uuid": "6abcf64e-4e3e-4da3-98d4-e96431bfb853", "value": "T11243F1E35640DB728AF4BE347EBC8282726A06ACD20834D15396D96CFBC205613F9F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377158, "uuid": "f9aaea49-444a-44d7-8429-685f7979c6c7", "value": "1536:3qdcbpON3LGFXB4Foq3TxuWUPgWvdm6x2CT:3GUziocvUPjPcCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377158, "uuid": "8d7eed28-e03f-4b86-a44a-688e0b73c091", "value": 56900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377158, "uuid": "7ede3ecf-411a-4f77-957d-f7ad53702bc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377158, "uuid": "1f39d489-3c06-4efe-9ecb-67531c5fc2f3", "value": "28f2d15a7bae63fdb620eccf7a05f38b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8583a5d8-fe63-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685393891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685393891, "uuid": "e87a3a84-11a3-4076-814a-70c8dee0c2a8", "comment": "Malware payload", "value": "f4f6e72c5e9ce0ec278cb0d756729342", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685393891, "uuid": "78e1d784-f070-454d-be88-2f772cb20539", "comment": "Malware payload", "value": "3408f97e869f8c68183704a186658b9d4f89e821fc50a8e73db00b5a1050273e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685393891, "uuid": "ff0af1b2-4a28-445b-90f2-5cdc9a9cd31e", "comment": "Malware payload", "value": "c8cd336cd8d4ec7ef9c62e3f85de5de6d48ba29a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685393891, "uuid": "3b3db83f-0e22-4d91-80bc-b49a70d265f3", "comment": "Malware payload", "value": "9addd671f1c4e2135229dd7944f00777e2cb0050489786877d35884c21451a4cb976c7047baae653045b4a44a9df580c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685393891, "uuid": "1a67baba-9a26-41cc-8cc2-0b8381421f61", "value": "T1F2D08CD33A02A228EC7B0E710230D71043012FF490240F4C20C310205EFE3C72C00096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685393891, "uuid": "8bbebde5-d0ff-4b3d-8d95-319c5c8a2cff", "value": "6:tJn/FnnbgZzMnnsMntDlumMG//3xl/l9msI:tp/dbgZ4nnsMtDlpr3xl/TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685393891, "uuid": "35f347f2-fe3e-4095-861f-46643d278db6", "value": 279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685393891, "uuid": "89c1d0c2-2eb6-4d01-824e-76137f50c606", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685393891, "uuid": "17aa363b-a9bc-4bea-9ae0-d303ec7fe690", "value": "aaak8n4d3la4vobllbvbb9rativxgunqvec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb36c06b-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685354038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354038, "uuid": "ffacbf93-cbfa-4943-abe6-ade650a86013", "comment": "Malware payload (Formbook)", "value": "501077473c7260aa94be655173c8ad40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354038, "uuid": "a4612cc2-5adc-417d-b2b9-cf15b6885a6a", "comment": "Malware payload (Formbook)", "value": "34834d278c8c71e3cc9d152c073cc444781465c285648630a1be19afab1abd24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354038, "uuid": "d1375025-5aaa-4f6e-9c86-93de39ea4d1c", "comment": "Malware payload (Formbook)", "value": "dc677d38541268f2c4a42eb8ba71a6960a04efb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354038, "uuid": "b57f4210-6703-45d1-9ec0-35e2b4006c52", "comment": "Malware payload (Formbook)", "value": "0312360f5ce936be07d0e4c17b9ad788e5dccefacd1d8a2b5bb62bf6132fc8cfb6c42ee2ae8220dee24491b3581c9d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354038, "uuid": "8ffb7538-1152-4a5c-9d6e-7af9893018cd", "value": "T1AB35D53C0AF507D9C27BD3A4CBC89C17BB65941AE9A9D6680CC913D33643B0F648667B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354038, "uuid": "f99eefa1-7ef8-47b6-b479-292efcdc6185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354038, "uuid": "e731de7d-4543-455e-83db-2f1d0d011e0a", "value": "12288:5TLaa0X6S2iN6dn1tWKeMTmHY31v8nhaIdpMdZHs747yr5i6cNOYV2nw:Y510313TC0JIdks7iIv1bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354038, "uuid": "41fa859b-e122-44b2-9074-fd085cd08772", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354038, "uuid": "efed2d0c-33a0-4a9c-a3f4-9dcef1dafb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354038, "uuid": "2e17c386-fa46-4eee-82ba-8fb6de615dc3", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d599923-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374013, "uuid": "0619671d-bcc8-4e47-945e-077876e73d6b", "comment": "Malware payload (Mirai)", "value": "4d7b16eccf4f50686029ce51483a15cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374013, "uuid": "6bb36897-ba40-4ec2-89d3-c7f6036ab7e9", "comment": "Malware payload (Mirai)", "value": "349c4b977fe2e9a89e5c36200846a0e8540f6006721133a69ba6be14765b281f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374013, "uuid": "bf3b54b0-66c6-44ad-93f2-f6cf2e8bcb5d", "comment": "Malware payload (Mirai)", "value": "67356e6e759c3d93f78d8ded11458240faa82b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374013, "uuid": "bb335512-3b47-4610-aeb1-57d11ce5496d", "comment": "Malware payload (Mirai)", "value": "451f20f9340c392df5cb52bfceeeb054422e726859742d853147149e2de8db58fd0242236ac8527580a111252d6c7f53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374013, "uuid": "e2c5eb12-369d-4519-8153-30dca50cc383", "value": "T1BFA3850D7E258F7DFBAD863447B78B219249339A3AE1C584D05CE9012EB024E745FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374013, "uuid": "16a4147c-391d-4634-83b5-0d21ac5b9f09", "value": "1536:EN2UyaccudSFInl8bShRVH1MfxMrSnZXGRTOdcJkxoDKmYqg0OB0/3:zU7LudS+l8bSB2fCrSnZnxoDKmYqg00U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374013, "uuid": "a23b6534-838c-42cc-9d57-0aab1ed29242", "value": 104776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374013, "uuid": "a8bb7455-fd53-486a-ab13-4cbdf909fd39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374013, "uuid": "b5f32da6-cb59-4a3a-9ff5-e9cb2b7115b5", "value": "4d7b16eccf4f50686029ce51483a15cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a416cc79-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685376762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376762, "uuid": "a64525e2-ba65-4b02-8df6-2042c5a8b6b0", "comment": "Malware payload", "value": "7644c2cbdab421d7fdc82a604905bcb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376762, "uuid": "fa2cea57-377c-48d9-8c1b-da964b071878", "comment": "Malware payload", "value": "349db26e6c2006c15d7887eac78a0b070261888689e46f42f0b38edae6456ecc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376762, "uuid": "f1209dd8-4f07-4953-b9e2-78373a3d1e26", "comment": "Malware payload", "value": "f9c6ac651e92e715fd1cdd4f45022a81dfb4f929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376762, "uuid": "69fe8072-853b-4618-ab3e-ea612e5ef858", "comment": "Malware payload", "value": "52e2e175b37305b6bf573869d3692606424ca96192f90c8065a5814463a30086f8b65bb027fe7503e0392f795a830d4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376762, "uuid": "ecd692a2-ba67-40d5-b7db-5b4a3946018a", "value": "T12EE34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376762, "uuid": "d95e3305-6040-4471-948a-c1277b4501ba", "value": "3072:Ib2NQviuoSKTe1a83P0GBCaJQM/9ISWHFwmhwfCHQC2W:Q2NQv9oVTe1a6FBCaqM/9wlwmhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376762, "uuid": "1e9704ea-4946-4b5b-8535-c565d23f4dc4", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376762, "uuid": "bd9c4176-57d5-460a-9747-9353c2684a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376762, "uuid": "7109e2cb-7453-4686-b38f-2ce3982f5ed2", "value": "7644c2cbdab421d7fdc82a604905bcb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9750c1f-fdb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685320507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320507, "uuid": "30d518af-f9b7-4e27-9620-9817cdd40b16", "comment": "Malware payload (RecordBreaker)", "value": "ad6d2896bbd140fe4c04349eb77826be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320507, "uuid": "32798c56-e5bc-4f5e-b612-acd0cc70469e", "comment": "Malware payload (RecordBreaker)", "value": "364eb1a2597ac397957249204c6b399f7bcc0eb06fdd75f3b4bd20c877110399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320507, "uuid": "9677489d-5aaf-487f-be42-d8069e8dbdfe", "comment": "Malware payload (RecordBreaker)", "value": "7bb04f1b1e60b18ee3503299bc9b141577320260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685320507, "uuid": "f3aba36d-7efb-44d3-8107-955d8fd8f2f1", "comment": "Malware payload (RecordBreaker)", "value": "4ba41f867dda20ae426c148ef98b9eb9d6d4d78d12838cf497da5ec1e27eef9f00a8cf6dcf7cdfdd2382fd7dbeb4ce54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320507, "uuid": "25c5fc7e-3500-41ce-ac90-5f9d616f4f07", "value": "T14244AD127A95C032E15329314961C7B54E3BFCF68B62AACB37D47A3E5E342C18A74B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320507, "uuid": "cc2f6130-100d-4d35-babb-36b7f686c21b", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320507, "uuid": "b9fa3917-888e-4e74-bf45-2d253633f705", "value": "6144:hGspRi9l2eSgMuryTJc7clU4vylg2QrI0h:hViL2vgMTVcQlHGS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685320507, "uuid": "d42c3df6-aea7-458e-98ca-d798ebd215cc", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685320507, "uuid": "19ef3711-2378-4a99-84a2-dfadddfc3479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685320507, "uuid": "25062f2b-241b-4e2b-af82-d89380b5f7a1", "value": "ad6d2896bbd140fe4c04349eb77826be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a6337f-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388407, "uuid": "cad4b117-979b-4f0b-83ab-875b72b6f1e1", "comment": "Malware payload (Mirai)", "value": "f4467919f365217bc3386f826c02fb43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388407, "uuid": "30ef509f-66b0-45a1-8ac2-8f60013253e5", "comment": "Malware payload (Mirai)", "value": "3681099993b4b347a28a91d1f57aaa06b5af2998ca9c2ff619d512e9cb601e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388407, "uuid": "4a8366cd-155c-46fe-a3af-a628eee71a9f", "comment": "Malware payload (Mirai)", "value": "1f42f93a4f8a076237840979f8a52335de69e18b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388407, "uuid": "29283aa1-2dae-46a3-b95d-4e7486893e39", "comment": "Malware payload (Mirai)", "value": "93d55f34de905a3649b94dfb46118daed4c356e82e038557d392c791c0e5498a8a11ba9f1447172758388f4dcc4cb84e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388407, "uuid": "238ddff4-d389-410d-8db8-6dc34fc43427", "value": "T19713C692B8825A26C6E0237EB9AE418D336173E8D1DF7257CD211F047BC951F0DA7B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388407, "uuid": "43b8889c-617a-4e5b-b08e-8fdaf082c750", "value": "768:R7YKzjgXjF/L+E8cAXG79Zkj2GoWRtElBxMfm6QUNmYDPzkdgbpGAc7+1uTPN:R1HgBT+L18WRtgBx16QUwYDVpGAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388407, "uuid": "26493397-0812-4172-950e-83e649dbd14d", "value": 43076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388407, "uuid": "06eab546-ed13-4506-976a-350d7f805d6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388407, "uuid": "3197e5dc-de9c-488d-8775-73ce27ffc03c", "value": "f4467919f365217bc3386f826c02fb43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdeec02d-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388402, "uuid": "b98c9656-1b59-497e-9498-0ef00881a8f4", "comment": "Malware payload (Mirai)", "value": "2805e708de60f0da1b2ca8c7405f077b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388402, "uuid": "28bef1fb-d5fa-4048-90b2-264d708ad478", "comment": "Malware payload (Mirai)", "value": "36b4d86056f0ae81f36c418d264cc1e549d13aa376e11fce189e77cc0001d086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388402, "uuid": "344be369-8803-4a93-9eb2-a83029669216", "comment": "Malware payload (Mirai)", "value": "087c70ffb6074ab89dc9f0faf6bafa8899cade4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388402, "uuid": "cb5dfdb6-f65e-4d8f-b737-edafb5e830ac", "comment": "Malware payload (Mirai)", "value": "e9fdd07e1f9fdea5076d3b38d7b47be742255fcbf063bd68b3dbf63ad78e4171155f9b17edcdb1e5c1426b1a3c8e8c07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388402, "uuid": "c89ab4da-28c7-44ab-9429-4b38378a659b", "value": "T102231942312C0E5BC6A25AB0253F17E0C3FFF9A060F4BA89655F9B568675E371182F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388402, "uuid": "79075970-f60c-4dda-86f7-fbb11facd57c", "value": "768:cMONjlFgTJ17LhYWbFIhMERs6RJVGXXlmH53Fo/s8lbhYJARQc:M7gl17LqIAP5mmH5u+Aic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388402, "uuid": "16bcc61f-77f3-45c5-a1ea-01edd615864e", "value": 45988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388402, "uuid": "fcc38acd-3f7d-4d25-916f-b815b21224b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388402, "uuid": "6270ec4d-3bdf-48de-b11d-2db53a440d77", "value": "2805e708de60f0da1b2ca8c7405f077b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae22d90-fe53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685387162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387162, "uuid": "d771e308-66ee-4745-9c2d-4c00469ed524", "comment": "Malware payload (Mirai)", "value": "0c253c98afec02822427ee57937f4591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387162, "uuid": "b78bcf6d-6ef2-4216-80a3-67d260fcdc95", "comment": "Malware payload (Mirai)", "value": "37c86a63067a1b8c5651b1328f1d9b8254967d782a3c7293b9e2e3e183097e51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387162, "uuid": "5705452e-485e-4393-9d7d-8aff0d133300", "comment": "Malware payload (Mirai)", "value": "eea05a4dc25295f655273d1c8133594b7ba01bce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387162, "uuid": "f8fdd738-1458-49eb-9214-609569fb970c", "comment": "Malware payload (Mirai)", "value": "253a0cde6190f08fdde5f486adf00d1b00735ce1d990dd3ab73b71dfddc7fb8d940d248a884f50ce84078b4a85ec6591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387162, "uuid": "befd6e66-2ed9-4d5f-84fe-160d71d1865f", "value": "T1E6936AC5BA83D4F1ED5704B55137A7379733E439602AEB42C329AD36ECA3900DA1A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387162, "uuid": "56cf5f4c-af48-40f3-8e56-ec0bb2d32f35", "value": "1536:uDYL14N+OYxC3cj+6q3KicThx7N1mOA/SwKeG:WYLg+OYYsi6q3K7TbRm6eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387162, "uuid": "8c604c66-61d7-4add-9177-d98c9d2da12f", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387162, "uuid": "d61b367a-9d27-4099-b223-3f8c9a867949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387162, "uuid": "2e50f1be-cca6-462e-90b0-0c438e09d3a3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67309dff-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379667, "uuid": "3ba0e2c2-dc62-489c-811a-4569083ff43b", "comment": "Malware payload (Mirai)", "value": "6c0157a61df572c73286605e3f70f14e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379667, "uuid": "442d8f31-8fd3-4f9e-9c3f-48ed29b0797b", "comment": "Malware payload (Mirai)", "value": "3878c1453f82aa67da87962c5472a75a1ad5b39ac22820cabad08919d8c2e134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379667, "uuid": "92ac346d-0271-4358-9f10-7f853b23d577", "comment": "Malware payload (Mirai)", "value": "49e2cbb9c0ceb73bbc2a8656cca2c46f14e3edf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379667, "uuid": "e5bb84a6-ed48-4bbe-8fdc-e4a71038dba3", "comment": "Malware payload (Mirai)", "value": "0037b16e029a6989bb1fc47b5366bb9b2cf6dde19fe3a70eca4b5ea45e32973029975d6e7a7f08b223dd7d34c31b0053", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379667, "uuid": "b111e8d6-9ab5-4f7e-87a0-9c020ee64eac", "value": "T17DD3E730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379667, "uuid": "b08c11f3-abe0-4167-afbf-705123ac0661", "value": "3072:+DShVLkDZ6waCAdclCbYJOmP46aQyfPluesNb:VhVeZ6zclCboOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379667, "uuid": "d44047ae-d8d7-49a9-a8d5-c6cc748b4e5d", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379667, "uuid": "3c223ba3-10cd-4e66-be5e-90ad66889f29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379667, "uuid": "c7cc369b-3d33-4af7-bcb1-1bf26d3860be", "value": "6c0157a61df572c73286605e3f70f14e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e8a400-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365327, "uuid": "d05f8eb3-2767-4ddd-91d8-7ab5c2994948", "comment": "Malware payload (Mirai)", "value": "c57858fa5408ee7f396f67c03d591d1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365327, "uuid": "0ef03a6f-c5e6-4103-9992-a9d823141c26", "comment": "Malware payload (Mirai)", "value": "39b8b317ff748632fedcfaf526520a340c70122d84e01f6bab0d80782e11b2e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365327, "uuid": "3fefd232-8b24-4b5c-97d7-c559b3efddab", "comment": "Malware payload (Mirai)", "value": "58e58fbcfb48ae7dcc32cfbce80f263055543560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365327, "uuid": "10880c5e-8962-4861-b1cb-edf315ea00a7", "comment": "Malware payload (Mirai)", "value": "efa7aa23f42cb700b470772b150636e82f29e421f08433da6f0a70e7f23683ccd6a22ab56cbf448cd12abcceca9774b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365327, "uuid": "1ce62f7c-78fd-489f-bbbb-024baa8f813f", "value": "T18DD3E71A3B218FBDF19EC63547F34E3086A866D217E28145E1ADDF502F203896C5FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365327, "uuid": "c1c23f05-bbbd-4dfe-8f5b-e7b596dad8aa", "value": "3072:YuflP3FfYo0jZspZXz2e0peakyZZZZZZeZZZZLUpmrZTqhnmMBiwhpnB:YmlP3Ff2yZj2vpKgmMiwhpnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365327, "uuid": "3f716af8-be2a-4c69-beb7-284c8864de17", "value": 130862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365327, "uuid": "1d46cf22-504b-4fa9-a3db-97944b1e5663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365327, "uuid": "4f754751-6ed5-4654-b1d2-c15905db733b", "value": "c57858fa5408ee7f396f67c03d591d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee400d9-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376754, "uuid": "dbfdb2bc-ef24-46c5-b44d-7bd6a00f36e1", "comment": "Malware payload (Mirai)", "value": "7565678302b68c9268f7a3113ac94749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376754, "uuid": "1cb9f1d3-5e2d-4987-9365-4e2bb2b00d7f", "comment": "Malware payload (Mirai)", "value": "3addc860595171e2f42355f5444e8cf6354aa58c9565579fa92ec005d636c422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376754, "uuid": "733be069-b7c6-4b0f-b925-2211cd69eec8", "comment": "Malware payload (Mirai)", "value": "ac5a238ddfb1d0502ab84a65c8fd6e19a26e8381", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376754, "uuid": "d5a591e5-e56f-4645-8a47-08e2b0cbf261", "comment": "Malware payload (Mirai)", "value": "c4aaa144a85330b786ddc47cfc5f0c13fb9b642c3137b0b5f721e4416957b86af776542b3189718b881801fd5b284e1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376754, "uuid": "607a4a8c-6f10-468b-bb1b-0b609b1aeae1", "value": "T1F6330A9AB8029D3CF90FE6BE54164E0DB93177C152830B2767BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376754, "uuid": "8e97d854-b526-4342-b2cd-ddb68111c784", "value": "768:YBCP9hTzoEWRcqOCLuwUBmoe+Tm806Msq3zMHQXOXrupiQG1:jX5qCwimoeqm806M9MHQX2rui1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376754, "uuid": "d26a37fd-5a74-49ad-ad85-1dd30a62c69a", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376754, "uuid": "90c9e4d6-2076-456c-8f4a-4a0f607577f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376754, "uuid": "cf5d078a-9aaa-4988-946e-765b31d49930", "value": "7565678302b68c9268f7a3113ac94749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea14c22-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346635, "uuid": "df43c884-1ea7-4008-ae06-06b18fb1b425", "comment": "Malware payload (Amadey)", "value": "7b8eef96656ad1a2ba31c7cd9772ca38", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346635, "uuid": "2f07586a-5543-438b-b854-86e495e448c6", "comment": "Malware payload (Amadey)", "value": "3aee073a4daf0f2236ce3d3b82fa634b6aa6a0a2796fce9f9c73f6109a83e367", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346635, "uuid": "b3bb06c0-9dde-488a-bfa6-049ec251fb6b", "comment": "Malware payload (Amadey)", "value": "0064f47ea8500602d83c71f5541581cdcdd79f0c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346635, "uuid": "7a6745f0-a347-44b8-8bd0-8100ede67444", "comment": "Malware payload (Amadey)", "value": "d8c89e15449bfeab7a95b78a0c61f0decca61edcd0d2c73d7ede7818d831318ac190ade3d333fea964df8bc28e7f7491", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346635, "uuid": "e8ce6609-4a16-43ed-9727-44d9296f0c65", "value": "T1A4052263ABD98472E8E4677059FA03930B317D819E78433B7B8A255A1C73BC46632377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346635, "uuid": "9fd4f1e1-ff22-42c2-9c82-cf121fbb4904", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346635, "uuid": "5d6a9b81-6cb9-4b34-b045-d179377b1202", "value": "12288:+MrAy90B9MlIBLUxaIiiBe9t1zYOJoDEUVM49VwFbuYgGwv8uUkRpxZ3qfjmv8IO:qyMQei49U3gUVfSbfvwvRUaZSZD/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346635, "uuid": "ac62cf3a-6d2e-4a3a-baba-eb3be4960f64", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346635, "uuid": "f716f070-4dfd-4174-a192-c4f10efdf015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346635, "uuid": "a70250c9-36dc-44b3-ba5e-a19e2e51c917", "value": "7b8eef96656ad1a2ba31c7cd9772ca38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c28709-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685348447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348447, "uuid": "524f766f-a988-4578-9f0a-008a4f16e63e", "comment": "Malware payload (Amadey)", "value": "c6b91ff8745691e8f382f4d44fa64bf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348447, "uuid": "a69a2dc5-0b59-4d44-858d-428e788bc894", "comment": "Malware payload (Amadey)", "value": "3b28a1a02b86837e7e951ee2862634f921e9be6089ce542eaf4b2a1652c8e7bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348447, "uuid": "1a65f37c-ac4f-4d73-a433-16d75acad477", "comment": "Malware payload (Amadey)", "value": "719cb70116b636f18e54bfb7b293ba9525f5717d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348447, "uuid": "abb6f9bf-04ae-427a-a136-a0a8970a9289", "comment": "Malware payload (Amadey)", "value": "46615bbf4ccf3bf311652104f57f6f343d94873158cec5fe5eb389747803635745c7a1a4686980be016e7fb65f572030", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348447, "uuid": "045226fd-c309-40d0-b4be-e4bede544db9", "value": "T1BF352353A6D84036EEB627301CF606C30A3EFDA39C75865B2B996D8A1E731C051727B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348447, "uuid": "a970537e-9e08-42db-a55c-85ba661157a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348447, "uuid": "92d66798-3a26-4f38-853f-c5b35b7154f3", "value": "24576:Cy6BM/x6OAdGmCmfYWI9OQyMIwMAv/7imPh1Pbn4vRtP:p6BMsOmOWI9lyavHHX4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348447, "uuid": "a7f915b8-2996-46a7-adf4-51041aa0a485", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348447, "uuid": "e0cc1869-87b3-4c74-9274-49240d21c2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348447, "uuid": "2476a409-eb08-4eef-9eb7-15f2f0d1842e", "value": "02069499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f0a236-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388410, "uuid": "0fc1c4d9-3d41-4c72-8ae7-d72ae7819dde", "comment": "Malware payload (Mirai)", "value": "6eed4d61c1e9e7ead0d882d10dc686b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388410, "uuid": "5acda422-ad5f-4ee7-ab74-25af1fc62116", "comment": "Malware payload (Mirai)", "value": "3b38e4e6777d4ed566ba83460cf5f79c8013b5530d36450abbbe3bc80dab5406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388410, "uuid": "f961617a-66c4-4b97-bc3f-9fc7f33a01b6", "comment": "Malware payload (Mirai)", "value": "406ae39b91d7c6da5b5d847d2d9ab9fe70646081", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388410, "uuid": "4f2200d5-4163-4c59-80d2-8015eccb7740", "comment": "Malware payload (Mirai)", "value": "190cc5f8d5c987c18d36ba6443b525adfbff99baf07f2b976e5dd0c4465f3193a0834a7315c70da157f60f7d3fbb9d40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388410, "uuid": "a688ee2f-e4c8-4b81-8d3d-86661f43916a", "value": "T13AD30845FC515B23C6C612BBFB5E428D7B2A1768D3EE720399256F60378B85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388410, "uuid": "4b7585d7-54c7-44cf-95b4-c6270f2b42eb", "value": "1536:PUue3zAfaCxQFwAxpF4VA0qYTPC1Y2ANHjqKVT89XlPYwywxiCEjS6KcQrJ58n5C:PUirSFwK4NdTC1Y2ixVo6WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388410, "uuid": "eb914d9f-86f0-4ccf-aaed-0f6fea0b4fd1", "value": 130060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388410, "uuid": "8c5e1816-f93c-480f-9fb2-6a0d79ae487d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388410, "uuid": "06178b95-4a06-4a23-aa28-3ab8cc2aba00", "value": "6eed4d61c1e9e7ead0d882d10dc686b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810a9723-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685348357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348357, "uuid": "2fc14923-03af-4273-ad8d-6831074cf1f3", "comment": "Malware payload", "value": "f58c019c6ba8357a34c3d7d5ce98225a", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348357, "uuid": "3df1e9bb-66c6-475b-be1e-95334fa2f5f4", "comment": "Malware payload", "value": "3b4c5a368f2dbf8bda76ee169d59a1ad10172b15fb7ce6e0ae5588f6e1e6b628", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348357, "uuid": "060e8adb-c238-46af-97f6-aae97126e2f1", "comment": "Malware payload", "value": "66ef581445017549b80c94806d851eb19eb90b97", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348357, "uuid": "380a6cd4-14f4-429e-ba62-ef94fb21ffa0", "comment": "Malware payload", "value": "7ec5d3669fbe2976f7a47f9c73ec6cbbe0463b0a6bad87894a91a3c19b26d0efcdd40c8eca6b00bbc814aa6afd851aea", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348357, "uuid": "1308b1b3-32ac-43ca-bf72-fc6825501367", "value": "T15CB61301FAF80269E163967D95B29E15D1B27C451B30CECF0201A67A1E77BD6CD3AB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348357, "uuid": "fa5b1d4e-77c7-42c3-9046-f1d544cef3c3", "value": "196608:4fiahxH06GP6M21U/M3mYQ/nChxMrZ0UCu5lO/K8M9zX2l:CBQP6ZVmmxMGUCu5LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348357, "uuid": "9f52294e-0fe3-414e-b6fb-48ca6abc5f00", "value": 10670080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348357, "uuid": "612151aa-fa9c-4ae1-8352-b2cbc54a156d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348357, "uuid": "b84edc34-ea7a-49e4-9f15-0221fec791bf", "value": "01498399.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d504905-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362443, "uuid": "7c57c166-5b9c-411f-8f45-0dcc3b7cdaf2", "comment": "Malware payload (Mirai)", "value": "f3d15cb032d0cc670f27ac0ed66b5913", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362443, "uuid": "0a67d4e7-2d37-4ad4-a43a-c80b730c0de8", "comment": "Malware payload (Mirai)", "value": "3c7107348dee3145716c945427f5c8c734741e9aec312887037de1fc53c42467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362443, "uuid": "9a927e8a-47cc-4e4a-910a-f3e92f4525f7", "comment": "Malware payload (Mirai)", "value": "439396f93943bddfd44aaab2f83226401a62b723", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362443, "uuid": "6f2b40b4-fb9a-4f99-bedc-c3f29bc163a1", "comment": "Malware payload (Mirai)", "value": "74a47b9b22b6b5a3a6619d0fb5681866505cd6666270d51458d50e0350f5ba5a6cb8fadcc0bb2e540fb4a09feb29dbc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362443, "uuid": "cdeb1009-2b9b-448a-b13a-4a263b55355c", "value": "T18F534A217A792E17C4E4A07E25B38324B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362443, "uuid": "3cbc59f6-fb2e-464d-8101-b833e13be5e8", "value": "1536:IDK6bb9lTEFq1X6JySbe7M/Tbrv0kvVpdYm+A:mKQ27be7M/Tc0VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362443, "uuid": "a64b3b31-c15d-4da1-a3af-daf42ecd4b8c", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362443, "uuid": "bc9e2887-e7d8-450e-a950-5edcf794fd5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362443, "uuid": "825c124f-a239-41ec-b48b-f90a86363ed7", "value": "f3d15cb032d0cc670f27ac0ed66b5913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a70607-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685347229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685347229, "uuid": "5b319be5-a0c2-48e8-a76b-9e53a3183cc8", "comment": "Malware payload (RedLineStealer)", "value": "c2ac912109144bd3df4b41a3e4789625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685347229, "uuid": "7e82b1d7-8f0e-4a3f-a99c-6590edc6f095", "comment": "Malware payload (RedLineStealer)", "value": "3d365be8935c913264c63da617ba41a53d112903741c54d65c1c2c697d49a7f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685347229, "uuid": "c9697eb0-7d5e-48e2-97ab-a7fcd83993a6", "comment": "Malware payload (RedLineStealer)", "value": "2fbe8e08db3de3daedd108d01d1de12879d403c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685347229, "uuid": "2edd881e-a857-4721-a7c4-b830f5c310c9", "comment": "Malware payload (RedLineStealer)", "value": "4c1e6b73d024ec95e4eb8f29ba4bd3349e773643ab441304500a690a2fc79b269639f05035ab119a5399f98305b93ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685347229, "uuid": "10376472-3f95-4197-b838-1145ee91cffd", "value": "T150052302A6E99473D9B81B306CF30787263BBDB19874C39B77463C4A1DB3A94A432357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685347229, "uuid": "315ddcd9-dbfc-40c4-8a6d-cccdf90afa41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685347229, "uuid": "7f599024-5997-4e29-b5bd-7ab2bd8d5d6e", "value": "12288:ZMrry90N4Z85Sn+UFh8ko1siEXqAR6ZuuyVtjhIfffheM8neEQ3US0uQl:6y0fSVMC6VhyS5exnP6USGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685347229, "uuid": "8f57c253-9018-44bf-8922-34163f2229d4", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685347229, "uuid": "d17b85dc-08af-4d5a-9903-15abc0fce064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685347229, "uuid": "7c161b84-dc48-4b04-9b2a-b28395ecb127", "value": "c2ac912109144bd3df4b41a3e4789625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878606c2-fe77-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685402484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402484, "uuid": "8e793954-a70e-48f8-a171-b61969bb640b", "comment": "Malware payload", "value": "ae606faf2a7bb702cc38fb678e37bcf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402484, "uuid": "87faf20a-a5dd-4c51-b274-5ea751b33d99", "comment": "Malware payload", "value": "3dd6f0a5463af8d67769e1ab11ce51ce0d4dbd6ded93f9e59a751ddb94d3eb4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402484, "uuid": "00f536a4-7ed7-4e9c-8319-abc17ff59bcd", "comment": "Malware payload", "value": "67105be7c6a87a666a14e2328fe826657bfb6897", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685402484, "uuid": "4b6f7349-f944-4474-b3d9-8015db23f4d8", "comment": "Malware payload", "value": "892134086d6d62e0fe822b4b8a4b580265804363f829f8a4e55787ede59c3d2fbca20c864ea22d93f3be0a7b34cecf64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402484, "uuid": "df1b6c49-6f45-4ec6-aef1-d740ff625773", "value": "T1B8F41247A7DC5132E8642BF008F616470B3E7CD04975A76B3789A92E0DB3794A4B33A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402484, "uuid": "93f0ac0b-36dc-4f07-b8f1-aa7d3fd6c263", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402484, "uuid": "f2ab8374-1521-4c60-8682-b22950d4b8ad", "value": "12288:+MrEy90tLIYRrv7r3UZf91hxs87Uz3wrv7+81XcmdtF0jnBNHebHw4pR7U3OBU/:mylu7rEZfThxsAUTwrxJ4BN+bJ7nBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685402484, "uuid": "a2748826-9116-4e86-8d69-c6b93cdce57d", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685402484, "uuid": "a77a8694-f581-4493-9a9d-ac034d23a975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685402484, "uuid": "5fbac922-fdbc-44d1-bc58-c9c4241d39b0", "value": "ae606faf2a7bb702cc38fb678e37bcf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e7878c-fe30-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685372012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372012, "uuid": "ba146dc9-3599-4295-a669-9ba897d73144", "comment": "Malware payload (Smoke Loader)", "value": "ea4f425777a2eb1cc31cda3748bf5373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372012, "uuid": "271194ee-86ca-4845-b20f-b00ba2abf94e", "comment": "Malware payload (Smoke Loader)", "value": "3e1b698626a7363a16f4c6c7aae8e5cad191be0ffb9c501c455abc259913655c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372012, "uuid": "567b2436-18d3-4c9f-8ce9-9c00936ffaac", "comment": "Malware payload (Smoke Loader)", "value": "82e51948c957dc0634a9da1c17b0723151f6f602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372012, "uuid": "f98a7be8-fa1d-4ba1-9a49-02c7fc8c81e5", "comment": "Malware payload (Smoke Loader)", "value": "d7cca6464faba77c4e26f8a6f5727d4b15ca01727aa43b35066065427b0aa99a4fb6ca50f7afcf2ed01c3b3d0ffca44d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372012, "uuid": "d3699a50-9b20-4567-84b6-630b8b2e3247", "value": "T1AA643A1362917C60FE264A319E2EC6F87A1EF9508F5977A713189E2F48732E2D572331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372012, "uuid": "728164f7-34ff-4be4-88f1-53cd2c652bc0", "value": "0a261f793955a0334411687f62dd4035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372012, "uuid": "d2ad4d82-c69d-4f77-a758-7971060b0af4", "value": "3072:tyKL8GYbyR65qBF0Mw3h/D6HDU16mDAlRx7SvPcU+hp8+FvW6CCfpT:lLjup5rR/D6jU0mDAlRx7HvFOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685372012, "uuid": "a26043f0-7886-41bb-be24-28867299caac", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685372012, "uuid": "d899e9e3-1efe-43f5-9f04-3ca9f0fd178e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372012, "uuid": "c8eea0f1-ffb8-493a-a7eb-a16800303e3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a81495-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377166, "uuid": "6c10a80b-27b3-4e58-a1ff-c137ed9515a3", "comment": "Malware payload (Gafgyt)", "value": "720e78daf3dbbc7d9772bdf74e230ce5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377166, "uuid": "45ca582e-6e53-49ec-9077-ebea85f96f1b", "comment": "Malware payload (Gafgyt)", "value": "3e4517ddcc484746028b151ab1534ed2e52e4eb9bc0f2128b03a9fb8008602dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377166, "uuid": "e9eaf9f1-b311-4396-b529-f7ed3d5ec23a", "comment": "Malware payload (Gafgyt)", "value": "a51b00711438a0b59a6f97ace3e48d21d5ee45bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377166, "uuid": "3ebc265a-40ce-4e6c-8273-418e8dec1321", "comment": "Malware payload (Gafgyt)", "value": "bb007021e1e6914eda7730b9d6dbbec549f0f45d1263b369f1be607cacc1c86dce9cd1c623de3f969976739d6f27cd31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377166, "uuid": "ff30dbd6-a104-48fd-80b1-59d180cf91a7", "value": "T10FC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377166, "uuid": "f0e9c287-c5a7-4071-959a-61f0cb468c3d", "value": "3072:H63VpNeuWDGeQf8sRC3t3DxkS2YmyVUQuiXfQd6W:OSuWQEcC3t3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377166, "uuid": "94f57026-98fe-4d60-98e1-f69e2b704ef7", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377166, "uuid": "104e3e38-7744-41a9-a060-3e48392ac0db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377166, "uuid": "4c6b4d01-bcd5-488f-98ca-f933f774a31c", "value": "720e78daf3dbbc7d9772bdf74e230ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76962a82-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346621, "uuid": "71ba5e4f-712c-4d8b-bbe1-db6177b22596", "comment": "Malware payload (RedLineStealer)", "value": "55c3c2af022a1ef1167bb3a097495667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346621, "uuid": "220137e0-1e28-4043-98d5-778a9c5441b2", "comment": "Malware payload (RedLineStealer)", "value": "3e4d9d44aa2f9a5fd8cbeaaed653e362865f857a201bef04f625f7f2a951b1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346621, "uuid": "c0380d84-4b38-40f9-be4c-8c0b1722e488", "comment": "Malware payload (RedLineStealer)", "value": "30f78e8e774d8a99d97e2665cf6bbeb7a74a95af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346621, "uuid": "57e12c2c-9583-433a-be34-f4851c0a3969", "comment": "Malware payload (RedLineStealer)", "value": "cdc008529f8969697aac72eac4eccc23506640c04415d841c55dbe451f17e56a1e31b62e89e5e8dbfba0b710c2fa9304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346621, "uuid": "6f6766fc-510d-4552-9a82-9ab0cfc3c27e", "value": "T12E052241B2E44473EEB82BF04DF607871F3ABCA15A74965B0388995B1C712D2B5B1B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346621, "uuid": "c0349815-7e7a-4703-901a-e6adb1bd14a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346621, "uuid": "728d1610-c6b4-4eeb-96a9-aac2ca3f9c61", "value": "12288:NMrNy90xJxVNVEqdaCCSakC0aWaOVKyxpL4LOoZHATbAoe+ib4y+mLuRjHRJJh9b:Ay0jNyJSalFiY86LOl5el+DR1JJbsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346621, "uuid": "1a528290-2daf-4649-896e-760b7bfee1aa", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346621, "uuid": "0809c652-b859-4466-a1ce-0a32a2b69bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346621, "uuid": "2a3ce4db-4aa8-4a49-b1d5-92c7644054be", "value": "55c3c2af022a1ef1167bb3a097495667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135ae4ed-fdf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685345596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345596, "uuid": "aba1c42f-1e71-4732-8c3c-9e1541d62c2b", "comment": "Malware payload", "value": "c0871f07733a3727e82c64aacda9a85b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345596, "uuid": "f3890c6f-14d9-402b-b015-7147a9d43005", "comment": "Malware payload", "value": "3eafb742af9d3a8bbbe4bd90b19d175ea4b698505cc5623594d0f13ba883692e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345596, "uuid": "66c7a60e-1faa-4653-9b79-793a53bed7bd", "comment": "Malware payload", "value": "bf364b5b56ee65351a0bc5bca249ddeed5705e76", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345596, "uuid": "55c5879f-f9b2-4354-b720-67ae9811b0be", "comment": "Malware payload", "value": "cc4e13521240ddb60f851b1063016f41ba115e5e6d5d5b7d253045ca59ae06f1879cfdf41d3fecca3e138bfbff59324c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345596, "uuid": "0c24586a-dac8-4b0e-868e-3a714a533c9f", "value": "T124049F0267EB8348F1F26A58867B0532163BBE55A93EC35D059D214D5BF390884BBFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345596, "uuid": "4a68f949-50bc-473a-9c17-91b4a6b1bafd", "value": "3072:zbT1AJM/EaZ8ok36/EI4+ZQSU2bokXPXliq3kJIAsKLfbT1AJM/EaZ8ok36/EI4c:zbZ0M/EaZ8ok36RftbokX0bZ0M/EaZ8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685345596, "uuid": "e2947597-765a-4f93-9ece-173991a41645", "value": 173550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685345596, "uuid": "73cb5455-4d96-4b1e-b7ab-9b6421013ef2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345596, "uuid": "d5924ee6-1e14-4914-bcbe-a7722e3662c0", "value": "Pagamento.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4772d8d2-fe39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685375748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375748, "uuid": "0f39c5d3-1aab-4f5c-87fd-84177ca0864c", "comment": "Malware payload (GuLoader)", "value": "569e490823a7e71eb59d866b131942e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375748, "uuid": "6ae71e0b-1c2e-44f8-b7c0-bb8560234e54", "comment": "Malware payload (GuLoader)", "value": "3ed33be126e5b2ad5120ae735d700ccb288e595db714eb90bfbba357c637aa9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375748, "uuid": "c7a07a19-5ddd-455e-9c37-7bf30a2da6e0", "comment": "Malware payload (GuLoader)", "value": "c96883891a963632c6ad4f78b65346e923615a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375748, "uuid": "86d914c4-7904-484c-b7c4-50831630f81b", "comment": "Malware payload (GuLoader)", "value": "adca2a8b64dfc414976cb555c30bf23890d19b1d3369c2e0cf49124ecc79175d4dd8a5a2d5ea44a02d628afb4e6005ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375748, "uuid": "a1a4c2ac-26c9-4e12-bda9-eee3a3342790", "value": "T187D4AF93B7074177E808B932B33B4BE369B21A8F93E541BA2151F63C51726711EDF226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375748, "uuid": "7f7d34db-a4dd-4ca9-be02-106cb82e7782", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375748, "uuid": "90375b70-0bb1-4a89-80d1-cfb09cc6da24", "value": "12288:Uoqqqqqqqqqqqqqqqqqqqqq0qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqm:U12neJgWY+WQVcsYgsy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685375748, "uuid": "1601d746-ee13-40bc-8c7b-180415e66dcf", "value": 641272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685375748, "uuid": "022a932c-060e-4728-9bc9-a611ad770539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375748, "uuid": "9a12464a-885c-42b5-aa92-df9d380908d7", "value": "z1INV-01182023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5265ba6e-fdec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685342695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685342695, "uuid": "5d0c4f0f-611c-4a9d-af41-73b16d1e55eb", "comment": "Malware payload", "value": "2649a0cdd385220ace4898e1f3f5b377", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685342695, "uuid": "c28c74f6-3694-4d73-be51-74d9f3113bb1", "comment": "Malware payload", "value": "3f092421ded47e51764275f6267cd92ee66063d3d4b8695a4b917a1c59fbf69a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685342695, "uuid": "49e47622-9bf2-4417-84c4-a1c2db94f385", "comment": "Malware payload", "value": "8bd1c77e03f04300e62db57763baeaae05dc7d53", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685342695, "uuid": "539fc499-4344-454c-a47c-645a59a547aa", "comment": "Malware payload", "value": "24354d944f2f71f35029b3dc491c8009766d2d8f79152d3b3e09d02d4479368df8cc21c3ea0b52a45ba9edd292c7de43", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685342695, "uuid": "f79cc414-e474-41c9-9537-97f5cac8584f", "value": "T1AFB2F2566B8C4C61E26AE87B835EE00E08BCF63631C245D5BD9DE2717B3D14E0B671B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685342695, "uuid": "5d36bd58-0dbd-40cf-b1fa-a894e94dfc08", "value": "768:NL4dQjZbIs8XLKl/bWQrabnOEwEIr8jVHGHYc7Pyk16sS5:tttbIs8XsDFkOE7AFPyAXS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685342695, "uuid": "7f067ebd-e733-496b-b91a-733ac46cb4b9", "value": 25102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685342695, "uuid": "b7bab316-01ed-43d8-afa3-049e095fc022", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685342695, "uuid": "20326357-3622-4ae4-ae20-7be17b04e5d2", "value": "2649a0cdd385220ace4898e1f3f5b377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a3819b-fe36-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374341, "uuid": "57a2e265-1e2b-46b9-837c-a326a3d970f1", "comment": "Malware payload (Mirai)", "value": "dab8cb60c4e152a6c80e0304e4b6e6d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374341, "uuid": "c3b36231-c8e7-4197-9dd1-911f6c9a675e", "comment": "Malware payload (Mirai)", "value": "3fde4a20053b0c9cfe75ab7402801f0e7667d970e29e63706061398c733786f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374341, "uuid": "a8ba4efa-40bb-4b49-8e55-1120a70e6444", "comment": "Malware payload (Mirai)", "value": "7867228e3f2adcf620a9c9a1c9c27956808b1da5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374341, "uuid": "0d65a7a0-da94-4ff0-8987-b276dd9d5e12", "comment": "Malware payload (Mirai)", "value": "868eabd825fe58449ce8877d528fc7ee889e24892c174edd9d84c980adbd84bc4c0a957db3fed2079f9e151a73277c60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374341, "uuid": "a0d391c3-a21b-4d18-b2cf-13a1d884ab53", "value": "T16C735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374341, "uuid": "f76d8e7d-040d-464f-b40e-6a572e6f4a14", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws81:YwfdNu4cmZvFqI3w71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374341, "uuid": "01dfcc1c-0dc2-4d5d-8d66-e5e6e8ba52e9", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374341, "uuid": "0b11fcbc-360c-48e4-8e63-d70d1dd6a22a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374341, "uuid": "5fd25f4f-37f6-4412-b3fd-b10a325d613f", "value": "dab8cb60c4e152a6c80e0304e4b6e6d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1310194-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371603, "uuid": "2ec1dde4-267f-4a90-8586-6cc9796f69fb", "comment": "Malware payload (Mirai)", "value": "023bee700ae0f82842730ea343b6865e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371603, "uuid": "aae76938-11ad-4003-b258-c090a26dba18", "comment": "Malware payload (Mirai)", "value": "40ec9c069c377d5c26db4132d8472a22f5bdbf147aecc441f4c72f4b6147a944", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371603, "uuid": "e30cab16-26a3-4ea2-8373-c7450e002e97", "comment": "Malware payload (Mirai)", "value": "f08d6e499b1951df45c315996d4fa5e4a232ef0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371603, "uuid": "e6a9a043-73b3-4b30-a812-ab99b496deec", "comment": "Malware payload (Mirai)", "value": "97b7bbb74212d487ab1d54bc022a27d56056f73fcde3ceef586950cfbfcf25dfa0f7ab543921c8f80fcc398493107863", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371603, "uuid": "fb7f159c-1722-4399-9de9-4da5b28c5a91", "value": "T1A0E2F19CDE0BDF14D286A6B2094239281B77F56D0143FBCABD184B62B1722DA93B4F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371603, "uuid": "e91eaf1d-095b-44be-b2a3-cd916c86b8e9", "value": "768:svGt6GF3pJKN98wfxFGaGbT+7u7LqZMNonf:FXF3ON9bFIbS7ALvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371603, "uuid": "d4143a23-5fc9-4c9f-9e36-d3985392a968", "value": 32736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371603, "uuid": "94d08c5a-adda-4ffd-9a91-f1505fb02547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371603, "uuid": "10d5724e-12a7-49dc-adca-cdf0b9923fef", "value": "023bee700ae0f82842730ea343b6865e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8209507b-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376705, "uuid": "3bb82b30-2b81-49c5-82ad-181506680a36", "comment": "Malware payload (Mirai)", "value": "33f14a1c61360b6fc1149e3871809f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376705, "uuid": "b4be0285-e9d8-40dd-a5fc-3a31a8ac1a73", "comment": "Malware payload (Mirai)", "value": "4104f74e940338379deac6fa0bff564e01a16b0a792ccf6ec39ee880ccad298e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376705, "uuid": "cde963b7-533d-4a08-945f-65ef0133b713", "comment": "Malware payload (Mirai)", "value": "3f315a9ba6b1d6590b1e3304e6c8ed52bf26ab40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376705, "uuid": "d3d5f1e1-9bac-4e25-b352-cb4f091254df", "comment": "Malware payload (Mirai)", "value": "7965e4966c0ff3292505afa6e7929b8adc9f88a3f32ccc8394710f66141190166ef09591a5e158540b86a4701750527a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376705, "uuid": "2332532a-bb26-49cf-b8b1-9627806f0fb8", "value": "T1F5B339376251C97AC08342F526EBD5729C13BDBF0732229A33947D60AF368DA1E99F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376705, "uuid": "618be3d0-4beb-4f4f-b4af-840eeef0ca93", "value": "3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJiouz2yd1m7FnVqfJXoebNb:SKo/O8qtUbK5bm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376705, "uuid": "b56a44d3-0859-4fff-9fef-0babc5b750e1", "value": 116760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376705, "uuid": "b95e6c5f-6e52-477b-9cfc-cbd5cc899acb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376705, "uuid": "f0a06ef3-6d41-4ea7-ad69-94eecae8d228", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26db19d2-fe10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685358084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685358084, "uuid": "26f7ab45-9f44-4ed5-837f-df95b32b5fa7", "comment": "Malware payload (RedLineStealer)", "value": "696e4a7c4724ae69c9a8c609682f2ec3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685358084, "uuid": "bcaae45a-b070-4481-b8da-9e838a254ecb", "comment": "Malware payload (RedLineStealer)", "value": "4148b06748f8f1e0c1ac90119f7e9f4074dee46df74be7c8d64fe9a9285c59c4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685358084, "uuid": "5805ece2-c71a-42c1-a1e6-2187cd7df37a", "comment": "Malware payload (RedLineStealer)", "value": "47aabe797e34896fe52e200e418aebf0ae4704b6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685358084, "uuid": "b36cc2bb-8b13-4efe-8324-b3ba606d797f", "comment": "Malware payload (RedLineStealer)", "value": "58c34662fad4929c2bce97d95b2a5876e6a79195a6f3b015df770d19aa5e9830f2f1af41d062fafc2ae23e8826207380", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685358084, "uuid": "f41c9637-6f08-4938-8e61-ff44c2cf04c8", "value": "T19216331A3A1C566EC92FEC64781E036FA9891CCDC5C041AE4FED253B6B85C8D83C6DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685358084, "uuid": "20583891-bb4d-4bdc-913a-d4d3bd8b791a", "value": "98304:aKLXzyBpoY5hC97QaF5hAjFjDIzyBpd97QaF5hAjFjDI7:aKLjkCY5kbYizkhbYi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685358084, "uuid": "4a1f1595-6b53-4d82-ae94-e49436f0c359", "value": 4054604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685358084, "uuid": "da47f084-3d75-4334-9b9a-a0244504e52e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685358084, "uuid": "0a5afe6e-6174-4cdd-9f9c-a31e5ca7ac4c", "value": "696e4a7c_4148b06748f8f1e0c1ac90119f7e9f4074dee46df74be7c8d64fe9a9285c59c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ea5001-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388441, "uuid": "6f456fb1-593d-4698-b0b4-4878d0a4599f", "comment": "Malware payload (Mirai)", "value": "dd583ba00a3285c177ef9def788927a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388441, "uuid": "64458ead-b318-43b0-9a2d-14ce59ecced9", "comment": "Malware payload (Mirai)", "value": "41530dcdd76fe82c91a8e0c8e7bab5284a30db3bbc02d94eb6b702514c124723", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388441, "uuid": "4c05b0a0-2c8e-4b8e-9eb7-2b556c0fd88e", "comment": "Malware payload (Mirai)", "value": "5173d5cef262d16853db54e8cef5beea403c0eab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388441, "uuid": "a4426a80-73ae-4080-be03-f5965c5cfa7e", "comment": "Malware payload (Mirai)", "value": "ae596b3cccc42c3fbc78649416bca9e415c2626bea2ccf35dfa7370ee841af402f1b188db85b0badf0c7ef8e11b3770d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388441, "uuid": "58b7756c-9861-4dfd-8c1c-c47ed5307937", "value": "T1F3A2C191D194C5A4FFB6FEF3CBE6F2C13EE01E8A7863C76251944EC174259512100CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388441, "uuid": "7bdae945-893a-4952-9d1a-a6f03375c3cc", "value": "384:N/Wz9fp6VaHdXMcPnJI9q5xKa4bZdKT1M4uVcqgw0OaWxWXkd:kz9B0a9XMcP0TaGPKe4uVcqgw0RsWXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388441, "uuid": "b5690c16-eeff-4e01-8a11-395c600a542e", "value": 21836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388441, "uuid": "92a6864f-465c-425d-a60b-8d59a6e8d83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388441, "uuid": "da3211d6-255d-4bad-b8d8-b2c807265a61", "value": "dd583ba00a3285c177ef9def788927a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6afea8-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685354043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354043, "uuid": "c97e2efb-9686-4f8c-9ecb-9d72c6a3b189", "comment": "Malware payload (Formbook)", "value": "674b265386b0436e06409005786328eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354043, "uuid": "5abce5cd-eba0-41e0-b3ee-0fab872f107a", "comment": "Malware payload (Formbook)", "value": "420755b65fa49bff0785ce8a56600f1e813f7821fef09f156cfebfb46f8f1096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354043, "uuid": "d25d68cc-e651-4118-8ffb-3e58a7073158", "comment": "Malware payload (Formbook)", "value": "40822a1914225d5ee4c648e4a1014794af802e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354043, "uuid": "487fd26e-46d7-4126-872c-375f8ca5c523", "comment": "Malware payload (Formbook)", "value": "37eeac1b1d6ba0f9c3a02bc946dc4b8a039f4a94b3cb1374c7acbecf82c2af6ed0f4cdeca0ef1777df167e32fd1b636c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354043, "uuid": "f3753426-7891-4584-8d50-0846a865cea2", "value": "T10BF4125052A7CB2BD93F47FD60616B3003FC5B8A7662E7474DD3B0E89AA6F590E0490B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354043, "uuid": "70877e33-e993-47aa-bf47-cf59616aae26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354043, "uuid": "3acb1467-008a-4113-abc4-dbd5c5eedfb5", "value": "12288:NVHkmFx2iqNhujGjUlzoN0sGIXrmUK7hXtKSpuHVhQ5jVhIAEpaJQO/SE7/xDlEi:vEmFxULNX527x1A1O3WaJR7/dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354043, "uuid": "4becdd16-b147-4401-9ff5-ef7b7539d764", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354043, "uuid": "bb1cf25a-5bad-4718-8c23-8e2036612451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354043, "uuid": "f428af85-9597-4de8-a790-06d4af4dc227", "value": "Swiftcopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c46bcc-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376758, "uuid": "c9c431dc-bc14-431d-b065-b27ef0b70c58", "comment": "Malware payload (Mirai)", "value": "33e5044c6a175970001182c7e718dd59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376758, "uuid": "1dfb2ae2-2d52-4daa-b33d-0f9a025e80c8", "comment": "Malware payload (Mirai)", "value": "4240527749b97682910cab1283b22fb15f03622f36680b79b46a37178962f3b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376758, "uuid": "226e2498-bd1f-4ec5-99c6-90aeed57d1ec", "comment": "Malware payload (Mirai)", "value": "64354672be5ca86cc80bef5327456b45540f2635", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376758, "uuid": "a56a4100-d841-4086-ab02-fbb541c1772f", "comment": "Malware payload (Mirai)", "value": "4b18b6d121ebdf260a26db9d81e41e9ea70e7f12a2a9fa0e392a338b688342bdae5624773ca2c9689bd03f94937af74f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376758, "uuid": "e2c94991-f258-43e1-8319-157eebd02284", "value": "T168D2F1622A5CE673E7523F35EDB7038353035B74F8F925A8D5D98568E9020D2D8BE04B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376758, "uuid": "fd7cb87b-1fcf-4ce8-b39f-ee7b6c213a4a", "value": "768:xsLpiLDjL5BExgSkh8BIunAyXjMDoJ3U0:KgPPrEdnHdXjMDo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376758, "uuid": "635d27e4-15e1-486f-814b-249e901ab8fc", "value": 29740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376758, "uuid": "63ccfaab-a11c-4a37-bcb8-f020e3331f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376758, "uuid": "b846846e-bebb-4c69-90b3-94626763e700", "value": "33e5044c6a175970001182c7e718dd59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a9f84d-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377277, "uuid": "140e4f28-ac1a-46fb-b009-bd79ce8baa83", "comment": "Malware payload (Gafgyt)", "value": "f8c2987b34a965018d94569f0ffa9418", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377277, "uuid": "683d25b0-f02f-498b-bd09-61e8ab2388cc", "comment": "Malware payload (Gafgyt)", "value": "43123c53f95dce1dfaa5ffb10d0463d5dea8946437567ea8e09d107ccff290e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377277, "uuid": "91082181-9579-497d-9415-86df7261626a", "comment": "Malware payload (Gafgyt)", "value": "69ddbb9561b1e1ff84c636001c7fd1d6bf5f73b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377277, "uuid": "ed064431-8718-41ff-889e-3b6383deb6db", "comment": "Malware payload (Gafgyt)", "value": "d7dd56727fefb6d7e2057900492c4fa37eee3ca5e0a4f5f29f1927cd95bda8fd083c6a0e9b663e3675dbfe9b685d10d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377277, "uuid": "0e4a245e-c752-43cb-b7fc-e8a36c0a34fb", "value": "T1AFD31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377277, "uuid": "cf0b0a24-be97-42b3-8f4d-6a67a2df21c8", "value": "3072:Sdf+fvEqa9FazYA7IboRhye391CErktmCQA9FX9aH:ifWEqa9FaNhye3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377277, "uuid": "2e2772bf-1f5d-4e5a-a928-667e9221948f", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377277, "uuid": "9e6d5a02-bcb1-4881-837c-3bc1135077ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377277, "uuid": "5051db07-9401-46ee-803b-9c45b5287ebc", "value": "f8c2987b34a965018d94569f0ffa9418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d1601-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346318, "uuid": "9c911bf3-64e6-4fb1-9366-d52517708874", "comment": "Malware payload (Amadey)", "value": "391a4091fdf6db3cac886f44f79b0f0b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346318, "uuid": "f2f13633-18bf-4c5f-8262-ba32e3d447d0", "comment": "Malware payload (Amadey)", "value": "43194d3b2159ad2be499b5d153da84dd4bbb0e0ee0fd622d46d148a5275e3c26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346318, "uuid": "395642a7-a3a1-45f3-b765-44531d355c7c", "comment": "Malware payload (Amadey)", "value": "ad2c6cf326a6e4b5aba620d6b362eb40be817831", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346318, "uuid": "afe360ea-d50a-4f8a-824a-aef49e32d1fb", "comment": "Malware payload (Amadey)", "value": "ad5da4c60b32eae55d58f101c3e132f432a594dad7b0749e559a2adb327f0f25b814a8ea4aaf41fb8b4170d679a0c3ae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346318, "uuid": "3eb15834-9bf9-4a80-a589-a670298ff629", "value": "T1CA0522A2B7D840A5E9B5237098F743831F3ABCA189A4C36F134AA56F0C3374496357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346318, "uuid": "e9026ecd-5271-4344-a35b-c245d9d53873", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346318, "uuid": "23299104-576b-4638-af5e-ac0d4d499850", "value": "12288:QMrky904jsXvyPTHkTTX+VaAWlotBwgfQ55KX6CgP/wWfYipMA:kyBqyPTHkTTX+6y6CGwWFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346318, "uuid": "cbd22429-7967-4ad7-b8c4-405d5004aeb3", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346318, "uuid": "76f200b0-8709-44f4-aefb-58a1eeec3a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346318, "uuid": "b3141321-8674-46f1-bdab-193d168b060c", "value": "391a4091fdf6db3cac886f44f79b0f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80e847a-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685387587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387587, "uuid": "4a9ebdcf-3bd3-4bb1-a324-ebd2a6d80459", "comment": "Malware payload (RedLineStealer)", "value": "128746491c835d6eba2e8c4e6c46010f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387587, "uuid": "fb9f38c9-2393-4868-ab9e-eaf717db53ad", "comment": "Malware payload (RedLineStealer)", "value": "438d64bb831555caadaa92a32c9d62e255001bc8d524721c885f37d750ec3476", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387587, "uuid": "0e491d42-9940-4ebc-a9a3-d557374f961b", "comment": "Malware payload (RedLineStealer)", "value": "fe7d7907d7b7e6f43af79f806b6640fdfb9468aa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387587, "uuid": "7f5b3e83-c9cd-4c61-a5bc-2993bd222a75", "comment": "Malware payload (RedLineStealer)", "value": "d2edfd508284a8f23cabae0ea8f99210f88394577bff3c4f78022f3e90fd31315ff77383e47be7974d97739e248e33e2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387587, "uuid": "a759874e-a70c-4f04-9d07-47e53e891c16", "value": "T1E3051253E6D8E532E8B1277908F603D30A35BCA18C71871F375A9A5E1D726E0A97073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387587, "uuid": "ec41e66c-0273-4108-abfc-1674afbf289b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387587, "uuid": "1d6b0d1a-1191-4a8d-a5b8-09339369593a", "value": "12288:RMrgy903+wvNDnxMddL63V1pRyrq2bT3o8418TXMRs2hO20PX2uVXR9EPP:NyzonIUJMmQb818S3svZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387587, "uuid": "77c3751c-621d-40b0-9151-4c5b975d23f8", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387587, "uuid": "46c97dae-3285-4375-9386-9e5b0509240c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387587, "uuid": "1d06a199-093e-474e-a922-0c04e42d680b", "value": "07496299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce83553-fdc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (OrcusRAT)", "timestamp": 1685326392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326392, "uuid": "5492e6e9-9f79-47a2-9ffb-05aee551a48e", "comment": "Malware payload (OrcusRAT)", "value": "b373982c595fc0a74e90045eea34f8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326392, "uuid": "e214e00a-65a6-413e-af44-ba1173abcd92", "comment": "Malware payload (OrcusRAT)", "value": "43e8e826167ff5bdc9c26638bea69a318ec956201c06727b0bb4516937874e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326392, "uuid": "e1198e0e-e8d2-4a12-9e5d-7f321e037396", "comment": "Malware payload (OrcusRAT)", "value": "263707ff6e3966106661e6a7628c8b40a41a799a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326392, "uuid": "853b9cfb-808d-436a-bd1f-2c15406211a9", "comment": "Malware payload (OrcusRAT)", "value": "8825e490dbc32e72e29d7ba90fe3e935b63cf9e46961a80b59f73dc27cca52abb42ae240f0fab269a3e036050752e70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326392, "uuid": "3bc7dce4-f220-4225-9a51-00beff5727b8", "value": "T1EF15BF013FACBD06C1BE3778B6731AC91BB8E9066052FB4E085861AD2D9FB01BD55367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326392, "uuid": "34dbdec1-99cb-459a-b5ed-6274a2b3d5b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326392, "uuid": "bba45a04-9f24-4570-86bf-2eb1dd4c0d9f", "value": "12288:oXBM21gsgPktzYX7dG1lFlWcYT70pxnnaaoawUjKgRRARrZNrI0AilFEvxHvBMQ5:DuQ4MROxnFSgHarZlI0AilFEvxHi2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685326392, "uuid": "63fd12ae-584c-4301-8354-4e2e4f51e2a4", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685326392, "uuid": "91adefc0-3f91-4047-8700-d0b85c42c5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326392, "uuid": "a723a5ae-0404-47e4-9a9c-86dfbeadb1c2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf6babb-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685354041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354041, "uuid": "f17f7ede-9bad-4e00-ad17-efe480f0244a", "comment": "Malware payload (RemcosRAT)", "value": "68816b2a7e4aa3d70c7472918071bfa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354041, "uuid": "d356f804-a66c-4641-bc16-86ed778ba39e", "comment": "Malware payload (RemcosRAT)", "value": "44b9c7b495d855d23b1dce528639b2a726a1b89f0f5968df842a508d0f6d3f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354041, "uuid": "c96ff972-dcce-4969-a1dc-195b74571315", "comment": "Malware payload (RemcosRAT)", "value": "df2ad7020f832f381a9a12d6f0f63732aa85b455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354041, "uuid": "56ef5bd1-3d32-40b3-8fd4-a8fb75a1ea5a", "comment": "Malware payload (RemcosRAT)", "value": "33599a23f5e5b08ee88d904fa4d04484e7b418134a3cdb5e5e4fd210386438f92fc872fcdb5a7a03de1c07b416213a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354041, "uuid": "ff2f196e-3a48-4b01-94ca-d4f7a9c5fc41", "value": "T19935F0DC3210759FC857FA319AA42C74AB6178B6631BD24390D327AD9A0CA97CF152F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354041, "uuid": "f196aab1-ea33-44ea-bea5-9f71bf17bca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354041, "uuid": "542190b0-5272-4f91-aaf5-4f5240634cea", "value": "24576:u5GoR5acwNogEDYUuBBvv2hXVp8sGZJN0wavkRQtCr:uIo2c6gsnBBeFmZZb0w6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354041, "uuid": "d05db45c-fc05-40aa-8a6f-45f5292f8c80", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354041, "uuid": "5c97f8c7-10f6-4e5c-9926-9929ec5500d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354041, "uuid": "ea5b6814-0794-4193-aa9b-83be8734e2f3", "value": "SOA Sinotech Logistics April'2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ed2b45-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346639, "uuid": "4e264376-ddce-4ddf-9d1b-943a01ddf18e", "comment": "Malware payload (RedLineStealer)", "value": "75de2c5770f035648cbd81647bbf7878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346639, "uuid": "fc2f8374-c087-48bf-96f1-fea5e7dab8da", "comment": "Malware payload (RedLineStealer)", "value": "45840a13791f855d6de74f94fab12a6ae60869235c51b22f2b69595d47132777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346639, "uuid": "d37155a1-fc3c-49df-8fa3-bf6e0483b1dc", "comment": "Malware payload (RedLineStealer)", "value": "4035a4db3a07ee42da05f9f6b3c80b050e8eec41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346639, "uuid": "6b9c6fd0-0ae2-4d24-bedb-be7795db6026", "comment": "Malware payload (RedLineStealer)", "value": "93dbb28c44dfef34f58890b93529921548d27d8cc4c3635e88ed5c92efc8da239bf1fb0e631f1b9d3e522ce82b3e9427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346639, "uuid": "993df62e-f0e5-43ac-81d3-b367bb115888", "value": "T14505121677E85033E9B807B0A8F203930B3A7E729D7943AB33445D971DB299066B573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346639, "uuid": "036c4f47-8810-4e6b-a021-0ce25826b275", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346639, "uuid": "7849601b-a75e-4d20-9364-3879442b32f6", "value": "24576:qy6I8X+i2ay6sjtc65xfP8BjoURn1emnv6USBhyq6:x6Iri2aAjq6L6EUamnvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346639, "uuid": "b69ac575-d90e-4e6d-aa53-01e55843a0e5", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346639, "uuid": "2a2376a8-2311-4376-87a8-b3e4799e5993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346639, "uuid": "7b64be17-dec1-4b53-b027-48f008bada7b", "value": "75de2c5770f035648cbd81647bbf7878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d78fccf-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388106, "uuid": "f930af98-d483-477d-a17c-60fb7e2a0ec7", "comment": "Malware payload (Mirai)", "value": "782c4c26729b17d6500bdabd50456b30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388106, "uuid": "54508978-268f-40c3-a020-e5739132e78e", "comment": "Malware payload (Mirai)", "value": "4627939272ff29fc68ad6af7fc524f4507a21a07642c1e1787fa868347af7156", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388106, "uuid": "c1f462e6-6709-4f2c-a939-4692e72adba3", "comment": "Malware payload (Mirai)", "value": "c1717284c5005ce272bf238a01fc07de48b57a70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388106, "uuid": "7dd15ab9-0656-49cd-97bf-278e9089264d", "comment": "Malware payload (Mirai)", "value": "03c48b479bc86e695e65af1edb8381d9a7357d96fd547b5a4172c3b60306613c667b99a893d762e1ea4e0a2d82308a1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388106, "uuid": "d8698a93-bfa2-48ec-9fae-e74ef3202eff", "value": "T1C3C2E0B4FE28E7FAD6F00875ED2C4D02E6D51AB480A91C15F7349FB092D2940B6FE550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388106, "uuid": "c3ecd877-250d-4af6-a3f7-57539d71f2ed", "value": "768:qJU1bqjxmB8GdA0wWrGpeVb+YFPpcpc0VFf1zBOq3UI+d:qJObqjpGYWAeVCYPpc7RPhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388106, "uuid": "084688be-90cc-48eb-99a7-c4a7c7594e9e", "value": 26304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388106, "uuid": "bc019912-eb14-4678-84cf-2f1b86efbbb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388106, "uuid": "247cb816-51af-4982-9403-ce985b20dc27", "value": "782c4c26729b17d6500bdabd50456b30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36c8b41-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685387633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387633, "uuid": "7e319185-a592-4974-a866-92a710ded758", "comment": "Malware payload (Stop)", "value": "4161347510c3d7c8bd5a66bb6050c96c", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387633, "uuid": "eef60ac3-ee7e-41a7-8e4b-24abfc39630e", "comment": "Malware payload (Stop)", "value": "47e03ff21b669855f25429024005931007716250473e4a0c250e1dfbb5b4f81a", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387633, "uuid": "176bfbf3-f433-46c2-95ff-ba019baaf070", "comment": "Malware payload (Stop)", "value": "326979c7f3bad947e0a5b1f96275f2c177b41d5f", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387633, "uuid": "808b794c-86cb-4aa4-b423-005d2aa6b089", "comment": "Malware payload (Stop)", "value": "e3ca8326c2ba24d22fb5d5d0d6be852d01f583a4ce69b9a1ab4dfebf50fcaaf3c817ae1cf532975002c2dea874a4fa74", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387633, "uuid": "fc432cca-f811-475e-8314-96579fad1156", "value": "T10905D003A2916C64F5264B71DE2EC6E8F75DF5618F5977A72218BB2F04B02E2C172731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387633, "uuid": "6ff646fe-1e07-4f0e-bc6b-4c590487c098", "value": "067710d045234604093d7ae15ed3e5e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387633, "uuid": "329a2a58-306f-45a2-a86b-57cde6276916", "value": "24576:GHybijcgEf/jCmbGeh7E0xFMystmstoCY7IS0:GHybngelSensRzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387633, "uuid": "abfcb4ba-1f21-4901-a994-d17a2b2ddfbe", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387633, "uuid": "bc982a8e-3e83-414f-af2a-d763b0090de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387633, "uuid": "bfb8782b-ce1a-43ff-a120-7b4e3abe8d31", "value": "08590699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86429a9e-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363398, "uuid": "edac975a-9d5e-45a6-8904-7586b13fb5d2", "comment": "Malware payload", "value": "e16e51b1dd6051b2617e7aad678142b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363398, "uuid": "88378a56-2668-4043-8a1a-b0db445dfd12", "comment": "Malware payload", "value": "4872c5fa8fe85d75538d00f56a6bc94801f77c7bf217ec69a41d9f9937b7652a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363398, "uuid": "5fb93b1a-9175-4051-adc3-543625de38f7", "comment": "Malware payload", "value": "4e1289a2958b6b32c90bee3e7afaa21d331e76ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363398, "uuid": "03f469b3-9c09-44a1-a9fe-ac498b3815e3", "comment": "Malware payload", "value": "b73c81e0c60047054527c2b3da7bfa34c91bfcfc94e6fee0b7889d5bae85ee778d8a9ad89f33dab47b142421f3007338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363398, "uuid": "8217a67d-f977-425f-96cb-e4f5f85a876d", "value": "T1B6E47E43BBCB40C5E5E67DF11277E323EB35B53A632A69C7DBD01C225A60910AD29327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363398, "uuid": "f3729729-dc28-42c9-9456-5b754dd9a11b", "value": "12288:I8WHr+sPyWWbj3aJdWEG3qerC94rchMv:I8rWWKJdW4OKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363398, "uuid": "efa4393e-996e-4a50-a847-d3254de48cde", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363398, "uuid": "b046953e-d077-4689-8be7-b4eb771b2f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363398, "uuid": "4429b080-e544-4bd8-bcd7-52d0493d6df9", "value": "SecuriteInfo.com.Trojan.Crypt.6469.12502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2846d4-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365344, "uuid": "d4b6404a-7262-47c8-a9da-ff100b9a3bce", "comment": "Malware payload (Mirai)", "value": "94238e7760dbc7f64f2c6289d025332a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365344, "uuid": "eaddfb37-aef8-43da-b4d8-01e0f6001eae", "comment": "Malware payload (Mirai)", "value": "49c167445bff850d1c713aa2622dbbbbb96edf3fd7a9753ff24926e550093efc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365344, "uuid": "39ebe0b7-7497-4bef-b262-f5ab56c13dd3", "comment": "Malware payload (Mirai)", "value": "d32e4d3943b3cbfefd970dc753de1df0e6410acf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365344, "uuid": "87d52225-a0a9-4b7e-b926-6c9a92aef743", "comment": "Malware payload (Mirai)", "value": "1b4bc3bd4d5e36300e8e7efdcd44eb736a1388972275b2b25b061193296298c692d1cd367a88cb826a1bd9cc87b95643", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365344, "uuid": "9caba001-e577-4f93-9e07-ad26e49e5e99", "value": "T11EA36C0163190953E29B5EF026FF57F187A6ECD026F26604A61EBF845373BF11486F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365344, "uuid": "09ece5d3-74ef-492c-a84e-29da3108f0c3", "value": "1536:MgU6ieccgcK8SK8kxJNET2n9EggtdJvOaDjAmLLh1blSn9C:MFERgbBK3xJZCHf5umPh1bon9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365344, "uuid": "26d7ed22-0a6a-4dff-991a-122d0501c859", "value": 106263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365344, "uuid": "99b5caed-7a3b-408c-b278-1702244cdbf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365344, "uuid": "3a62e41f-6157-472c-93f2-51971487f3f3", "value": "94238e7760dbc7f64f2c6289d025332a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09136de1-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685348585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348585, "uuid": "f1f0c470-913e-4afd-8f4d-5edffc971a4d", "comment": "Malware payload (Rhadamanthys)", "value": "21ca10b3d5af240e7eccde4a14f0ea8e", "object_relation": "md5", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348585, "uuid": "70ce1821-7956-4819-bf02-96d8ef02a887", "comment": "Malware payload (Rhadamanthys)", "value": "4b1a1ad26d581f4670cc0521f6c7fb4ef0370003b149d06f5f40ed637bbd16e4", "object_relation": "sha256", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348585, "uuid": "bfa68df6-db21-444a-90bb-36e4acb8fe6a", "comment": "Malware payload (Rhadamanthys)", "value": "a55b7644433d41a43fee7b20404959189d86d70d", "object_relation": "sha1", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348585, "uuid": "2a6ebce1-e62f-42d5-a7e4-50469a098620", "comment": "Malware payload (Rhadamanthys)", "value": "508c3a2a8582b905521d4094047da06b123becb237ebfe9ca6673f65c7a3186dbe9a2b56cd3645ca405dc4c8d4ff31cb", "object_relation": "sha3-384", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348585, "uuid": "f799604a-7c3e-48cb-9c45-0c65f2d517d4", "value": "T1BEC49E03A3A17C60F5250A729E6EE7EC771EF9504F5977AB22585A2F09702F2C272371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348585, "uuid": "4c56fb3b-d657-4202-9d22-460ed17f5124", "value": "1552eebb89b3841e6a330c0c93657732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348585, "uuid": "c3b03cd1-64d0-414b-82dd-5b8b4b173d8e", "value": "12288:BtYS2+GrIef0IUIbc3L2+50qyCpfBHz0Eo9lF:BtYaGAIbc3L2QnrfoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348585, "uuid": "4f76f1ca-6735-4c43-9e36-7b9e18661aa1", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348585, "uuid": "9d0b4ba3-c433-43e5-82ee-10e69335f9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348585, "uuid": "22708d02-6b3a-409e-a467-bb2865691ad7", "value": "05361299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b880cc8a-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365630, "uuid": "df8d24cc-fcd4-4601-ac90-85a764b66be9", "comment": "Malware payload (Mirai)", "value": "f0d8cedca01f1558bed29a37ffde5ac8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365630, "uuid": "8659f5a0-706a-465e-972b-d60345b0981a", "comment": "Malware payload (Mirai)", "value": "4b6a583526fc911bad785dbb3f53ae17a7f5a123c43f80154ea13c891acae563", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365630, "uuid": "d9195e7f-939d-40ec-8f40-955a8fe65c4e", "comment": "Malware payload (Mirai)", "value": "a3afb8c52bbb36bc7d1ab2dc738b082bb41e04f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365630, "uuid": "d633fb25-d9b5-4cb6-b2da-3599f2842a01", "comment": "Malware payload (Mirai)", "value": "b368be6f6ee63b126e8b4dc034c2a520ac35aeee33f55b7f5b4d2bf66c76c4e4f87d00260fc267a90aedbfa71cb53896", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365630, "uuid": "ff6ecdb2-2657-40bc-a18b-6635b570124c", "value": "T12BA32B0386B18E93C0875FB916E78A740713AC714B571F75A2299BF80B43EDCBC993A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365630, "uuid": "a994d4d3-3fa6-4925-9d4e-6b1b7b9cc07b", "value": "1536:y6oa8ugSfuxI/yjFcUbWNeisloufkSZzBDHLIOaeUm2BY1N/ZzS+:tUx849bWNeism0VLJmmKY1NRzS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365630, "uuid": "8b07d686-2df0-4b38-b67d-866b3a1ae6ff", "value": 98764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365630, "uuid": "acd8c71d-c157-4caa-ab3f-c17be19f1112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365630, "uuid": "bf16ea8b-7191-40e4-a806-cd5aad8058d2", "value": "f0d8cedca01f1558bed29a37ffde5ac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb906e4d-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388398, "uuid": "f19d9521-6a55-4684-a0b5-ae9d1ec1e41f", "comment": "Malware payload (Mirai)", "value": "1f93b54ceef88f2c052ff830d63e5264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388398, "uuid": "5fc3d031-6f4f-48da-b113-cc5a50b011eb", "comment": "Malware payload (Mirai)", "value": "4c81c667a4b9926fe1e83696faaf3792b299098442f3a6d3318af681a24dc8b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388398, "uuid": "207ed193-a999-43b1-94b9-d49441c4b600", "comment": "Malware payload (Mirai)", "value": "2b947f16e8a7ea49933f2b1f08ad9868013d9987", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388398, "uuid": "af6247c9-699c-4f0e-bbc9-b83efb05fc3f", "comment": "Malware payload (Mirai)", "value": "7b5eb622e266df5298ac2aac90d96b71cabd1aed43862a130f1eb6097a77997052cf7cc93cff536f9f4d482d90f25a2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388398, "uuid": "00721759-ffa6-46a8-adf2-3cb47a4d82ee", "value": "T1A504194AEA404B13C0D627B9FADF424533339B5497EB73019928AFB43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388398, "uuid": "373bf779-6880-44af-80d2-9387bda24bcb", "value": "3072:o81S2KcEVzpI8hnaOTVc1hqPtudXYCmwbN6aOB8oBM/RPT/W:o81LEVdntaOTVc1hq1aYjkN6aUBBM/Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388398, "uuid": "8117827e-7338-4639-85dd-57ae287082c0", "value": 182289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388398, "uuid": "e8ab9fae-af69-4e87-91a4-62db03235a26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388398, "uuid": "c9d1b4f6-674b-418b-aa3c-e64071a204fa", "value": "1f93b54ceef88f2c052ff830d63e5264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead1107e-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685348534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348534, "uuid": "6f7223af-6acb-48c4-9440-f394ca45da1c", "comment": "Malware payload (RedLineStealer)", "value": "cc647ad9906585f241a35f64ad395186", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348534, "uuid": "1415dc68-61f2-4021-9824-93c7b91ba7ea", "comment": "Malware payload (RedLineStealer)", "value": "4d0d6b7e688985af8d1228c8d7d5d003cfb6827eb3a637dbd63624b778f7c949", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348534, "uuid": "c59b32e9-8ac2-4eb9-a0d8-497592534f81", "comment": "Malware payload (RedLineStealer)", "value": "c345a7fd96f6dad45dfe2b9ade4864be769b3c54", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348534, "uuid": "ea62954c-1e05-447c-a47e-1076cdb65180", "comment": "Malware payload (RedLineStealer)", "value": "2d622020a322665b18dd829544d81b00c5f58a1cac0a2328b3cb0f1962f7845f59e16e477bc59bb223feacc06d8873ff", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348534, "uuid": "37581e31-5df3-436a-b6b2-1e69c87961dc", "value": "T171F3D568364B657EC96F883D9C600CD07A7CAC662203A7479D8FB0E8393B7919F151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348534, "uuid": "6c88cc24-7f69-45ed-8e55-0ea85eaeccd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348534, "uuid": "0d055cad-a68b-4fd7-8c54-8e07294477fe", "value": "3072:R4O1/jHX8WNS1DSE6RZHSSSSSSS8SSSSSSSSSSSSSySSSSqSSSSSSSSSSSSSSSSf:R9j/SuHbp9Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348534, "uuid": "3a93157f-efbc-4af2-9b89-5760089af665", "value": 172518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348534, "uuid": "0077ef57-9b02-4141-a64e-451192815f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348534, "uuid": "df067844-ec94-432c-9b58-f869554ddec7", "value": "04570399.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d6263a-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371578, "uuid": "aafa4f8b-51b6-4137-9c29-cb2cf944eef6", "comment": "Malware payload (Mirai)", "value": "421461db5cd070c90bf718b9706c5c50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371578, "uuid": "a33a8471-6832-4e18-8fc9-4558d925e6db", "comment": "Malware payload (Mirai)", "value": "4d59f036c296138d45bbfb4732e7c56eea9703034b3a2e7a5edd48a1d0135565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371578, "uuid": "2e7aa820-1793-4703-bb69-e3d58b5afef1", "comment": "Malware payload (Mirai)", "value": "5f93183d4b63c71977b7602babf258c2ed0cfc31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371578, "uuid": "f39ad337-bd71-4f91-b12d-4eece1f5f7c5", "comment": "Malware payload (Mirai)", "value": "3645a57ac0243a60d237b0434423ec863b469f41ddb8669e077b75fdd0c5d072212c6caadd5bdb1c47700c5c0fa80156", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371578, "uuid": "ba0c8e6d-e413-4e3b-a7ad-e001c1d5268d", "value": "T15E634B32BA711D2BC4D5A47A72F30725F2F2879A24BC8A1A7D710E8DBF2565032436F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371578, "uuid": "23708c7e-5675-4d3e-9764-63e11760b6e6", "value": "1536:f/JVqwV0Sgu9KOgtgElt5gKt0o+WbtEG4X3:ZVqod9KraEl/0xBX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371578, "uuid": "59653755-504b-49f0-a309-3ab1c4c4c305", "value": 71008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371578, "uuid": "360558cc-b671-46fc-9984-93f8630b266c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371578, "uuid": "0b889b8d-841e-4d63-a343-7bea20be3dcf", "value": "421461db5cd070c90bf718b9706c5c50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454e70c3-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362430, "uuid": "39352eb2-a517-4808-8782-7f5093a42a17", "comment": "Malware payload (Mirai)", "value": "1ddbc47b0ddb4b2bd01d3d6f8b64fe57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362430, "uuid": "949becc1-843b-476b-a02f-646ca270e22a", "comment": "Malware payload (Mirai)", "value": "4d9cd935a7c7ce0000b78ee7e88aba6adfbb2c445bccbbe64b2d12a6c6b6dbd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362430, "uuid": "83fb0c6b-8c1b-47a0-a72d-488bd498a23d", "comment": "Malware payload (Mirai)", "value": "e1b7c076a930d686a9ad225e71539b66b8fa09e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362430, "uuid": "34560531-eeee-4452-b582-fb37e5609fb4", "comment": "Malware payload (Mirai)", "value": "60bdd03a94ffe3b69db4597d11e3057f4b12f376c57aed12906c391d69d90cf80b2f3db00e444723dfd81fc8e225ed05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362430, "uuid": "e8282824-9a56-4710-9f31-3f67dea3c0a5", "value": "T1AB434C0333280E07D9961EB0353F06E093BFF95126F5B68A194F9B758639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362430, "uuid": "bdc2dbdd-bba0-4156-bb65-7d1b1269db5d", "value": "1536:q01NDkjhWBPe1ZMaDy0wYrudk/GrNd42+P:qEgoBf3YrucG7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362430, "uuid": "d717c579-1a4e-493f-9b57-b515cdeef05a", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362430, "uuid": "729c7fb8-7071-499f-9ccd-fa674c9509cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362430, "uuid": "c56aa8a1-6b2e-46bf-b93f-a35fb5e3bab6", "value": "1ddbc47b0ddb4b2bd01d3d6f8b64fe57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcedba5-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376802, "uuid": "66c5f46d-7b77-4462-a792-4efe89a88a1d", "comment": "Malware payload (Mirai)", "value": "7592df37fb3fea64a0994ac342f319f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376802, "uuid": "4de4a1d0-2c7c-4ab4-86a3-8483d407699f", "comment": "Malware payload (Mirai)", "value": "4e97dfb181ef3db9a59094b5f468255ee7dc5d5e52543730d8394270a434b162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376802, "uuid": "6245bf9c-8244-47e2-bcc4-dbbfc2016063", "comment": "Malware payload (Mirai)", "value": "bd612669bbc816883907689411667f34b471259f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376802, "uuid": "02a66c96-2ef0-4b03-9d0d-0a96d3c21964", "comment": "Malware payload (Mirai)", "value": "ed88ef87d069535e663406f608bfaa42bc4ddc04a8276d77ce88e9b3d86aad6c7514bedf55c38864789ee5e2a7795698", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376802, "uuid": "1ea7fd5a-f271-477f-b1b3-e6580f3ba256", "value": "T15FB2C0717015B8B2CAE1007B6AEEDA43FB801EF8D0E873391465099DEAD5D42BAF1547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376802, "uuid": "1b5f4c10-e059-4bdb-95a4-ca9d5c5f511b", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3prhymdGUop5h1:5X9nxn8o9wnBoWzEQf2EjKb3prs3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376802, "uuid": "404ae6a6-6804-4f3f-9f2b-3be60385c285", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376802, "uuid": "f342d246-8036-40f7-94ab-883c2adb8346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376802, "uuid": "41f3d048-ef24-4aa8-96ce-a782d33fadec", "value": "7592df37fb3fea64a0994ac342f319f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f427c6-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374007, "uuid": "160846fb-fdc8-4df8-af48-ff38dbdc0110", "comment": "Malware payload (Mirai)", "value": "4d8f1b894a20b94b68e3e3ffd96199cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374007, "uuid": "6f696968-d01b-4b30-bd63-b5f72e47ff0e", "comment": "Malware payload (Mirai)", "value": "4eb63b9bec2e6996070125e809344cb9a7e38f1ba5062a558ace7bae15981095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374007, "uuid": "8d31c59f-a701-4842-8fa3-2155938c94ad", "comment": "Malware payload (Mirai)", "value": "71924823bf6698465723f889c10dcfd2e0a03eda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374007, "uuid": "0a04b861-dfae-4ff5-90d3-280d42470cec", "comment": "Malware payload (Mirai)", "value": "49bfea3f2ceae72b459617de5a818481def3b8bf8cef7c8b15739afdc829fcb32b15f6d26e81ab9c252dc3eea7f39c1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374007, "uuid": "950890dd-641d-41ed-8a97-a499e1e5ee60", "value": "T10693F746B8918E11C5D423BAFA2E118D331263B8E2DFB223DD105F6477CAA2F0E77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374007, "uuid": "fa89d3c7-9240-4e19-a077-c6db986af8fe", "value": "1536:5nwnqIuUUiDclVivygksCJ15k5F1+fwPl/zITiNdR8tDc1Irikwkf4MaOw:51I3yV8y5s4+Z+uiuNdOwkf4Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374007, "uuid": "9a6c65e7-c220-4e3c-a67e-d17f809a6d29", "value": 91500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374007, "uuid": "339cba07-ce5e-4ae5-a399-b7f0184ee40f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374007, "uuid": "f6e1b337-e7ac-4ad9-baa0-52a9c83841b5", "value": "4d8f1b894a20b94b68e3e3ffd96199cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09520534-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365336, "uuid": "8223c153-ab0a-400a-8c57-1bd6e2e32ef5", "comment": "Malware payload (Mirai)", "value": "685395aa83f00096f043c80a59bd93a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365336, "uuid": "a5ba79cd-4b6a-4e64-9c1a-9cf3afc6467d", "comment": "Malware payload (Mirai)", "value": "4f04f2f227dfe1eee0f867c99ad5299362ae2a4310356b8a787c27d8a075c5af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365336, "uuid": "108578a0-63a6-4f92-b2e9-5f0c7a66f8c3", "comment": "Malware payload (Mirai)", "value": "fe0de0b60a64d61d7296bf897a8e47048ee86142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365336, "uuid": "252121b2-6ebe-43c5-a62b-b75b518e7634", "comment": "Malware payload (Mirai)", "value": "2242cb09704ac7d68957ff25141394d9b4351870972c9a98a8473cd504135015e978e2c18504edf7b553c18cfe1b272c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365336, "uuid": "e098b3d5-9dcb-40bf-881b-af6b96379dae", "value": "T142935C46A6A3D2B7C8871B7812EBA7360631F997075E9F07E36CAFF09E01594705B20D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365336, "uuid": "75d153e4-f170-4fda-b7e8-eb03a76ece6c", "value": "1536:tqP4sy9nrsedXjbv3Ej4V74zWNPPiZI0UHY1ZTITuRzevLvevaeumOkIOsvjmVL6:tqP49djzv74zW0ZZkiyvLvIumOkIOoj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365336, "uuid": "f78a1541-5213-4600-995e-feb2d0e2ad2a", "value": 93300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365336, "uuid": "22746bdb-31ff-420a-926b-b10a777a3868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365336, "uuid": "29c27ff2-45b4-4d00-af10-a0686fe9d137", "value": "685395aa83f00096f043c80a59bd93a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79be1c9-fe13-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Babadeda)", "timestamp": 1685359588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685359588, "uuid": "27b9c0f6-fe25-42e2-a5be-ebc44e88f30c", "comment": "Malware payload (Babadeda)", "value": "d73af3d62820b9939920770c0185047a", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685359588, "uuid": "06d68e32-5332-406f-92ef-5b6daa480a30", "comment": "Malware payload (Babadeda)", "value": "4f121de95f628648dd2792ea2a3b02e7e014ac8fd20027fecd7c19b47533c115", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685359588, "uuid": "495c1b89-2a48-4d0f-bf57-8a619dc3e09e", "comment": "Malware payload (Babadeda)", "value": "98a410957a22970b56a4f978608f2e1947f15535", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685359588, "uuid": "634088d1-ff8e-413b-94c7-beeb8ab3262b", "comment": "Malware payload (Babadeda)", "value": "6c5235498576588e35cdc338628045dae55dbd37e8edb600cc8a9893102d7b55865b74df353f38d45e89ded59c78991d", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685359588, "uuid": "d6616af5-79e8-4782-a3b9-1949269a3268", "value": "T15114D045B2D641F3EAF54A3200E6712FE73662289761A8DFC34C3D428953ED0A7793E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685359588, "uuid": "23c31200-7b81-4f40-b27e-a98ead20e617", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685359588, "uuid": "5f6afb05-b8a9-438c-befd-dacc4bf41e51", "value": "3072:5q6+ouCpk2mpcWJ0r+QNTBfs4KmwjICnjoE+9sm2QfHh6GVFX8FgdNz4wCT2Nx:5ldk1cWQRNTBEl60+9e8nFXfdX02b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685359588, "uuid": "c1191679-edd2-4a24-849d-4f601df6badd", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685359588, "uuid": "97020685-195f-4fb4-99bd-b2381a1f1c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685359588, "uuid": "a74ff908-a9e7-452b-9400-bbd803e2824a", "value": "d73af3d6_4f121de95f628648dd2792ea2a3b02e7e014ac8fd20027fecd7c19b47533c115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740ab25d-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377111, "uuid": "902b1f22-7a14-4d2a-8895-ce01c2359d5a", "comment": "Malware payload (Mirai)", "value": "ae9ea86754c37fd2b8e98bb7f5758946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377111, "uuid": "d9b523fe-427c-42ec-a10f-e737cc4b26f6", "comment": "Malware payload (Mirai)", "value": "4f466933ed40fe326a339048619ba0e0620989253d314fc0301366dca5a4838e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377111, "uuid": "73abc609-c2fd-41b9-bbce-204c0b139572", "comment": "Malware payload (Mirai)", "value": "214bdfd69c7252fab45894f33af8a6d1077b86de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377111, "uuid": "85a1f876-b89f-4e50-adb8-b65bc34b5b57", "comment": "Malware payload (Mirai)", "value": "8bd7acf0f12fd6d28d4167defbaf74b975c63398827bfd5d962571fdddda7c8b57d48c5d398818a40df9c44d8bec3f6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377111, "uuid": "c0bdee7a-0866-46ef-b27c-4133e14d0ca0", "value": "T159639D36E40A9DA4C0424634B0E5DE351FA3A9C043272DB6AFE442B61843EBCB55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377111, "uuid": "7d2844e9-cede-4796-89e6-52875502e954", "value": "1536:wam7dIbOF5lwtHAlpUvn64k/NLzHv25+hsCDR:wPubOPlg6Lvk+hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377111, "uuid": "6a27d1f6-fdef-4ebf-af98-80c3196a5a46", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377111, "uuid": "cb68ea09-e783-4f15-8bb5-db6ed3a47ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377111, "uuid": "a88ab669-78b8-41a1-a58f-5c0f25ca870a", "value": "ae9ea86754c37fd2b8e98bb7f5758946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8eadfbc-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377280, "uuid": "7f56bd90-fb1a-42ee-ae07-243778204629", "comment": "Malware payload (Mirai)", "value": "9e32ed8c9403be4cf22c1dee53c7da0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377280, "uuid": "98a2a146-dd2d-4d07-b25d-934becda02a4", "comment": "Malware payload (Mirai)", "value": "4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377280, "uuid": "063cb34d-a59f-487e-bd6d-892750966e8b", "comment": "Malware payload (Mirai)", "value": "91c086a6a71453600d1b3b894b4158a0377b6af1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377280, "uuid": "74e8ad92-21b2-48b7-8a34-819d53357ee7", "comment": "Malware payload (Mirai)", "value": "c31d99b9f0d46d885a22f5371b64990078bd728e2503ec3e613da273980df344c65377bc58fffe531eb4c45112036894", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377280, "uuid": "49eaa4ac-1786-4275-b420-f4f4f69e4cd2", "value": "T1A4E2E00EC8893B81F9EC4A3E8338E521CA7A72B7334F6B19A7644C889315586FD4C476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377280, "uuid": "e175957a-9391-49c8-8d70-94796afcf55e", "value": "768:GdI28u3wKNzyHtNc+9BT447b4AcAOjSSP624PSqgWMz3:qx8CNWH8eBTzaAaSSCCx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377280, "uuid": "6d6bc279-5477-49d6-a527-5ddf261ede44", "value": 33212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377280, "uuid": "337244f1-d30e-47f9-9202-4fb7d19f8d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377280, "uuid": "87964a91-a174-45f1-913d-817d46bc5ecf", "value": "9e32ed8c9403be4cf22c1dee53c7da0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178079b7-fe1d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685363642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363642, "uuid": "5b03625f-a5af-4493-8e4d-4d834e171d8a", "comment": "Malware payload (GuLoader)", "value": "1548cfef1962af9a18e0751f21324e6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363642, "uuid": "a5541a4e-0937-4d5c-bbc9-eb6162932969", "comment": "Malware payload (GuLoader)", "value": "50803eb43c6bd5d0f4f631169f2fad176e97e57aa1ffee306d7cb64a7479f7bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363642, "uuid": "2630059e-c235-4923-9ee7-216b42304842", "comment": "Malware payload (GuLoader)", "value": "3a59143105bdd6bfe0cfdc918bf58dec8bf4ca07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363642, "uuid": "d343ee1a-53d5-4807-a900-fabf70c9945a", "comment": "Malware payload (GuLoader)", "value": "6af20ad0fe3fea2d63186fb655d5fa0a26546911ad590333df25b4da7984767b5b67c3b544ba6f7e80c08716d68f3d4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363642, "uuid": "29f81d33-eb4d-426c-a526-3ba619bb2531", "value": "T10BD4B093B7074177E848A932B32B4BE36A732A8F93E541BA1151F73C51726311EDF226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363642, "uuid": "8f01d7c2-b591-4242-a34e-6140a14b4519", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363642, "uuid": "49c7504f-bd45-4885-8c64-696e448c7ad4", "value": "12288:Uoqqqqqqqqqqqqqqqqqqqqq0qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqN:U12KKD3UywPegHB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363642, "uuid": "4d854c4c-2322-4bfd-9bc6-06d5856d13b6", "value": 656885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363642, "uuid": "6c866b97-2bd7-48b5-a03f-3dc75aafc3ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363642, "uuid": "ec85e5d8-9a0d-44d4-853c-dc84052ac4de", "value": "Ramsay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0171d78c-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365322, "uuid": "875f2c55-5432-4c8d-9af4-34d23920d4ca", "comment": "Malware payload (Mirai)", "value": "5b0866c247d51c3fd8c648cf623659d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365322, "uuid": "bcfef930-d672-43f9-9274-1c52bd54ea88", "comment": "Malware payload (Mirai)", "value": "510bd4622e0878b1931cef2c3f0cba31ba5af84f2f1b6a0baf21476d831b7ee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365322, "uuid": "634f4692-c2cd-4e4b-b6e4-a32d9aae4c83", "comment": "Malware payload (Mirai)", "value": "d40f47331b201881914058ada6dd6beb7a3f6e6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365322, "uuid": "7aa8a54c-e27f-499a-b763-4ff1db98ed63", "comment": "Malware payload (Mirai)", "value": "e104ccb3d632b8590160e2c24dd83be3cf2ebcb7f7764b4f0e8052c9549154ce2cfb9fc6e248cb36832558b748e730f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365322, "uuid": "273d0270-7fe6-4355-854b-c4fdc21c3068", "value": "T15E731997F8C19F22C9D166BBFB1F4648732643ACD2EA72139D649F21378781A0E3B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365322, "uuid": "b9cd073a-cd0b-4fe3-a6fb-f2f9ed5b27d1", "value": "1536:8VVOHWifIPfpGqOeXS013jJFRdvI8XZUlqmFLb/43euc7T7/TsVercOWvY:IO1IXpoExJrdvNJ+9FLbQOuc7nbsGaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365322, "uuid": "143bca68-1bc5-40b4-b455-9c6306b65f29", "value": 78864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365322, "uuid": "f360f6d4-7c65-42e3-ae00-ac8092c3cf41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365322, "uuid": "496a3307-3ece-4882-af52-ef1174a85757", "value": "5b0866c247d51c3fd8c648cf623659d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfd7748-fe41-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685379086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379086, "uuid": "f5a32c12-4106-45ae-b49f-b778895b0574", "comment": "Malware payload", "value": "79441b006a2145fa62d02622400ac2e6", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379086, "uuid": "9849343e-54bd-4136-ab5b-8f182dc804a1", "comment": "Malware payload", "value": "512dc2e5252c2063a348f3475789b0cd02fce90c68f17845e3b99dd2fd8049e4", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379086, "uuid": "1069494c-7ebe-4b87-8bd9-ead54852d095", "comment": "Malware payload", "value": "89d8c2e884766d0e1d4e460903f7dae0075bbaf5", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379086, "uuid": "4dd692d1-e818-4e43-84c2-609f901222af", "comment": "Malware payload", "value": "10798d8d189d74031db181012207324477be361801179d685a40dbfaff4dd6be9914c036ef8c0354e7f24ce49198b6c9", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379086, "uuid": "7427174c-f3d7-4b70-9c5d-989abe2119e9", "value": "T1CB462322F7E1983BD161167C9C2B57A85D25BE001D28A48F3BE43FCD5F3A78136261A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379086, "uuid": "5e43c6e7-3b29-40da-bfc3-7b125eaceaf3", "value": "61a969b6362c5a896bbd9ca2a9ad934a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379086, "uuid": "8d49ad44-de72-4637-9a8b-83d2a9562e8f", "value": "49152:ybVKnrKEdSQZaH5GcLo3Fj/Z92N9QjCuX+kVoNkvMdm66w5HO6vrVlZruEk:y8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379086, "uuid": "0fca86a4-fe7b-491e-9e04-1c09858f3efc", "value": 5407840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379086, "uuid": "8e10bd5a-e4ba-4adf-b519-feb034ae83c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379086, "uuid": "434834e6-9f48-4eb5-b7f1-0944d6584199", "value": "Visualizarpdf-print-29052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351b915f-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346941, "uuid": "a6f6a070-9753-4399-968c-2e4c86202c74", "comment": "Malware payload (Amadey)", "value": "f7cf675d0aadc35bec0928426a4900ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346941, "uuid": "17f5d298-adcc-42fb-934d-90e72efe1ec7", "comment": "Malware payload (Amadey)", "value": "51f1cdc2eb8cc1984315c1089b4999e0d82e66d935f0b53e00779d0a70198dd8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346941, "uuid": "4772da1d-3fa6-486e-bf80-d92a403bb10d", "comment": "Malware payload (Amadey)", "value": "34e15221c77545ed86ee5fc5ac023a3bfabeb37a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346941, "uuid": "0ae2e341-a277-48f6-ae6b-7d888bae08fe", "comment": "Malware payload (Amadey)", "value": "4a00febe5690818c9e26fae8c2140b3ac8adccabeaca2a5e80b3347c4c5f01056a2f9b1a9b15c44d908febfbeaf019af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346941, "uuid": "98e7bc6c-7ed0-4c16-9be2-ec1b453a7596", "value": "T1FF052203B7E80123E9F41BB05CFA47831B3A7D628CB0825B3B855D4A1E72AC46D76767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346941, "uuid": "fbca9e02-2bcf-4005-ade1-b9dd296d30f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346941, "uuid": "13ce85ef-ad95-4c7a-b3b1-37a0cbad5c2d", "value": "24576:ey3tQjut30fp/N0aNRe+eALBZcS7De5eFnP6USmXQe:t3OjW33aNwD+BWSPxFnPBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346941, "uuid": "30f77383-edd5-4892-b62f-e8e9f915179c", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346941, "uuid": "1e787309-a657-480f-83b9-448f91c457bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346941, "uuid": "6b3ff85a-6988-48fa-8c78-5793c5f9ff6f", "value": "f7cf675d0aadc35bec0928426a4900ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3773ee71-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346945, "uuid": "21eaa272-be2c-48c6-aae2-675deab383a1", "comment": "Malware payload (RedLineStealer)", "value": "f877dbf24dfe65890d13bdf19e2d72bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346945, "uuid": "1ac73df3-64b7-4d91-a83c-2759d75b53cb", "comment": "Malware payload (RedLineStealer)", "value": "54b8619950fd7b656f45d0cf30e289e051b763d4e52be6cbdad97a3dbe6e5dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346945, "uuid": "baf67b72-0482-41a1-b896-cf7a042e69cc", "comment": "Malware payload (RedLineStealer)", "value": "7fe2de40800e7a199e2d4ea865ee72d031999e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346945, "uuid": "818b86eb-600b-4bb6-8228-986dc48ad2ff", "comment": "Malware payload (RedLineStealer)", "value": "b6853bcd7d18f2196df26457e8c618ada708d02ff8695019b875a3abd1f10536aa6b1dfda1b8c8f971f4758a15f81c1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346945, "uuid": "83d58eb0-6b99-4186-81a5-f93c884b4ab0", "value": "T19C052253E7F846A3DDB52BB0A4F603870B35BCB25D3543272345889E2DF2580A9B176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346945, "uuid": "5d103654-68f5-4d44-b336-8e5502141178", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346945, "uuid": "5bee3535-a69d-4cf7-8ada-65f2373cc6b9", "value": "12288:0MrSy9005E9BJzY4sR2ArLF3wqcb0A5CpmkNa1J+tX8Dfg1hee/nDEQ3US3qDI:eyR5+BC2YLFgqcIsTJ+5VneGnI6US/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346945, "uuid": "970b8b27-030a-4908-88f1-335e7368d491", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346945, "uuid": "2073ebb5-153f-4cda-a866-419a53b4b9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346945, "uuid": "bfc5d746-d212-4dc8-81f0-39ad39b5e823", "value": "f877dbf24dfe65890d13bdf19e2d72bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d328c2bd-fe32-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685372976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372976, "uuid": "cec260db-83d6-48b3-a7cb-ce1607a3fd85", "comment": "Malware payload (Mirai)", "value": "d2e8344f3a4fa5cc6af9e73dacc190d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372976, "uuid": "ea68f7c6-2157-425d-b918-0688978fc074", "comment": "Malware payload (Mirai)", "value": "54be7fe1c0f0d68e84d311c4a32e07029387a28307075849f87918b197f7eab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372976, "uuid": "3cd7a95b-8d0a-4efa-bdd8-6b67b6465bbb", "comment": "Malware payload (Mirai)", "value": "45f344c21c1afae0aaf5ab043bf12400844bfd2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372976, "uuid": "45a7d63d-af41-4f7d-afb7-ab8134824228", "comment": "Malware payload (Mirai)", "value": "1a54f4f83d554408ce73320760e24afb3041a29a1db4f92ac4fa4e5c2f6deb76876bcb5865bf7db605116dcc03fe2851", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372976, "uuid": "edfa37d9-a96e-44c6-80c6-09e65c5cc849", "value": "T1C9736CC5AA93DCF5DC100A353077FF319AB6F13E2169EB87D3A9A636AD42502E00725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372976, "uuid": "6f4075f1-b834-4fa3-9382-cb7767aaa708", "value": "1536:R/GfYklyNkSw0FLOsB2kPqaCM6dPrrl4zXU2SUnwh67S:FGAklyNFw0FLOqNPtefl47n5N7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685372976, "uuid": "c17fa734-3678-4471-9699-179ba8262e25", "value": 74608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685372976, "uuid": "f0081d15-6f94-43d8-ba5d-7bfd02b6bb59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372976, "uuid": "1f6ed867-ac7a-4a33-9ba5-9b02019618c5", "value": "orcod.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce22a54-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379703, "uuid": "6acb9242-d085-4511-a689-88686fa73bbb", "comment": "Malware payload (Mirai)", "value": "31d5ae02e4e7fe63d1a9d94a88dd5b1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379703, "uuid": "60fbe60f-8525-439c-b69f-ca72d01f73f6", "comment": "Malware payload (Mirai)", "value": "56cc1b14e934263c4e864bed49e1cdbd18f03527df7ec003fd6e5460f3384b6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379703, "uuid": "6d2aceea-ed41-4428-b5a6-d7c22bfd6ec4", "comment": "Malware payload (Mirai)", "value": "77a2398a018f4c234211c0efe0c9232304532816", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379703, "uuid": "57a81e70-c781-43f9-96d0-edefde2ccc7a", "comment": "Malware payload (Mirai)", "value": "e46106f536a6672da625ddfecef5dd931b6e3a312d782fb44ad569107fb389f1a04753fd38167535297a036f740fefb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379703, "uuid": "99f7b382-8616-4973-a45e-a2fb83f4a0eb", "value": "T12CD3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379703, "uuid": "692b0067-307d-46c0-9071-eb7fb2792f21", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+p6AOhmm/QMurB12CGNb:RrUlk6Xmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379703, "uuid": "44fca44b-01e0-4b51-89d5-33b0e86ab121", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379703, "uuid": "846b04b3-8119-46fc-a00c-770d4a6f4fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379703, "uuid": "c043d223-bdc1-498a-adfe-77909256f57f", "value": "31d5ae02e4e7fe63d1a9d94a88dd5b1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fce6e64-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685377131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377131, "uuid": "af37c4a5-e3f9-4029-93a1-f5b448f5db30", "comment": "Malware payload", "value": "4376753eb07f354080486e698bb2dae9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377131, "uuid": "f3c9169a-ffac-4a1f-b48c-69881d99c0b2", "comment": "Malware payload", "value": "595eec2c2faca8621db871abba067b6460d4cbdbf6208286f352f75d4638a8bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377131, "uuid": "6cfceed1-aee6-4b66-b0a4-9d9e305e2eb1", "comment": "Malware payload", "value": "f32b41b297aebb2fb2d2d5d1b7063abacdc9d57b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377131, "uuid": "208c8104-5755-422d-a93d-eb7cbeed9372", "comment": "Malware payload", "value": "4432cc1d10574b075c9f1d8bb54f3d3e230f2274241887076ef0e8d793cce6d17d0880a836e4ef65f550c4f933ad92e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377131, "uuid": "9dbd55f4-0e5e-416d-8abc-0ed2f3782a8a", "value": "T1EFA33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377131, "uuid": "bab74788-293b-4489-b661-9b279af17c3d", "value": "3072:iHobm0w+aSP+wUsGZmDYgTE+mBQO/IXZFW:iHo6+aGUsGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377131, "uuid": "193ac16d-7ed5-472b-9a84-ec44bfc07b94", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377131, "uuid": "af4a37c6-2090-479f-9788-2dd65fea456a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377131, "uuid": "eb241819-fb1c-4287-b37f-c9334d70f1b4", "value": "4376753eb07f354080486e698bb2dae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83adb1f6-fe1f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685364682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364682, "uuid": "d830b656-55ea-4aa0-b99b-ab0d0fede3fe", "comment": "Malware payload (Gafgyt)", "value": "d56c75587658d9134330cb071c8c9523", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364682, "uuid": "cf988a02-85d3-4cb4-a470-6dad8dc0bffb", "comment": "Malware payload (Gafgyt)", "value": "59d90ed186faf2c5635791f335a587fae4a069f7afed63241bf6625cf55afcd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364682, "uuid": "9b1a328f-7556-485d-96d6-7ccad566ff87", "comment": "Malware payload (Gafgyt)", "value": "aefaac8974478b4c954b3d6bd9ff18ede4c1bda4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364682, "uuid": "ddef49c8-3ef3-447b-80e9-e9ce3628194e", "comment": "Malware payload (Gafgyt)", "value": "0c46a04886b96e4272a8aaf7662bdcbaf8d7e27bcc7e80f68dbef2d4630856c8342b101a11eaea84fb2a171d9f1dd86e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364682, "uuid": "7d38a7bc-a190-493b-a6a2-f0be3c323574", "value": "T120836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364682, "uuid": "b0f758cf-958b-4c43-8e78-07441a8d58f1", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3X5uWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4X5uDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685364682, "uuid": "f9ee2403-debf-4e9d-a262-7facb306f800", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685364682, "uuid": "3fd379c2-deac-4aaa-8d17-edc85ebbd34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364682, "uuid": "68ec729c-9e0e-457a-a76e-9aedda7ab471", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5b4dd8-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "6dc3d19a-14fe-48b3-8843-ef8b20e339ba", "comment": "Malware payload (Mirai)", "value": "bbd02ea1ef17ae65bda37d5ac7ecf11e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "8885f7c2-900b-4fa7-8dbf-10456298ad62", "comment": "Malware payload (Mirai)", "value": "59f50cf6ab5ed34b748b2da7c44f9b4fce5322e39ff590928150e3de62b53823", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "5a788b29-64e9-4d6b-aaed-e22953b2147c", "comment": "Malware payload (Mirai)", "value": "f0bc6427f0e8b0ea8d462607dec9080797f21c41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "2786defe-21fe-466d-8136-e4dc47a78aea", "comment": "Malware payload (Mirai)", "value": "b858d2845708b9237bad120a4c2de7768a7a042f9793b482d8a895634b432acb5db3fe1662c61930ff27740a0b3f3799", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "09243578-5925-4b47-bbac-7448e6ef111f", "value": "T17A634B21BE712D1BC0D5A47B61F34324B2F1579A24B8CA1E3DB20E8DBF24A5076536F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "46398598-f3ae-4274-b0a5-d768e7d7adde", "value": "1536:1YeF9LT9yFXkLpGHjaB9JCEVg/zJylk5RCtF38Nx:yUgXk19V2JylUA38Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377182, "uuid": "aa858bb6-3953-45cf-a188-37ce870128aa", "value": 67352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377182, "uuid": "859775bf-c125-4581-bc89-64d17f6bcbff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "fb121165-20a6-4571-a1bc-12b428728a12", "value": "bbd02ea1ef17ae65bda37d5ac7ecf11e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb038ad-fe27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368215, "uuid": "8aeac797-451a-4e39-aa72-271860f882da", "comment": "Malware payload (Gafgyt)", "value": "16d47860ab120927068a0051800ffa85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368215, "uuid": "c192cbfb-0f1c-49df-94a6-49ccf6865d7e", "comment": "Malware payload (Gafgyt)", "value": "5a65d0ff5f881a911234effec2fa939ca565f39295f5910d0338b978026c4646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368215, "uuid": "0af538fb-412a-47a9-a2c3-143cded6a718", "comment": "Malware payload (Gafgyt)", "value": "3b3002b36461a772b6a2b9dd7567fcf75a0453a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368215, "uuid": "d91a8160-177e-4517-b547-723437531989", "comment": "Malware payload (Gafgyt)", "value": "f86066470187cc0bd4181e3988dfebd9daf8af9b2faa6de6344218d205baa7ba64262f8f8f71df3456e5b3e5f6be5c3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368215, "uuid": "9bf57eb7-689f-443a-aa9a-c35127210f30", "value": "T1E3930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368215, "uuid": "2ecce76c-ee76-4837-8a91-9f9a68f463bd", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36g262f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy36XNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368215, "uuid": "15a32e53-200f-44cb-bc47-eba2fe728d34", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368215, "uuid": "904a3f42-1e67-4321-a5db-c9c8cc6033d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368215, "uuid": "5f2e231f-ea63-4a5d-a006-2f3c3d4d2947", "value": "16d47860ab120927068a0051800ffa85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b885867e-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685354033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354033, "uuid": "eac9e7e6-60d6-4cb6-a941-243e8b018419", "comment": "Malware payload (AgentTesla)", "value": "171a5f5234f78de2cee613f535fac988", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354033, "uuid": "c191501e-0470-4aa2-a425-2cc7ad7e3d72", "comment": "Malware payload (AgentTesla)", "value": "5ab22e56eeec62218a25df2b827421b501188978e80fa4ec531479d38ea3f5f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354033, "uuid": "cbd7dd77-7892-4a02-992f-a358c40dac7d", "comment": "Malware payload (AgentTesla)", "value": "2d94e5f43e791c751fa0deddecc1817ec7ec88ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354033, "uuid": "931dc437-5ed9-470a-8eef-b2bea5497992", "comment": "Malware payload (AgentTesla)", "value": "0f36c5cc3781bf00ba19532d7bd3169124c65dfd3efc8480e34ef9416d727f052fbc0858affe6b36c868150632830040", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354033, "uuid": "5fd691a7-1427-471d-a40e-f6dedfd604fb", "value": "T137E4028476A66F62E67E4BF5183066B447FA659A3079F31E0CC7B0EE5961F400E90F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354033, "uuid": "8af31a70-2885-4690-bed4-27adbb939cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354033, "uuid": "36831cbf-d669-4ec4-9f37-a219327353f2", "value": "12288:cqzZBEP85ImmHmRibYhKuLgBwfhcYcS08qR2647ldjnoWKcXuLx9z+F0:X9BEP8LXi0hbguJcFSNI29ldjnQcXuLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354033, "uuid": "595684d0-f8b9-45ac-baf7-dc40a472d59b", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354033, "uuid": "e5612837-dca4-4a78-b1c6-511672a040cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354033, "uuid": "a1b53b73-1229-41e7-b8eb-a07a55110347", "value": "Revised Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c080576b-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346316, "uuid": "ed0b7b4b-2436-4515-94bd-67c8257d28e1", "comment": "Malware payload (RedLineStealer)", "value": "1ab271e89397291088b5469b6aca9828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346316, "uuid": "6a3b547f-b266-4344-9b99-c9434a6f749c", "comment": "Malware payload (RedLineStealer)", "value": "5b08be09c8886c8e8e4e8a0a969c810b2f05f47f7c657e5b86eeacf6eb12ae01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346316, "uuid": "289c7f7d-8747-427f-96fe-b32c54728948", "comment": "Malware payload (RedLineStealer)", "value": "31e4cb63a755f0e6b10c0261a332f092b0595dcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346316, "uuid": "1d1af9a8-d786-47fb-b97d-d1fd55528ca3", "comment": "Malware payload (RedLineStealer)", "value": "e5e0f6b3178968ec90a77ac4eaeee8aa9ef7cddb9485e23a87b4f3dff8b021b69847e51e0f94f619bfea3224ab8a9196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346316, "uuid": "8fa17ade-0f6e-4a15-901d-4f56a9621af6", "value": "T1AF052302A7E45163D9A61B7058F702C31F3ABD31DCB5436B6A8D5C2E4CB16C5AA3632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346316, "uuid": "b38c8800-1387-47b9-aea0-833c918941a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346316, "uuid": "e8189a82-f754-43dd-8e8f-8c9ce5946160", "value": "24576:7yGE6wx0EEBlwf2xuJPavXDeSnr6USUd:uGE6M0/jEPBSnrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346316, "uuid": "f7ee4d6d-7c2d-4db1-a42b-dc4702a04cba", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346316, "uuid": "914c9495-f8cb-423e-b8ea-6d4fe1f6b8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346316, "uuid": "7ba24a05-779e-4d79-a360-2d9ca8b8dd98", "value": "1ab271e89397291088b5469b6aca9828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cfc25b-fdbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685322145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322145, "uuid": "37df4647-ee1d-44fa-a631-06a7c085b2d2", "comment": "Malware payload", "value": "9df8954fa21b2fb3783b7644d52485ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322145, "uuid": "d1c9dd50-5f8e-4667-86ec-a8627798fba4", "comment": "Malware payload", "value": "5b11e2bc35ca9e6189dcaae53874356f7a6de628085dd76e6de14701a52f46d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322145, "uuid": "3eff4c15-c023-4b7c-a331-f4ba3686bd3d", "comment": "Malware payload", "value": "0c4f053d24d8636c7bc13a612c9f282f0444e4be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322145, "uuid": "5110c707-46d3-4d8b-aaaa-5e460bd44461", "comment": "Malware payload", "value": "d75d43607ff316e8be3840ea5401ba33850ec1901faa64c8e2ef16c8e507bcfda725306dd42c7b3125c78d63bfc1eeb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322145, "uuid": "7b113d8a-4fca-4c24-a429-9a7e3ab5724c", "value": "T1A6E0C70B4A60C8B1CC1802B80B63CE202369BB98D6C98B33DBA8007AA9002786491CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322145, "uuid": "29d027f7-7d2c-4aaf-923a-4678b0e6e612", "value": "6:idquvVg3F+X326PyDRH8ywdsG4CwtQZ/3tyelz:e1GSG6qDRHmdsG4CwW/dyeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685322145, "uuid": "c2471b79-b634-4c78-a507-9d1c68c85e9d", "value": 420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685322145, "uuid": "d9cfda96-d46b-449c-9abc-348d7a516de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322145, "uuid": "45d6ba02-3260-45b7-b9b5-70a8879ec2aa", "value": "EwPWNBML.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f1762c-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377170, "uuid": "58ed2147-a7e4-4048-b09a-924c228ab735", "comment": "Malware payload (Mirai)", "value": "2f68b90ff5bbdd0f9eba0d03b54a1ec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377170, "uuid": "692a76ea-986a-4352-a4fb-86aba3c9d567", "comment": "Malware payload (Mirai)", "value": "5b3e1175d5a0c6d53fd70044d6facfb3eb398be078088d01263fb89d56337919", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377170, "uuid": "5c8108e2-6352-4513-8356-7e1ba5d2a690", "comment": "Malware payload (Mirai)", "value": "4eda396ec3d418cacd27e5b1e341e49affa81c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377170, "uuid": "e7de5848-ab69-4bde-8a3f-fc07a9912656", "comment": "Malware payload (Mirai)", "value": "00b4ed24e7dfd20dc94f930d3efdbd87145c75726b64cb0c950048876d02b487b6507485c720b4a4067fc94db4bc27f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377170, "uuid": "d2a54a78-0938-44e7-bcd9-f3412ac405a5", "value": "T128A2DF0921CDED22D1B0803EE23CC357AEDB43A652FE31791E080B9DE49591AD7BA949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377170, "uuid": "8c22da98-472a-4e93-90f2-26adb13565e5", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbPmhymdGUop5hXz:Ypoh/DxCvhdR4IjWVFbSqs3UozJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377170, "uuid": "b94e7292-b4d3-406a-9d6d-4f68c8493f8a", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377170, "uuid": "a4acf0a8-e244-4ba3-9c39-eaee5e464320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377170, "uuid": "8704af19-827e-4581-8ef4-329bfb27298f", "value": "2f68b90ff5bbdd0f9eba0d03b54a1ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c46331c-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685376937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376937, "uuid": "3d442946-6c40-40b6-8460-9059579391cb", "comment": "Malware payload", "value": "7b49f3cc509244b5ae380ed596025774", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376937, "uuid": "9ec95149-f4ba-4506-b85c-3e6b21988b15", "comment": "Malware payload", "value": "5b92fbc1db4a644f96440ad7b6095f3a74266f3a800deda7d27d73e49c2b8667", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376937, "uuid": "86c1de5d-6461-4af5-9eb6-ba7945c7d1ee", "comment": "Malware payload", "value": "7e9c090ca8650a1c250fdc08749e1da74eff310a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376937, "uuid": "98d64c79-316a-42bf-9851-56977b1ba246", "comment": "Malware payload", "value": "0a46c4bd825ed319c5b4ca5c32e900e871db30714e9bddcc59af73dac648fbc6b07fc0c3b22991e96daad3960c3bbd3e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376937, "uuid": "5997c132-725c-44ab-9eaf-c38f787dc694", "value": "T155012D71C12D04E3C91ED9B2D00A2510CBA3A415391BDB8AA604D2FCA3090EA33F9923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376937, "uuid": "83831f58-f62f-40d0-94b2-25f8d01005fa", "value": "12:5jr6idMJl2jeWaf/ylIVOz7/1dvisoo6hPFY3tbH+XpxizyRpidjtaG:9midY+lbzhd6xFtops6qid5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376937, "uuid": "3110ceb7-3208-4d83-8f7e-05c358d837a6", "value": 674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376937, "uuid": "7d5bf8e1-6d9f-4fcd-a1ad-97755801f631", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376937, "uuid": "bb2d558b-8127-495f-915a-1dc4bf77a626", "value": "CBM_Vistoria82783048885553654586815.699179.38512..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d81f557-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363410, "uuid": "6a62a090-6db9-49c4-8ece-fe27012598a5", "comment": "Malware payload", "value": "fb2231f08c796f907a4baf27237c1502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363410, "uuid": "7c46fa7b-1d35-4f8d-9de6-abffa58fd80b", "comment": "Malware payload", "value": "5ba9f645a6630f92303e74e59bd929cd65ba7234bc542ece51aefa817a0e01a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363410, "uuid": "608549fe-583c-4308-bca0-1fad5662ab5d", "comment": "Malware payload", "value": "548006beddf08bbd08b565f44f55b7779e47125b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363410, "uuid": "9bb43838-8922-45ba-8c1b-abb9c472d5f9", "comment": "Malware payload", "value": "5f7be877514895e41c766015fff429f9117355127ffcb19049bcdde5a5e571a83f069818aff251532622d06f350bebb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363410, "uuid": "0697a992-f3e5-49f2-a113-dbc980785fb3", "value": "T1F874092293B544B0EF459C31A86E5B6E5539F9464F18AAD373D03D1EBA32BC1D83231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363410, "uuid": "a1751bf8-a711-4055-9056-3c41d3bfd249", "value": "92a07eb3b7b240a61c24caa04984d193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363410, "uuid": "0905f463-68a2-455b-8140-b62632a5f6a0", "value": "6144:N3dw8e009xCc4Vd3Ekkus5G5Gvj5D4W9:xdb09xToApOGvj5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363410, "uuid": "08759d96-3e14-4e1f-8732-d399a47d9cdd", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363410, "uuid": "69b218de-a650-4b06-ab10-62222f819bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363410, "uuid": "87483f8e-a042-4f6e-9413-1e6a5fc3ed3f", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.4013.8195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8497a7-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371035, "uuid": "e7dde28d-2a70-4fc1-92e7-8f8590199f05", "comment": "Malware payload (Mirai)", "value": "711c78ba81128f606a16eb20efff3d8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371035, "uuid": "cac287d1-49f5-4131-a9d3-54ba1f39b9cb", "comment": "Malware payload (Mirai)", "value": "5bc1716fe938e707c931e2ce5bee514d7ca1e80ec3d0fec6cb2bd2e033d9779c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371035, "uuid": "f6de43e3-b5bf-4667-bde0-53ce6b5005ef", "comment": "Malware payload (Mirai)", "value": "8bd5744e74e669159aed8d743853378688718c28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371035, "uuid": "a27b2661-6125-466c-b8b0-57829b2d9f08", "comment": "Malware payload (Mirai)", "value": "9096ba1c187cdfe5f368c9810733471ccb6e8da98e2d58ae9a55cf35977b80c9e3bbc080237d7d92a984794ba09a0596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371035, "uuid": "26d05ece-7465-4b14-9abb-d35cd2591eac", "value": "T13EF35C316C793E16C1D1A57F02BB4361F2E2278E3AE8C55D7DB20D0BEF157606412ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371035, "uuid": "262e61e0-1655-4ab1-9cb0-c39ebdbaf905", "value": "1536:JKH5zKe7uAkISKsPfjBU6qvBdwtKUlt/8jHfAJke1S/m0BxBhY1We1cHyaiilHnj:Je5mFI8U66Y03rBsYHtu8QUSL6JWrpYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371035, "uuid": "433260da-3be0-4ba6-8c57-52ba93023a52", "value": 161496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371035, "uuid": "e38c2946-e71d-4433-8b97-573a0d060e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371035, "uuid": "72b1fbfc-a670-4c47-8125-80d0761a6565", "value": "711c78ba81128f606a16eb20efff3d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89749d69-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363403, "uuid": "17f07baf-b54f-4394-814f-4dbb2ea65425", "comment": "Malware payload", "value": "aba8b492982341b71646fd6e54fc4612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363403, "uuid": "f972f68d-fe3d-42ee-bc48-707d6219cca6", "comment": "Malware payload", "value": "5d303ba63024abb58b2b34bd8c1f72612f03ca8ac3c1de3c0c44fa41bd1d95d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363403, "uuid": "5e9b10fc-edbb-4279-b736-b982ce25b865", "comment": "Malware payload", "value": "c9b7f2acef6122b853ba5117e3ae59c336caf3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363403, "uuid": "8ce42274-fb8a-49f2-b384-f561cbcba379", "comment": "Malware payload", "value": "33d4538ef182cef8602159e86224d5bfd6d5f2b4585b1c0ba53ff604e0f96fc859130413f2f1a031d34212b375d4017c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363403, "uuid": "4b56c7c6-c321-412e-b909-9f36dbdbf485", "value": "T1B7529313F76DD810F46A8AB64EB3C7F80573BC326D20951B36A4BF4E2D76A40681275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363403, "uuid": "5556d9ec-f203-470d-9e30-19302f1f8f7b", "value": "7ef50fde7b584febd5fcd2257e1201a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363403, "uuid": "ab718223-75b3-4e4e-84e0-9e2c0f89bbd3", "value": "192:8yXWw31dPOY24KPC8ijBE/boZrEKWj5Y/WDvpe:hNFL2pgjBEEZrEKWj5Y/WDvpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363403, "uuid": "037d35c1-81b6-4f87-99ba-331578bdb18e", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363403, "uuid": "50f0021a-cc95-4b78-8aec-6e1573c6d511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363403, "uuid": "114c2d33-b408-47b3-a93f-49bcca9a2f1c", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.29365.14919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46340fc3-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374028, "uuid": "56061d20-4731-4fdb-b373-4c946f43ef15", "comment": "Malware payload (Mirai)", "value": "93cc9e6d4f2de744ec9df86090b2c764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374028, "uuid": "94acfcc6-6265-4a5d-9696-3fb90868edcf", "comment": "Malware payload (Mirai)", "value": "5db1072bdf27b68763ec47ff7aa4ec78f4f47f22dfe44a699e7946ee346de821", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374028, "uuid": "3004f7eb-0071-4318-b596-27ddf3b415c2", "comment": "Malware payload (Mirai)", "value": "0ef66dbd2f6db9d618511ef24c2b510a5d504fe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374028, "uuid": "cc57a4d7-569d-43b0-8eb1-b64386486b29", "comment": "Malware payload (Mirai)", "value": "f38ab23bf0bf87709786722110aa241767286ff32aff7e0768cd3535be9ef4c0b87f8792f52785fb643bdc7c80b36eca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374028, "uuid": "5b183708-486e-40d8-b2c5-741702d59cb6", "value": "T132B3A1197F610FF7E8ABCC374AD92B46248C651A21A87BB5BD34D818F24B24F14E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374028, "uuid": "9824ed17-3044-4145-b4c6-42dd9e2159c5", "value": "1536:gMzYL15ZheRZpHpT94Ib/DvuhxSJZJTiOovhZ:gnLzZhkZBpTSsJ/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374028, "uuid": "5d37386f-bf72-4028-ba4a-c7f6fe42dd64", "value": 108872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374028, "uuid": "42287e49-9115-4c1b-a28c-a0f6eaa59fd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374028, "uuid": "ce4e2e9d-fb07-43df-ab1c-a6d32d2cf3a3", "value": "93cc9e6d4f2de744ec9df86090b2c764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4372fd8e-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685391203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391203, "uuid": "55f79aa9-8d5e-4624-baa2-cd182722d4d5", "comment": "Malware payload", "value": "56d8fdb3683ae232e13bd88a6b1235d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391203, "uuid": "3263f470-c341-44be-b953-e150f892dba4", "comment": "Malware payload", "value": "5f79066ea8731982dcd1d2f5cba63213ec60f5bed4937fc5992bf8b11cd53e96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391203, "uuid": "ec405374-7992-4bab-9b5e-f2c4dbb5fd27", "comment": "Malware payload", "value": "02e83f031659e9a18f914508c12e04b7b1f9d484", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391203, "uuid": "2edd0843-0b5e-44cb-860c-988010d0f8c1", "comment": "Malware payload", "value": "402e924fc8605e5df8c8044d7d0efe702929a81d28407a31fc0ef56c8ebbd0b6d9b98c906314299938c23ef62b6e26a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391203, "uuid": "29f10771-3452-446b-b33b-538ee6b95650", "value": "T14BC4BE4266D07C60F6264A718E2EC6E87E1EF9504F5577A71358EAAF0B732B2C172370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391203, "uuid": "f900bc47-4f7b-4ebc-b7a1-8cce56f00f9b", "value": "1b92b40b68088f344c60bb50fd5ded79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391203, "uuid": "b72842b1-aa61-428d-85c6-d13b96fe051a", "value": "12288:KFkipMS+lXkHjnKMF2ECz/FWqjsycmjVxG:KFkdS+lUHjnniQmjVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391203, "uuid": "4e65a6cd-dca4-466a-9533-d5f7528f44dd", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391203, "uuid": "bf1e2354-51e0-443c-aa43-33bdba72e9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391203, "uuid": "68eb9b7d-96aa-42a8-ba87-5f1b09f9163a", "value": "56d8fdb3683ae232e13bd88a6b1235d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97172478-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685348394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348394, "uuid": "28a2cc5c-1004-4199-b39e-765792bda9a3", "comment": "Malware payload (CoinMiner)", "value": "ec3150c2a9fb5e2011ec8f2653f46dde", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348394, "uuid": "578cffb6-d532-4f9e-b9aa-20c02d9e85e2", "comment": "Malware payload (CoinMiner)", "value": "5fd8247a8e7d25652a04145f08d557ad1203874d44a6c73a86698552a36aa334", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348394, "uuid": "c846765c-4676-4320-a215-ec1a5ca0a87b", "comment": "Malware payload (CoinMiner)", "value": "7d5d76fdaa73dd10fa25c5dca169476e19757fbf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348394, "uuid": "f3612be0-8924-412b-a5fe-be8367bb1f64", "comment": "Malware payload (CoinMiner)", "value": "c8065456256a32ce508826acf23250faa7592285e9330c021717fb09d0ebf03d9da7f6b7df174d3432164e624a69fe29", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348394, "uuid": "889a23fd-fd2f-48e0-81f6-8ff38345a30c", "value": "T1E956D00E618D18A0F80B3BFBC1317FAB47152C9289278929CAF5B459053F4DB9D562EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348394, "uuid": "e56e3495-06b7-4076-ac7b-079ad3d33291", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348394, "uuid": "ff721396-5392-451b-9510-fbeae43a4041", "value": "98304:rpswnk/VMr7p++DjfoAN+GSkK7YJtycn2RbMFkM1SXrJqhcOdVKxkREt0+TuL:h4VMvpHjfd+GS9yEOcbML10JCJwxkON0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348394, "uuid": "2d0773db-98c7-462c-9588-701a897daef8", "value": 6088192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348394, "uuid": "e9b3770e-3788-4432-beb9-dd33c79e4ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348394, "uuid": "c7d205bd-93f5-4c76-9062-85d6740db21f", "value": "01587199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ae6b5d-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685354035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354035, "uuid": "2d0c9c31-c58e-45ff-9b69-d4b519f667f0", "comment": "Malware payload", "value": "dd9ab64e2c0d8b8b359e795dfbb38108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354035, "uuid": "76d660c9-b2c2-47e4-9d89-5a4cd18e5245", "comment": "Malware payload", "value": "5ffa793430dd1f555f553ad327be2f10791d32bc47b76671432f51f07427439b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354035, "uuid": "9784014d-2c1b-4bc5-a3a9-9639364c7e56", "comment": "Malware payload", "value": "e34d4c6c46ec61b618b648a051337fdd3bb570ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354035, "uuid": "b276487f-4b73-4f9f-af36-172078903715", "comment": "Malware payload", "value": "567d4780277a39616ccaaf2e3ec0e696737729728e2f9348f697daa6d178a08e9cff3ea54a5c1f198ef18313cc1ea955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354035, "uuid": "cdf35960-ad9e-4e09-9af9-8667cbb1de0f", "value": "T1641432F871E2E279C81582312E647C7157F14EA0DDB1A915EDECF9E0D630EF62B22606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354035, "uuid": "613eecf1-935f-4723-b14b-4ff612dd64a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354035, "uuid": "f82bb48a-0931-4920-b553-e3b98bcea9e7", "value": "3072:umKlbConONL1Y111111405kKjdGKfxvPXj5:lubCogLXaxhvj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354035, "uuid": "c579044e-ec9f-4337-9f5c-347f981c81dd", "value": 206400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354035, "uuid": "8903b767-df84-4d1d-a9e2-a3f1c5613625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354035, "uuid": "5ac8354d-9e46-456c-beec-95dcf3e91cdd", "value": "SCAN_DOC_003930_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e8c333-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685387575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387575, "uuid": "3626a712-f3b4-4ff9-8b0c-2bd9317e17a0", "comment": "Malware payload (Amadey)", "value": "6392f9473488585adf633a7fde82f28b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387575, "uuid": "0b042695-67eb-44fd-b4fe-97e403380d4c", "comment": "Malware payload (Amadey)", "value": "620dcb6d3c34f6627fed65ebb049b59faf86bde0e42a2425de1f16485f344082", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387575, "uuid": "76210a8d-2693-4f50-a006-b71a9ea5ef4e", "comment": "Malware payload (Amadey)", "value": "0d3f16c438aa7d3a8890b6f5e77e484450799090", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387575, "uuid": "5f95a7b3-0cef-4da0-9f9b-651fa3745b7b", "comment": "Malware payload (Amadey)", "value": "4d1eaa642b0220140c9e669feedb76ad2aa84346161bd665ba54e5eca8b9ebc50d974c3f8652f3ddc73c8fc04950dc2d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387575, "uuid": "4300109a-6387-4e8c-81e7-c75739403d20", "value": "T1D2352395F2EC5022E5711BB448F317D30B36B8E1EC72868F3654694E9CB38886E71B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387575, "uuid": "8fac6329-6c42-4294-903b-ab9b5c373fa2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387575, "uuid": "5c2c6ec9-1074-4fdd-9603-3f0b1f9e24b0", "value": "24576:HyN3Enqag3R/rgZQiIlnf9I8wZelAnZnA0Eb:SN3ERWR06i2f9I8UCYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387575, "uuid": "b7b0637c-6998-44a2-ae0a-50a6c2ab72a8", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387575, "uuid": "372379b0-4382-467c-87f0-84bdf140c4d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387575, "uuid": "a194be1b-5538-4697-b8be-c0cc7f624626", "value": "06777499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03ac4cd-fe22-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685366099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685366099, "uuid": "73da55d1-0b98-4856-bde6-7b70f5235e47", "comment": "Malware payload (Gafgyt)", "value": "893fa613edbba07f7510150d8b819b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685366099, "uuid": "7837b2e4-85ff-4c90-bb6b-c47307fe47b4", "comment": "Malware payload (Gafgyt)", "value": "629d81986bb01d49eaec5ec578c721e7184ba428d6e3d69efd3401b42b908e72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685366099, "uuid": "f71e9b95-cd19-47fa-ad8b-cf9a650e3356", "comment": "Malware payload (Gafgyt)", "value": "eef1681582fea1316a94ebb33cf014c5c1b1cd53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685366099, "uuid": "a0dfb8ab-8568-4778-adad-28e2d439a105", "comment": "Malware payload (Gafgyt)", "value": "064291960d48cea21e30a382a7f81a7093de17db320486c3f1630473a52babe66a012529a67fe9d44d552fb80ee58cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685366099, "uuid": "01435f6d-b175-4ce8-bb40-2dec7f1ef67b", "value": "T16BC309176693CDFAC0434B796B8EE05374B2FD3F073A61026782FE642F35AA5598A311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685366099, "uuid": "aadcf465-1399-4430-89c3-7cbedba37979", "value": "3072:wVcF7W39zGB0q9pd8vCWmMh+zJaQJn1eRlVUncRSdws:wEMCBW+bn1eRlVUncRSdws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685366099, "uuid": "2e125b2c-5c6b-4ebb-ac93-c8d1f2b1e1db", "value": 128713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685366099, "uuid": "8ec8170e-b582-40f7-82b9-9d0cfc8b7fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685366099, "uuid": "a5242c42-e9a5-4290-a731-b8c120b39193", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fbbd1f-fe3d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Generic)", "timestamp": 1685377710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377710, "uuid": "b0ea03ad-3c1c-41d5-aad1-c8a9afdb9592", "comment": "Malware payload (Adware.Generic)", "value": "779b81e667cc424249463b56a17889c9", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377710, "uuid": "7d9023ef-3d4e-41f9-b1b0-7e23768b8859", "comment": "Malware payload (Adware.Generic)", "value": "63fe94f5903f4d969dd1e3032497a9f7ed693410a1a58a9857aaf22826bb0115", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377710, "uuid": "1cc86208-0ffb-4127-86ee-a32592c63d37", "comment": "Malware payload (Adware.Generic)", "value": "debef05000eb4326822a7a139004476b3a6d8182", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377710, "uuid": "6dc9da89-d735-485c-a5f4-9888c86ffeb6", "comment": "Malware payload (Adware.Generic)", "value": "273179f7e149e11174349188c585482351958a433e9e797e074879300dd47b776ec7b4cbcf388d45d25b0e88ee19001e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377710, "uuid": "86b1e0cb-59ea-4f22-8f74-98ded138081a", "value": "T14B75BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377710, "uuid": "b4f254d7-406b-4175-a305-1120ad1161c5", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377710, "uuid": "2ca2f1b9-b8d6-43f5-a5b2-477505429b13", "value": "24576:s7FUDowAyrTVE3U5F/3nKic6QL3E2vVsjECUAQT45deRV9RI:sBuZrEUTKIy029s4C1eH9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377710, "uuid": "432197d8-7950-4cf5-963c-216d70666e5d", "value": 1673138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377710, "uuid": "7b32416b-e767-4cbb-9a27-2268eb149380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377710, "uuid": "9ffaa4f7-e3ea-4b25-aac2-433e03f86ee8", "value": "SecuriteInfo.com.Win32.Trojan-gen.31777.10021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26adc8ab-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685371398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371398, "uuid": "e14b08e5-0503-45f6-8f5c-b59ece6fb3f3", "comment": "Malware payload (Fabookie)", "value": "8a8c08155bce86d582d32eee9defcfcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371398, "uuid": "01f0a4d0-c3ef-4c98-a55c-708794df0ba2", "comment": "Malware payload (Fabookie)", "value": "642431ee850811f23e1ac8ab13524a669d4c6ebe1704792879621e2746c05939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371398, "uuid": "01688390-d167-4000-bbdd-3dbbaccb0374", "comment": "Malware payload (Fabookie)", "value": "ce7cee3f525507323ad0cbb61da23cf4115d0521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371398, "uuid": "c72a0704-a885-4cd0-801f-aa2f84e8642d", "comment": "Malware payload (Fabookie)", "value": "f9a2b1272ac488e8157d3eaa9d5e747f27a9a7c26f430f380d0f20a7c87b8ea4f80de90c7d7b86c18cfa106f4fbe7a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371398, "uuid": "cf37dc22-2fe7-4d79-a23c-08099d505d1f", "value": "T18B24DF2172E815F9D67A4130DA235737CBF3BC5419286B2F12A0CB5A1F3251ABE1EB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371398, "uuid": "69fbe801-3a43-4878-be5a-ebeca3a9dece", "value": "43a39bb2bf8e4b5d75b452af52201829", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371398, "uuid": "c5245855-c675-46e1-94ca-96e655b902c4", "value": "3072:DVFE/flYeQ6DRePKEywh8QUEH2e1zJLgf7nDVF6PUp1Yo3ICgy:IlYeDRChyI8rETz5gfzDVlVXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371398, "uuid": "280d2c7c-0f94-4b17-bb94-66ef938fc6da", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371398, "uuid": "4f485926-daca-4796-b98a-7eb5851a156f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371398, "uuid": "ff62475a-66bb-470a-83e4-67ad5391d93c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd4bf27-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362414, "uuid": "1e6026e7-5493-40cb-9cc1-c774e17d0ebe", "comment": "Malware payload (Mirai)", "value": "05464a663c0d43b3471d2fbfd1fa076c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362414, "uuid": "7d32c2c7-594e-44e8-82e2-8baede585ff3", "comment": "Malware payload (Mirai)", "value": "6465ce91939c5987313e989d65e19381214de7ba027f87fcc3709f2f0adc13ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362414, "uuid": "2b2f8310-506b-4e21-8c97-3aa186f3abda", "comment": "Malware payload (Mirai)", "value": "f029bb8add0738d4884cfb3b9488472db7d8c3e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362414, "uuid": "f249001f-14bf-4bd3-b5f9-200fff1a3a9e", "comment": "Malware payload (Mirai)", "value": "42bc4f61150312a7f14b4991bb046b21f6d4cdcb524396554ab5221abc1efe6b2199844f509783623bf749e7bb00e60c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362414, "uuid": "96387c94-7e1c-426c-b461-1052c11edf9e", "value": "T11473980A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362414, "uuid": "5c7be6f7-3242-415f-a164-e94fa3a11339", "value": "1536:HogWL2T87i8qXc3SEyNlnXLKgLhaV4+6uHO/YQBSmP9AAGd42+Is:HoB2T2qX4+JXLKgLwV4+6B/YQBSmP9/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362414, "uuid": "74c13267-e5bc-4908-9c79-3f90b38f4335", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362414, "uuid": "5ef24456-545e-4d30-a6d7-09318f2a28dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362414, "uuid": "3d425045-0d6b-44de-87a6-88faeeee8e73", "value": "05464a663c0d43b3471d2fbfd1fa076c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3d00ef-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346629, "uuid": "5cc3536f-7560-4f9f-a503-e96d685e466a", "comment": "Malware payload (RedLineStealer)", "value": "696aabf661e3522b3ee2f1ec238cb7ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346629, "uuid": "538f3260-267d-46fc-8baa-1b5a0066363e", "comment": "Malware payload (RedLineStealer)", "value": "646648a3568c4af7e3f5f4d2b87d33bdd9be49ce9f9a228dafdcad0c7c3d2546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346629, "uuid": "964d9a81-99f4-4b72-bcb9-8ccaa85e1bfd", "comment": "Malware payload (RedLineStealer)", "value": "ba9a3056d054afc9b793c77b1034e6c36444b90f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346629, "uuid": "7bee2e1e-fa71-4af7-9f08-22aab2f2eed0", "comment": "Malware payload (RedLineStealer)", "value": "ee533eafee7fab3627bab17eafab94712e5fe858fbff21b8b9b79074540ef8cbcd49a9c339a62ce634a90eec39f36905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346629, "uuid": "e6da528f-f724-411a-b1f2-135516a5ee68", "value": "T1D9052343EBE905A3D8B51B7028F343831B3ABC91AC74426B6755A45F0DB3E95263237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346629, "uuid": "a240bf56-ea4b-460f-897f-93b9d9a6cbd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346629, "uuid": "ce6417a6-8ffc-4d68-8196-94d077d7d2c6", "value": "12288:8Mray90gvdWPjTD3lNqaTs4D54ZjD+V9Kp3u9wTiKoTPUBvBgfFJhe3YnSEQ3US/:myFvdW77q0sakD+/1wlmDeInr6USgRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346629, "uuid": "73455926-26d4-4136-a93a-3ef873479293", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346629, "uuid": "782738cc-cb81-4e8b-9a9a-8cf9ef9e183a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346629, "uuid": "4194127b-2a66-41ed-856a-2e1d84eca89f", "value": "696aabf661e3522b3ee2f1ec238cb7ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ba5de9-fe1f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1685364608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364608, "uuid": "1c0900e9-37e5-42dc-9651-33c85a327656", "comment": "Malware payload (MassLogger)", "value": "60ded0642762a22d14b26c053040c9d5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364608, "uuid": "239cc7e9-175e-48bc-9efc-a5d9a6e87ef5", "comment": "Malware payload (MassLogger)", "value": "64993027a06a6816de87236edd01f75852bbd6bd593eaf9ab40b8825dfc41744", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364608, "uuid": "0f88d09a-ec41-4763-9060-e9cb737271fd", "comment": "Malware payload (MassLogger)", "value": "a7f3a91ba5ca3e3d70f97be2fb2ee2fd77ba1eda", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364608, "uuid": "08609e64-4186-4047-9826-90c99e333caf", "comment": "Malware payload (MassLogger)", "value": "0b10ccb806ee577b907dc466b19c56c39aa58e1d7660d975c84692b63cfa7a791075dad230396dc4da2e1770b3519712", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364608, "uuid": "87cfb016-56ec-4062-a576-abc9a32750cd", "value": "T110735C13B94ACD5BE01D96B86E92DEE87724BF18AC44DBD732903F8EBC741A14C52352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364608, "uuid": "80ad6bce-f8d5-49cf-b162-0dee0d36e7a0", "value": "1536:ZN4qLY0xLg+MMNWH/bw3PeLKKKKKKKKKKKKKKKKKKKKKKKKKgxrtAl1UV6h7c:D1L9g+dcHs2LKKKKKKKKKKKKKKKKKKKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685364608, "uuid": "d617e763-021d-4f99-b245-912c41b77549", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685364608, "uuid": "e5e1a0d0-cc95-4914-8e8a-8645a95423a8", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364608, "uuid": "31ce6241-ea1e-41e8-918c-a8a1f01bb648", "value": "PO29-09123.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577741ca-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685374057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374057, "uuid": "e7647a94-ff9c-4b14-b4d5-f4bc83fd89d1", "comment": "Malware payload (Gafgyt)", "value": "605c2613bc30fd3cede9b4a9aa6dff3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374057, "uuid": "888cf998-4fee-4682-90d4-46479e9ca3aa", "comment": "Malware payload (Gafgyt)", "value": "64c6f5039b72a83c7f81b094177ddf675c73a8cbdb0fae6f3f55f528213d1c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374057, "uuid": "e38d2434-a3aa-4a19-82d7-65e21c5fbc52", "comment": "Malware payload (Gafgyt)", "value": "777cdc7e0f89444669a00d43ae2b8d01bef92dbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374057, "uuid": "3631fc58-7bb5-4f8d-8187-248ac7c27946", "comment": "Malware payload (Gafgyt)", "value": "dab6940625fb9894b87e2ca8fbaf4ce7611e4fb408f784569a0f15c92c62be6e206bcfa1c1660446a4d7a0eaf92f049a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374057, "uuid": "8dd770a8-f687-41a5-bf27-5836e46a4daa", "value": "T148B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374057, "uuid": "7328a7ce-1968-45f7-a7f8-7fb20d2e73f3", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPMJmDk1c8xF6KjW:jfO8IBVJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374057, "uuid": "3d760f8d-ef07-476d-a55a-da44d202f809", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374057, "uuid": "54d8a7fd-8a2a-4796-bff3-7718f0e7f475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374057, "uuid": "d6017caf-b901-4dbc-ba96-67bc75f647c5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da818fe-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374040, "uuid": "381cc02a-8a88-433e-803a-340a68bdfc50", "comment": "Malware payload (Mirai)", "value": "8fcf024c65458da1aa1e47dc3bcf4738", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374040, "uuid": "45b42633-5f66-4249-9695-6009ed708c50", "comment": "Malware payload (Mirai)", "value": "658f77e7854641dd637c31b007166dea4ec7091d6a00f0cb00b417d2ba00cccd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374040, "uuid": "6f497309-f095-44a1-b390-5ca9a9863102", "comment": "Malware payload (Mirai)", "value": "0f914d427dba30cd8e7f89b26c07b68ac2d35f04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374040, "uuid": "c2b3268b-9cad-480e-95ee-7e5825a62c54", "comment": "Malware payload (Mirai)", "value": "7399388a1205db1402d74e6ceb24fb69525f259792d94476511254ae87c7b7630ad72f8360e8a1f60a5177b7e8e0bfb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374040, "uuid": "9af402dd-58b8-4b1e-a810-84465fdd215e", "value": "T150836A25BC792E13C0D4A43F22B78325B2E5230E25F4CA1DBD760E8EFF196A024575B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374040, "uuid": "3a11070c-cf4b-440f-bb01-d225ba2e6d75", "value": "1536:bKMo/69SyAXsE3QdMvjpt4jlzOEGQuN6GMs0oUAOw18:2hCsZ6M7pgzrGzN6Ns07Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374040, "uuid": "04c3d804-1a72-4a24-9562-3fa9fc4d6f4a", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374040, "uuid": "a327711d-44ea-4979-8f55-7ce86506cb78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374040, "uuid": "f65d81e7-c17f-45cb-aecc-20b1f30ced2c", "value": "8fcf024c65458da1aa1e47dc3bcf4738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a5a2ea-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391155, "uuid": "bcdf9a70-1835-4a8b-bdec-247cce829808", "comment": "Malware payload (Mirai)", "value": "20a117261e6f4debf72f7542dc9cae3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391155, "uuid": "57c23a93-e8aa-455d-a166-8c93f30cf7cd", "comment": "Malware payload (Mirai)", "value": "65a1c2f04a84116fb78055b8bd8338505ce22e72a396914def1faa64907d010c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391155, "uuid": "72a94532-bb03-4a12-af9e-7f0e94e90674", "comment": "Malware payload (Mirai)", "value": "a4beb7ec19582d8f0ebee2dc8e6d9bb6cc5affc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391155, "uuid": "fd0c90b9-5e89-4762-a751-bdbba2e2916d", "comment": "Malware payload (Mirai)", "value": "e5d3533cea112066dada4d735302743714d9f34fb9ad08488e4b195b11f936879372df920d1440915dbeb35158f8560b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391155, "uuid": "a4e6499e-ea8d-4504-8ddb-f27c604d173e", "value": "T119E2F124E00C1FC5F9FBFDB015AD62E6F1ECDEA99F9AD4669162AE401583131A301ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391155, "uuid": "729f4798-ac47-4c7b-bcc8-69b3d59a6034", "value": "768:btBN4QwjNAOqTQPUDxqAfTik+2pNO81KdrG4uVcqgw0RTWXd7:V4QmN8DkATZ+w1s64u+qgw01WXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391155, "uuid": "100a8a48-aa55-41b4-84c4-31721cd476ce", "value": 32148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391155, "uuid": "66747168-04a7-4858-a141-f71396e15fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391155, "uuid": "f09c1b82-9564-42dd-a60f-7ba50eb7aac8", "value": "20a117261e6f4debf72f7542dc9cae3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a816de-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377241, "uuid": "820f0d35-5f85-4d56-b386-4ac530f8b0ce", "comment": "Malware payload (Gafgyt)", "value": "206090966e6d4a7cb3895458dffcce0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377241, "uuid": "b48b6862-db4e-4b77-843c-432a06c10973", "comment": "Malware payload (Gafgyt)", "value": "663051025d389c38512ffd1c26bda756cff1ae29eda27bd586a5a9526e857644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377241, "uuid": "f08a22a3-8153-47fc-b867-aac3baeabb30", "comment": "Malware payload (Gafgyt)", "value": "ae66c5e5e724009c2bc5e7402261ed5e618900dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377241, "uuid": "3dea7d30-ca74-4c88-9a3e-b30d00168ef2", "comment": "Malware payload (Gafgyt)", "value": "8c066d32bab6e1b11d3f4c5c5a06db36b1c4a7996235b9ef9b9411adfda4acc19527e566d6a0eb7482471294ce27b345", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377241, "uuid": "dc9bff84-03ab-4813-82c0-fe6ad90c7704", "value": "T1E2830797B901EAB7F40ED67604D74B247230FB624E931A32731779A6AE362D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377241, "uuid": "5688e1bb-f8d5-4c11-a890-0b35388a659b", "value": "1536:uoEA0hVJxW/93584AWzab0y79N1xK19OTetUvZGJifUImzS02q2/cOfBgj:/H64/Nnzab0y79NPI9+GJemu02q2EOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377241, "uuid": "3f5d6d9b-c3df-4dd0-9669-ed2004bd1e43", "value": 86519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377241, "uuid": "5089dd3d-79da-4791-80eb-565e6f84e758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377241, "uuid": "f76a2113-32b1-4acb-b448-756093b08183", "value": "206090966e6d4a7cb3895458dffcce0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7cdcd4-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346928, "uuid": "bf6704b7-0eba-4c09-acaf-5f036578902d", "comment": "Malware payload (Amadey)", "value": "d3827eb206277ef7abc812c85b93efa4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346928, "uuid": "3ede74f7-cd8e-4899-87fb-c5a0124164b7", "comment": "Malware payload (Amadey)", "value": "66472a3669acb63ac6513937e09f1200e8734fa52924838956764a3a597a2c1a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346928, "uuid": "f5d410a8-6bac-409a-8aa2-70312bcf4509", "comment": "Malware payload (Amadey)", "value": "f5fcc1ead4230c4c4fef9e179c34598a40982ae7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346928, "uuid": "3b49f771-1773-4ee0-8f59-cbd911ed38e3", "comment": "Malware payload (Amadey)", "value": "16848fbd61b1bb0ee2cc5a3d19fddbf28f09deae1fd841ae7c208b436c8b51c711096c0ad5567914fd52e05f261dd02f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346928, "uuid": "66c92795-39ea-4bf0-8946-9891305cfc6f", "value": "T118051247E7D44033E9B40B7068F206432A35BCB6DD7447973799AA4A2CB3294A9B173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346928, "uuid": "6b6437d9-9278-4f95-811b-8876177888ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346928, "uuid": "0e3ded83-bcd5-4ccf-8d7c-f2d29effdf32", "value": "12288:cMrby90O2Rc6EOJTrJzV8dlN2CUBqmI5TOK1M6J/J6gFGSfHxheepn0EQ3US1cfW:Pyl6zJNV8dz2CaC31MSTFLeSnF6US1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346928, "uuid": "5b99edcf-f7be-4a3c-85cc-a1ce3e2652d2", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346928, "uuid": "c0539f6e-6dee-4c45-9900-9c6a77573a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346928, "uuid": "bbead981-448b-431e-b07d-066b97bd0a00", "value": "d3827eb206277ef7abc812c85b93efa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ba2c2f-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685346704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346704, "uuid": "60cba9e0-d1cb-4fb2-b0c5-3e402417bc6a", "comment": "Malware payload (Smoke Loader)", "value": "e0ffa7d71c70c4ef2cddf0fa8d951128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346704, "uuid": "df596f9e-ce1d-4bb4-a44c-d460e59fe28a", "comment": "Malware payload (Smoke Loader)", "value": "6667500156d0b0d81fb98d32794c8c50de82fc915d2a59780e9b6e1b9f78ada7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346704, "uuid": "2f868e71-478b-46e5-8d5b-f257d414a66c", "comment": "Malware payload (Smoke Loader)", "value": "c3b551a21122c3c7af237b2fa10ebaa5a2516c67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346704, "uuid": "d9587e79-adae-4f77-87a8-bc01c2724ec6", "comment": "Malware payload (Smoke Loader)", "value": "1e4ed1e30d4261b00081e49366aec4bb4ba6d7b8d28665ab551caf3d2c4cdbf4ce498253f221c87106ed848f395b1b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346704, "uuid": "ffd0dea7-8c59-4404-8252-372c0008e142", "value": "T158642A12A3F17C67F5264A329E2EC6E8771DF9504F5977A713189A2F08722A2C17233D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346704, "uuid": "db1a025d-059f-4bf1-87fc-5d5b0f92664d", "value": "1552eebb89b3841e6a330c0c93657732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346704, "uuid": "2da77f07-a495-448e-970b-e9516f1de04a", "value": "3072:ANNNCapZyUHLiDUuhpYKvLq9FevbL589w5GsGBxvyX4x1ff1M:eNpL/iXYWLq9FeHwvs6x2Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346704, "uuid": "9e9f5531-459c-4c81-aee8-f0d76fd0a7c0", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346704, "uuid": "326eacf5-4263-4e2d-a305-09950d1c9b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346704, "uuid": "eaf2e2c8-550a-47da-8989-a27d6b4c72f1", "value": "renew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0dfad7-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685348647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348647, "uuid": "315db2b5-a53b-4bea-91af-c686d34b582e", "comment": "Malware payload (Stop)", "value": "a39813388b99c7886ac51b36284b56ec", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348647, "uuid": "54fd045f-1d21-417e-8e51-9d8bb9ba5b23", "comment": "Malware payload (Stop)", "value": "6767263e2e3b69d94eea6a97de170097a8af42de5ccb476f8475f8414b931728", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348647, "uuid": "59e60b84-ba26-4637-b4cc-e8af1e39faeb", "comment": "Malware payload (Stop)", "value": "7320ed49d0fe37d685b8a6d5461ab74c1f9938f8", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348647, "uuid": "4212a898-0a3c-4135-add3-a7dcef5349e2", "comment": "Malware payload (Stop)", "value": "f0b0bedb04dd1850f9e9d9da2c55477bb929f4e989823b018ca1edf84c98dd0e670824dcb5da5103d32bdd6754b3e25b", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348647, "uuid": "ff2e3e4b-b09c-4869-b3e8-08e66040c302", "value": "T18105D013A2E17D65FA660B759E2FC6E8771EF5104F593BE71318AA2F05702A2C272331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348647, "uuid": "a8907fd7-ae7a-43b3-8e8e-11d421506693", "value": "1552eebb89b3841e6a330c0c93657732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348647, "uuid": "dfa332ff-d04f-43b3-8804-ea235927f907", "value": "12288:T+1xoXCaz3OLkvPbjN9FgyHkmD+o8PqJ7GdnFs7hUyXHwu8+bHb/1O:T+1gL3U+Pzxxj6k7bhBXHwzQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348647, "uuid": "98c37c08-fcab-4535-942e-5dd8e8b24a27", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348647, "uuid": "b6d0063e-3a64-4720-80a4-e4fcf7a98993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348647, "uuid": "1699452a-fd60-49eb-8fb1-19644ffe7b3c", "value": "06941699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d099f903-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377266, "uuid": "999137b6-bab4-457b-ba27-d2df65bfd7a0", "comment": "Malware payload (Gafgyt)", "value": "aa5d49e8c99212edf2ca56218480a579", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377266, "uuid": "e6ca5130-24d9-44d0-8da5-c9631020599b", "comment": "Malware payload (Gafgyt)", "value": "682c92bced26e5b50c641eda09f09e18fed7dcce9de8b66e3efffab9f02e4604", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377266, "uuid": "90fe6a0d-a2b9-42a1-b23c-fed37e4cba69", "comment": "Malware payload (Gafgyt)", "value": "ef13b94cc7691afba602e4764f4ed5e064f20812", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377266, "uuid": "ce4afb62-45a5-406e-a86a-f45af0247e62", "comment": "Malware payload (Gafgyt)", "value": "ae3b6dd3e10f42949331c8045c31526f89db27964662c2ffba8af779875094471cc746b8359b6d629363772a154cdf25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377266, "uuid": "f744cffb-5f71-4a56-9ea6-5145fc1d6cd9", "value": "T1BB63290399669FB7C0866EB525F70A304753FD251F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377266, "uuid": "1b45bd0c-d8bb-44e2-a649-fca0b372ed90", "value": "1536:N1BOxUVm4Wqj6WMzKrtg/p96CLf3l/XnVMuC4mk02q5vc6fBnj:NnOxIm4Wqa2rS6c9/XnGuC4mk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377266, "uuid": "f0173d28-0b1b-416f-96a7-3afd2f92fb5d", "value": 72105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377266, "uuid": "13b4ab87-2ddd-4820-b461-23fa43baf80e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377266, "uuid": "6d081bb1-1421-4897-8be0-19a42492eabb", "value": "aa5d49e8c99212edf2ca56218480a579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181a33f1-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391130, "uuid": "b2fd85ba-3d5e-4da4-8ef8-6529809e7f92", "comment": "Malware payload (Mirai)", "value": "565ee66745a9142dcd71ca310d770d4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391130, "uuid": "5c0aeda1-0002-4c5b-b6cd-780a199df08a", "comment": "Malware payload (Mirai)", "value": "692443a56c569029b23b0b8ce74e10a09d08bbac7ac6b5d6293e9b8eeb6eea0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391130, "uuid": "8a9569a1-d936-4858-b47f-94656ef23314", "comment": "Malware payload (Mirai)", "value": "45e481f8b2e6ebdc23cfa20ff901d5b11b9d12a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391130, "uuid": "74d0f252-e5b3-493c-9be5-ca75af9f23df", "comment": "Malware payload (Mirai)", "value": "45b673669b3744bd351fbed05e26f37beefe2edcb15cb69ac7964b2d0653b618582d91e1b8cd4f8a6cf8c13c3f9afe67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391130, "uuid": "c05e82f5-e1df-4684-8127-eb5e95bf4956", "value": "T181732896B8919A22C6D4137BFA6E41CD372163E8D2DF3207AD202F647BC681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391130, "uuid": "36df3357-96b2-4a19-a47b-d0a4d662e1d5", "value": "1536:fpXcKpBUlet3DBboJubLCNgpRTZankcahWMPMEY4g5q9/e357EFI:fpXcKLU1cRYnkvhTEegp3aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391130, "uuid": "0679c7e1-2727-433c-88e9-541b3472dfc1", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391130, "uuid": "00474ba1-54de-4903-b527-7cd52a268934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391130, "uuid": "d4e8a54f-5be3-4d2b-b775-992253af7ae2", "value": "565ee66745a9142dcd71ca310d770d4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519ef82c-fe28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368463, "uuid": "c88ae48f-1d5b-43f5-92d1-909e2c9d96a5", "comment": "Malware payload (Gafgyt)", "value": "a50972b8d1f1f349aed59b73bf81b7f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368463, "uuid": "d2045b21-174f-4bc9-9d57-bfbdc330aed2", "comment": "Malware payload (Gafgyt)", "value": "6966c950e826edea556fadefde69b681436a31bd502eea8a9f16101b6c225160", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368463, "uuid": "8fb00c06-717c-4643-938f-465213f00dd1", "comment": "Malware payload (Gafgyt)", "value": "59dfa49bcd5c1c6f8cb3f80dfe35ba836b2d690c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368463, "uuid": "00c507b2-6ea4-474f-81a2-6c6d14dac309", "comment": "Malware payload (Gafgyt)", "value": "5cabc34f37e88b13c0683c2ead1ad03d0e24858d7e3b92e7b01342009c3f92063ebafa3a16216d55901df9290fdba645", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368463, "uuid": "50cc6b52-f99d-4537-8006-6b212f26e9de", "value": "T177733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368463, "uuid": "a6cfb413-61a1-434d-b468-00327b722416", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMzMmLI2VOCjXUfJRk:45omr0xKFn6J+O8MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368463, "uuid": "1187d4e5-c10c-4b5a-b39e-798f4c8e749b", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368463, "uuid": "2ba5fe10-6597-4bbb-b4c9-5f924eeb0a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368463, "uuid": "3b16294f-6b8d-488d-902f-78bd3e8b0219", "value": "a50972b8d1f1f349aed59b73bf81b7f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993f961b-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377174, "uuid": "2112d1d3-8466-474d-9d8a-9eda62bc9f8e", "comment": "Malware payload (Mirai)", "value": "982b1d575a7ecc8e579dad8f78f2b058", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377174, "uuid": "3cc170ad-c2a4-4a28-84ae-f3337298c05f", "comment": "Malware payload (Mirai)", "value": "69e1606d255412e64fdd89201ba25d0046e45b9aaf50c62278009db8dc02144a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377174, "uuid": "b0077d89-9555-442a-a448-174548f0aae3", "comment": "Malware payload (Mirai)", "value": "298b26cadd80992959bf61b95b3dfb3a2ebf9659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377174, "uuid": "1fa370d2-4d77-4670-a107-daf5232d6205", "comment": "Malware payload (Mirai)", "value": "a0ed74554f564011dc76b0c87368db12d06a9d27cc5134ba46f7227890484d79a6aed68fe6662379a6b45474e0df4bb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377174, "uuid": "68a00a76-a424-47a4-b994-e60197c674f9", "value": "T119330991B9824E6AC9D513BBBA6E55CE332023E4D2CF7313D9201B543ACA51F0E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377174, "uuid": "e52d96a3-75a3-4490-a3b0-f790ab24dd6e", "value": "1536:/+6AkY6wggbL6DCgz7P7BWy4LpEyT1maBy21TNA:BxwgKLAC0r7gzLuyT1Rs2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377174, "uuid": "b0d0152c-a5cd-4b2d-8552-888f7f1637e6", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377174, "uuid": "7c709085-e069-4cb1-a0a0-47321abd5386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377174, "uuid": "16e80476-dddc-4172-bc1d-cae458bf5388", "value": "982b1d575a7ecc8e579dad8f78f2b058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0df9fa-fe33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685373318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373318, "uuid": "db9656a4-03cb-4d9b-9ec7-e17777520d47", "comment": "Malware payload (Gafgyt)", "value": "9add97dff4979cede51b128058a846af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373318, "uuid": "329d7ba6-8b9d-4b51-bdf0-3feb55b1c5dc", "comment": "Malware payload (Gafgyt)", "value": "6a3084bc7ee9501e33dcefceaab00ec8135e523d811ab8cc5c389df1511858b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373318, "uuid": "2da98be5-2268-4e66-82ad-802b327aba62", "comment": "Malware payload (Gafgyt)", "value": "7984ef0669966f7075e59026d299d26dfbd49010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373318, "uuid": "7d49d9c6-591a-43c4-95b8-35e0ca8b9e38", "comment": "Malware payload (Gafgyt)", "value": "a2599f0bf31d18770411067739eaae22d31a7fafc3b0aab32e9b1157d56ca4ef08293dde7edc74e0ee34b430cd868602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373318, "uuid": "a4d4c3e9-ed74-4ef0-9c3c-223616578021", "value": "T17D735C136991CB7BC4C747F92BDB952144A3F83E1B32620A73D8BDA92B1A9C82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373318, "uuid": "a8c5ac6d-853a-45e6-ab53-5bc41e7b736a", "value": "1536:47IZuSaH+1iDnD+Q8bQ8O32Ls0FnswNbzvmA+JbOm/coZ3ymj:eCae1ItqQH2LDnsEbzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685373318, "uuid": "6518bc4a-5a33-468a-a101-34bcc65ea16b", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685373318, "uuid": "e1f8fd17-cb48-4e30-94ba-3bd1b6814502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373318, "uuid": "97156531-8753-43d8-bfcc-6f33c17a7485", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ecf4c7-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388100, "uuid": "0b5945e1-42e1-4155-9580-96699d502d4a", "comment": "Malware payload (Mirai)", "value": "49e9097426c67a02a693232d4808cc2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388100, "uuid": "ce0f54c6-6908-45c6-ba67-a311157436c6", "comment": "Malware payload (Mirai)", "value": "6a78c6cd24783d322012b58e6918f3cc1c23ed4067fcf21f03a24645cea01d41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388100, "uuid": "f5beddbd-23c8-4dfb-a50a-a2d045723678", "comment": "Malware payload (Mirai)", "value": "8c36565465cb2f28f92eb892b8e4a4943bb133e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388100, "uuid": "62ebf870-96b2-40ce-861a-ea512b6dc2c7", "comment": "Malware payload (Mirai)", "value": "8461855f8830a00b67af1f0d5ed44ba881051457cdefc84705bcf3d476ba87d44ad1fe72ad0a1c6ac44b58b40c62b0d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388100, "uuid": "a0275a93-62b5-4fb7-bb9b-68e918dacd35", "value": "T1C8D33B06B31C0D47D2632EF43B3B27E1D3EF9A8121E4F640655FAA8A9271D321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388100, "uuid": "502cf8b0-07e7-4071-89a0-51eb176c1522", "value": "1536:JT/D3aXqPs0f8xB4vQp8WgPrqqnCO/xzZEzB3praWvASyRJHYWjqH1CfHPaK:ZzC0f8x2obgr1zoBc/S/EPaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388100, "uuid": "e6d96575-822b-4a2b-9443-e4e49c9b731c", "value": 133636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388100, "uuid": "2b2ac3f7-7ddf-43ad-ac2e-6f633c76353b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388100, "uuid": "baee0979-7502-4bd0-9b34-14c41e19ed9f", "value": "49e9097426c67a02a693232d4808cc2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd34c533-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685371758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371758, "uuid": "d1603d9b-dfff-40e6-ba7d-19c6660bedcc", "comment": "Malware payload", "value": "f9a2970a840e527748d522a52cc13402", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371758, "uuid": "1a078b58-be6e-4c6b-8cc0-a91f59c22d9f", "comment": "Malware payload", "value": "6a810f3798ae22da1819ea297a5992f886397061e35e965b99bd346d795a93f5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371758, "uuid": "f18fe808-160b-4328-b315-7ff6d9ad5d75", "comment": "Malware payload", "value": "eabc29a0501dba3289c107747f79c054ce997ff1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371758, "uuid": "bfa51877-5c6f-48c0-b374-baa21dec8769", "comment": "Malware payload", "value": "69a69e72c4b614676def9801a76a628d72f0f75da9323eb65ec036564203421b11daa18466c5b9395626bb2607795643", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371758, "uuid": "f0e46d7f-1a9d-4d30-b9b1-08007529b910", "value": "T160428F2EDA440932C24691B552590B4F933EB0F69BD3EB45BCC865E659B62FC0B4F34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371758, "uuid": "502ab390-8ed1-40f4-a943-14cbd4dac2a6", "value": "192:zkbgGUD8Mo+YQhXsQT4YlJUAe3VgXDs6Y4E3pNHUDnPVsNARh2KeAlUz65:uNSyQT4EJpqyXDs44HHI9sSRYEKm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371758, "uuid": "3c8c5927-d465-47b7-8446-a58c4097a91b", "value": 12882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371758, "uuid": "2f0cdf6c-c80f-4a78-9f84-d422e384bf52", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371758, "uuid": "603198ae-3197-445c-ae6a-a2a649b75414", "value": "T\u00fcrkiye, Israel and Bulgaria Promotion Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8444814b-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363394, "uuid": "7751f764-dd89-4b32-8b0d-6a8001e50ab1", "comment": "Malware payload", "value": "ddbc9adc09440a6b7e11948eb9a5f087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363394, "uuid": "d51632ba-5750-45d6-9219-4e369fcba76c", "comment": "Malware payload", "value": "6b361db5a42df2520d1b52e0a91b414ee7a70ffbbe6a9b5272060d90e682d553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363394, "uuid": "7f3cc789-f05e-4dd4-bd59-8dac568e4670", "comment": "Malware payload", "value": "ead9e9373808f3ab180b135e34edbe30facec470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363394, "uuid": "9f769ccc-2f6e-44ee-9ea1-153fccbee9d4", "comment": "Malware payload", "value": "1d736c018cd26518de9a480445bbee50a8804dc9e0baa1471c0e3ad62204594bbbfb5031898c857f77a85feada97056b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363394, "uuid": "078d896a-88e7-4c00-8653-d6941f744124", "value": "T119C4BD822FCDA9BCC4265D32B3982DD5C3095E1AFAEA119176DD391A40F33BB4DDE181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363394, "uuid": "3989ab14-dd18-47d3-87ab-85086a9598ec", "value": "6144:PtUKPsCiySQoLnrA6JTzAQHTLVXCTyOe5mUjaw:1UKPsCiySQoLnrRzLVDHmAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363394, "uuid": "556c0ea4-aafc-4893-b02d-e372796025c3", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363394, "uuid": "ea90ebf3-a63e-4773-9dc9-86da1e2ca6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363394, "uuid": "18991f9d-7ba0-484a-95e9-a8687a1a4d2e", "value": "SecuriteInfo.com.Trojan-Dropper.SuspectCRC.27734.22560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c8cf21-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377139, "uuid": "4070a5aa-7a44-4e6b-9813-6aaa45195a08", "comment": "Malware payload (Mirai)", "value": "c1d1f26c054611066aa463f0c1399a44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377139, "uuid": "8ab44066-05b0-46cf-abd9-01c845ca64f1", "comment": "Malware payload (Mirai)", "value": "6b4d621c858e202d077475ac41720593832b84896b470a6e96f90d6c811ca7ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377139, "uuid": "56262503-996b-48bc-9567-6448a9030b41", "comment": "Malware payload (Mirai)", "value": "ec872ed99346806a2fe467662365ac737e733137", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377139, "uuid": "679c0cf3-f5a3-46d6-a696-5a0e2dcf2bde", "comment": "Malware payload (Mirai)", "value": "a81064ce4c25d099e061cc6889e0195dcd3429f8fd63a8e9fc04f2403a308d4644828afa7fb2890cf3f886285db06626", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377139, "uuid": "60dcc0cb-72e0-482c-ab04-5b0ec20f2bd8", "value": "T159D2E0026640FEE1C5B00236E9678A9B72253D78D1D134FA8B3D0DF8A6E961D47F4A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377139, "uuid": "2b433ecc-9e17-4664-9c66-6eec7eac2b64", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXg7o9q3UEL7d:HRwynNIOQQ1KMw7RLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377139, "uuid": "fb0d4b21-65b0-4e67-9cea-880f680bfe7b", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377139, "uuid": "c5282d0e-d859-4b70-9425-7b6b0bd57621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377139, "uuid": "03e85376-1679-4135-a6d1-dc6d86d14dae", "value": "c1d1f26c054611066aa463f0c1399a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c407c616-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377245, "uuid": "701e9923-1547-4c01-8852-4f07e0080877", "comment": "Malware payload (Mirai)", "value": "f072cb98bbba5f3a046893e3daf56ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377245, "uuid": "b86733d3-0002-4fce-8244-5785c3457d88", "comment": "Malware payload (Mirai)", "value": "6c51668305b756bd70336573051b6a8e4128368425ac1f85956ff20c62b8a6fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377245, "uuid": "4b6c0f15-9784-476d-8e82-483af3f05c11", "comment": "Malware payload (Mirai)", "value": "35aee1da01230c19c44d4b97719c4b1d7f0b7e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377245, "uuid": "977a4200-832e-4fd7-8215-c50530c6fbec", "comment": "Malware payload (Mirai)", "value": "17bbb9b84db473f02cc7932eeea7249c9dbc8c0261f699ebc765a86bd6be541fa4c3dfef2903c5482ba4476c1ab8edb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377245, "uuid": "307326ff-a8fa-49a7-a7aa-4f7c5caa7d2a", "value": "T1BC339EA2D836AC54E59886F0B0384BF41B63E419D6872FF91465C3259403EDCF7593F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377245, "uuid": "b43ff453-4aad-4a30-9d25-88c34a88eaf3", "value": "1536:Ya4cBJnP7EU+HTI3K9VEplyfl0CXYbZTq:YKBVP7uHTI69Ayfl0lZTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377245, "uuid": "85168c0d-f0ae-4b6a-84ba-d5e8c6cdefe5", "value": 54792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377245, "uuid": "6c322ae6-54f4-4ac5-bf7d-1c9678931989", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377245, "uuid": "d19a31ae-4cdc-4efe-b79d-296c5fa21337", "value": "f072cb98bbba5f3a046893e3daf56ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7763be4f-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379694, "uuid": "8d51341d-b9ae-4489-ab14-00d6f22c4c18", "comment": "Malware payload (Mirai)", "value": "b10f414c223db8d25377fd6bd4349938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379694, "uuid": "34c51cab-4204-4d9f-821f-9b88a22f13a7", "comment": "Malware payload (Mirai)", "value": "6d2bb74dfb198cdeca6a76d53d060c40944bc6c8cbd88c30e12281bc9597bb5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379694, "uuid": "35af5894-87e7-4668-9f55-4b692872447d", "comment": "Malware payload (Mirai)", "value": "d54412a3a0657d016daa7063b1a0c7d8f1a6964e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379694, "uuid": "1e09fbd1-fb9c-4632-b473-2ddb687ebca2", "comment": "Malware payload (Mirai)", "value": "92c60252ec31d0302c60b5e3a5abb1d0e6b2ed08ef528ef4b8d4f4fe997d291782ed2b124f070bf10062ff9152581efc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379694, "uuid": "c5877abe-eb25-4b27-a719-a2690f44d0c6", "value": "T1FDB31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379694, "uuid": "087b4b2a-83d6-4448-b039-669e84b1a443", "value": "3072:OwNUWqpCgYXlrSyWUfMNoMmH1cuEgv26uN/:OwNjqpC/G8fMNoMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379694, "uuid": "8e75588e-4175-40b8-aa58-105df1783eef", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379694, "uuid": "bbde4f2a-5c0d-4d34-96b1-63f2f65b76c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379694, "uuid": "84275301-62d1-4874-9a05-7b1663490679", "value": "b10f414c223db8d25377fd6bd4349938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e89ddaf-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685377182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "9eb45c27-567a-4a32-ab8a-e810c7104eac", "comment": "Malware payload (Amadey)", "value": "aa9fa7808dca4fd4cadab28cabbc3266", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "4e6f9969-3846-45e1-aff6-1de4069d34e5", "comment": "Malware payload (Amadey)", "value": "6e01f9d1997186d06274a508bc0a511aa6fb50e430b77efca593c00d3fc62cba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "9af3ca0f-f979-4522-a51a-04120ea0b4a3", "comment": "Malware payload (Amadey)", "value": "1a45810526df332dba5003d0627d1c14bf5183ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377182, "uuid": "cb95cdf3-6867-4cda-b21e-864098039f60", "comment": "Malware payload (Amadey)", "value": "defc6cd092a85607211cf1b4b355e652a74d7ee6bcb060b7f7cb4db623adc411b4efcd1a47f5ecf88b0336af0a2fb37b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "f7e9eb6c-75cd-485b-97ba-2009fd43cabd", "value": "T1A92418653912C071D66065B619F4BFF6C19CAD15ABB049DF2B800F77DA222F33921E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "0ee81de6-9c2a-44b8-b73b-1c1ffafac8a8", "value": "dd9df9b9e52b22adb197dae219c6a26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "673c3e13-96b0-48db-911f-304fac038683", "value": "6144:Q/31H3YucxpcxoLebwlAsUy8F0WEutMVPdKET:QFmxCxoakeLyw0WEutMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377182, "uuid": "52122cf8-cf7f-4851-8dd9-f9a3dae629bd", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377182, "uuid": "a200281f-d6c0-4a07-939b-9c17fc30f7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377182, "uuid": "1bb9bc15-2303-4bea-a4c9-4ea14de6b7f7", "value": "05789299.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9acb1e-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377127, "uuid": "adbe3e94-6f21-487a-bb41-cbfca05149de", "comment": "Malware payload (Gafgyt)", "value": "6e52f14675ead1a1c779c3253025cdba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377127, "uuid": "4f5f09f9-c778-4f1d-968b-a4bc39c7ecbc", "comment": "Malware payload (Gafgyt)", "value": "70cb3cd5527c34cf271f380b595ce772ad0dbc4c94519bc4a188f40168a6dd90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377127, "uuid": "9c1138af-b406-49f7-a328-47b30690f164", "comment": "Malware payload (Gafgyt)", "value": "ea850e6d763cf46a2a5b2490a0a948fc365fd873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377127, "uuid": "bcb5a1ac-24c8-492f-9078-e1897b4942cb", "comment": "Malware payload (Gafgyt)", "value": "4154169182927928785c8ac9d958f77463cca36589a195291e8ae816428fc97b7088dbb387a550781575c2460f003bc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377127, "uuid": "95b933fa-c564-4125-809e-e16f2b6d48d4", "value": "T190E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377127, "uuid": "0c4c5876-89a3-4fe8-8c6e-fcd0d5d3cd84", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hr:vY01ZkXAQT4NW9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377127, "uuid": "7b21929d-b94a-4356-b83c-ac2b4bb8491b", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377127, "uuid": "20e05003-65de-4000-90f0-99040f4d376d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377127, "uuid": "9c5c0bb5-89e6-4526-a22d-c512fdbf8159", "value": "6e52f14675ead1a1c779c3253025cdba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa659d1-fe1f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1685364613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364613, "uuid": "b48bebf8-609a-44e8-9913-119cf27d4298", "comment": "Malware payload (MassLogger)", "value": "9ad05df0b2acb11c60556ad6c0cb0ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364613, "uuid": "989503a2-3787-460e-a5c6-f9daff50d166", "comment": "Malware payload (MassLogger)", "value": "70daaf9752c26c258fc840577a2601fba41978994192d0205a233a4d658e13e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364613, "uuid": "78a57452-39ed-4dd6-9bcb-89bf4e3c9faa", "comment": "Malware payload (MassLogger)", "value": "99bc59ac3b79292c6d6eb59ed70b1926baa6f880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685364613, "uuid": "236b8bf6-ff8c-4c25-a6cc-99af23bef354", "comment": "Malware payload (MassLogger)", "value": "d8c4ab73ac79191fcbabebddc2068149d708264e7a26e75928c2107af27dd9fb06792599873784aec008b494aea7360e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364613, "uuid": "04ebd9e2-56e6-4269-965f-31345ed2974a", "value": "T1221402CDA19C5237C9C009FDD492DA6297393A727A8AE71ADDD472F98412BB04301FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364613, "uuid": "d738b216-cd57-44bb-8efb-e39d6e0a8eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364613, "uuid": "82fc77c2-cea9-4c1f-88df-2b319642eb0b", "value": "3072:SrIf6jgNAjYszT+4hUT6tMAQ5k/JH2SrTZCISxwr7TgGKJtm/R:L6kN4X+4hUl646bJT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685364613, "uuid": "88b02fc0-279a-413a-8c82-21d69273b747", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685364613, "uuid": "f5c90785-a999-4090-826f-8a61d41d09ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685364613, "uuid": "ceb90147-5f85-48da-9ef6-05c694eaec87", "value": "kkraken.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27812004-fe1d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685363668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363668, "uuid": "a2de7be5-da3e-4d85-90ae-dee0b8f5f415", "comment": "Malware payload (STRRAT)", "value": "d0cd238e4e20ca3171599ca95ef44012", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363668, "uuid": "5d6946bc-025b-4fe2-b6ad-7858b9cdd662", "comment": "Malware payload (STRRAT)", "value": "7116ea122a374e325975fa5455db6e3b19776f68d86e7bac84d1f147ecb2de2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363668, "uuid": "b04c4269-c953-42c5-af80-b01bb6b1ad80", "comment": "Malware payload (STRRAT)", "value": "f0d98e84967612e5564aabe93b7a107afc385f58", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363668, "uuid": "5595e609-da19-46f3-854c-cfc17afcba15", "comment": "Malware payload (STRRAT)", "value": "845bbaee9fc600b97d7ad752bf926b55efc48a38d433e47fb2a5f7a8fdc1014d543aec9ef6abb5d6b8203c9c8b1a7861", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363668, "uuid": "dab48d6f-df60-4c49-9668-16c6707e8646", "value": "T1CB748C0AA06A871CA7B6701538EEB35F8BF4910DC330DC7ADDB25F1F6BA364D9085658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363668, "uuid": "40a6f0bb-7ef6-4036-aff9-1794b2220cbb", "value": "6144:3PT0tnyQ0svyERO2Jq71tc6+O7hOB2nT7fhR+tthtxWbtZBDLXa:3AtnRvTU1tvZhOB2nj+tUDLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363668, "uuid": "1ab10817-8c48-4265-84bd-769c94165adb", "value": 358935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363668, "uuid": "1c00f952-337a-484d-9ef4-c327ffb94f97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363668, "uuid": "1acfe9b3-62d7-48c4-a723-96c93d1b51e7", "value": "Dashbadu contract 0938.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642b7cd8-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1685348738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348738, "uuid": "d4cf5421-bd59-4afc-8e0c-8325d60c737d", "comment": "Malware payload (QuasarRAT)", "value": "6584be6ee6ef26f3636531c0e3f41cee", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348738, "uuid": "4a8f07e6-233c-421f-91c4-f90dd81d7791", "comment": "Malware payload (QuasarRAT)", "value": "716153d5958b307c96be985da422552195800586967911ec5a69d4aa3e7236e7", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348738, "uuid": "79b01889-675c-4aae-a5f8-4a7a844cd1a8", "comment": "Malware payload (QuasarRAT)", "value": "e5291dc84bd32fed5831eafc33473ccdaf09ac16", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348738, "uuid": "bf53ad9d-cf29-4752-9924-b3784eb798d7", "comment": "Malware payload (QuasarRAT)", "value": "4bb76a30cda0dac260c81d6dd91f6fdda8877bde9f3d03f87017cad1d9dc27040056520d6f3c2baaf5ea20149aad76fe", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348738, "uuid": "5a21a6f4-e113-4eb2-8b8d-223f99e441ee", "value": "T121E55A143BF85E32E17AE673D5B0501667F1E82AF363EB0B6281677E1C53B409C416AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348738, "uuid": "a879f615-6c7d-42c1-8e6e-38f7012875df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348738, "uuid": "b9c62a7f-96bd-40af-af4b-bfbaf3b1ba2c", "value": "49152:Kvgt62XlaSFNWPjljiFa2RoUYIT9OTj81JdLoGnT07THHB72eh2NT:KvM62XlaSFNWPjljiFXRoUYIyjOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348738, "uuid": "c7835696-d1bb-4d4d-aea0-07d458b5db33", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348738, "uuid": "551c5b19-f57c-4b19-860d-1116765d76fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348738, "uuid": "f360752d-d057-4651-8844-4e10bdea1d15", "value": "08827299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b7f585-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685348464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348464, "uuid": "25ba9344-3f7c-481b-bbee-3c4b1c493ec5", "comment": "Malware payload (RedLineStealer)", "value": "940b95e7cd6ad09398bc18843ad96676", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348464, "uuid": "35c498d2-0d66-4077-8113-bfa742dc8f7a", "comment": "Malware payload (RedLineStealer)", "value": "71b21c067079ecf5cb6479f1210b48cb9aa73eb51f7d0e105b8ee02d856ce65e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348464, "uuid": "2a546e06-a5f6-438d-8519-5988efa939a6", "comment": "Malware payload (RedLineStealer)", "value": "6fb16bf3d35659c159a5c9107da8d2d517aebc13", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348464, "uuid": "9f89f4cf-8a44-4bc3-8431-bad0b0ed93bf", "comment": "Malware payload (RedLineStealer)", "value": "7ddb41d909c8d7caf83b1b3df0f882dcdf2076170c505e8ef240dd1aab866bceabddf20484b116a259e7df07276c214b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348464, "uuid": "5962367e-0482-4b75-8251-6e88bd54ab77", "value": "T186052353B7CDE532E8F163F058F207C3093A7CA29D79429B37496E191CB2194A93573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348464, "uuid": "5377121e-8035-4f23-9f26-3917491305c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348464, "uuid": "f8450118-6bb9-40bf-963a-cbc3345d7bcc", "value": "12288:uMr8y90voNENFa7GcuhZuU9LlAiYeaaFATYyW5Uzo3Pa8HccftNZ2SVnxQsrCvHV:OyiDc/WZukXAcyW5Uk/zPt71VnDS0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348464, "uuid": "55f3788b-388b-49d5-982c-cd9c54395d3b", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348464, "uuid": "e822071c-5904-4f8c-8eac-edb2fa259761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348464, "uuid": "890d019c-9d16-4c67-84d7-81eecdbd5fc5", "value": "02695099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99adc120-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376745, "uuid": "4b058415-c1bd-489c-a1ea-c20e7bac3820", "comment": "Malware payload (Mirai)", "value": "49f694871509fca998ff488dc296452c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376745, "uuid": "d1cece93-c3d1-4710-9c73-ff02356c7100", "comment": "Malware payload (Mirai)", "value": "721f421d2158865f8d0ffa0b552784bf702fa12783b8359411fe0396a718abc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376745, "uuid": "fa648171-414c-45cf-9e7b-52d3bef60362", "comment": "Malware payload (Mirai)", "value": "473797466d334f5b1660ed6e755672ab0e9cf149", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376745, "uuid": "62067eae-87ad-4d81-979b-b365c8e1c108", "comment": "Malware payload (Mirai)", "value": "0985e9420f9e4318b32e1b4878a3135f143d42115817c290b1114e3572f65cca3ae0e9aef750101ea6ddaeab26f20436", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376745, "uuid": "87a82c69-25d1-4c15-9f60-be6ff1221bfa", "value": "T14B23F11320E7E913D421847BD8159D697D045AF9B8AD7B6728011394CD20A23FEF6ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376745, "uuid": "7a75210a-580f-4ea0-b004-94f2d00402b0", "value": "768:AK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFbc9q3UELv1Q06pMBwAA3i5d:y12O1LCNguovDPH7TcrxlLtQ/pSAy5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376745, "uuid": "935970b7-b29d-4d9e-815b-b42714bc3283", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376745, "uuid": "ae9b3228-ced4-4d44-8d1b-d9307529dd14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376745, "uuid": "942b5477-3485-4454-818c-afd70b1bb20a", "value": "49f694871509fca998ff488dc296452c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36390cfe-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346943, "uuid": "bd340d7a-526e-4c6a-bac5-590ea218a269", "comment": "Malware payload (Amadey)", "value": "f95323cd390f1a3a25e00ea6890434b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346943, "uuid": "8b6640af-6077-4bb4-8603-ac2d32608531", "comment": "Malware payload (Amadey)", "value": "72fbdc747e736815f49ce60e32dca154e165127cbd052b08f3360f4759076861", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346943, "uuid": "610fc512-05f2-494f-8ed7-60a995f4dc87", "comment": "Malware payload (Amadey)", "value": "e7935448fdb34ad30f14f434f52234972c5a9911", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346943, "uuid": "ac71081c-bcf7-4a8d-8523-457419b0b616", "comment": "Malware payload (Amadey)", "value": "ffcee3efa3aa3fe80ecf9cafcdd5e962b3a5649e71b1dbe04eff8a9db5daec171e889620e53ef5b3bcedf62557554ea3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346943, "uuid": "eea117f9-cab3-413e-8637-fc4f587ff690", "value": "T1CB051293F7E98826D9B027B058F31383173A7CA09D7443AF73965A4A5D734D0AA7132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346943, "uuid": "c206afd1-ce12-46ca-be49-9bcb5b848c3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346943, "uuid": "934bcd83-be93-45c5-b099-fc6f8517ee60", "value": "24576:9yD9b7Xuhr05KDSL/8ghPWTdoYiJ1eqnv6USqfI:YD9b7eQrLEgqoY9qnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346943, "uuid": "594c64c0-8b59-4f37-8a7e-f8fd23b9cf90", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346943, "uuid": "1cd8386b-2428-42c0-bf7a-66cde9a07df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346943, "uuid": "97f06afc-8387-4978-bbf5-9f17a3faa422", "value": "f95323cd390f1a3a25e00ea6890434b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922ed883-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377162, "uuid": "11f7c453-94c8-4e0f-b6cf-fca4dd6ef07b", "comment": "Malware payload (Mirai)", "value": "9a412a962ea4b0d00009b6d4be86f2c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377162, "uuid": "3359c510-3bd5-49f7-a135-766db8c42ccb", "comment": "Malware payload (Mirai)", "value": "7322317e57cc36f5f6681ccf29b69ae9a735fd9056bf08d6d418acb200e85ee6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377162, "uuid": "550597d1-1506-40aa-ba0d-1e4f91459983", "comment": "Malware payload (Mirai)", "value": "ce98095a5ae2dd01fcdd887c493f241f96030120", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377162, "uuid": "fe8291b3-4970-4e2d-bb78-d6b8e8a14419", "comment": "Malware payload (Mirai)", "value": "179934c54ce7a71736a464d2dd610204b9f3a0b29a4795c6303fe57d81278fdfb1fdef7e31c8164e72a75474891160d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377162, "uuid": "ee6d5828-cee0-4177-a309-876b1905c3db", "value": "T172338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377162, "uuid": "65bc093f-62ba-411f-a90e-96e1eaaf4e8d", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvH:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377162, "uuid": "d1a11c33-9623-4c78-a245-9bec2e6b28aa", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377162, "uuid": "5b0117f7-e431-4368-b237-7054b20ef91f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377162, "uuid": "c71f82a4-d570-45cd-8d17-8eafc3a7a26b", "value": "9a412a962ea4b0d00009b6d4be86f2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e73f5a-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685354025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354025, "uuid": "8fa654c7-f7a8-4dea-b9c0-8b2961172e95", "comment": "Malware payload (AgentTesla)", "value": "97b638dbfd7a8d5ed33c0d5a4852dd0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354025, "uuid": "6aa0c24d-787a-4020-bd34-5a240825b8b5", "comment": "Malware payload (AgentTesla)", "value": "734da354d0b8c982d436b43e4f8e105382af3d08def6114dfa685d1230bf64dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354025, "uuid": "dfaa1dd9-6386-47d9-a743-5479c5d0a4f9", "comment": "Malware payload (AgentTesla)", "value": "64ff8fb7513515b13481d7f11cad160a20acfa0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354025, "uuid": "f167eff5-7112-42f6-a9ea-6266c8ce3c21", "comment": "Malware payload (AgentTesla)", "value": "9a5a0b2a612cb0dcfeaf701f628f73122d52b660ee9fc70f1cd16581d090089dcf48570faf4fc003c012e1e596b12190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354025, "uuid": "67c67cef-bca6-46ba-bc51-20aa1c4feb21", "value": "T150F4126862B58B37C07E4BFD90612FB507B4578A7A23F79A8EC3B0D99B1BF800945507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354025, "uuid": "174a35ac-c36b-4419-b8e1-20c25dff26ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354025, "uuid": "13c07cd1-3c1e-470c-b388-b1d4208789b1", "value": "12288:3DHkmFx2iqNhujGjUGyGMagierfRdg9n1t5VKiRCifmcPBIRGy6oxCm+xW:TEmFxUGGMFi8s1GirqGborC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354025, "uuid": "ab48cc87-9eba-4db7-9442-54b5e3506033", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354025, "uuid": "46d44349-cc3c-4c53-be6e-982834680573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354025, "uuid": "301a37df-d75f-44c0-97d8-fef1a407b389", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc86a0a-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379681, "uuid": "35c995fc-8f08-436b-a3d0-2e828e243499", "comment": "Malware payload (Mirai)", "value": "3f873257c444500f6545a64d98033589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379681, "uuid": "20ce7d17-65d9-45e1-84ff-23265e16d8aa", "comment": "Malware payload (Mirai)", "value": "7448ffe45565ac89bac6bfb853f814e3a08869bec4ad6479fe4282c835e0a50a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379681, "uuid": "9995f94c-9759-4457-b3fb-16a38c5d3ed8", "comment": "Malware payload (Mirai)", "value": "0f071b87e35fe8509d4e4e32ee06b7190e6ac1db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379681, "uuid": "46ee8049-923f-4390-bef9-c67d8c7e786e", "comment": "Malware payload (Mirai)", "value": "edc645c42523e35541eeabce84bf54b56ac6ff6e8ed3d5822d1fd922d383ef43ed7744a74a5c0cdb5a88fe467bca0758", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379681, "uuid": "b57df2fa-5eda-4803-a722-a78066c6c877", "value": "T15FE31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379681, "uuid": "8f7e05a1-ad90-470f-863e-51047a12b2dc", "value": "3072:Z41HOuaGVV3NfHUOjqyljqCw3jkmhxQwoVZUNu:Ze3aGVVdqyljq1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379681, "uuid": "08094860-fd7b-4e93-b6d7-fc12d34aa960", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379681, "uuid": "b5271519-437d-43e9-8ec1-a3bbdca09814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379681, "uuid": "4f9b02d5-535d-447b-a47b-78bcef53fcce", "value": "3f873257c444500f6545a64d98033589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be29dac-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377178, "uuid": "d699997e-8a6d-4229-97fa-df94c210e80e", "comment": "Malware payload (Mirai)", "value": "fa044ce28a1bbf0dd30ba79eb704d68f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377178, "uuid": "4d305e76-8885-4aef-9ac6-ea94ab654d60", "comment": "Malware payload (Mirai)", "value": "74979f14f22486c4e5bc447ef6659711ec7e048ac24fad7337b7f4c7ed5da922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377178, "uuid": "8fc074c2-29db-4b0d-9c82-8575518110fa", "comment": "Malware payload (Mirai)", "value": "3dca62e3e0cca9ec82c6234ed4dc79f1437e54c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377178, "uuid": "16b3b75a-f920-4518-bef2-736d63404f5c", "comment": "Malware payload (Mirai)", "value": "daa4346a383400169115c5832851b75c51ca036ae0503d79374cabfd570b226b8ad8405ac6258f013a2c417f143731ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377178, "uuid": "bb516ca5-13f8-447e-bc16-037bd5030c19", "value": "T176C2C07DACA5BD46C9ED08384CDD13B4089D76C6B6CE4FA892261DC4BB611CB3C994B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377178, "uuid": "e96721a7-76dc-4ed1-a2b3-f275e31d47b3", "value": "384:3KWUv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwS:l7ddenS3j6Koolozxfk5JmsEzrttCTWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377178, "uuid": "37e3637b-c17e-47ee-8a22-76d19a631f24", "value": 27260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377178, "uuid": "5fec252a-a704-45e3-9eef-702ada4047f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377178, "uuid": "4f01946f-6581-4f58-9526-bce728ad8a2d", "value": "fa044ce28a1bbf0dd30ba79eb704d68f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e328204-fe09-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685355197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355197, "uuid": "a6433e0a-e4ac-45f6-8223-333d3f85b4bd", "comment": "Malware payload (RemcosRAT)", "value": "77e6cc7bad97936c7b94728c52d2b32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355197, "uuid": "d8d2b1a9-7149-402f-bd7e-4069f3a1610a", "comment": "Malware payload (RemcosRAT)", "value": "755c5cfdaf13b6a255c3b2015da23ce5e634b0e896e13a95b7fe0a97389c8f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355197, "uuid": "cc4bf03e-4e10-4b4e-bf20-b3bb5d502407", "comment": "Malware payload (RemcosRAT)", "value": "6b72c05c858b10ec9c3320427e965fc8b7a105b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355197, "uuid": "55b0b311-e5b9-424c-8d54-da5945e2b060", "comment": "Malware payload (RemcosRAT)", "value": "24aab9c604aff7a2856477f712188b65959462c34d8cf38675c94053c72fb709cbc1e0576f465deeae3148387340884d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355197, "uuid": "9d4c33e8-d0d0-4b41-b33b-69f3d67d3c66", "value": "T195B4232696F1DD5BC8670E331CBF96286A70B723209169070722AF553C63192DB1FBB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355197, "uuid": "a540d253-75ec-4618-b0c4-7433451af703", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355197, "uuid": "04e2f9db-3ee8-4783-a5f0-e803692e8e0b", "value": "12288:ZYC6phcxu+g2yjk91gBoU1Pn1CECdtd19hrsAj+qsASR:ZYZpmO2yjk9aBRfzCfd1frKNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685355197, "uuid": "c48f661a-40bd-4b22-b4c0-26bddf908a04", "value": 527696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685355197, "uuid": "a0537845-9c31-4a17-be81-4fa8fb84dca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355197, "uuid": "1b60730b-e29c-4257-8773-24a250c07092", "value": "FAT098900098789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecf6d32-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685377049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377049, "uuid": "12e98e33-a40c-43f0-af25-854a0bc03b2e", "comment": "Malware payload", "value": "8803a1dbed30d489119371b74e2a3c65", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377049, "uuid": "d3375e61-6ccc-456e-a8ea-1124c4f800dd", "comment": "Malware payload", "value": "758b0dbe7570d81fe24b5a6d6042480c43496e21f1b9dc8a000f0dcf05e82290", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377049, "uuid": "6d5f1786-e8b8-4767-a893-bf2523b3107b", "comment": "Malware payload", "value": "8ecb70f3955d68b4d8396ee03456ab2236a4d8c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377049, "uuid": "bddaa9b7-5b14-4791-b29f-f0e214600a18", "comment": "Malware payload", "value": "7c1fb38071e644d9bb75e38535637e4838767edd1e34a76420a73e10145f9fcb8a7a3a4aa93dd6f39bf1f0509e6e4e28", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377049, "uuid": "6aeb48f3-1cd8-4705-bd7c-230a5467cd28", "value": "T19AF0D3D2C5315D70F40755F5781535F5E66781475646335E5C5023470C1311F22B2E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377049, "uuid": "5c1dba22-38c5-4312-a099-9fdf160f6ae5", "value": "12:5jYDrXeqXSjQrWgYR0ywD+5vSrc3Qp78KHz5hbEzks0rXhXta4o:9YDrVMQa3YrLpYKHz/wzks0rFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377049, "uuid": "dfdaa760-25f4-4b1d-8e6f-7ecbab143fcb", "value": 632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377049, "uuid": "49504aff-9500-41d0-921c-12e7f62e257c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377049, "uuid": "0bfac080-2a0c-4c4b-908d-8483cd7f0130", "value": "TRT432537.2023.624430.673564.26748..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb335ff-fdfd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685349933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349933, "uuid": "49fe8955-9221-4cfc-8b3a-52aed0fa829a", "comment": "Malware payload (Amadey)", "value": "c3a30183ecb661efcb519b94da13f7d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349933, "uuid": "a1d931cf-7b51-478a-a5b1-b4c3a8af9e4c", "comment": "Malware payload (Amadey)", "value": "75cfb5fee9893ea9aa21c2dc40d468f370fd6ca32886a5d71c81a708b0d96f28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349933, "uuid": "6d9dd55a-2ff1-409d-ae0d-0c86b8a13f38", "comment": "Malware payload (Amadey)", "value": "2c2227b2c55427dd66e5d943c598e80c5a150f04", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685349933, "uuid": "57b6710c-677c-48b2-9768-aa009191a9b2", "comment": "Malware payload (Amadey)", "value": "d2b2c5fdf35f0dddc799baddf96242cc7c999f1af3551590f637cab3c0997c3c3892dc7eaed7c0a46bcb5e0aa793c14c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349933, "uuid": "38e2c60a-34b2-4304-9b40-6808fe90a322", "value": "T1A2051253A6F65476E8E60B709CF203830B76BC718D3483A72B11591A6EB3B88757173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349933, "uuid": "827b356e-cfff-4ee4-9c48-67df2e1615d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349933, "uuid": "ba8d83de-88e8-4eff-acfd-0bc9a7d6fd2d", "value": "12288:AMrry90yLYh0fw8l+x3yL3dVPAQ52i3UD9sS8+wfHxheejn0EQ3USK/J:byah0fwS+atBA4bS8+ALeunF6USK/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685349933, "uuid": "cba2b4de-2fd2-4bc4-b5e4-ac27f5b3ebf6", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685349933, "uuid": "be485495-ae78-40d0-bee4-66e888ce085d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685349933, "uuid": "12892056-dc9b-4f31-86f8-63b7ecbf4d0c", "value": "c3a30183ecb661efcb519b94da13f7d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c0e7dd-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346623, "uuid": "8b1f77a6-0bd9-46ee-96ec-b0c01b8d4102", "comment": "Malware payload (Amadey)", "value": "702451743abc4defbdb72bee666e4efa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346623, "uuid": "f89f0406-9a75-47b2-b2cb-a089055e18ae", "comment": "Malware payload (Amadey)", "value": "75df491c258df118e56284b9fb5976b16979523971bf6c1fa3936aba6c8e4f2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346623, "uuid": "5d43493f-6895-416e-a723-1dad62b775df", "comment": "Malware payload (Amadey)", "value": "f330815924cf29cbad6677c64cafbee338ffc731", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346623, "uuid": "655cf32e-a96c-4534-abf2-f23939814d8e", "comment": "Malware payload (Amadey)", "value": "691adf0790482fef6dcd8d16bc8b727cea27cf9983d007231e0c45731695877507f5bcaa5af100c10ab192253fc80a58", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346623, "uuid": "4177b45a-e7a1-4616-be84-57c433863bda", "value": "T19D052257BBE50433E9B6A77078FA138707387EA069B4437A3346AD4D09B26C0393536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346623, "uuid": "54bfe219-580f-4c72-9942-a06a546f8e4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346623, "uuid": "286184f4-60c2-4058-8409-44b25338dcca", "value": "24576:+yuZ1pN9O2SOVv7x3Lc5xqNL1eGnv6US9d:Nt2SOVzm5RGnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346623, "uuid": "a53ebdc9-3620-42c2-a8c8-a33e226c6a98", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346623, "uuid": "ad839c8d-c32a-4634-a9ae-478003e79769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346623, "uuid": "72dd9bec-a112-431a-b9a2-0b9a8197d10e", "value": "702451743abc4defbdb72bee666e4efa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81cbf38-fdf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1685345550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345550, "uuid": "47dc5c4f-06e4-46b4-9fd3-ead19716a3b8", "comment": "Malware payload (XWorm)", "value": "ee8d7bb249af9a72c38da00c0822c75f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345550, "uuid": "4b949e38-6b57-40b5-92b6-0257c9e4a4dc", "comment": "Malware payload (XWorm)", "value": "777a742286d0f7283f50cffe654e8d7c34f14f261fc1e6a120289f52b28e64d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345550, "uuid": "78db6e2f-1ed9-4be6-9447-7007f3ecc4cf", "comment": "Malware payload (XWorm)", "value": "bc4ca72a72470b6df7bea36572f71ed440ac61e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345550, "uuid": "f1d55837-2d20-4870-8977-bdd087f6a35e", "comment": "Malware payload (XWorm)", "value": "13a0d51eef1aaef32ab9b4c7f8151fd4985af049ca234956651a1c557770bbc77b393683c188388dd1c310420eb9de1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345550, "uuid": "8d2b0b60-d26f-4a3c-998a-e4eac61c8af7", "value": "T181D31882B640C2A1E47D4A33E166E5F10F32BC1BEF1A691F2584FF5B39732516D03A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345550, "uuid": "42700ebe-b5b4-4aa7-a6c8-c6a2e365d2d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345550, "uuid": "7f0e1eea-29af-4e74-ae38-f8ed7295c2da", "value": "3072:PAR5UCMPQpFb9M8OCkABz65/M6If+3Js+3JFkKeTnD:u5UCMIfb9rxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685345550, "uuid": "0b3d87f9-ca06-4c56-993a-2ce466b73ce3", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685345550, "uuid": "1653f39b-79cf-4820-8ee1-e97b11c9bdd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345550, "uuid": "b53e8780-de94-4418-ae41-a0255be67729", "value": "ee8d7bb249af9a72c38da00c0822c75f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b71fc2-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346650, "uuid": "e3398642-a0f4-4531-a080-af9412b1c50a", "comment": "Malware payload (RedLineStealer)", "value": "a413420c1380269e17530c4a8fd14803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346650, "uuid": "ab329e89-d260-48bf-8686-fac97ec96656", "comment": "Malware payload (RedLineStealer)", "value": "7781e6af001af86e1d91f70c9acfc32d8b80045649fc91461fbb41c08ba75cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346650, "uuid": "2fd035a3-981c-4566-ab73-9b4f9edfd84d", "comment": "Malware payload (RedLineStealer)", "value": "21d7039e547fc7bdafc12d38753a125e17887807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346650, "uuid": "b645ecd8-ce8a-4b66-a73a-52e8906e05a3", "comment": "Malware payload (RedLineStealer)", "value": "29dce030a19c6e8d3b9efa4cf7df671330b83267c4e6bdaef368c911d815bb722e636e4544a5d110d995ad409d6e52c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346650, "uuid": "d0b33222-09ec-4f51-9c63-20e0a2f78ae1", "value": "T188051207A7E84177E57627B019F602C31F72FDF2A875970B5741990E1DB32A0A832B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346650, "uuid": "6c1cc5f1-60ca-4a0a-950a-2156b0c0dff2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346650, "uuid": "da66db71-5311-4af0-bfdf-7235213ee508", "value": "24576:ay94telO0Hg/3ipSfU4KaCki+RcDnZ6USZrG:hkelDu3Vri+mDnZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346650, "uuid": "cf7e5763-13c7-45db-9585-8f753f262b75", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346650, "uuid": "99ff4d22-7ffd-4029-b03d-1cf0656badb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346650, "uuid": "28b254dc-75ab-4389-93ea-75c7fd0f5420", "value": "a413420c1380269e17530c4a8fd14803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d354354-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685348297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348297, "uuid": "abf177c8-0ca8-4dc2-8a09-4a09ef9e1b1a", "comment": "Malware payload", "value": "9a68f0f01a2c7343d7279392ce3fd267", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348297, "uuid": "fe5d99de-0aa3-4dcc-8ab5-87088ca4a3a1", "comment": "Malware payload", "value": "78166edf7561d7b8479cdfe50ac14176b622c2385b5c703699da62cf02315ab2", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348297, "uuid": "e793e178-2019-486f-bdfe-033475a8fda2", "comment": "Malware payload", "value": "9e1b8d076ff1c5fe9a1f1d8be6a932da3ad05b35", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348297, "uuid": "bcae7db7-fc26-4ca9-b3c5-a0203169f745", "comment": "Malware payload", "value": "2263a1401611a213a7e13a188fde8bcc0a47147761dd86ce17ab8d556a2077472bf35b2694de3eb9e9d36df340cd975e", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348297, "uuid": "26ee0387-0653-4448-8b20-5539ccd772a2", "value": "T15AE523A0AAB2EAA50BF4C27FA56FDC585B1FCBC24B04D6FF417426C6440DB678C83465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348297, "uuid": "edeccd06-7d6f-49d7-9214-928dda2ad746", "value": "49152:3GuyR+hhdxNOxlGmXq+uzEkicn3yAtwQ4JoSbnj0QNhbzFl7lR:+qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348297, "uuid": "59647dce-5b89-41d3-a0d7-668e3e2db3c1", "value": 3270550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348297, "uuid": "c71fb07f-e4b0-4792-a8f8-5f3acfc206a2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348297, "uuid": "1866a1ab-ab03-4c27-b9d8-11824972ca3b", "value": "01183599.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8577b4c3-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346646, "uuid": "4f52b21d-fed8-40ce-97d6-723f60cc08e7", "comment": "Malware payload (RedLineStealer)", "value": "b22805b0a804fc5b7acc5ddff49b82ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346646, "uuid": "3b9bb4eb-3778-4399-bc63-946ed686e2e5", "comment": "Malware payload (RedLineStealer)", "value": "7a6e921db095744382475491bea779ce556f233203709215277f14b033e28efd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346646, "uuid": "e2b041f7-7d5c-43c4-9b03-123e37b37f56", "comment": "Malware payload (RedLineStealer)", "value": "c0a447c8d3dc723dc5caa24c686314d926f4a22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346646, "uuid": "a94447a1-a741-4292-92fe-aa36a59d0fa5", "comment": "Malware payload (RedLineStealer)", "value": "ec69000282fed36b06c82a996dba6fcbbb0a1d5a41c8d6f887257f4b778cb7f3290ef71dfff235025a5ed5a6d7a3872d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346646, "uuid": "b68000d2-df17-47e3-bca0-2f77db779c25", "value": "T14C052312E2EC5473D4F42B3068FA06830E35BDA09A75833F3745996E1D72788AA72777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346646, "uuid": "c0094ddb-9f63-42cb-8a7e-2282403b086b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346646, "uuid": "7ef31c9c-259e-4ec3-9ea9-429a7a4d0199", "value": "24576:Ey+vPlYNenBYTmkpEbpsmYurg5hVp0/86OTK:T+vGqBYTmkGbpsm7g5fp0k64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346646, "uuid": "cb34383f-d802-4bae-9026-c3b2640dbee7", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346646, "uuid": "00e4fbe4-040b-4689-88cd-0d8fdaa8e721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346646, "uuid": "5d73f46e-4b60-484d-9986-19c2b99b89f9", "value": "b22805b0a804fc5b7acc5ddff49b82ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54d1ed5-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377221, "uuid": "90f1a26d-a1ad-4f1c-b576-a9423393aeb4", "comment": "Malware payload (Gafgyt)", "value": "c9eadf8e470eb2204ddcbe2ac9539aec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377221, "uuid": "76244e11-1ed3-4438-b03c-5b94ce454a51", "comment": "Malware payload (Gafgyt)", "value": "7b78f22a9226979d2b6e1ca27ad91a4285beb98655bfa1bfd3de610c4634bd23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377221, "uuid": "b7b3ad17-d4d0-4936-b40f-5cacae7f71db", "comment": "Malware payload (Gafgyt)", "value": "f5930aa97257ba046d4f62ae36b867a1e9c81bd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377221, "uuid": "1da17d26-b1ef-4686-bfb2-5d4c07161a86", "comment": "Malware payload (Gafgyt)", "value": "51698e7c3e321fa53b653f4e17a35e72426159f730f2d92c83c05f3bd6d933dba8c940ad21306fe5ff1bd264aa07d274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377221, "uuid": "e4ae4d94-aea0-4414-a76d-b4156095d199", "value": "T11D830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377221, "uuid": "d0cbc91f-7e8c-48c5-b48f-55d146460fb2", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1n8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3F8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377221, "uuid": "e0f9600b-57ed-4255-9e6c-d6e7dbf52bae", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377221, "uuid": "407ddf0c-476d-413e-bab4-ab982332c883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377221, "uuid": "c9ba5d82-a3fc-4444-9abf-bd5802629efa", "value": "c9eadf8e470eb2204ddcbe2ac9539aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd85f87d-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685387542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387542, "uuid": "7c9b87a1-dfff-47ec-b213-d0a11aff919e", "comment": "Malware payload (Smoke Loader)", "value": "72e4062c4e30395dc500b8062b895177", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387542, "uuid": "4dc6de82-726f-4201-8bd5-2e39a582a511", "comment": "Malware payload (Smoke Loader)", "value": "7ba2537e24a94622140aee053f477fab69dedbed273ea9bf8f0395b9d8a2d07c", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387542, "uuid": "0175dd3a-0e6f-4493-837c-c784a6e14efe", "comment": "Malware payload (Smoke Loader)", "value": "c4513bd1a636f7a7219a84057a649b36284bcb4d", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387542, "uuid": "7f203609-171e-44e6-9ac2-b3cd31a380a9", "comment": "Malware payload (Smoke Loader)", "value": "84fd38d470d6263139eb23648e4f2835b1d35accca4f2ba099b14880fa153735efd5596fccae4733ea1b95425449a80b", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387542, "uuid": "7e3e3285-1d90-4821-9a1c-4bbd472bec3b", "value": "T1F2642A1262E17C60F5364A71CF2EC6F8771EB9A08F5937A752149A2F08B12A2CD73731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387542, "uuid": "1114c4d0-9c9a-435d-ba96-2f31f754a0c4", "value": "d0fa90ab077085f07c566a80dea00339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387542, "uuid": "99c9741b-c60e-46c2-8b40-e254c915483e", "value": "3072:bXHSAkEUmXt0xdfYBv+pJhKYQ7YaNs8quwccgSknFCZa+nz1AR1Z53QG8lVfpS:bSFEXthgpJhKVVwceDa+BAbZ5AGQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387542, "uuid": "ea2bf34c-6d80-47b2-9dfb-e67a74bd2143", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387542, "uuid": "03ed0d73-ee94-45c0-81e0-ceb4d7064d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387542, "uuid": "4b97947e-715f-4bc3-a02c-bc9fbe4f4eb8", "value": "05926299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e751fa-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685387603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387603, "uuid": "5f76751f-7706-4a26-8191-077c2c852ed8", "comment": "Malware payload (RedLineStealer)", "value": "0285918474f56d3bd4a0dc86e26078ab", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387603, "uuid": "8fbcd1bd-36f3-4251-90da-94db9f3813ea", "comment": "Malware payload (RedLineStealer)", "value": "7c294b35d12b5598bc3452b5ea8bbfddb804d0c7cda753302fd42337c1f5de8f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387603, "uuid": "7ab34c53-82c9-46eb-8d00-35518c742499", "comment": "Malware payload (RedLineStealer)", "value": "9108e792c1490eaf1236150c56eabf728ae7e9d2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387603, "uuid": "9541f732-d419-44d1-9626-203adf6957e8", "comment": "Malware payload (RedLineStealer)", "value": "2cc74525acc3dbd88d5a9bc93360dc66031db191c0cfc860ffa1e4341dfff4e66f0e48b7ca06a923d189ca013d2cfcd2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387603, "uuid": "fdbcf931-115d-4099-8f10-5fd6c91c918c", "value": "T10E052253E6EC5036D97627F418FA07930B36BCA1ED75834A7B99AD4A4C73680693033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387603, "uuid": "08e77171-72bc-4f97-a7e9-ac0614ddb6c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387603, "uuid": "6f9b478c-0604-4f3b-aafa-66ab63ccd836", "value": "12288:HMrky90bpwBhRaJg6nv5JG5gqaZtOJk6JUCYVoP9nR2xPX2u1VRTH9T:zyE8aG8rGdaWJk6HYVJvPTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387603, "uuid": "52efe5bc-f8a8-4170-98d7-fdbc5080cd69", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387603, "uuid": "60e90567-db06-4df7-a728-a04342f2e0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387603, "uuid": "f38f592d-5eb7-4907-b124-ed011f7210da", "value": "07879899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d10251-fe2b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685369756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369756, "uuid": "46e56ddf-24d9-4ff7-9c6d-c06c886dd9b8", "comment": "Malware payload (Mirai)", "value": "ebb6a793b734426bdd0a3805ef76eff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369756, "uuid": "d04bdfdb-02e4-4934-952c-e5b97e30c84b", "comment": "Malware payload (Mirai)", "value": "7ca046612cecee59f9bb6507019654f83f005da31711a7e2813d37c848ba1372", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369756, "uuid": "b78a447d-6284-48a1-880e-b79c94dbd68d", "comment": "Malware payload (Mirai)", "value": "15d9c1c2b1556f531a88091205e8e30b872671eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685369756, "uuid": "dca52265-68e9-43a0-9b31-cf49b86d00b6", "comment": "Malware payload (Mirai)", "value": "1b518c716e4ce17b68c27b61b5ce87963e6086f0e3a498851125c2d510ea9c926f0e2697142c73c740d1b89f2ef81561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685369756, "uuid": "6c14f8a2-800f-4ce3-9ef1-fa2a3d29934f", "value": "T131D2F251D43C2E82E99EF335887A3A4205218A2DD8E495DB8DD0673F5420AFEDE2C949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685369756, "uuid": "891aa27a-2333-4f69-98c2-0905d9893b69", "value": "768:gIhuJ2klwC/4P8qhZABQ3L5FRgRnn8dVWZd2nbcuyD7UHQRjt:1MR4PZ75FRg1MVcd2nouy8Hy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685369756, "uuid": "b141f268-fd8c-4d1d-b4be-b59b949675a9", "value": 30028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685369756, "uuid": "f56c95bf-d726-4de5-bd47-1c7853c65656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685369756, "uuid": "61355633-0b95-439a-8001-258f0d14f509", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beafb3c-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685391164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391164, "uuid": "186de270-012e-4035-9c25-cd8dac293494", "comment": "Malware payload (Mirai)", "value": "06cb6462fe1d76d6d9bc7118e54af922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391164, "uuid": "24093d5a-3c6e-44ac-9c00-d5550c0df332", "comment": "Malware payload (Mirai)", "value": "7cce54e430e2f134442a5b0cda251958ba1a2e0e63f1008908ffdee6a7f2248f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391164, "uuid": "145a2931-c554-494a-a690-df200e2acd08", "comment": "Malware payload (Mirai)", "value": "8b1f49ec8189e87048c6481fa885aa93f3134213", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391164, "uuid": "0d6b20fb-b952-4c6e-a7c5-359a7d46f4d1", "comment": "Malware payload (Mirai)", "value": "d375122cea920da1b3ee58d57b945b8cc004872e0c231070c59234f231826364f18de3ace31b893c20eaa4673d4a8b4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391164, "uuid": "e410730d-fbf0-4dd6-a72c-353634c73510", "value": "T1B8735B31B9762A27C1D0A43A11F74B50B6E117CE3AE8C61E7E720E5EFF216506113EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391164, "uuid": "97ed8553-992d-415b-8d90-7e892616b6f3", "value": "768:UIaoeBDF3voaBq9/J/j7g1LsAStrDwJZfZVZLmWs1GhpSGijO+S0sxbu6:XaLBDF3voaBS/J/j7g9sFrDKNs4O8u6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391164, "uuid": "b77903e4-e55c-4828-932e-729946d2efdd", "value": 76176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391164, "uuid": "878c61be-c7c0-4e30-9200-0753fd8a430e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391164, "uuid": "03270b2d-caf3-4d97-bb5a-8fba3c240f8a", "value": "06cb6462fe1d76d6d9bc7118e54af922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b52105-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371047, "uuid": "5241acdd-a2ef-485c-8dea-5c543e22716a", "comment": "Malware payload (Mirai)", "value": "f196a252b3cb264fd7076c2b0b882692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371047, "uuid": "b586a827-3eba-4292-8e15-b159829d1541", "comment": "Malware payload (Mirai)", "value": "7ce4eb8e15c4fa0f41dd4d32f9a284031c8db58176c73087a07b0849fe3a5bf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371047, "uuid": "94865399-39ea-4779-8b13-4fcde86d2448", "comment": "Malware payload (Mirai)", "value": "e4167fabbeeefa085503c62e2bbce698a6500824", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371047, "uuid": "b5576753-b8d7-45db-838d-d23016e718ac", "comment": "Malware payload (Mirai)", "value": "6a4124e741518916e9c95c70c077f5fd4559fb302ff46cf203f6cc45218fd177ed74902d70f067d9cfd307ca9eb534ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371047, "uuid": "c82655aa-aeb0-4973-a882-4866c07c02f4", "value": "T18803E195FEA280C8FD38C6BAD2DC83476A3417D5F6E868D9D01098728F70374A9C536A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371047, "uuid": "dc7635ea-60e1-4c16-b409-9ed3b4be0526", "value": "768:ambVu1XsZ/ZkbZcCwCHxu6s7MAlRNqB2pJ9Rr2+iO9v9vkuTMEZ+IZ2qJq9hRNUZ:DUxsrkb+7UxQ7MWwB2pJy+/9v6lEZ+9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371047, "uuid": "36ef7a8f-2044-49d3-a2b4-116ad17c33c7", "value": 40056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371047, "uuid": "4d6d59a5-3f4e-4869-961c-410ea198a9b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371047, "uuid": "104981ad-e0c5-4f72-8ba4-78d40efc5dc8", "value": "f196a252b3cb264fd7076c2b0b882692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f9f175-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376772, "uuid": "324ec2bb-e6ed-42f7-b44b-3ac67356e0bb", "comment": "Malware payload (Mirai)", "value": "b1ee071790b50052db93c593f4364597", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376772, "uuid": "f1ddf3bc-5600-446b-9ddc-ced7fff29bd5", "comment": "Malware payload (Mirai)", "value": "7e6de08a7ca7fcdb84aafdd14ade7c1fcc606fdf530529c066383c6d25dd93d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376772, "uuid": "d30c1964-43fc-4bb3-8553-ac8b94c8fd30", "comment": "Malware payload (Mirai)", "value": "3d5043493ee0238df5996ab09f532f1d66812f89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376772, "uuid": "cb946032-dac4-49a3-980f-501fdce2c0e2", "comment": "Malware payload (Mirai)", "value": "0426907cfcdb8804b899443b6c01b1f4e0622f830db807fb59b81344377ac4acfd38a58b072f74a6c0b7ace24cb9707d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376772, "uuid": "a7aaff3f-b632-4de3-b6ad-7f97a344498e", "value": "T1B082BFBAA2846430C630483FCB2DCB8123D706FDA1EF7725201916F5FB5588E66BD582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376772, "uuid": "7bd4ce2f-f8ed-45d0-86c1-8c710c540e5a", "value": "384:M3MJcxMwYgsO0WyBXLZAJgn1ax6Z1+VLAqvHEBLlaxFX1DOlhymdGUop5h5f:LcRYjO0WyuJgkx6cVIV7s3Uoznf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376772, "uuid": "3a8d10c2-d07f-447f-91c5-d3655fc3bb93", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376772, "uuid": "6ccfce02-6464-4b0c-9eb9-8b4f5facad7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376772, "uuid": "1c30ccb2-ebfb-4c9d-8ea7-2e40796429ac", "value": "b1ee071790b50052db93c593f4364597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32aaffe-fe27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368198, "uuid": "f0c47ad3-3927-47a5-ab20-aa00032d2d10", "comment": "Malware payload (Gafgyt)", "value": "ab5548ce1fefe35536ef25e552135345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368198, "uuid": "a12f5bd5-c2ac-4bc0-aa87-89509919ed41", "comment": "Malware payload (Gafgyt)", "value": "7eeca42526933c4206eec250855fa383f524f5350259e528801c51968bee61fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368198, "uuid": "a79ca44e-2a54-40f6-ad84-e69db8978752", "comment": "Malware payload (Gafgyt)", "value": "a3d8a42db6929950015424fcad8c5c6fa4ec5e75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368198, "uuid": "a3ed3733-6345-4cbe-b8d6-e20589508e61", "comment": "Malware payload (Gafgyt)", "value": "fccc49ab1586583636e9670b756d06fa04d2906c0b03cf39985eb364dc8c1fdd9047dd8de19b6e55b8a39e5f51b64ad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368198, "uuid": "48609f7b-911b-4a6a-8afb-66874943f56f", "value": "T109B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368198, "uuid": "3b4325a2-3d2e-4e76-99bd-6b40213ea672", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OiN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUrerNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368198, "uuid": "3af58f53-78e6-43f4-811c-a1e257c423d1", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368198, "uuid": "edb7cd96-0e6c-4949-af66-833aa55f8c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368198, "uuid": "0b133fad-bde5-443d-8986-908ddf32185c", "value": "ab5548ce1fefe35536ef25e552135345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17a32a3-fdf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685345539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345539, "uuid": "f58157b7-4af4-4cba-9348-4f01bb6e16c1", "comment": "Malware payload (Mirai)", "value": "96329cc7d37b78e442aa684d4016d2c5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345539, "uuid": "dce50c2c-74b9-4e28-9d4c-6ada685813f1", "comment": "Malware payload (Mirai)", "value": "7f62c5975b3c8cd99f84d52a7453307865b523e97685bc85b3bdbdbd11384143", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345539, "uuid": "b387d9ed-a321-49ba-a765-272f2237d763", "comment": "Malware payload (Mirai)", "value": "1a0f13975ea771444ae5cd90943de99ef70b861b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345539, "uuid": "81453946-0c72-4204-9755-3edb6d40e661", "comment": "Malware payload (Mirai)", "value": "38bf1cff5ba09208a4ed6b310c5f51583367ccd9f402d54534bba5f3dbe84ba80f43162f8beeb7c75fc478022f30c57f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345539, "uuid": "6cd74521-9427-4b92-befd-6a84be064d28", "value": "T1B8534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345539, "uuid": "7add1b6f-2d36-439b-82bb-f330f89e6356", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/XDiQ5gLiKimfFoktCe3fYRMx:WShU3q7cEDlCK/XD+9i8Fok06fYR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685345539, "uuid": "147f43c8-2ed0-43e1-8cf2-4f3b06a5f2f3", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685345539, "uuid": "6e7d6adb-4601-4553-b738-f93a33b1834f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345539, "uuid": "38db9465-5b45-43a3-9673-6e0aafe856eb", "value": "96329cc7d37b78e442aa684d4016d2c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aa897a-fe4e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685384870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384870, "uuid": "e14afefd-89cc-4f56-8da7-20555b100f54", "comment": "Malware payload", "value": "ff320e8e61e96e9d76df7f3b0c0a10a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384870, "uuid": "f205feea-78ff-423a-8d8a-d400611d2e12", "comment": "Malware payload", "value": "80546ea8108a9667e746afc5701d0234cc8adaaa69086de4479e96de6ae6c740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384870, "uuid": "49e8d6a4-50c0-4278-842e-87a843b349f1", "comment": "Malware payload", "value": "f17f374e433bf947dd613ac29eacd4838407d084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384870, "uuid": "747172bb-be39-4efa-92ac-659dd560313b", "comment": "Malware payload", "value": "3b7774101e7f4251d792a88cc10da0e264649303e3fc077cb41e223ba1fe0609f0c600987030039964722db7bc234154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384870, "uuid": "0fd2295f-f3ba-455a-bfcc-1d1766cc468c", "value": "T196765B8B72D512ECE0DD0F331352829013F9A5363BA45EFE4A208714957B5B522EE7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384870, "uuid": "236595d3-eb97-4fb3-a848-640e3e3a0e21", "value": "fe63e322309337ee09a198afe547e82e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384870, "uuid": "7c49de8b-b2fb-4100-b9db-57ae6f5b991f", "value": "98304:qWuOBQ/+mCceDp32m1Xl74CdXY1UYkwWfTpVMdBcbfYzgqDEYKAzwdA:qWuOecTF2m1h4Co6YPapSdSfydo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685384870, "uuid": "91aea27f-1f64-4f03-962a-178178fd4317", "value": 7446528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685384870, "uuid": "52ede0d8-a56a-409a-bd8c-2fa29b06103b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384870, "uuid": "a2fa54d2-b0f0-4973-b957-feaf379bb76d", "value": "SecuriteInfo.com.Variant.Lazy.345597.32606.14359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ff1037-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363392, "uuid": "ca3813dd-01b4-4987-91a2-2f3f0b63e2ae", "comment": "Malware payload", "value": "52a6ec049ebd4106e9a4c5cd67cd5398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363392, "uuid": "c638e635-52b4-4d4b-b929-9cb6dbd3b8fa", "comment": "Malware payload", "value": "80bf50f010b1ff64811243ca9dd7c0e94708095a99a19f44ca2fa33af7f79f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363392, "uuid": "6e71318f-0438-437b-bb84-c79c5034b3df", "comment": "Malware payload", "value": "1839792d1d3f24687b4944f7ee3f0115ec608633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363392, "uuid": "11078051-720d-4120-a293-e0baa4b8764b", "comment": "Malware payload", "value": "9990ca25500f5d2fcbc14b6983f0d44802cf3cf47ce973e053771d87eb45776267d242ef1a63c472724e16fac4ac4b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363392, "uuid": "36ed9a2c-7a38-487d-82c7-b6d486768f95", "value": "T105E47E43BBCB40C5E5E67DF11277E323EB35B53A632A69C7DBD01C225A60910AD29327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363392, "uuid": "bd525e52-6208-48f9-9a57-deefbb01a6be", "value": "12288:X8WHr+sPyWWbj3aJdWEG3qerC94rchMv:X8rWWKJdW4OKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363392, "uuid": "5d5d2df6-5317-458e-b111-aeafd01e81ae", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363392, "uuid": "1e532e84-1f57-4229-88d8-0415dd253988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363392, "uuid": "59b3ff67-4d97-4d04-8beb-e2aacfb2a411", "value": "SecuriteInfo.com.Trojan.Crypt.11433.12740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13283bd3-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365352, "uuid": "9f41e90a-a9be-4474-9dbc-4a8017c682ad", "comment": "Malware payload (Mirai)", "value": "07bd73ec0c427fbd3a328ea3f8bdbd46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365352, "uuid": "5804f639-266f-4e0c-ae90-6ab934807666", "comment": "Malware payload (Mirai)", "value": "819602fe14342315f03286cc4b55c957f944c8ab3ef28076f6202c2e799d04ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365352, "uuid": "c0038bc8-7d13-468d-8f5d-023ede9076d1", "comment": "Malware payload (Mirai)", "value": "217cffcd95074c39288c9c60dbfdc2d946d3674b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365352, "uuid": "c15cbb22-4469-485c-adaf-a0126ddb8e35", "comment": "Malware payload (Mirai)", "value": "351847c8cc2387927cb7c96e1b0ebf96e45fb3cbcc215331fcf37110b6e95b271666f0ab0ee4d0fe4a7685b08f21ab9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365352, "uuid": "8ae80a9a-99aa-41e1-a4ce-f6128f1ddd27", "value": "T1B7E33A56EB808B53C0D2177ABADB82453323D764D3DB73069928BFB43F8279E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365352, "uuid": "ce424785-7a29-4bf6-90f7-aaf5c5a943ae", "value": "3072:UBHVAeD6Zm0aaBZX+Rv2F+kxHn156MKrvmSV7mmlaTqXsB:UBHVhDQaaBZORvkxHn181rvmSV7mmlat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365352, "uuid": "17465455-5b78-459d-a096-37e48928a401", "value": 151050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365352, "uuid": "ee94874c-20ae-4105-92e5-eb12502f5045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365352, "uuid": "1902d49c-0045-4e46-a0c4-77c8a028c851", "value": "07bd73ec0c427fbd3a328ea3f8bdbd46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b3ebd4-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685353735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353735, "uuid": "3b5a593c-3f13-4b82-aeee-f534b5c34e55", "comment": "Malware payload (RedLineStealer)", "value": "f7c99def6eb8317575912998ac811999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353735, "uuid": "5d89a5f9-8f6d-4c38-8e81-c5a244c077b1", "comment": "Malware payload (RedLineStealer)", "value": "82aeb7a6980248408831cd3b2e42f1fd2d9454757e63117d187fbb711e6c01e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353735, "uuid": "c72734ef-f559-40d5-ab32-571a817057bf", "comment": "Malware payload (RedLineStealer)", "value": "d91ca5fe101596503b4abc6467a237f679aa7812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353735, "uuid": "9d71281f-f41d-4858-b360-49104fec7fba", "comment": "Malware payload (RedLineStealer)", "value": "c348fe42cede848744354df0d341b1e37171c3baada926bb87bed89ff76ac0d8d487ba330fe3facb43b952c41e373d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353735, "uuid": "c8eb25b3-a44b-4a98-b150-2a301cd7b802", "value": "T17364D021760CC07BF56B24B084E9CE76A66878341B2F11EBB7D44A694F327E1AB30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353735, "uuid": "018dcfac-0d1c-49be-8f03-ae0f83e083a3", "value": "0ae55b3d0316ee186a9c0447182ae42e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353735, "uuid": "21b20a80-21d5-4e92-8579-4d1675de6cf5", "value": "6144:D0nruBSmuqurusx4RFM6AKnqFOqiOxrS4fIN6JgvW4u8wXD:kKImTmusx4R1nXOxrS1ugvyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685353735, "uuid": "a064afee-92de-48ef-8dc9-d5bdf990ec53", "value": 317688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685353735, "uuid": "f5d77b88-7ee5-4e61-9344-d3a7f7581167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353735, "uuid": "f08f7718-ee2a-4b67-884d-6ecaf022330a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6eb490f-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685354031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354031, "uuid": "cdc7db8a-c4fa-4e15-a154-b8f6630e18f5", "comment": "Malware payload (AgentTesla)", "value": "f3cd7f3717110f3259e206a52d5941bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354031, "uuid": "f23e6ba0-b90c-489c-bd99-3c33afc88f0f", "comment": "Malware payload (AgentTesla)", "value": "82d1e259002e43b95937bc81dd217664d6b0776e39f6a25fd114ae7a37fdc616", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354031, "uuid": "db5e63da-9a79-4970-9f8a-8facbecb207c", "comment": "Malware payload (AgentTesla)", "value": "9a6442051ff49b86c80675c1eb83b4f9620a50a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354031, "uuid": "68ae2e2d-de21-413e-9923-d5b43fa60f68", "comment": "Malware payload (AgentTesla)", "value": "382c8084239de821d3200c8c05ca1e69a33a5de9d2bb6ba2f4cdb21115ff49e1d7c58b1eedff2d0bdba97b7a0f38d7b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354031, "uuid": "c053aac7-4028-46b1-9b10-1551c575dfa7", "value": "T107541242777F562DE39F3BF597A33B8113698D063042D6298D8E304C6A6BF0A75C6B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354031, "uuid": "1fa041bd-b498-4048-9661-e43da7e490d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354031, "uuid": "44d34510-822f-491d-8190-b5b0c058caed", "value": "6144:EEuzQsL+FvbMDDMFlK+tQcQK+7tkKOFSY4/uixlkQBrH:BzwQEcbuk34WrQBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354031, "uuid": "65ea5c4e-7e84-4dc4-b190-dbed5903e5bb", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354031, "uuid": "f60ea8d7-dd2d-4595-b329-952f6d529c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354031, "uuid": "e864ab50-4098-4abd-b551-feb2227ea2a4", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7a9a71-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346633, "uuid": "9ae41b5f-0cdb-436e-9d16-d416d23b79ad", "comment": "Malware payload (RedLineStealer)", "value": "9459b907f33dc3651f9772cae0cb8206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346633, "uuid": "eed329a2-e2a3-489e-985e-9c113e55220c", "comment": "Malware payload (RedLineStealer)", "value": "83af08757a9eb243af9ef8cce302e1fd237e75d92aaf9d820ac73d1b81828544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346633, "uuid": "957fb02b-e833-4c01-a945-22c3bce169bc", "comment": "Malware payload (RedLineStealer)", "value": "76f71669f41b1d48d34dfd024f65e523b06c5ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346633, "uuid": "4381377a-1473-4052-851a-5fcc55350ea0", "comment": "Malware payload (RedLineStealer)", "value": "7a4a4b8e540e9bce5ba61fe7f6cbf403a2622a9858af38ca38dad30332f4e1c0dacc9d84284204614de082fb83e67cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346633, "uuid": "593739aa-cbe6-4edd-b5f9-8544d3de41db", "value": "T19D052342A7EC5123EDB417B0ACF252D31A3AFE719D75836B63104D4A0EF3AA06971367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346633, "uuid": "bf560a81-229e-41e5-96bf-6d8bde3abf9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346633, "uuid": "eabe13dc-7fc2-4714-a65d-58764e83dce3", "value": "24576:eyv2Hgp/GT7pOa8ZSBHGF/5reS6BeVn76USq:tbGPpOvSBw6SFVn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346633, "uuid": "9a633a03-c8b2-447c-a92d-08b5fe64d3a4", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346633, "uuid": "85d6faa4-1c29-4de6-967d-088c1e3c32a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346633, "uuid": "448155c1-5355-4311-8b47-53d9ac04c1bf", "value": "9459b907f33dc3651f9772cae0cb8206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416515b8-fdf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685344814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344814, "uuid": "fe6bb620-28dd-4c32-97a9-1afe24757e5a", "comment": "Malware payload", "value": "0e65c589e0c6edffb3b305e7595a271b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344814, "uuid": "ab07d736-caa0-4fc7-81e7-9934a1afef69", "comment": "Malware payload", "value": "83d171ffcf9f88d4e1408e34ef2829c849b90748e1b7b2da0679d6ee39cd958f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344814, "uuid": "94c111f2-9be4-4c34-ab86-5b43f1b672ab", "comment": "Malware payload", "value": "53ef35185fa07082cb278e7ef52645a21fbbe058", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344814, "uuid": "c01603b6-5bed-4d7f-b3bd-5755a9cb4107", "comment": "Malware payload", "value": "9ab0ffbd370d9176200d1855411139fee4288860fc66db6675582910e54833645714dd3825660a6616a78c97eac355cf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344814, "uuid": "b4886887-ac56-4118-ab4c-1941c8e337c0", "value": "T1EE527D8DD36870A4C1BF6C3DC21B0CF1DA49705A9D85F70E24967A0D2ABE19327CE29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344814, "uuid": "999f62b2-7ccd-4f40-853b-4cb0d7ce32c3", "value": "192:0TUa42Szpq9H5FEBPJ2Z3KmFOt+FnzKqiWlw0QSFMaxon0YSntQ:ZaHiBPJ2cEnz3lwduMaxon0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685344814, "uuid": "faddb0ec-327c-48cc-8266-2d49c64c5f91", "value": 13247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685344814, "uuid": "bdf55ec6-4279-4b2a-aa0f-63e1a92bca75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344814, "uuid": "2e4daba1-bc3c-49fd-9120-9334aa476bad", "value": "ddd.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c3d9c5-fdbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (REntS)", "timestamp": 1685322038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322038, "uuid": "866ee32a-197c-48da-8377-8d27b66e28a4", "comment": "Malware payload (REntS)", "value": "066afd9da9205eebe99f93f14392d8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322038, "uuid": "d6ffd4a9-c1b9-4235-a616-a26ab5a9231f", "comment": "Malware payload (REntS)", "value": "84ba9ebe889c3e289a22d88291fa483fe1700e87e1cd5191e8cf41f213b13003", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322038, "uuid": "af81188d-06f8-4b54-bab8-62ba9238b3a7", "comment": "Malware payload (REntS)", "value": "657c28f29423d3d202e0ab23e339839d74ecffce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685322038, "uuid": "d731c133-138b-4ded-93e7-270f463752da", "comment": "Malware payload (REntS)", "value": "93675978928da315d639e60cb3f2d0e57c00259fac1c20438af6badc0efc943bd062ee7dc847860fb7fccdead4611d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322038, "uuid": "65e3ad64-4927-4a32-9d8a-989037f55505", "value": "T1F0863367404639E9F8A26D315F3AF8E42A49B5138E5234B00C1BC8D7563F9D3DAEB207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322038, "uuid": "0102a436-34b2-431c-91fa-a56faef32c69", "value": "de3863888c83837b13b7c1a90a18d46c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322038, "uuid": "5820866c-d7eb-42b4-8763-6b8b61701559", "value": "196608:bEKXYQqWFdpetn+0AqccV1YAjIsygE4cZdh+8t0bXFGlz+ToCHaGBN5svkU8tH:bPIQBXetnDIcV1q4eh+Fzcz+VHBI8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685322038, "uuid": "3125dcdd-f2fd-45df-8bef-d2c508644023", "value": 8124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685322038, "uuid": "579487e0-703d-4876-9ea3-885ac84b8e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685322038, "uuid": "92293fbe-a057-4dd5-a75b-81ca0a51361d", "value": "setup.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a6262a-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377107, "uuid": "acf175eb-b754-4d83-80ac-ea8f4ab56673", "comment": "Malware payload (Mirai)", "value": "1d0d5d0893b3eb51b3ab3aa48b14f8a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377107, "uuid": "1a82acbc-3b6d-4be4-9238-6ec3df9bfe83", "comment": "Malware payload (Mirai)", "value": "859917b2639f05ca661d3d37b6391328e1686d0d688847529ffaf676b1405ce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377107, "uuid": "2e55944c-16b7-40b3-8cc8-8507496b6716", "comment": "Malware payload (Mirai)", "value": "693d1a11fd4ad2939486671389be918158382909", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377107, "uuid": "49308ba3-18d1-459d-b46e-1a5fbe39dec9", "comment": "Malware payload (Mirai)", "value": "a53f87865272aa2a8b5bac6ff32eee348bc6657eb617364714e56dae88cd49002f7eedb8fb54fee1d011925dca7ecf2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377107, "uuid": "feaf2bdc-e868-4a6e-a6b5-2c3ae31f6a2e", "value": "T14EF2F1AADF415852EDF10130555E4186B35ABFBCC1DE3938B38B0E3495E464AA3FE272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377107, "uuid": "53f526ea-ae7a-4640-b311-ead0a7bc5633", "value": "768:r8qJjFRmZ9IIP02ltJcU7fs+5Iam0y0yTAmykpL3FToq3UIA0:4qvRK9INaL7U+5Ia8aQTpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377107, "uuid": "50bd57b5-a557-4ef3-bd64-5f395320fd73", "value": 35540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377107, "uuid": "259fabf5-5c42-4e8c-b677-93743ff83503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377107, "uuid": "7b4070f7-ec40-4bff-8933-ea41af1f457f", "value": "1d0d5d0893b3eb51b3ab3aa48b14f8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d334c958-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685377271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377271, "uuid": "65983fad-2733-4a0a-b6b8-4b5723aeea81", "comment": "Malware payload", "value": "89288a417371e08b7f3d7186ae03990f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377271, "uuid": "85521212-23a9-4c63-b4cb-8799addda854", "comment": "Malware payload", "value": "85f6c19203025280ac67620318a01d8eaaa29b7a49aba012d61226e29bc6c761", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377271, "uuid": "9b6c539d-d135-4c4d-b648-f9cb9c9f7f0d", "comment": "Malware payload", "value": "c604fee1ce9d7f326efc17ec4bc7e9fe1ad1fa4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377271, "uuid": "f3a972b6-90d1-4c7c-9771-329723a5275d", "comment": "Malware payload", "value": "0b94b0065479ab1ae92e02c09344e5e3d30e39bc63487e5404d578bdde66927dcec17adef96a473239591e2e31892027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377271, "uuid": "a95cdc3c-8add-42fa-9f86-9c6fe527c32d", "value": "T1FBA3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377271, "uuid": "2921d462-62dd-4b32-ad5b-a42083086df7", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggpx2ymOimW+zWBSirHzai:0oc/pOZM1p7NggT2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377271, "uuid": "fadbc845-0066-4000-a630-d67a22d089bb", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377271, "uuid": "2020e6c8-9b70-4a1b-806c-418bc315f599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377271, "uuid": "9c732498-52ef-4472-9286-bfea623ff8b7", "value": "89288a417371e08b7f3d7186ae03990f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b6c07b-fe16-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1685360738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360738, "uuid": "e19573a2-70da-4dc3-b168-d6a45215ec64", "comment": "Malware payload (NanoCore)", "value": "adb719d2a3c51a77ab1ed355f91d3ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360738, "uuid": "c960f339-9dab-4b58-89c4-60be5a199f00", "comment": "Malware payload (NanoCore)", "value": "86016f9f3443fd0a79162579f2d359b1150e84182f9e3c162a2fb4932ccc2e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360738, "uuid": "0b8ed3c5-dac8-400b-ae62-aad1041fe6d5", "comment": "Malware payload (NanoCore)", "value": "488faf72df7a8fd8e47e71b98d1149b0f4e6950b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360738, "uuid": "e233653a-bd2e-445b-9cf5-bde8f465d17e", "comment": "Malware payload (NanoCore)", "value": "826b9a568d5ce72ab7f080c5fe1fc65ccebfa39cf843c1735e67a19e58740cf00b5dccb7501c212ca19f4cbce26bfe17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360738, "uuid": "64ef95df-c440-4f74-9b40-66d1509fa921", "value": "T10E24DF1A3BA8892FE2DE867D702212568779C2E3A8C3F3DF18D454B64F667E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360738, "uuid": "6ba88bb9-6fdb-4874-8c91-3312112c65ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360738, "uuid": "5cc0f1f7-113d-4a25-b078-62f70b537530", "value": "6144:gLV6Bta6dtJmakIM5sx/r1+Fw1VRQRnuDoPvEPWNSnswy:gLV6BtpmkHVYFSgRnrvEuNSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685360738, "uuid": "79fdbe10-4cc8-40cb-950f-faf84eb2df79", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685360738, "uuid": "ee645bed-b004-4e6c-b409-9b3345508b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360738, "uuid": "944a7d90-339c-45ac-8dac-7de9b990617a", "value": "adb719d2a3c51a77ab1ed355f91d3ca2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b094a809-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377213, "uuid": "500e9d76-999b-4472-bb54-e500176987a3", "comment": "Malware payload (Mirai)", "value": "30bc108934cbbaed717305bd7dbb9e21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377213, "uuid": "f1b5e555-27c1-4850-bc6a-5cbecd2fd3a2", "comment": "Malware payload (Mirai)", "value": "86dd7eeb604cc26791b34eed64fd9840a83004c19be08e5ab04f5231271f0124", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377213, "uuid": "e90e7944-19db-472f-9d15-963e02634969", "comment": "Malware payload (Mirai)", "value": "a7feebb8c3ad970e323e01105061b6e31c1dfa32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377213, "uuid": "c44cb53c-087a-4533-bf22-c52c178c241a", "comment": "Malware payload (Mirai)", "value": "4717be3d920fbbf3f77eca6425553c23e6ec312e50e6d09cefc855e4549933886d5b7b0c571e943dbe86063cadf5feef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377213, "uuid": "ba1e08af-39d7-45d4-aa5c-5104e67559e0", "value": "T1CF23F1390B97FEF6CE1598E9F5300FCE6DCD67E6C1B5702306399BB82896580845528F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377213, "uuid": "be17c088-a1d7-468d-8f50-e802bd473be6", "value": "768:sf+Mc+xJFWXFdleqp9SFfuKk8be174vjD49q3UELPcLJUYErThuMrx:sfW+BlASpQGe174vBL0VfEr1u+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377213, "uuid": "819e1fac-28ce-4601-87c5-212b2bb81ad5", "value": 46656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377213, "uuid": "656dd00d-36e4-494a-aa05-7208e4ac04cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377213, "uuid": "a315f870-3e00-4a12-9890-37f1b662a3f8", "value": "30bc108934cbbaed717305bd7dbb9e21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c28e4a-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377225, "uuid": "752abcc8-0de8-4873-8743-4bebec77de6c", "comment": "Malware payload (Mirai)", "value": "00f8ab08ad65445fbecf2090535383d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377225, "uuid": "f634dbf1-24f7-4490-b89b-4fa25325825f", "comment": "Malware payload (Mirai)", "value": "88321bcb6a19e7d51836072d179e41154d6d6dbbc4cd5eaed54b347d137c3ff5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377225, "uuid": "69ec5fe5-1ffe-460a-aeea-bf72fc16f1ee", "comment": "Malware payload (Mirai)", "value": "0976e8581177bad5db1f192dd5f6e40e32d6fcd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377225, "uuid": "2df6003f-d107-493b-9b15-0301feeb49d5", "comment": "Malware payload (Mirai)", "value": "1754356bb1e7f0b539aa6cc2bd99820ec73e336a1706c5c73f43edc94b5d58c53278ace122d08efc021ab23096538f75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377225, "uuid": "014e797c-c517-4778-a0ea-cd3cb706753c", "value": "T1E2330991B9824E6AC9D513BBBA6E55CE331063E4D1CF7313D9201B543ACA51F0E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377225, "uuid": "198b8c29-bc46-4443-86e9-e97fa650ee55", "value": "1536:CM6A0Y6wggbL6DCgz7P7BWy4LpEyT1GaBy21TNA:mxwgKLAC0r7gzLuyT1xs2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377225, "uuid": "cd4e6a86-8530-4e1e-8d22-4a2d93da93d1", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377225, "uuid": "0ee68490-a69c-445a-8036-1f3b5dd37db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377225, "uuid": "e932c79b-f080-44bc-aef9-43d3e03c21ca", "value": "00f8ab08ad65445fbecf2090535383d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ee71c-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377145, "uuid": "8d133318-ccad-4081-95d9-8c0a18587d3d", "comment": "Malware payload (Mirai)", "value": "6ef4cf992cbefc1370776668eb40c6bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377145, "uuid": "c939fbbf-e6c7-4f8a-9e97-71002269c837", "comment": "Malware payload (Mirai)", "value": "886524f014ec718339fa27c9be2a3f210c4dd82e6e81b24517aea2ee9fa3d06b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377145, "uuid": "755a1c1b-0ca6-445d-8edf-f0effb4cc789", "comment": "Malware payload (Mirai)", "value": "1e5be8407b93a672b41fb6522f73d405d4f6a36e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377145, "uuid": "29b0c911-0c4e-423a-8aef-5da5b2628a76", "comment": "Malware payload (Mirai)", "value": "3044a88b62358cdf4020eb7f393c56fd2b355855025d0cf28c67c7629a9f11cab2adf2a56e70b716e58514e02c758831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377145, "uuid": "2addd88a-4f34-4bc5-9160-19bfc3aaaf5f", "value": "T1D66329DBB800ED7DFC5AE77B8813050AB130B2A595930F7762A7BD53BD320A45927E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377145, "uuid": "c8202fed-d6ac-42f9-9b59-1e3c3218e3cc", "value": "1536:rL2Cdm8bLNM2dLR9E88lrrcrX8EURZx7/KNb8T9U:+C8wLNM2dN9E328zR7NT9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377145, "uuid": "302d07cb-630a-4222-bdc6-2a1bc83e71ac", "value": 68316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377145, "uuid": "1a12fe2d-8411-45ab-9539-daf9348591fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377145, "uuid": "1058def7-fdda-48ad-8c82-39dc7bc7fdf0", "value": "6ef4cf992cbefc1370776668eb40c6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dde8153-fe1d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685363652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363652, "uuid": "778603bd-053c-4746-80fb-1fb2a1df49cf", "comment": "Malware payload (AgentTesla)", "value": "9f5c1c72a8f48ac8cee9d2c50357824b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363652, "uuid": "ebe035b6-b622-4e4b-b866-2c79589d2a5f", "comment": "Malware payload (AgentTesla)", "value": "8866f6c589741b658ffd084aa66e2ef4b34f84b40238e7d60e2acc5961cf207c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363652, "uuid": "9a1af694-5da6-4a25-82a0-c2a8fd383064", "comment": "Malware payload (AgentTesla)", "value": "3a8a030b56848af1f0b5bcc16ad3c3db4a87be16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363652, "uuid": "5b47bcb0-b927-4ad3-8876-98ce3644a698", "comment": "Malware payload (AgentTesla)", "value": "2cc629744510d36f9a4a7ec8c37a3fb52b1f30fa8f9a453ddd3df8d7e565b57b7511ff0a69219644b946377feb3e5ced", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363652, "uuid": "8a68556f-c3fe-4fee-aca0-fdc3d634b990", "value": "T147E4021853FC069AE2B367B652A04634577BFE9E7671E34F4E8376C96A22F004A10773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363652, "uuid": "eec74320-c7d1-49e2-bbba-a3a6495b37d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363652, "uuid": "6ca11e5e-2779-4167-90a4-7123ead08971", "value": "12288:IsIdum2iNfmFx2iqNhujGjUTGRd2mbdZadNqi9VRTsSqrZ3xjabyPK:IsIdum1lmFxUpTrXadNqir5s5xjIyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363652, "uuid": "715bfba9-8220-4354-876b-655e3579cf54", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363652, "uuid": "d371f979-1664-49b9-acf6-978cab5c124d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363652, "uuid": "e5d34421-bc6d-49c6-92ba-c5a29ae6f0da", "value": "84022000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb30b1e-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346930, "uuid": "67346485-faf3-43e3-a7cf-b64dc9efb88f", "comment": "Malware payload (RedLineStealer)", "value": "dcfd7bb43cada0e0f9bcf50801b34826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346930, "uuid": "452f9ce8-e54e-460a-87eb-b17ef91811e4", "comment": "Malware payload (RedLineStealer)", "value": "88bfa58958b1c9d19966433f6839a7ca84ed9313a0d2d50bb5946ce46adb4c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346930, "uuid": "19d51035-e386-441f-aab1-91a8dd905983", "comment": "Malware payload (RedLineStealer)", "value": "f4cf9bca63cc3591123ecaa4711c2f0376da8830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346930, "uuid": "04410fb2-5414-499b-965d-f24ac05325d3", "comment": "Malware payload (RedLineStealer)", "value": "d3016cd5734d1fdb9f1c4166d5436177276faf3eb96d264dcc030d621736b1c95c263823166c338a4bc1f14874815b66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346930, "uuid": "d21326ab-7944-452d-a99c-6af627a43658", "value": "T161052282B7E45473EC715B314AF116930B397CB65978837B625BA91B0C637C8A6303BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346930, "uuid": "e2e509ca-33fb-47bb-a15c-e96c7b2ea845", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346930, "uuid": "dd48c8da-81db-4d56-96dc-3dfa12493e07", "value": "12288:LMrsy90AKU22NecIWtqwy4kAMGuL91QswgIdY3ZcCyYhISWB7SBIlW83lonjEV/:PyBK0NyyDy4kAnuLNwgIUHZKSAWhjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346930, "uuid": "b7f1ce65-c6a4-4f55-94b9-0fe6260111eb", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346930, "uuid": "ea835aed-c0c2-47b3-8469-7f3c1d2f5d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346930, "uuid": "4eb2c0c3-c315-4aa2-a441-da68a85044c5", "value": "dcfd7bb43cada0e0f9bcf50801b34826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8697e243-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346648, "uuid": "93b3821d-5839-4ba1-914f-eb255c177906", "comment": "Malware payload (Amadey)", "value": "bbb75c73317cc0b0eeeac8ce5d4de986", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346648, "uuid": "0e16d05b-9deb-4711-bc9f-6ea74421b2be", "comment": "Malware payload (Amadey)", "value": "8954d3a42453d05ca5cbc9a81da67ce7ae89548fff5eb4078f9bbc2579b380c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346648, "uuid": "922a75e5-d42a-44f9-8eec-031f39d12295", "comment": "Malware payload (Amadey)", "value": "d1a08c1771555031d295c6d8385f1ea37cb9988e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346648, "uuid": "91593d67-02f3-4659-be1d-362de6464ed1", "comment": "Malware payload (Amadey)", "value": "f21ef99d475649371aad44bdae0be86769645c1e274b70d68359acda0394589c7f58169764514300da2d30152e84af19", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346648, "uuid": "bea1cb17-630c-467b-b1e2-f87d177aa880", "value": "T13E051217A7D54433FE712BB118FA42831B3ABCA1DA3847937351995A5CB36D0A532337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346648, "uuid": "862ca28a-e4ca-444b-b348-2d443ead24f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346648, "uuid": "03417867-add4-4b5c-8a8d-e4c5f588cd76", "value": "24576:PyPpfDlGf8e3jEHpx2RBsvu5nI6UScfvT:a12QJAjsm5nIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346648, "uuid": "fe4f38cb-1e96-4670-8c22-3a1d01b4bd74", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346648, "uuid": "1acd35b3-2de2-4fa2-9e12-fc1bc691e875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346648, "uuid": "7b607a15-94a0-4e12-b652-41fbd4dc367e", "value": "bbb75c73317cc0b0eeeac8ce5d4de986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc972c55-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685374226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374226, "uuid": "b4cd78f1-1947-4b14-bf75-24c3fa6fd4ac", "comment": "Malware payload", "value": "ad54a2e9615237b3ae41a6d56cef09e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374226, "uuid": "5772777c-0980-42fc-8648-ddd44a8485a8", "comment": "Malware payload", "value": "8a47e87082cf1a90524f5c1c90d014290910409b16dbe562e2df25c4e130017b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374226, "uuid": "e42c563a-1c66-4f0f-ace4-5fe6b2ec396d", "comment": "Malware payload", "value": "ed236193f900568b7990f260a7e3ac0bc23509e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374226, "uuid": "8b8234df-aa82-4a59-9004-f0c4ebceaa27", "comment": "Malware payload", "value": "dea3b18c5d2f206fed5941504e4ee8e68dc67a04c95c3569dabf4448a58a1982f7f1d363b63c163e250eebfbde342514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374226, "uuid": "8068e93b-f47a-464f-ad45-d48caf510022", "value": "T14F13F2982F03468BC53224BBB54BDC557CC71F1A341F48AC15BAD5788AF321CA6FA326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374226, "uuid": "2104cec1-cd7c-43c9-b187-d1bed34424a3", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4Aup:XtBTX941eYF8Nblpuvnway", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374226, "uuid": "e3ab3e45-837c-49b8-b3ea-a36f67ac7399", "value": 41992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374226, "uuid": "2bde693c-b9ed-4672-bcae-9d51b4cd480e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374226, "uuid": "d41ffcfc-c8a3-424c-b0ff-48975108db1b", "value": "SecuriteInfo.com.Heur.20230529152727478090820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5289203a-fe39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685375766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375766, "uuid": "f115b8c0-0fb5-41df-8a1e-a856b5b56a1d", "comment": "Malware payload (Formbook)", "value": "25ac7a56acd235bf14a34e0df4e128c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375766, "uuid": "447e4113-3a1d-479a-89fb-28d0cf959f62", "comment": "Malware payload (Formbook)", "value": "8a8aa88ed0baf350f9e35c7edcb3eb9fe6a024c489d1397b1b992f98ff47ea6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375766, "uuid": "ac7bc687-a07a-48b3-8e33-79ee665edf96", "comment": "Malware payload (Formbook)", "value": "10573f879dea2b92411ccc920258534ab85067ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375766, "uuid": "3f12c39b-6ab6-4486-8871-f5cb2d0072b6", "comment": "Malware payload (Formbook)", "value": "fa01ac41fc5545e50ba9f42355eba551ceb0e1397bfad0dafd330fed439ac092d7c7e7f58d00060fce693979538ccf95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375766, "uuid": "da85e7e1-7bea-46dd-8310-605f88b9d192", "value": "T107641225DBE36114DE7B0FBE18B012B67B74E79869A3118D2188C1289F257933BFE714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375766, "uuid": "9f48b074-477b-4015-9716-3b47d852742a", "value": "6144:v3MuNxM/g/Rn4IXls/W+urADjjLpmL0fJN/QUDpEHVVDOevj5:3//yJe+u0DjVfYUl+DOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685375766, "uuid": "eb801bf8-fcbf-4c65-8ef0-132431224694", "value": 328256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685375766, "uuid": "b69635b8-aba5-4b6a-bccc-a1b65528af69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375766, "uuid": "ac806be0-4eca-47be-866c-2b189f4604a2", "value": "rDUN-11503010-F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5618d4-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685371597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371597, "uuid": "f3ed38a6-463b-42b2-8e2f-0c21dbed5c63", "comment": "Malware payload (Gafgyt)", "value": "3e4d03c9829b809e3f5a5cfd63d5bcb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371597, "uuid": "38935fd9-ecb9-48a2-9f71-20676a9b8cea", "comment": "Malware payload (Gafgyt)", "value": "8a9e4ef8c8851ff99f1d153a6743b0b305535a909c97d473dae037f0f2d9f239", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371597, "uuid": "a5560447-e97a-4351-a5a4-8f1c1a0152ab", "comment": "Malware payload (Gafgyt)", "value": "f7154da2dbad1b6b8b347920c0adedbe77479105", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371597, "uuid": "f262160f-2794-4c2a-b4ec-2f6ed23c0901", "comment": "Malware payload (Gafgyt)", "value": "6f82adda10fa9af4400a08ae5145bdba8bb8983cbe2019a7f75360b410a34a4e74ace748cb116a54bbbed399e2ef1f4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371597, "uuid": "0ffefafe-59cb-422d-9cd8-518cfecbe46f", "value": "T14103F16B51DA3552CB08F3BA0F4F31D66954BF473923232432E96C66AAFF5953100AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371597, "uuid": "57f9a78a-e8f3-46e5-be94-f192ccce711d", "value": "768:RARp6kQ4Igajz2XfGQ70ckaih0gD23w65yq+24KTVGq:RAKkQ4gjzQf/RdIU3wOUKTVGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371597, "uuid": "1a0fb167-509c-4573-a09d-286d93d4dc45", "value": 38448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371597, "uuid": "c91111d1-4fe5-47fc-b675-c3b1645553c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371597, "uuid": "1fc4704d-93e5-461d-8c05-faf770111342", "value": "3e4d03c9829b809e3f5a5cfd63d5bcb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f2a360-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388394, "uuid": "4e295cb1-d41a-48ba-b3f1-6c61252a8761", "comment": "Malware payload (Mirai)", "value": "856601a0346dc68f651208751945a6b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388394, "uuid": "ea1c38a0-8a4d-42f8-b5cb-669e8f07206f", "comment": "Malware payload (Mirai)", "value": "8b900365754c140f5b3427261d13edff3dff490bd0dcc3674b35994e4c4878d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388394, "uuid": "f9b176e3-3154-4a25-b7e1-323b859cb320", "comment": "Malware payload (Mirai)", "value": "2f9e17818628afc1539ad4a13194448a807f2744", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388394, "uuid": "bd5c7a88-ff45-4265-a969-de92005f36e5", "comment": "Malware payload (Mirai)", "value": "521e12431dfcef1a4566674ffdec00e5ef854b6381879bf42517ce811bffd2972131f68797ca4b9ac3c8792102bfb5bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388394, "uuid": "5fb9a934-690b-447f-976d-4c5d275b6ef9", "value": "T136430952B8818A16C5D413BEFE6E018D33126778E2DFB212DD106F147BC692F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388394, "uuid": "a4d53e0c-78bf-45b9-b2ef-c9c5ec771571", "value": "1536:vxnSzV7eY6olIfvKTrwY/JA3/mPrA1j1aLxIbridgE5Qu:wr6E2vMrVAvmTE4gE5Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388394, "uuid": "19f26539-e88b-4947-ad82-a02f42ed6ce8", "value": 59440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388394, "uuid": "7e526d69-fc19-4768-bb4a-86ae10300a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388394, "uuid": "3e33574f-b0ed-44bb-9d89-b4acea45cf00", "value": "856601a0346dc68f651208751945a6b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ed5486-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379690, "uuid": "3120bdf7-bd81-4452-81c0-20b53e979818", "comment": "Malware payload (Mirai)", "value": "ca9dfb2df3b9bd8c616f5d5361fb69ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379690, "uuid": "2b0a6c3b-bdec-46af-a849-69c9310b898d", "comment": "Malware payload (Mirai)", "value": "8bd4c5af3e44577c72914095f76766d012f363ea8a2d73d3685b28e7afcb59c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379690, "uuid": "e644e1f4-6a9f-46b8-84a2-e4ae784a87d4", "comment": "Malware payload (Mirai)", "value": "1987117423a1061774fdff63485cc69dc2c8db12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379690, "uuid": "6e0c7841-7ddd-41f6-bf26-f7c96cf373e4", "comment": "Malware payload (Mirai)", "value": "d3470c1c773b19ae1b39e7a8a0fcc25ebc9b959ec1a583dec50183f33be5e591fd8eb48860bd366e9d5932116e6ef186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379690, "uuid": "414daa5d-fdd1-4786-9603-eb2578399cc5", "value": "T1FAF37436B7619E77D80ECE7305A985121C8CD98712D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379690, "uuid": "3ffdf9d8-c1dd-4601-b666-a0ee4b460f69", "value": "3072:1LNqrhHZ0P6bRFBQiFfRjHkLwmrThPaLEne7rNb:1Lsrr0PeRTJ/gLwmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379690, "uuid": "1a43da5d-3b08-4a75-86e7-2ceeb44d2745", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379690, "uuid": "349c4ed4-1cf0-4138-be4b-7bb12f3ca9cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379690, "uuid": "1d600dfe-404c-446f-af5e-f4e8c10db2e1", "value": "ca9dfb2df3b9bd8c616f5d5361fb69ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f674190-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685377130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377130, "uuid": "4c0527a4-8335-454b-be7c-ccf1fbc89f36", "comment": "Malware payload (Rhadamanthys)", "value": "dba1ef285229e1148f38332c93c02904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377130, "uuid": "abf578b4-8fa5-4d11-8e6c-9b713948dd8c", "comment": "Malware payload (Rhadamanthys)", "value": "8d39941ae1a443b26ba2015e41ffc11346881cfe16056fec5c45814638ee64f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377130, "uuid": "9027a278-799e-4fdb-abc8-d73742c3d62e", "comment": "Malware payload (Rhadamanthys)", "value": "ced0f7312491978b4be3b9231645cd27b0c386d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377130, "uuid": "714af0f6-1518-46a8-bdc1-150ba6de3d25", "comment": "Malware payload (Rhadamanthys)", "value": "5fe65cf957b955dfd2defc53205aa529ba59668ac082c9cdc87b1b6b72566f883be6802831173e75a2c16b06f590c856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377130, "uuid": "0cf56893-f7bd-4f23-af04-b9f887080e5f", "value": "T1DFC4AE0362E17C74F62646719E2EC6E8771EB5508F597BA72318BA2F047C2B2C5B2731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377130, "uuid": "4518fdc7-b486-4a8b-8918-0c0650c8ca90", "value": "067710d045234604093d7ae15ed3e5e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377130, "uuid": "77062b62-d542-4c2a-99e7-3d992e0f0444", "value": "12288:aiWpD5CRZZ6zuF2fhqq6SbrBAb8/0D0BtgV:aPpD8ZZ6yyh3Bw8PtgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377130, "uuid": "6a17b802-86ac-4f9f-aa5c-152beca702c1", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377130, "uuid": "706ce5c4-4803-4245-997d-259d9ce1e2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377130, "uuid": "1d003531-45af-4fe3-9e09-4706416e7d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3928f4b-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685376788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376788, "uuid": "540513e1-1d54-44dc-afa5-6e6d9111cfe1", "comment": "Malware payload (Gafgyt)", "value": "79f415ec07b1162202fe19405336f7c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376788, "uuid": "46fd5d58-25d9-473c-9191-ed7956c7bdf5", "comment": "Malware payload (Gafgyt)", "value": "8d439eb31d4b0154cd35ea13c451409aef374722eb6997770c5f022a3360bfee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376788, "uuid": "fe3bb9b2-3b3a-4d6d-8312-012abdda053a", "comment": "Malware payload (Gafgyt)", "value": "ef89a3f7e9de588e178980d77d9833fac0dc081b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376788, "uuid": "293016e1-37f2-40a2-ad68-4b2fb83cc7dd", "comment": "Malware payload (Gafgyt)", "value": "58a830238c86fb457070feec3343b49d2d58fb345d5333de744bad09bae795ad39637f54493bdd76147fc2f501c8c46b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376788, "uuid": "39a627fc-be25-466d-9342-66c06bb52674", "value": "T1E0933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376788, "uuid": "f2b365a2-3f98-4ab8-ac22-3cdf55b75f15", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvjUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBjUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376788, "uuid": "6a3be67b-4f0e-498a-a2af-5d2d995cc79b", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376788, "uuid": "e55565af-695c-4072-bbf6-57ade7a121f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376788, "uuid": "8fd98f6f-905e-4760-b869-fb81814326ba", "value": "79f415ec07b1162202fe19405336f7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b5eef2-fe38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AuroraStealer)", "timestamp": 1685375591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375591, "uuid": "f09af9dd-1cf5-4de2-b1b6-454adc55749a", "comment": "Malware payload (AuroraStealer)", "value": "b75fd8e4816c59fb7010815866b3ff8d", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375591, "uuid": "49caa7e0-9e6a-435b-8cce-368f4315ea06", "comment": "Malware payload (AuroraStealer)", "value": "8da8821d410b94a2811ce7ae80e901d7e150ad3420d677b158e45324a6606ac4", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375591, "uuid": "d21cb75f-fddf-40d0-bfd6-c70245af0934", "comment": "Malware payload (AuroraStealer)", "value": "1c4a82442da1028d684197d6579cdaed85d192d4", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375591, "uuid": "a1c46672-2b22-44e8-98b7-ab9d4e5333d0", "comment": "Malware payload (AuroraStealer)", "value": "903a6290cb70851febb5ce3875e5ce60ddb81aeca4f66f00a3b2cde10ac8bad2998f230ab88b1f97ae5ddf9c071e33a0", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375591, "uuid": "5188c37d-dd6f-41ad-ae8e-e38cd247543e", "value": "T11EE51847B99485F4C0AEE130C9A592137A703C985F3163D33B14B3B92B77BD85A7A3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375591, "uuid": "2a4b85af-d6b1-40fb-ac96-4a889df09291", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375591, "uuid": "72b9875e-e04b-4093-8571-38de709a9649", "value": "49152:GA3n4E7UMfPiyE4SBjLDtQZabasLaN8ex/z7bk1h9l:b3U71Bj/tQ6LO8Z9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685375591, "uuid": "364c4c06-6846-4a1b-97e3-9e35b2db66de", "value": 3317024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685375591, "uuid": "af14c49b-c6d4-421d-840f-3ccb6ceb48b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375591, "uuid": "666611bd-dcca-4de1-95f8-c9d1886f3179", "value": "CWGrabber64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25803c2-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388436, "uuid": "bec18416-f5ec-40fb-8736-f55349510b99", "comment": "Malware payload (Mirai)", "value": "c9a0f3e160f737a3c866cc6d8aeb3a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388436, "uuid": "b37bf3d5-40d5-437a-bf41-962229b2decd", "comment": "Malware payload (Mirai)", "value": "8e6c4014c712e07fab20e35a164dfd176f200c9c65bd75973cbdaa9b0603c864", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388436, "uuid": "516d3717-f29b-426b-aae5-5f79475d6fcb", "comment": "Malware payload (Mirai)", "value": "145fcc6215426cd9ac806c955715c828a1680ae0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388436, "uuid": "a97081b3-67dd-408a-aec2-2c6df51e8d15", "comment": "Malware payload (Mirai)", "value": "da8ce37ae87aa6e9ba44a68439459a1fd46579f5c04d9974c539c0cb8895bc60a0a222ba779d1622c2129ef948346cd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388436, "uuid": "dcbe78fe-9688-4b90-8d2e-af01d4d3bbef", "value": "T112232BD6B8019D3CF95FE6BE84534A0CF621375160930B2B57ABFDD36C321984E56E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388436, "uuid": "040dfbc1-819d-47cf-8e98-ca9a7bf0b5db", "value": "768:TLPkwDUxTLsJ2zEj4tWmn9LOrpc7/9qJC3Uw9G3RO+P8iU:HPIxXsJr+79LqpM/4C3Uw03RF8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388436, "uuid": "c2788711-3fc6-463c-99ef-fea56d403b46", "value": 48056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388436, "uuid": "4246a843-4779-4bde-8e42-69597c1bc1df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388436, "uuid": "7694deba-e7b8-4562-8b8d-11f2c5fc7b18", "value": "c9a0f3e160f737a3c866cc6d8aeb3a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63ca456-fe39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685376014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376014, "uuid": "aee466aa-5959-4542-9302-0b1c68b39efd", "comment": "Malware payload (Formbook)", "value": "2245ba729d9b9cb1ee2be35a736ddc41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376014, "uuid": "f5ec8624-4e55-4c12-a5ad-7420a0a424e6", "comment": "Malware payload (Formbook)", "value": "8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376014, "uuid": "9d9a44fc-1322-4fa5-9dcc-e496f19384c6", "comment": "Malware payload (Formbook)", "value": "d12a969dab1cb385fd34593759c923cd48cc55c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376014, "uuid": "a90a45ff-bb48-42c0-bfe3-10a7981254d9", "comment": "Malware payload (Formbook)", "value": "20950e8ddb6d377f872e77ef1ea4179020449affd24beb48aad3fcb621a6ab4cb6408a0d04c47afc1147c5ba3ca472a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376014, "uuid": "3a47dd16-2f85-4419-88d0-c58d9a480fcf", "value": "T105051289631356B7FBB812B117A2A2108DA4EEFE9071D6E7FF01179E9D4230625723D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376014, "uuid": "1c1b85d2-e68c-4013-9319-7f5b84ee8d5e", "value": "12288:ZsFbsfI8Z1gMFVobi/WYYZH6Ir293sb+Sei4NZwiiM4kFeK/fVTdHxcRNwS5q:Z0bsfI6dFqbLMIr2VUf4NfR4WNTD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376014, "uuid": "6fa9de53-3136-4731-95fe-09aa465d2412", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376014, "uuid": "cdd8bcc0-ceb1-4623-b201-09d48af3d9f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376014, "uuid": "b48beea9-9efd-4d2c-89ef-534cdd6f178d", "value": "r4824_230523090902_001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9bb50e-fdc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685325749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325749, "uuid": "39cc64db-2b89-4136-9ae1-eeff3a476bb7", "comment": "Malware payload (RedLineStealer)", "value": "e46bd104a34741d321da2f6daf72f44c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325749, "uuid": "4a64bc7b-aa75-4d47-91d6-2c096a83a49a", "comment": "Malware payload (RedLineStealer)", "value": "8e6f1d37c9be17f7b0a18df273618794992d5efeb11fd265840ea9e989d568e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325749, "uuid": "96054bbd-6dda-4ce8-b420-1b8cceac37a9", "comment": "Malware payload (RedLineStealer)", "value": "d0b24d4901d8cd7a3a777fcbf8eac8b6ed9bab44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325749, "uuid": "4549df48-d43a-4a94-ad0f-fc5653bd823e", "comment": "Malware payload (RedLineStealer)", "value": "a71c7c863add38743d6dff4f8b219ba1c5bfc2203389512e2b8f40103d0c00080da330c0f8d48fdc02ac283836c1a412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325749, "uuid": "a4e4c137-98a1-4bcf-83cd-ab97ade393f8", "value": "T1D7352202A3F5A1A3E9B40771A8F716C70B32BDB15C7847265652094E6DB33E47A7233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325749, "uuid": "74d371da-9078-4a08-807c-38357b2e9697", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325749, "uuid": "4538228b-9bcd-447c-8853-240d68c4d385", "value": "24576:JyWXzTzeKg8x1fMKD2wAkTeAy7TUSOruCvgkjt4AKPUxo6Ep:8WVn8KD34Ay7vCYkjt4cWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325749, "uuid": "c7ab9661-eec9-4185-8cd7-52051aeecc33", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325749, "uuid": "81edca80-dbc5-4cec-88a7-a38d3f646642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325749, "uuid": "db0c898d-88b8-481d-a07c-b73ebd6f4ab6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820ee86f-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346640, "uuid": "23f56bc8-e172-444c-a095-7ffa1cb51117", "comment": "Malware payload (RedLineStealer)", "value": "41b44495f327f99ccb6d4d032ade9562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346640, "uuid": "1ae5582f-c6e6-414a-b6c4-30689415d78e", "comment": "Malware payload (RedLineStealer)", "value": "8f32a93bf08cebbb194fde1369e432288eb0466ffad46b3be24be625bff9d726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346640, "uuid": "935800b5-c571-41e2-87a4-b1f998dee38a", "comment": "Malware payload (RedLineStealer)", "value": "b322b0c6750db2c9bf7fac47a78066cfc69c00b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346640, "uuid": "913244cf-e8a1-4114-9acb-1d415767aee9", "comment": "Malware payload (RedLineStealer)", "value": "c222cbe27dc9cc20bb81089319d31f550e6ccd84291ce839ae17d7b91b609692ac8df2e327c5f36a4797b384ea00226d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346640, "uuid": "d759a2f5-7957-47a4-a7b4-6ede60e6b94a", "value": "T124051247A6E64473DCB11770A8F202832B76B8719DB447AB324A2E5D0DB35C87A3573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346640, "uuid": "afb11d36-855e-4ae6-b0e0-7bb6759f768a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346640, "uuid": "a48ccb88-8570-4b1f-99a0-43b2ec95b60e", "value": "12288:rMrzy90E4ZgwQzhQNlJtBIxW9qHnztOHdrO2nuW25U/hUhK+fHxheeNn0EQ3USxw:kyrGgwQ2W/nztjJNQULLe2nF6USe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346640, "uuid": "d36b8f7b-c558-437a-b811-177b98661a68", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346640, "uuid": "edd7a7bf-bb7c-4d05-b9b4-5af16856a54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346640, "uuid": "71e3dc08-d896-43cb-a898-a4f0f34c48be", "value": "41b44495f327f99ccb6d4d032ade9562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f583c8-fe33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685373309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373309, "uuid": "6843485f-a5bd-4fe9-94da-f78f7ed4506b", "comment": "Malware payload (DCRat)", "value": "b1fb36fc31e2e9e18b07abc77c833fe8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373309, "uuid": "b14cd0e5-24e5-47a0-b02e-759a6eab4d88", "comment": "Malware payload (DCRat)", "value": "8ff008daec53167a2ec59a1fef763840c29bd032ceb6dec7c508b93d67cf809d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373309, "uuid": "1ac0ed15-81a0-4f98-8a7c-1459f00402f8", "comment": "Malware payload (DCRat)", "value": "18b1af1f4ee7a52e466fa10cbcd52f9f914c9ba9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373309, "uuid": "0c930d06-683c-441d-a3bb-ac262fb62af5", "comment": "Malware payload (DCRat)", "value": "2e4bcba5589988fe263e828238af648f92cf514a45cb7a06ff8443c5367c01b697895cda6ab8659fd3e529fca014c74c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373309, "uuid": "6a158918-6801-4012-8ac7-bdec2092b440", "value": "T19135E87C9BBA237BA1B7C3544BC9B45FB180A973F1057BE5A0C203498921971B5CBD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373309, "uuid": "4664ba81-5955-4aab-8305-7ebb2ac275cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373309, "uuid": "9e0611d8-229c-4e50-9b80-f3f3c2787831", "value": "24576:31VRAjJP3NZn0oWyFcNWQX/e5aG/Twy8j:3v+JPjn0tqeWQa/cy8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685373309, "uuid": "5abe96e6-19a5-42a4-bf5a-a7e4a900dc31", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685373309, "uuid": "1e87ee2c-d706-4205-8894-29e8a4c4c2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373309, "uuid": "b73b99ef-897b-46d1-91d4-8cd2be82f0ec", "value": "b1fb36fc31e2e9e18b07abc77c833fe8.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5da7526-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376792, "uuid": "33529e32-191d-4599-aa28-9eac797b1d98", "comment": "Malware payload (Mirai)", "value": "653648ec39362dcebe2bbbd9c2d0000c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376792, "uuid": "8a155b3d-fa51-4aa1-a859-422cee16251a", "comment": "Malware payload (Mirai)", "value": "902da1ee2591e9e47d918e1a3aa97936adef189dc11d87c2ca4a535aa12dee57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376792, "uuid": "2fa2d6d8-2129-4005-bf77-5d4e8d091ed2", "comment": "Malware payload (Mirai)", "value": "4895fd23afb7f2ede51c342425a8bb36e40d1acc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376792, "uuid": "8b7148e4-7643-497e-a960-adbb7bee6be0", "comment": "Malware payload (Mirai)", "value": "7ba1a15e661b0c33ec9d506691db30d8d49ac62e0a144ae90b52d4ee922f20dc5aa05bc5480b3bef3eb08babbb5b4d10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376792, "uuid": "e3041525-1711-4a62-9bde-e7ecb4f27f11", "value": "T172431925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376792, "uuid": "bd50e77d-c432-4996-bb0c-347edef196e1", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCD/:eL0AxvSHfymp0xgunvCkV6vTMDaus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376792, "uuid": "f1e9387d-f573-4b79-adc0-ea258f5365da", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376792, "uuid": "d5a5edc9-fd43-4c2d-965c-4db4377c8dea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376792, "uuid": "cbdc7434-8982-4596-b889-556a3e07e3ef", "value": "653648ec39362dcebe2bbbd9c2d0000c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86712fe-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346329, "uuid": "94e645c9-85ff-4e2a-b312-7169fc181354", "comment": "Malware payload (RedLineStealer)", "value": "473500e49f60a47ffb4a0911404d6159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346329, "uuid": "e9beb307-fd09-4274-919b-83de058103bb", "comment": "Malware payload (RedLineStealer)", "value": "914d1e4f26869d7670bf0141002e2a8b2f4e0f814c17dea7131bd5f150d0f649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346329, "uuid": "db863adf-ddb5-44d5-8deb-9ffdf7113632", "comment": "Malware payload (RedLineStealer)", "value": "87c3e5d4bc9c1522321219c6a41adac41525d3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346329, "uuid": "3daa96af-d723-416a-a575-830903d80961", "comment": "Malware payload (RedLineStealer)", "value": "cddce0b16a7ad8b6b0a008e975bc526a3ceeab9767b758787ea38aa133b28245710191ea6c7b9583017473471fd19795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346329, "uuid": "cf69e290-ed4a-4866-90fb-cae1c2fa7719", "value": "T19C052302B7E9A133ED750BF058F603C31A36BEA36DB4835B6306494B5D72A84697532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346329, "uuid": "0eed5e5f-0ea9-4ec5-b0b4-fa791324123e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346329, "uuid": "8d7bf173-6ff5-4108-89a2-cc3c1bcba135", "value": "24576:AyKNi4DdaTERgK5EngvE7WgiJD7HBne2nI6USKoP:Hqi3AgSEgs76B7A2nI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346329, "uuid": "af7a2edf-32cb-48b2-9b49-34510918a799", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346329, "uuid": "3050e435-1ca7-4dc2-b4c7-92daab274927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346329, "uuid": "7e5a14b5-d2fc-47e4-8641-84231d614072", "value": "473500e49f60a47ffb4a0911404d6159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f0a1a0-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346939, "uuid": "a4c40166-9a07-4b2b-a59a-3818f5c7420e", "comment": "Malware payload (RedLineStealer)", "value": "deb4100e32cb54e5b23e05d8f39a4619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346939, "uuid": "49574578-36d0-4512-be23-98a0b4417bbf", "comment": "Malware payload (RedLineStealer)", "value": "924e10b718441d510ce591122924550d3fdf6d8f98e105b7a53190d251cba49e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346939, "uuid": "f349df5d-65ef-4d64-b705-be3aee6febfe", "comment": "Malware payload (RedLineStealer)", "value": "4a52aa92c027fe3c382941ec391c1fabdc88ab13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346939, "uuid": "ca750fa4-a692-4f68-9fcc-f3603582f4ed", "comment": "Malware payload (RedLineStealer)", "value": "cc8401184f1e6b1fbf58c684e10de517ec42ff92279b1281cc45bebf40e3a4fcf16baa06aa2dab8499a5da08bb6d809a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346939, "uuid": "5ea1163f-0c31-4cb6-bcb9-45aa3b5a148e", "value": "T1A9352302ABE45532EEA01FB04CFA068B2B38BC615CB4D75B3795644B2DB26C564353BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346939, "uuid": "09b340ad-ae1c-4adc-aa08-a768154443a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346939, "uuid": "585ebbfe-a5a0-46b8-b54e-2f0cf8575b78", "value": "24576:FyDduO7wX/lStJ/qmzxe1eTnr7USZDJ1+A685/mvX0Tv/Un6bTE:gDjxRTnrl/cXy/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346939, "uuid": "50170447-a9f9-4092-9c97-3cbb75ddf65f", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346939, "uuid": "a2f54038-3a77-4680-978d-0a7e1a15bece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346939, "uuid": "2d83da29-5e5e-4ec1-b068-3b4774ac0438", "value": "deb4100e32cb54e5b23e05d8f39a4619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc220fd6-fdc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685325693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325693, "uuid": "9868c244-8b09-42b7-8583-c2cca7ed7991", "comment": "Malware payload (Amadey)", "value": "9d449aa414fd4fe93d33281a8d634fa1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325693, "uuid": "7ae56490-80a7-433f-b80f-0a15cfb6fcc1", "comment": "Malware payload (Amadey)", "value": "927f0f430d857223ba713a88de7d915c5a628aa4fcb600f67c4515043b2a567b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325693, "uuid": "ab3233f1-f076-4d60-9977-d5a589cc972c", "comment": "Malware payload (Amadey)", "value": "75609a513c6756c623af735f0cfa4bc5657a33fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325693, "uuid": "22d0e00d-07fb-4993-98e7-796b687b343e", "comment": "Malware payload (Amadey)", "value": "7e3809bcc53fa683ddd9b5abd6a5566707bb4a2b98c160411dc9d7426ac111b38636a654469b4d76d0e98dea5c614b91", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325693, "uuid": "efdecaca-b7a4-4c37-830c-6aaf338b5de8", "value": "T157052292A6E84533E9B10B71ACF202D31B3ABCB29C7443AF67449C4E1DB27907975736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325693, "uuid": "e5232dd5-6e1e-4052-b662-b7332bb7a637", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325693, "uuid": "1f8bfa95-e980-4411-89ea-1d9d1b12ea20", "value": "12288:nMrWy90XcrlLq2JdVnMDFt8mDfKmUS/Jq2dNKt4YVQa7WPlsbgfSzheUPn+EQ3Ur:Zym2J0Dv8JSda7nt1eanv6USrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325693, "uuid": "ac05f3f7-6f0d-44d8-8147-5cb959846a44", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325693, "uuid": "e8e3f6df-87c5-4c27-877a-74b401644a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325693, "uuid": "eae71ddc-3308-45ba-ad97-4c50ab71f825", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36ca352-fe38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685375607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375607, "uuid": "2e1c697a-781e-4f26-809e-4ae3ea38e36f", "comment": "Malware payload (Mirai)", "value": "2499bfcf0cfb4867e7a18ab6fa3643f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375607, "uuid": "fff3b03f-9a84-444f-a695-7e35bd936842", "comment": "Malware payload (Mirai)", "value": "928093a6d6546babfb3aefef4f95bfe6e2017b9cdce3fe08c2233a2e8d975da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375607, "uuid": "5be11293-c06e-4821-b146-0671131236b6", "comment": "Malware payload (Mirai)", "value": "35a5dee8a6eebc1871ae4c10b3b410154fb76316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375607, "uuid": "8b46fcfb-3551-4e27-9806-de6dce7fed87", "comment": "Malware payload (Mirai)", "value": "79eea909f32691d329775b4533ebaff243630504eb3d37b44c4818aad80f8ac83d57095aa91172f99287b5d2d5b918d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375607, "uuid": "1816393e-1673-4ca7-afda-a8588d62bc35", "value": "T16E534BC0B643E9F5DE020674306BEF324E36F6F6211AE987E3E4D573AC429419543A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375607, "uuid": "07514237-cac5-4f00-84d0-f7dc4b65ed4d", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPK3EyYEWoTnt05HFEis:1jSwY4keBfrtOCQsnnFOaENh05l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685375607, "uuid": "0e1d1b11-fc30-4035-be60-6614856df7e6", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685375607, "uuid": "0450591b-03eb-4ea7-b334-eab51271921f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375607, "uuid": "62e0a1e7-939b-49ae-ab53-c8dec4c060f6", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ce79b2-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685376812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376812, "uuid": "36737ab2-9c0a-481c-9d13-1863e9c13482", "comment": "Malware payload (Gafgyt)", "value": "5099b734897c89eceb994c364365970b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376812, "uuid": "8ea83b40-640f-4acd-bed5-d8f9377b63d8", "comment": "Malware payload (Gafgyt)", "value": "934bfd5d900d2e2d075f794ae596673afa44799bd9f1eca6e43178db9feae97b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376812, "uuid": "e68f1780-295e-49ab-a663-ff43ad375497", "comment": "Malware payload (Gafgyt)", "value": "89d144d0b89a03946195674684b64cd8a2a1911d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376812, "uuid": "f1f61b3c-3b8e-4a05-990e-1cd1c27895c4", "comment": "Malware payload (Gafgyt)", "value": "69e51a155d7dc25a8ead26823db2123b3d24698cb866dab45ad997bc7fefb55ddd886f1444eed82ff0b66e6838a6534f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376812, "uuid": "d4dbb5b6-9b1f-496a-bf69-489312303d32", "value": "T1A8633B42AA42CAB3C8930AB502EB9A260631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376812, "uuid": "9ff7ed7c-9b6c-44b7-8657-1f754209f13c", "value": "1536:e98b4EmDIdV5LTepgWncXyvolDmF+l2OZ/fufYEZ:zb4EmDI1LeNcqYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376812, "uuid": "8fbcbd81-e358-4d94-aad9-24fad53f4906", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376812, "uuid": "a22d0684-0334-47a0-86c4-86d914057a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376812, "uuid": "bc6ffc12-2890-493a-a9e8-3fa2393bc8a7", "value": "5099b734897c89eceb994c364365970b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485c3a4a-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362435, "uuid": "75eabf9d-3a85-40a7-8e32-521853741e45", "comment": "Malware payload (Mirai)", "value": "394744e60425d304d2629198f20e58f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362435, "uuid": "0d30782d-95d8-4bda-afc1-94e89f9dac23", "comment": "Malware payload (Mirai)", "value": "938858435df418026fb5b10c9467af2cc52bc8331d408af80f2a4780d78d9ae6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362435, "uuid": "e29c37cc-2e6e-41ed-9be3-329db5fae7b2", "comment": "Malware payload (Mirai)", "value": "c5f17eb80ff6430b7b8b3ea45deb7d3f157f4f17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362435, "uuid": "30534b9c-f35c-46d7-bbd1-00c8e398d115", "comment": "Malware payload (Mirai)", "value": "0e0ec2277278d9297a2dce452c131b9055bbad221353b22cd6aa0481d60f913d3e0f05e49f81f6a4e023c373ebe8f004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362435, "uuid": "12a7a8db-96c4-4727-b621-26fd3b3a019a", "value": "T1C453F58178819A17C5E422BBF96E018D373563F8D1DF3216CD226F6476CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362435, "uuid": "06baf1a0-424a-4cc1-9482-5fdac9d01302", "value": "1536:jPcNNq4i/J+EoMvMgGsSAPRXlG9WkHYDd8Sd42+:jP6a75PRVG9bHud8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362435, "uuid": "66d04eb9-1102-4911-9fd6-a115947f6304", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362435, "uuid": "97e32098-6ca3-4bd5-b4c8-3f9fa9878155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362435, "uuid": "93371cdd-d485-4364-a488-05fcefbde4e7", "value": "394744e60425d304d2629198f20e58f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c31fb93-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363408, "uuid": "692c47c7-b701-4cc1-ba5a-343ced318265", "comment": "Malware payload", "value": "a31af05dcf650b5825820e843eed6393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363408, "uuid": "5dfde5b6-e89c-4821-9761-16d63e73010d", "comment": "Malware payload", "value": "94affa4262d4a16b999f788ac9f9a7079dfad0846b8769b50a3d6f05e60434e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363408, "uuid": "8a411954-53cd-463c-99d2-216711547005", "comment": "Malware payload", "value": "ed41c6e1171b04e569d29d6b29ff86b96c2d5c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363408, "uuid": "75afc301-98c8-4114-8329-ed1c0da01202", "comment": "Malware payload", "value": "28b88340c066d9f30ff12151d067a984df6dd1cd8f23fc7acd9c94b02a17faefa44bfb336cb49ad11063eada414fe46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363408, "uuid": "a6b257ab-4d5c-40ba-af47-12febe1c18e8", "value": "T10BD3121DEFC56A8AD105043DA6775D6CAD46FC8CA2880B033BA8ACDFBD71642B1531BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363408, "uuid": "1aa62cf3-1bfe-44ba-aa98-664f169627aa", "value": "f818a698432ff1fb8ee83345704d189f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363408, "uuid": "ff4117d1-3ea4-4437-8b6c-74930421b749", "value": "3072:uNa6oXKd0rkFIwBLDNY8iV0/4yX5n1U0LPEIR:uNnu1ILRniV0gD0LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363408, "uuid": "d4cafe9e-3618-47d3-8301-1318e801b4fd", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363408, "uuid": "3941e949-e55b-42f3-85dd-c05ed05c5e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363408, "uuid": "763cba87-9027-4969-9ce3-1976a21d9c02", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1314935.4680.17557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e5b496-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371041, "uuid": "b93a8b0c-c25b-4c80-a66f-68e3d0342061", "comment": "Malware payload (Mirai)", "value": "7c234d74f4026918eb0e28a28ac42ba6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371041, "uuid": "d7e80fb4-d703-4930-b27d-004bcbab4424", "comment": "Malware payload (Mirai)", "value": "96038544ecb96eb8929bd33c29571b74d4ce9b66843a0b7d46779c8eaa64177a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371041, "uuid": "112d9f2d-abb3-4a0d-b321-7ea8678659b0", "comment": "Malware payload (Mirai)", "value": "e624d3bec83264859d9c75dfa15269b6900332a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371041, "uuid": "72a2166b-0ed3-4564-98c0-c420bece18e9", "comment": "Malware payload (Mirai)", "value": "9b13f3cd14d5c31fbb0cf8ee46bb1ee51502bff75005f5d2a7a01f2cf5313dd8db9396a42ec1cbdb606a9b0f917d6384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371041, "uuid": "0f4f0cc4-2011-4af3-b4d2-2efe2c7c3a56", "value": "T1FC14B50E6E299F3CF399C6355BB7CE64925837C722F5C141E12CEA115EA028E241FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371041, "uuid": "2c2befda-a7e5-4560-82c2-0feaf39774ff", "value": "3072:ea2fGw2MGvdhmZSKJKBq0wrDMSjFvhclg4l/ychUqN1MeYLBQqWcrErj+u4fxYpr:ebGw2MGvdhmZSKJKBq0wrDMSjFvhclge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371041, "uuid": "aea4dc24-cf3b-47d0-99b5-40d258d4ce35", "value": 194592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371041, "uuid": "505e0ffb-7b33-4e4c-b06c-eb4f3761e454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371041, "uuid": "cbc941cf-46bf-4f8d-bdb1-bdf57d7ddb86", "value": "7c234d74f4026918eb0e28a28ac42ba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c621c65e-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346325, "uuid": "41c97092-a40e-4f49-b9e4-810e3466cb6a", "comment": "Malware payload (RedLineStealer)", "value": "229a5e0928ea675268b76be0c755269e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346325, "uuid": "95421ed5-8f65-42b2-9fc7-66cc6ae01505", "comment": "Malware payload (RedLineStealer)", "value": "9792d2cd1585acb504071bb733af81490f522fe171b1b52067e4833fdd0a8e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346325, "uuid": "3c49d4b3-1fa8-4797-85da-624bcfcaf0b2", "comment": "Malware payload (RedLineStealer)", "value": "8a75558d65a66532997b151d79fa7f8864913f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346325, "uuid": "882c41f7-651f-4082-ae62-88ffc1082e11", "comment": "Malware payload (RedLineStealer)", "value": "f6ff6dc9f237ef675264772863807fe30f67902cd6653d9de22a52069095cf64bc63560e604ce93a149853684a1c8f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346325, "uuid": "d3d5b383-d122-48f1-b761-0cd7df37d270", "value": "T12C052201EAD88163D4B05BB065F227E30A36BC91ADBD935F2B894D6A0C737D4E934727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346325, "uuid": "8c2acd9c-546e-4168-b8b2-f81694244912", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346325, "uuid": "6308dbea-c46d-4490-8fe2-53ba0f9f07a0", "value": "12288:bMrQy90G7Kjy9dmFGGrFTXF5Z7lrztpHU2wunpW4MQ9bJmloY:7yY29dqFTXF5Zdzsh0pW3yPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346325, "uuid": "610c2fca-efee-401e-9737-8ea3c0337a2d", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346325, "uuid": "c1057286-ec26-4581-8825-0d6b5106d561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346325, "uuid": "d8bbb6dc-ec97-4003-afb7-fb95303b99aa", "value": "229a5e0928ea675268b76be0c755269e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94b5492-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377254, "uuid": "c1d9fe11-721c-4ea9-b7c4-b66e52f06433", "comment": "Malware payload (Gafgyt)", "value": "9037ef3176c8c8eec87a5138a7b13008", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377254, "uuid": "407f14e0-ee72-4b23-8c5b-80bd870d6a10", "comment": "Malware payload (Gafgyt)", "value": "979c135f14f9a208f3746ebb0509bff4fe5b98ffbee4a71bd9d153b21144c8db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377254, "uuid": "f74b75e2-17fe-470a-8508-be81ca095637", "comment": "Malware payload (Gafgyt)", "value": "40ad39f2907216048bdb80b298511b428b3220d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377254, "uuid": "6d1a3755-a092-4702-8683-6022552c9f5b", "comment": "Malware payload (Gafgyt)", "value": "a254a334fc27959d69cee0949fafa7ad62bc8641d705aeeafc8160184ebe36a605fa8d82c565e61bbb1615ed15cfe7aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377254, "uuid": "c580d38e-79ad-4efc-af97-741663e3615f", "value": "T1ADB31792F900DFF2F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377254, "uuid": "f7ebd435-4638-48ee-bf13-bc1a42646c30", "value": "3072:DG+3MNBCpCTyRQpimmrytKMs4OWlKhRm2pgYMx3IPtW:DHCTyRQuytZseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377254, "uuid": "eae9cb5f-5eb1-4a7b-aa15-85445f49ca46", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377254, "uuid": "9c7cde8a-5201-4368-b389-05e19095d216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377254, "uuid": "a7910f3f-6852-4b95-b060-30a0d4353f19", "value": "9037ef3176c8c8eec87a5138a7b13008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b87eccd-fdc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685325155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325155, "uuid": "955df9a3-0628-4e34-9e0f-20caf4a109c8", "comment": "Malware payload (Stop)", "value": "358cce8ebe4ef51ccde93c4f1acfc26e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325155, "uuid": "66fda397-8838-428f-a63c-38b9f04e9cef", "comment": "Malware payload (Stop)", "value": "981a5ceff09b61572b39e277ca8909681eb055bff5ac0d91d346d0c4387dc27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325155, "uuid": "69c05445-1956-4456-b465-0e2bc1cafe27", "comment": "Malware payload (Stop)", "value": "7e1a5c7a2e5e72f79d7722e9aaf921f81bd12f9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325155, "uuid": "aad0cc4f-99e8-4f6b-b69c-645e8e0e840d", "comment": "Malware payload (Stop)", "value": "ec827082b9358c0e738e7b0b7a0b3b34955afc013ec6d9d06f2bfdef0408feffe18bd5d0effe1aef4dd5e835329dba9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325155, "uuid": "8461b062-a940-4467-a6fc-aee3a7dacac3", "value": "T1A6F4D05382E13D45EA6B4B739E2FC7F87B1DF6508E497BA912185E2F04B12B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325155, "uuid": "9e8a3e41-79e5-4615-96c0-14589ef300f0", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325155, "uuid": "2c473f97-4832-49a8-ae8e-ec65555a446f", "value": "12288:Ji14CavkMdt9+H0mRXoXea+5XtkF7AM2Rpt5H4p5TQk640JN3D5:JiiCanarXoXeH5XtkP2RptSpBQk64Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325155, "uuid": "12c53dee-c953-42b1-b396-fb9106d43d72", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325155, "uuid": "6fd6db5c-a166-4213-8d39-a74214476c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325155, "uuid": "2d9c20f5-6b79-4aea-b03c-d606dc0d1cbf", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6af1135-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377250, "uuid": "2dfa806d-0b03-4cd0-a9bf-e32ca5991931", "comment": "Malware payload (Gafgyt)", "value": "3187b6ace9db6f67cdbda395ecb28970", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377250, "uuid": "f38e68e9-102f-41d1-b664-33f2909a0360", "comment": "Malware payload (Gafgyt)", "value": "98915cb03b5b0d624da2f5fb2fc70fd8259c88eb0989682a42536ca68af58b7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377250, "uuid": "50d53e6b-e752-496c-93de-01a25b38d0d6", "comment": "Malware payload (Gafgyt)", "value": "f0f983468b3f7db84619b1dd0bf98aab813a6934", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377250, "uuid": "c0a93c6e-169d-4de4-b9be-41ceaf4fa7f0", "comment": "Malware payload (Gafgyt)", "value": "69446f80210805af30482a5597a7930209c80cbb22e41d675dec721b15aa0f1e1e79620e285179afcbded41dc6f0a74a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377250, "uuid": "650f4bf5-d7a5-443d-97dd-0068f825c86e", "value": "T1D5C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377250, "uuid": "2c28ce10-259f-4908-a2fc-c66bc3e35ef6", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAiRdc0sfm7ypwYujl3IdnuW:ZP0DNPAH5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377250, "uuid": "d4c8b7c4-dc76-4a96-ad98-f1a4b5857cc4", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377250, "uuid": "ece570b1-a08e-43dd-800f-6ef0a610bc55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377250, "uuid": "8997847b-028a-4616-9f29-6917d6f46b5c", "value": "3187b6ace9db6f67cdbda395ecb28970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7df694-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685387433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387433, "uuid": "689b6ec1-fa29-4e9f-aa07-78b871fe11f4", "comment": "Malware payload (Amadey)", "value": "911c3c7d46a7c6b129589a1dec6682e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387433, "uuid": "a077b3fc-5d80-4de3-8a7b-97f52b0fdf1c", "comment": "Malware payload (Amadey)", "value": "98a8c9ec7df483c46e0b65c223cde073555a941d141afcc229a1d3c9f32f02f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387433, "uuid": "b166f8ab-4f93-4cde-a391-3041652072eb", "comment": "Malware payload (Amadey)", "value": "0c843eeb2cbb2119e6f7cbba3946da9242737f9f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387433, "uuid": "fba90ef4-4479-4c59-b214-72eb4cb7c502", "comment": "Malware payload (Amadey)", "value": "35e7a2e89d77244bfda5b020c665e6b5e53afebcc3196c7e311d21789cb6f455b58231f7a50d35e973b375e20c1c0fe0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387433, "uuid": "886d8e11-8cf1-46c7-9bb1-12afee81c2d7", "value": "T1E5051293E5D89933E86663B51CFB07970B35FCA09878878E2759CD1E48B2690783173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387433, "uuid": "377b35b4-5ca2-478e-9b2b-a84985dce898", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387433, "uuid": "12241c55-0654-4618-801b-91b83a2672c9", "value": "12288:6Mrry90iztpDontrsK/4datXRpd2ENZ4To1YaXYhZiao5m2sPX2u2xRO3/:ByFhponls1OXDTvIo1j+ZipQvkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387433, "uuid": "1b7e819d-fda8-4809-ae99-c27782bf577d", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387433, "uuid": "aae9631a-3478-4bc3-9c89-90833e391734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387433, "uuid": "3de885a0-1205-48bc-9059-52789e075f5c", "value": "04327799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9651999d-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685362566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362566, "uuid": "fb81f3ea-2b31-4f80-aca3-cb6178f473c0", "comment": "Malware payload (Gafgyt)", "value": "8bf432d5180f31a4213f28afeeccaee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362566, "uuid": "02579673-f84d-4958-9226-a5f35b424890", "comment": "Malware payload (Gafgyt)", "value": "99942efd8f186320dae03896a8d9663c3432a4a45ea17f07675278abb9fbcbe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362566, "uuid": "c8e939e2-9936-40a0-950d-2964f3bf8c6f", "comment": "Malware payload (Gafgyt)", "value": "200e3770c28163344dc37e542511fb489a31cb8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362566, "uuid": "f2f040d8-4d5a-4490-b95c-b8d096a1ae5b", "comment": "Malware payload (Gafgyt)", "value": "fc54bc444ed0050385009dd6ac57fc8b4c0426129a593e377dc32be9164605b6b271a1636e863d5083f6cb39f56efb31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362566, "uuid": "5754e19b-296b-4f3c-a33f-8718c55afc4b", "value": "T1CF735C136991CB7BC4C747F92FDB952144A3F83E1B32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362566, "uuid": "0e5045de-2361-469c-8f05-e5ea3fcaaf10", "value": "1536:Y7IZurwakbDu+1iDnD+Q8bQ8O32Ls0FnswN5zvmA+JbOm/coZ3ymj:+7wakbDR1ItqQH2LDnsE5zvm/JbOmEo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362566, "uuid": "7a0d8b1e-ecb3-4e56-a9a1-cfec52c14d01", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362566, "uuid": "0f29fd87-b3bf-469c-94e2-a7b9eada7f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362566, "uuid": "1e3f0103-6b8b-4b09-9749-d58fcaa33a30", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f20e3ae-fe36-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374445, "uuid": "a32791f9-84c6-4aa8-9206-d21c2727959b", "comment": "Malware payload (Mirai)", "value": "113ef39de724b1550e48578cebdd62d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374445, "uuid": "a93d1789-67bb-4db7-93e2-f9b713fada19", "comment": "Malware payload (Mirai)", "value": "99a08311f2eb23b34a5f1c58462ac8657a4f76ff7941de2ed4dbdc89af4fcd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374445, "uuid": "86928979-c072-4007-af3a-2a78c8891756", "comment": "Malware payload (Mirai)", "value": "a75e6de60426ce12fd3db98fa0facb1100bfd84e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374445, "uuid": "7f318110-4868-421d-8841-050a09102be2", "comment": "Malware payload (Mirai)", "value": "f9ca19776e672010766db06fe65eee9b9f275f3d9c55b38f1b3c972def75ed50b56e7180ab73f323c066eed85468546a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374445, "uuid": "a2ae6155-9062-4311-98d2-b7a95b8ca10c", "value": "T1EBD2E1B656BD5316EC0953F7A39D9320E12110FEAF05CCFA891B4C8631DF61AB635341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374445, "uuid": "90bdb5fe-f74d-4572-9685-80a166283147", "value": "768:VkAl0OCw3/AUK1BdPJGWnwckFX6rgYvP/C/+daKP:uqz3/AUYBPGEw1YgYvP/++dao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374445, "uuid": "dff59c00-e60e-4114-8ff7-ff1545158003", "value": 29080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374445, "uuid": "546e4e74-a0df-4faf-a4c1-9e328f6b218f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374445, "uuid": "7bdd9fd7-778c-4729-8077-a779ecdd7f74", "value": "Cronusx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b858b232-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376796, "uuid": "bf527c5e-947b-4514-8fdd-8914aea8536c", "comment": "Malware payload (Mirai)", "value": "4b90a09eee04f7f79f9f1b5709852604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376796, "uuid": "5bc5927b-d543-41ac-bbd8-d0682f96c486", "comment": "Malware payload (Mirai)", "value": "9c0007d431f36d5ea606db181fb50fe0c5e9b5c85e4cf8515e70e4f6f8d1b3b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376796, "uuid": "8267d9e0-0f36-46b4-81a9-15e7f8c82492", "comment": "Malware payload (Mirai)", "value": "b36c2b034eae87663ca27144ba7d940c00d3da8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376796, "uuid": "fd120760-50a4-4732-a1e9-5699de8d728e", "comment": "Malware payload (Mirai)", "value": "cb66bb9a377d3dc1855df2122254387759ec07537dacbc82c5e490dc00de9b79c71406924c24711e2c4bfd2345549326", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376796, "uuid": "fbf1bc27-0f14-456e-a382-64b553f369d8", "value": "T1B6635C02B2280A47E5931AB0253F1FE057BFEAD025F4B685695FDB568635E372086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376796, "uuid": "7b533ea8-3223-4d62-a23f-fa977811a874", "value": "768:hcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZsVm8uiFzys8qHH5eKnsbmqRr4sGZMY:uw+fYYC1yHyau3/K55mREsPkIOwDkf0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376796, "uuid": "ca599b60-2eb8-4a2d-9599-8cbd857c50dd", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376796, "uuid": "36f0541a-6307-420f-b6aa-019a08f11d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376796, "uuid": "4adfa577-ce1f-4e06-9255-31e285f7afb6", "value": "4b90a09eee04f7f79f9f1b5709852604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b75b3b0-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363407, "uuid": "3e9b919f-f7b0-4b99-bec5-b296eb26be10", "comment": "Malware payload", "value": "021351898d9b23409f4bf7c252f985de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363407, "uuid": "04a2503e-47c3-4516-8b4c-b781fd0b3e17", "comment": "Malware payload", "value": "9c04f22d89e211c4429a1f5187f624dacd8dfc55983398e8ab35fb58d3d84bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363407, "uuid": "ab175c74-12b3-4c6a-8dc9-44d89e5846d2", "comment": "Malware payload", "value": "9725705301fa2e5437fc21f3f9ce1508d95dd1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363407, "uuid": "9e44ba9c-e4ac-48ac-92d5-430fb68dd49d", "comment": "Malware payload", "value": "1d1609af2ae2b9af52fb95b9860dc3e6fda608ab8805669515bf72f302728e478c9e90415e61cc9706e9304d6400a9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363407, "uuid": "00c58037-e0e9-4b59-b01d-95a029f40291", "value": "T106452312E665697AF0664F7269338080AB333FA42C356052306A7DCDDFBF29199733D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363407, "uuid": "74bc2a15-6fbe-4ad7-97ea-5c9170b97a29", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363407, "uuid": "223fc1de-3f56-4ef1-9a63-941b89d8b8c4", "value": "24576:22UtM6RX1dOfOrrXIYRnH+gsfH9fjG5tZMVwOqCIDiCRT0uRPqRla0:22Z6RXS2oYRegs/BjHu9lmp0PqRc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363407, "uuid": "8ff02710-20c9-4e3a-87ab-b1c5141747eb", "value": 1219187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363407, "uuid": "9f046976-9a90-4ac9-8dd1-79a55ce5120c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363407, "uuid": "203d91ec-9d93-4278-8404-1936d810c2cf", "value": "SecuriteInfo.com.Virus.Win32.VBInject.22551.23601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5b061a-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346631, "uuid": "339a6b6f-cd3b-4565-b10d-097f3346b111", "comment": "Malware payload (RedLineStealer)", "value": "79e54e9e7f1dd3f1699f90089953fd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346631, "uuid": "e06f9afa-c1d4-42e0-99a5-1a6c12c5b941", "comment": "Malware payload (RedLineStealer)", "value": "9c11e1b5ae3841507594af53bbd1580571b323f4a62d493c700edb50f72a31ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346631, "uuid": "007d3721-d43f-4bf5-810d-de5860859ee5", "comment": "Malware payload (RedLineStealer)", "value": "48ce2b52fe73b8920eca7a4657778c4f87725657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346631, "uuid": "1967bf17-7999-4d74-a0cf-1411ef973d94", "comment": "Malware payload (RedLineStealer)", "value": "5123428e4cb46739a9954473c6a20b38c7353b8be1f1728fd861104a686d135750f12eba53f6b13562105c7b7986ed00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346631, "uuid": "ca95a6e2-9ff0-4255-982e-0c34bf692566", "value": "T18E052346AAE44433E5B657B068F3078306367CA168B8839F23486C1F6DF32D4B976767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346631, "uuid": "8cf36b5c-ef7f-4010-a572-5fc83768379f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346631, "uuid": "0e1bc1a0-5339-449b-bf3e-28a842ece895", "value": "24576:tyzRLmPcvhfYiZFhSW1S5l7pve4nH6US1w:IzUPc5fYiZFe24nH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346631, "uuid": "48c9713d-a112-4bb2-9add-6d3660b1001e", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346631, "uuid": "d647fc06-639e-4cef-924f-601383493d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346631, "uuid": "c7da9f50-0389-48a7-a1c1-4feab9e44336", "value": "79e54e9e7f1dd3f1699f90089953fd43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afcc60e-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374036, "uuid": "c3e16590-06c4-49b3-88f8-b838fd552aff", "comment": "Malware payload (Mirai)", "value": "62742a3f0989a5024a8da7973ce696ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374036, "uuid": "20772834-ecbe-413a-94ee-3d0e30accc42", "comment": "Malware payload (Mirai)", "value": "9c7f425e8c49ddcb4bda73d41d651e25905d11b712909992eb8a60c54148a444", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374036, "uuid": "ee1a215a-046a-465a-91e2-27d1432e7bab", "comment": "Malware payload (Mirai)", "value": "09c6a10ec3f240e60fafc36b3cba49d76b814eb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374036, "uuid": "4bc23d5b-bed1-4f83-a22d-5f4d40dc5ec6", "comment": "Malware payload (Mirai)", "value": "6ab8afecf846f74173b81e658160644b1b8e4a9716fed2b816120748b9362509f0bc5019d8217d02858d107696e0b156", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374036, "uuid": "ab493fd0-a458-4333-a2f5-f5e1f3bbd030", "value": "T1588329B81996B63CFDF250B5F45320EA28610A1C379CE1E3B9876076FFB47087269D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374036, "uuid": "9e7bd801-0d67-4124-b468-018d94bbac6c", "value": "1536:RFsqdPA6xChpzOWYbgABeOGxvv1/WGQt7yJlwCw:Xdo6xIz7+BeOc1/WRyHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374036, "uuid": "514cd299-bcff-4c7a-9d43-27ad6ab225f2", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374036, "uuid": "2048a035-5c6d-4f2c-9f30-98a9c5ecc6a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374036, "uuid": "0b3825f2-be0e-40eb-a4f2-7b655b1dc9bd", "value": "62742a3f0989a5024a8da7973ce696ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad84127e-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377208, "uuid": "7231dd99-de0b-4487-a3b5-8c7c33aebc91", "comment": "Malware payload (Mirai)", "value": "86b65f5f4e56ce09cafae8be5f22583e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377208, "uuid": "4ffc6ac3-39a8-44e7-be7a-a2df58aece86", "comment": "Malware payload (Mirai)", "value": "9f96a05683072a991a6a681503e3acdab83206713f4500b5fba60f69aef20174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377208, "uuid": "47c1ab84-9d25-47da-806f-720cd36f4a0a", "comment": "Malware payload (Mirai)", "value": "b6b57514452caa29f35c1454e7c63f708ca18391", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377208, "uuid": "69ed1d76-42a7-4a90-b90f-2f0772440d70", "comment": "Malware payload (Mirai)", "value": "93b310e7412a7569a5f5b05f719be8ec4ea207171ffef38d5a25c02de1c8bd0a00ae5cb31a8791368ef29b6a6911e5e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377208, "uuid": "dc3baaff-b647-4780-91ec-8e407b9c541c", "value": "T1D4B2D06EB56416CBCDEE9C7E909D17F24EA6A19A32822F0C33924C4037167633C891B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377208, "uuid": "81c732da-6fc7-45e7-841e-c55cd76e85aa", "value": "768:kLgJwgaM3cCK1oPTZQwG+Xx5EjBCIgY7unQWF:kq4fYtrXCcnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377208, "uuid": "1491805a-9585-4acc-8626-f510a07caac3", "value": 24920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377208, "uuid": "7552d65a-60f4-44ee-b972-c83fddd89379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377208, "uuid": "fd91e7a0-03da-44b7-b0d1-bf78e12e6274", "value": "86b65f5f4e56ce09cafae8be5f22583e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf7c2de-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377203, "uuid": "ab244005-d0ad-4189-ae86-e9659f4efc83", "comment": "Malware payload (Gafgyt)", "value": "fc9fe3284b937e59c1a64618890a70a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377203, "uuid": "951c5385-f506-439b-b66d-a6b449334ac7", "comment": "Malware payload (Gafgyt)", "value": "a03a7b6720fd1b3aeaa46c68cebe5f02c09237a2cccb2d3782464da710db0bd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377203, "uuid": "4fe436ce-0f8a-4b8f-85bc-3375bfb5c92c", "comment": "Malware payload (Gafgyt)", "value": "2aacdc03d9ee176392848821d016c4fbcf7ed94b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377203, "uuid": "b6cb5a06-0eaa-4bf5-b60c-13305813037d", "comment": "Malware payload (Gafgyt)", "value": "721901b3b6efda5ad41071c44ec0e00b42b42c8a3d7922e9f2860ed5df5ac59fe8bc73a0dc557eacd2e0dadaf1044653", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377203, "uuid": "6cdc9d4c-38ec-4edd-b6f7-deb2ed98ded8", "value": "T1E8933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F390987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377203, "uuid": "560d863d-66f5-42eb-af7f-cea8515b5280", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2em5GMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8rzeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377203, "uuid": "8623db6b-ddc5-4bd5-aa3b-203853e7846a", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377203, "uuid": "9539346f-09e9-4192-9c4b-f8dd7be531c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377203, "uuid": "23e12e61-9ace-4681-861a-dd85b9c16a1f", "value": "fc9fe3284b937e59c1a64618890a70a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72899b42-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379686, "uuid": "8f1ad72e-93bc-4db3-a05d-00ba38c23b55", "comment": "Malware payload (Mirai)", "value": "a542e4a2dfb70f0a23750715c4431bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379686, "uuid": "de07f746-eee8-473b-a141-882b2c5b2cf3", "comment": "Malware payload (Mirai)", "value": "a163985d8c99c3199ffd7d09060b84ad87f681347034e482f498ce6a69aff13b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379686, "uuid": "12b2a7cf-0793-48db-996f-7fb62f685942", "comment": "Malware payload (Mirai)", "value": "6db8df5ac7caf81dcd76db93d76b8b7bec52d2ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379686, "uuid": "91a3d5e9-da2a-4fda-905c-87074754849f", "comment": "Malware payload (Mirai)", "value": "b6e70320db42b7dfa8954d3fcc8030a090fc1b167af94b6f7c5f26b1191aa26a49425381e08b534cc6374b477c48312d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379686, "uuid": "b3e12e15-8a7a-4bb7-bc8d-cae6f65f7aab", "value": "T1CEC3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379686, "uuid": "44ffbcab-9617-4e42-a690-af8c75423ae5", "value": "3072:FDcYVLWKlAQTv+mY2bpl2m7/L7QsvmGugiNb:WYVxlAk9Y2bH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379686, "uuid": "892d129e-27c5-4b46-a106-637d89502a6b", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379686, "uuid": "cd168be4-f0a2-48df-bdcf-6fe1e40503a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379686, "uuid": "2d650fa0-2420-42db-9fb7-75f15fb8735d", "value": "a542e4a2dfb70f0a23750715c4431bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18ff2ae-fe39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685376033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376033, "uuid": "125f2481-b899-49b1-8d08-374f07eb0359", "comment": "Malware payload (GuLoader)", "value": "8f0c61518dd4885122c46b7bdf6f069c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376033, "uuid": "f610d9cf-3e63-45d1-9630-70cd538eef3b", "comment": "Malware payload (GuLoader)", "value": "a1b3717d728edb72724f461a03fb880377d0c3dc9a20b0a8566d3de8db8be286", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376033, "uuid": "5616da6f-695e-43f8-85d7-5eee2cca029a", "comment": "Malware payload (GuLoader)", "value": "4a3109be69f405ee1a8f681189b27606ccab1897", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376033, "uuid": "9dfe33a0-0d58-46c0-98fa-a0b916f202cf", "comment": "Malware payload (GuLoader)", "value": "1b45f8a44791e08d48c6e11cc64f663485c755ce41d716998ed2baa639175029bf86607d0ca5dab91cc0c6dbcc7cbf2d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376033, "uuid": "18cfe9e6-06b1-4842-a0a4-de9e31ad0100", "value": "T1700549311F98C813E35594B871E2CAD8EE75FD0C325ACD42EEE7786A66786C168F9103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376033, "uuid": "731501b2-de5f-4c95-9bed-6915480ab908", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376033, "uuid": "ec9d6225-1d4b-4df8-95a1-b04ffed559ed", "value": "12288:9PKcWfPW1nUOMa/E8KC/yKBGTkwbaH2mq0xSK+U+xYj:FWonUZac8KC/yKM3a4OSJXyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376033, "uuid": "a4c2820a-7c9b-48af-8378-68d5ebf39ea9", "value": 800987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376033, "uuid": "40a39c3d-929a-4ce5-9438-824b41f20b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376033, "uuid": "64e1a3fd-2210-4bbd-8f4c-858aafbcb903", "value": "rFactura.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f54429d-fdc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685325939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325939, "uuid": "dcbfb26f-7e2e-4b87-9ae3-35e51ce3c158", "comment": "Malware payload (Amadey)", "value": "953bb78b9edb622caf55714a638e0c5b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325939, "uuid": "29bc5e83-1e0d-4c52-856f-cd12275eefbc", "comment": "Malware payload (Amadey)", "value": "a4f0e73dc2148f2dcfe90bb2d03ab2a18341bf4d46565f648dab4f5f62cd418b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325939, "uuid": "a3743c43-7cbc-43a9-8b9d-e40607fa68ae", "comment": "Malware payload (Amadey)", "value": "0960dbfcaee10ea13ea81d48553478a935ed0ed9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325939, "uuid": "064a29a6-d68b-478b-8c30-29321fa5bd12", "comment": "Malware payload (Amadey)", "value": "3745a35d8a994702e192395d91ffcf8cc1d53aabcee0a68e0f47bfc05322a6ee648aea198e6fca1af642a00431409550", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325939, "uuid": "43709ba1-8adb-4a72-bfe5-0e9c48119f78", "value": "T16305224297E48933E9B10B70A8F746832735BCB19D7143AA6345AD1E08B3BD1E97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325939, "uuid": "1c468040-5488-4fcb-b1b7-ec83ed3ea9d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325939, "uuid": "4b4314bf-3cfa-46f5-b920-fb8454e96b7e", "value": "12288:IMrky90jXycjojgoe4+Wh3CptAKHyJroueDephs0jfZguLfSzhe+pn+EQ3USzygj:syBEFwro/NL1eWnv6USzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325939, "uuid": "76aa755c-febc-47a5-b410-f77f381339fc", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325939, "uuid": "e7447630-aefc-4f34-9843-e7df2525a0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325939, "uuid": "87e1904d-e63d-4667-a99f-03e660dcceeb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb8c08f-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685371707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371707, "uuid": "780d22e0-a014-4671-9926-07f50daefa70", "comment": "Malware payload (ArkeiStealer)", "value": "9ff2a868e5828fba7f8711b072fe8394", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371707, "uuid": "9979c3ec-4a1b-4d44-9290-f94618d9c4d1", "comment": "Malware payload (ArkeiStealer)", "value": "a662afc72f832b1d74c887bb57a4ad6848ebb5c16a0eee1bd82729cd00eef84b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371707, "uuid": "7d196bed-3d81-4b56-af91-1d1b59296ab3", "comment": "Malware payload (ArkeiStealer)", "value": "5e7a38fb2169fb6f7f86669ed9d79b26b43d910d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371707, "uuid": "cd5fab4d-cc89-4711-9396-08ba5e8f92db", "comment": "Malware payload (ArkeiStealer)", "value": "875fe8b15269f697f2bf2553884845b51d70b69d059526aa140d720a20565cf067dd1b6d8857beb08b2fe1b7e23a5076", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371707, "uuid": "6700a5c6-a12e-44cf-8fc2-8b45ccb98823", "value": "T144F4024522B06752DB8C1632A0DBD631DBE16EB3FD3BF59B7F14898628A21701F11B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371707, "uuid": "3b7ab7e6-9479-47a9-a7d0-92b2b5382c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371707, "uuid": "92d4305d-a15a-4266-abb7-e1357d9ef7ec", "value": "12288:4Eh/dWHJmsGo5zY3lt1KZj6nxqgR1xrEL+VhYxKjzfDI/RdjzP8BAtt1I:7dWlul2Zj6xVxrELk9LDYRVzPFj1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371707, "uuid": "912042bb-35e9-404e-89f7-89634e43f4d7", "value": 736128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371707, "uuid": "0d4e98f7-f716-44e3-b6a7-52a67ab35627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371707, "uuid": "c564439c-bcc4-4c86-b0a5-1955f33fb482", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bff917-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346319, "uuid": "e085a99c-9d5d-4917-87d8-6d62c9bcc86b", "comment": "Malware payload (RedLineStealer)", "value": "405c64d0c1848a7666168f64334d2653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346319, "uuid": "6a939a81-2d67-4349-a512-3d1f436e04b9", "comment": "Malware payload (RedLineStealer)", "value": "a9e303406de9efedeaaf30485c9f82e626c8246bc713e31d5c4b0c4856759780", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346319, "uuid": "add0d68b-051e-4bc7-9742-cd7f4a0a0691", "comment": "Malware payload (RedLineStealer)", "value": "2d24911cdae982c1def0a5731a367d9668a8c48a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346319, "uuid": "12942c25-09b7-48aa-ad1f-d610236737b7", "comment": "Malware payload (RedLineStealer)", "value": "4989ab8a1391a483e9271b34b3565a40250bdda8a886e2b4f25b3599cdd67b38aabb95bde33d48d6a7f4bf8e82ce079a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346319, "uuid": "29645dda-bb20-4329-9ff6-c64d25efea3f", "value": "T100051293B7CDA473D9B52BB4ACF64243173A7C561DB803AB2740591E1DB26D0A832B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346319, "uuid": "19156b81-02b1-48b6-9037-fef7ec393a43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346319, "uuid": "70d7492f-8345-4411-8ba5-066930744010", "value": "24576:ky+mA2SvmWTagFyqcP6ly/FlLe+nF6USfIs:z+mA/FaQyPPmAQ+nFMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346319, "uuid": "b90389b2-ea70-497c-88ad-977bfe8c0b0e", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346319, "uuid": "e3d8c59e-4798-4460-a607-778ae398514e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346319, "uuid": "25aea8ea-7e6c-4513-b0d2-ee4693825eab", "value": "405c64d0c1848a7666168f64334d2653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4bb210-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346926, "uuid": "3537c12b-98c3-41aa-bb4b-9829536d824b", "comment": "Malware payload (Amadey)", "value": "cdab4a8de6cd6d333e905b238cd34343", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346926, "uuid": "2da95324-f748-42fb-bf1a-748053e21787", "comment": "Malware payload (Amadey)", "value": "aa5154e295bd3e1382724c01cd15a3077d33dd6c8c6817062461e8f0770d889d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346926, "uuid": "3fe8b8db-c3cb-49f0-a682-3459d9aa0318", "comment": "Malware payload (Amadey)", "value": "466339d70ca69797eda3a5fded5476c867471500", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346926, "uuid": "557675ff-9d52-48fd-8212-75513bd22a1f", "comment": "Malware payload (Amadey)", "value": "276243e26e7074d585fdf7af4fd1f9484d8a6393049aaeb525254257a2ccdd967393f04745911edf6d3688fe21284f77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346926, "uuid": "9b89dd59-b394-4d76-82c2-d77e31870880", "value": "T19F051212EBE98473DDB527706CF703831FB1BDA48D7483AB2346499A2972AC4A571337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346926, "uuid": "60531e6c-20ce-4cd8-9be8-1e5ac0d47c26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346926, "uuid": "c90e9259-3744-44f7-807f-099d007fe75d", "value": "24576:ByWM5Oy7w1DgKMwjBsH1DQAvHLeqnF6USBfZl:0H5Oy7wl1MlDQAqqnFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346926, "uuid": "fa623a8b-413c-4a60-97ea-f0461a728981", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346926, "uuid": "b728528b-83e6-4f08-ac77-e9279beed29c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346926, "uuid": "28488509-979c-487f-a859-b4f439ab02c9", "value": "cdab4a8de6cd6d333e905b238cd34343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b46042-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685354003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354003, "uuid": "f23d7d59-89ed-48db-ae0f-a3d3630b1326", "comment": "Malware payload (SnakeKeylogger)", "value": "47152b15670fb696a5e56d48cad8f07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354003, "uuid": "837da439-0c4d-43ee-8ce9-2bd804aae24d", "comment": "Malware payload (SnakeKeylogger)", "value": "aa51910f1e1caed35717d46f699918bf86f5ccf4f99ba8e9343e32e91e0f06ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354003, "uuid": "1074890c-a3ca-4d8d-a87e-55b8b1ab5e1c", "comment": "Malware payload (SnakeKeylogger)", "value": "fd532b52f88fa5fd4ff46284eeabfcd8b133f725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354003, "uuid": "6e922cb1-a55a-408f-8b61-7c98366d0c80", "comment": "Malware payload (SnakeKeylogger)", "value": "69a979f8735f5e4fbe4a23d1011fbed01bf37b05b7657a0ae342f41fcaab10bbb60b5f6501b6c06fa3a1f6285cdc9d10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354003, "uuid": "5967dd82-8f4e-4e24-95a4-7f8b50c096ce", "value": "T154A4E16C33E89800E6BF9973257150258B75B8021D1FCE1D56D2F629293DBE08E6AFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354003, "uuid": "6e35d804-5921-4e45-9bdd-25b25b1fe936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354003, "uuid": "369077ca-de77-462a-9e99-4bc64291ec48", "value": "12288:QlV3E3HDei3oXA2jCXgXLz/HQOqzjW/NV:QjU3Hq6oXA2jBXHnqzjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354003, "uuid": "a4a5769e-ea58-415c-89e9-c0d35af531e9", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354003, "uuid": "71fd59da-4521-46f3-8a2a-04f5ebf527e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354003, "uuid": "d2ef8879-cfc5-4411-b94b-47b02789ae5e", "value": "aa51910f1e1caed35717d46f699918bf86f5ccf4f99ba8e9343e32e91e0f06ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3224f073-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346936, "uuid": "b6f06115-43b4-40c4-8945-ef6d58315243", "comment": "Malware payload (Amadey)", "value": "ea56d8756a1091227f0b5583f42ec54e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346936, "uuid": "ee4335b4-f685-4dd1-ae6f-adb5fbbe7507", "comment": "Malware payload (Amadey)", "value": "ab4e1eeaeb53370f7925e8b334371a185123cf693f76e4a03390372a658de1ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346936, "uuid": "555d0506-15c0-4a65-a34b-daf9de4e1bec", "comment": "Malware payload (Amadey)", "value": "79cb9ab1892a6a4e56ede35e3ebec09ea62e7d4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346936, "uuid": "0d92175f-756b-4dde-b76f-4094fd1e2447", "comment": "Malware payload (Amadey)", "value": "17b7063b3d06baec6b893b38baa5731dde4d6d03e0ecdba394cb0ee5397e8780df65ccbec9c66c6972e4bc999c59cdb3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346936, "uuid": "78f53eb2-bd61-481f-a579-4e06871b5356", "value": "T1B2051203A7E444A3DDB513B49CF20387173ABEB29C74435B2641589E2EB26C4BA7177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346936, "uuid": "8eaa942e-0ce9-4cd4-95ed-0b3ef86d533b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346936, "uuid": "4c30ee1f-ae36-498a-964f-21efc6e9422c", "value": "24576:/yneIem9Y0/1EBzuLz/SSRPINeyol6USAJ4:Kn5neOwza/VjyolpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346936, "uuid": "9ef044d0-fdc3-43b9-9665-4bb9d6f3f64c", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346936, "uuid": "c5984592-930a-4e88-bc5e-19d619426eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346936, "uuid": "7c3750d9-64b5-491d-94b7-2aebf3fa1e78", "value": "ea56d8756a1091227f0b5583f42ec54e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a71fbd-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365621, "uuid": "394c537c-3957-48e7-a522-0723fb469921", "comment": "Malware payload (Mirai)", "value": "34fde6a127cd06632bb9f563b2ea38ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365621, "uuid": "e4093a85-72a8-4750-8920-7d08a3fbc7dd", "comment": "Malware payload (Mirai)", "value": "acb1d76051602de4079ead7a42a3daeef5925c830e4e52670a465832844b0b5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365621, "uuid": "6805aeed-9c29-4f39-a8fb-50a4fd5bc3bf", "comment": "Malware payload (Mirai)", "value": "e4a82cdd55b76ae114ce537c75d4e62ff8a51912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365621, "uuid": "1317f7bc-7053-48fc-8e0c-0bee755cd57d", "comment": "Malware payload (Mirai)", "value": "a9b2d085f1a2e5d3cc78104bf8fe370b55ac6d25b169bb516477e2c421798308bbb8f49e539b32f544b9ef493258dd69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365621, "uuid": "0899d3bf-57fa-4078-938b-df99dd0c5fb2", "value": "T1B5E33B56EB808B13C0D21779BADB82553323D764D3DB73069928BFB43F827AE4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365621, "uuid": "55dab670-49bb-4d8f-81e0-3a94302d64b1", "value": "3072:UBJVAeD6Zm0aaBZX+Rv2F+kxHn156MKrCz4M/9mmlaTqXsB:UBJVhDQaaBZORvkxHn181rCkM/9mmlat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365621, "uuid": "1fb33cd6-008e-40f0-aac3-43c7e1546744", "value": 151050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365621, "uuid": "17712ee8-9657-46da-9a39-c7c7d3e0459c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365621, "uuid": "a46c1360-c4ae-4cb6-bc0c-3b8ba7a81849", "value": "34fde6a127cd06632bb9f563b2ea38ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd6243d-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377233, "uuid": "e7e43094-7a24-41af-a047-f1dee5060494", "comment": "Malware payload (Gafgyt)", "value": "49b9c25e9c7b61ab998b2deed46377dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377233, "uuid": "094e554d-53a6-4a87-9abe-c43f9a65a2ff", "comment": "Malware payload (Gafgyt)", "value": "acd3cef14c0588ec70809b75bbfbb3cc63baa6a1f19871b0c71d0a93b6c81bb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377233, "uuid": "d35f1822-66be-4c99-88f5-81f4fb2e0d13", "comment": "Malware payload (Gafgyt)", "value": "120fdec9b0583637bf2284e92d8319051f758223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377233, "uuid": "48c10d01-0880-40a4-9a15-d98c523d23b9", "comment": "Malware payload (Gafgyt)", "value": "bd83e8ce077f56991e46ef51416d028cd8cf2183f86d2160083b93eb03889da57a94b124056a20bc931950c007ce7ba8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377233, "uuid": "5a7ac052-cf8d-448c-8dc3-eb0ae2fa0763", "value": "T135E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377233, "uuid": "6ee45490-efc3-41de-8e9f-720147902513", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVypLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflAgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377233, "uuid": "7735ea30-c05c-4d3e-babe-101bdcc8858c", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377233, "uuid": "eef8ef06-c60d-4236-a429-b5461965fe6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377233, "uuid": "6e615a26-a0a6-4337-be9d-a1f06d58f7ca", "value": "49b9c25e9c7b61ab998b2deed46377dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cdd027-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685387524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387524, "uuid": "b4e33bf9-1d2d-48e3-b21a-66840b855007", "comment": "Malware payload (Amadey)", "value": "5e3913928acc36a8748e315841a4ced0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387524, "uuid": "158e7cb0-c04b-42b1-808a-bc6068402f22", "comment": "Malware payload (Amadey)", "value": "acfee546804f2fab4df9f00a965f5fb89f1705aa38d7de4eb5ff225a4415220f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387524, "uuid": "0627a4b4-3e9f-4b79-aca1-9238547cfef4", "comment": "Malware payload (Amadey)", "value": "b233e50c0824f288a105d9154ab52ed30df092c2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387524, "uuid": "b57f3e9b-a6ab-46d1-96b7-a1e4632275c4", "comment": "Malware payload (Amadey)", "value": "88770d191677a7258a9fb098a398243d94b98154c9c863ecc9a9755961651b1812c30ebd1b5c2641125e7eec54e1b3af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387524, "uuid": "77d49b32-99d4-4f73-9b98-5b48ce177920", "value": "T164051292E6C88076DDB617B048FA0AD72F31BCA05A744A2B379DA94F4D73A80543173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387524, "uuid": "6efe5482-e08b-4438-9c16-5ddfe421f972", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387524, "uuid": "f39d6247-9f45-41b1-90b4-d9613e231f36", "value": "12288:pMrMy90oQj/VYZQXavo+jiWlRxXbXjJQZvx2rX1yY20PX2uRXRuQgy:RyAIoawxmHvXNvl1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387524, "uuid": "9ce48658-b197-4db1-ae1e-c71a6b18639a", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387524, "uuid": "c51e771f-6594-4a91-bbb9-e751d806f96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387524, "uuid": "38db628f-0a4e-4740-9d46-b45470d64686", "value": "05394899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c9fe3c-fe51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685386162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386162, "uuid": "d6097f59-90cc-4d79-b1fd-29d2c122a891", "comment": "Malware payload (Stealc)", "value": "e7946204dee344a8e0ec8bdc4a7f6b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386162, "uuid": "30ab820a-7c77-4c1e-ac40-1d7fcf181c1f", "comment": "Malware payload (Stealc)", "value": "ad1631eef269b7dd54df995000b702d36e5e278ba0277be7252e294f7517b662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386162, "uuid": "2eb03dae-b2d5-41df-b06e-9ab309b563f6", "comment": "Malware payload (Stealc)", "value": "e7f6fbbc7f2ee1bc1a09a41fded604a30c8e6fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386162, "uuid": "fde44afc-2d19-4f9b-9a22-c35c380e6a8b", "comment": "Malware payload (Stealc)", "value": "33c65c53957f753666c2903f7dd898abd477080113e5b44ccf03ac6e6c3c3af577b0e1c1156f6f72aa2a9ed7fb6bcfd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386162, "uuid": "cc18fff0-8c3a-488b-b384-1daa46fde6a1", "value": "T1E237333FB258B53EC96A4A324673A320997B7A61B41B8C0F4BF0055CDF674211F3EA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386162, "uuid": "62806a8c-9979-46f3-bd37-1505bc3e9bf0", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386162, "uuid": "5e3a1403-d29a-4de5-bdeb-756b38dd8b2e", "value": "393216:wnFCJ92stxaUoxBAoYIn04B8PT5UbkYkKJW6ctXyt5K13N7QvDpK7KO+In:KCT2stMUoxSpI0A8VfKOXY5Kv7X7iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685386162, "uuid": "3f5cc542-2cf8-4cba-9cb7-8ae7cab8b34c", "value": 24324512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685386162, "uuid": "01d969ce-fd0b-4ed4-851c-97f637998376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386162, "uuid": "4d642eec-29ff-40f1-9ee4-6509d4abde10", "value": "Office_Setup_v2.65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed5caa4-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685376807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376807, "uuid": "46b0ae70-5793-4286-bcdf-5e0ee606ed7e", "comment": "Malware payload (Gafgyt)", "value": "72dd51cbeb656e87bd3181c9a5dd83f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376807, "uuid": "0cf358bf-c0af-4f5d-bd95-7467c882365a", "comment": "Malware payload (Gafgyt)", "value": "add2b06443351635653f69fe588be49c8da4efbd9a15b2d50d005c5d4768f3a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376807, "uuid": "0be9cc3a-c68e-49bf-afc2-bd424da8aa46", "comment": "Malware payload (Gafgyt)", "value": "bb4e0a70f89fa53326f01253c685c77089678fab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376807, "uuid": "c652a51e-557e-496a-b156-dfa9cded20a0", "comment": "Malware payload (Gafgyt)", "value": "790bb9c3f4634c0b8fd88dcb83cbf2e0b84732813643088619acfee37b9cbd883c57216c4754745ebae8a109c49dc6d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376807, "uuid": "2d63979a-1d9f-47ed-96d0-d8e1e4fdb3f2", "value": "T1A8C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376807, "uuid": "4b836ffb-0367-4ecd-a5af-f5b78b24034b", "value": "3072:hQrFRNfuLrGhEPOD0Ig3gNlmBoHQuQekQnYW:IFzuaEGQIg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376807, "uuid": "165c3fca-deee-46f1-9ebf-4777bf3ad78c", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376807, "uuid": "68c9731f-5a6c-4b41-aa41-9fe3fdc7ef39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376807, "uuid": "bf4ec622-092a-4f76-af3a-0ccd32543cec", "value": "72dd51cbeb656e87bd3181c9a5dd83f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd92f97-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363409, "uuid": "8796e234-4cb6-409c-9211-9e0613bb3d19", "comment": "Malware payload", "value": "a68006a5c963a4d25989c61eac047f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363409, "uuid": "8b58df03-f0d3-4555-9169-84ee84bfc6bc", "comment": "Malware payload", "value": "add72ea3eb4daefb2ac436291264b0c6a8ee927aef98cdb4c6382fc2c5ec74a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363409, "uuid": "38c1ed42-dd51-41a7-8caa-f2714f22e0b2", "comment": "Malware payload", "value": "14e9fd18bb7b78b300ca7cc3dcbfd1cf61c8ca45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363409, "uuid": "282fd658-32ee-43a9-9d89-32d1faaeb4dd", "comment": "Malware payload", "value": "74f24cfd29b15517f1f892ad3479d9fd700644e23be098c287fb04fdaa30d3519b726ecf1eb1af437f1299248637af1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363409, "uuid": "68ccfded-6b15-493f-8f87-72e18b622be3", "value": "T13E726D0B6CA80510D3A54F32CE734FAB6C21F430CA3197DF599097AFBC34361755AA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363409, "uuid": "94b7bf0e-69f3-4e0c-bc2b-be5981fa7f64", "value": "83343292a2b868352964155c145bac9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363409, "uuid": "62e8207c-442f-4f7d-8204-52ec70e0fe37", "value": "96:mM+R2Ri06aMcVnQYTvFsU7U3LOAHI8cy6brBH6uKD2bcVqTfTTRVa7gi8R/LuohK:mrR2RcOhvFsNfchvPKqeqTfTT6ZGWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363409, "uuid": "8309fe24-14ec-4999-bd46-87aeee6a8ddb", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363409, "uuid": "e4e7f315-87dd-42fc-b988-2a40b72148a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363409, "uuid": "6ae660f1-f0ae-4f4a-9e1e-d7fc6c4e7749", "value": "SecuriteInfo.com.Trojan.Packed.29897.23587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93565534-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363420, "uuid": "8e948b3b-b655-4457-98e2-0df2af8e770c", "comment": "Malware payload", "value": "672744986f8907b972b509a608338e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363420, "uuid": "fae1b46b-71e8-437f-806c-1fb640e038dd", "comment": "Malware payload", "value": "add81f67dddbc89ef471b93d268bf62940df84714f51e46b87d60a55d797742c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363420, "uuid": "fd8a4255-4e58-496b-ba95-9a67a7b8473b", "comment": "Malware payload", "value": "d32bb3d3431c4c257aa06f2e9f35bc53f961d50f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363420, "uuid": "78395d06-f6d5-4f6a-8b29-a9ba391f982d", "comment": "Malware payload", "value": "885a8523456aa6e17fb6eac3cc3e68e7f8105869bd30e6fda4080e326d6d7fe8563d6bbd5f9ae87289caecf9f91b5e0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363420, "uuid": "60cefa96-bf9a-46f3-8301-b94a13a31dbe", "value": "T104829DA1B220CDDAD58414366C23CABCB7213E3ACD250E073BC4674F3E32759EC4599A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363420, "uuid": "9ae44eda-f2cd-417f-801f-9e9c7527303b", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363420, "uuid": "ad194852-7c3a-4c69-a50c-406904e70e81", "value": "384:PLDTs8hsF6qtK8lzQ8+Sych3mYvCPHxrm:PLXVhaTtDE8VfCPHxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363420, "uuid": "ff796c74-aab2-45e6-bc5e-2de17c2ba1bf", "value": 18647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363420, "uuid": "f85da5d2-9ce8-481d-9f01-3d61f0c51959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363420, "uuid": "faf22ef1-70dc-41ca-8fbc-79bbf94fef17", "value": "SecuriteInfo.com.HEUR.26695.768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822ccb92-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379712, "uuid": "95b403a8-c61d-421b-97b3-230c71e48211", "comment": "Malware payload (Mirai)", "value": "c8f61ef256fb1c0a4cd82719b21cb620", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379712, "uuid": "b74afc6e-5adf-41b9-a287-f6a0e4fd708f", "comment": "Malware payload (Mirai)", "value": "ae3545ecb2eb7e4bb89a0803bfeef2d34600372fe34b7243b27d6a1551325945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379712, "uuid": "95580076-e8c0-4f1d-91e2-348845b5e343", "comment": "Malware payload (Mirai)", "value": "f73c6ae41250b863b6e246e0b1f5ae70e4661c56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379712, "uuid": "1526cbd1-d032-4deb-b374-53595d9d3e33", "comment": "Malware payload (Mirai)", "value": "7b0798de375df32b62b4bb7687099dd84c1455a6931c9cd8847f5dbae3c2db9b6fc80308f9fe1c8a2aedbaeea199f945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379712, "uuid": "5c0e3346-7f0e-4fd9-9f24-d8c47dbc241c", "value": "T1ACC3F772B804DF66F40AD6B604D38B227E30BFA70E631662B31739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379712, "uuid": "7c7f33b7-3a4e-4508-86c9-50174ae8df27", "value": "3072:L+YUpmc5hIof5UM7XgYjykKdGmm/QcuLB126DNb:LwU1of5UMPyk2Gmm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379712, "uuid": "6919d399-b75b-4594-b12b-fe30eb8a66d9", "value": 118319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379712, "uuid": "e783d98a-5319-4764-9a47-9202398c523e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379712, "uuid": "58ca9de5-32fd-4eae-87d3-082763aca5ce", "value": "c8f61ef256fb1c0a4cd82719b21cb620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ec9fb-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363401, "uuid": "03b6fa22-b3c6-4562-bd1f-694e3a5f5426", "comment": "Malware payload", "value": "bcb9e7729036db9a3f6cdf29c4005279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363401, "uuid": "0ad47410-f939-4b03-ad69-df07a034ce23", "comment": "Malware payload", "value": "af01c44682c8a3dc8b282b039b2fcb2fe0a8089b13a233f6c3a86d3bb0c2deea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363401, "uuid": "9bbf2846-5957-461a-8f9a-eef0b630cdf1", "comment": "Malware payload", "value": "aff1b06bf21d5c8e1bde6dfaee2397302e7c7ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363401, "uuid": "1d25317e-2edc-4de8-8493-e865dfcb69cc", "comment": "Malware payload", "value": "7dab4ff3a15d60317a973bb847a8ce9780b4d6c42948f9992006736c46975931a2a5de3e58f0ef9fff1a8afd68fba162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363401, "uuid": "80e9bc5f-fecc-4e34-8c4f-ec8b4cfe6fca", "value": "T11CC30229B1D0CDDBDCD1C13101B6EF79EFF3896500156E93ABC82F389D22192962D3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363401, "uuid": "67e88285-76d5-403d-a8a5-cbaedcf9f5b3", "value": "c939e33654123500f1701c29fcc1c697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363401, "uuid": "9c2b5b17-7e10-4778-b409-866f8f1bd06a", "value": "3072:P1fYP9VaSNV0RCgmJO091KrYnPoZeNXgXCwDcn6SWtyWMJVK8:P1AlsSL0DCLxPo06Cwgn6xtyWkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363401, "uuid": "4986ea3d-d136-4a18-b94d-4c6b53a0a9d4", "value": 125965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363401, "uuid": "a9214de2-e2fc-47ca-b362-59a04c7ed196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363401, "uuid": "55432014-8a40-4c1c-89b7-069c2bfe0002", "value": "SecuriteInfo.com.W32.Downloader.N.gen.Eldorado.20947.16771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ac9e75-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363415, "uuid": "f6e263f0-8454-4bc7-abf2-c542cb6bc0bc", "comment": "Malware payload", "value": "31a3f4d622d4be06e6024723e930c77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363415, "uuid": "008cf22e-d046-447e-88f4-8ae7abe4f9c8", "comment": "Malware payload", "value": "af09dd70b02c30aea66940b13e3265cb1228f4dcc907e73c511d073d3fafc892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363415, "uuid": "0343a4f9-3a2b-4437-b42d-e4e688676287", "comment": "Malware payload", "value": "1608d715bbd4e863e9bb8f70292e594634e4dd20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363415, "uuid": "ffcb062d-1abf-4121-86de-9e77ed15c2c9", "comment": "Malware payload", "value": "55102158b8924406043fa39528af970310f04838c889ffcc7872087033fba02a3a51b76dc26d977bc6cbc6d228947f3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363415, "uuid": "8112270e-e95b-47ea-92f6-ab2a2d116f27", "value": "T1BA03E145731D88EBD21649349FA367A8AEAAE9007593434B33E6374D1C18378DF3EE19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363415, "uuid": "cfbaabf5-8d78-435d-bace-14890017013b", "value": "a53f732e1bbd70e2b3217e8d53ce6afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363415, "uuid": "06d631fd-721b-4d27-b79d-a794a65edd87", "value": "768:3vUEIgESC4ibJDEt9jyCxGa9Pkk6rZKz+5LI1kolryKOsObbwk2J:fUlC0bqwI/Pkk45UkoEKed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363415, "uuid": "27da9bde-6842-4e42-988c-b656c2053e0d", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363415, "uuid": "ba2e918e-4f7f-43d8-a20f-3addadf43959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363415, "uuid": "a671b7e1-5684-4cb7-bbe3-09b9dbef52cc", "value": "SecuriteInfo.com.W32.Downloader.N.gen.Eldorado.8247.15521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a282fd58-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685377189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377189, "uuid": "2233ce9a-2739-4548-b47b-d3f0a43f40ed", "comment": "Malware payload (Smoke Loader)", "value": "24436f5ec6e6042c87ee7ae559cf8b04", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377189, "uuid": "68607aa3-ab8c-4bbc-88ca-968c4bbbd679", "comment": "Malware payload (Smoke Loader)", "value": "af57cd930203ac9fe6937372c220177e7646da47c65d988c43bae58f87764d9d", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377189, "uuid": "ed2bf9c7-8a68-4a7d-873f-0c28bfd652be", "comment": "Malware payload (Smoke Loader)", "value": "fe35b4400dae1a500fd3cfd2f5ff0f2b3afe1cd3", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377189, "uuid": "cc5ad4eb-b93b-4814-bd8e-18512cb13180", "comment": "Malware payload (Smoke Loader)", "value": "3684ad9b9faeecb9c1a62f62cc2af5ae0aed73c93d71732ead78d8d6bd84c52d55298ba43c1526af7703458b1254c81d", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377189, "uuid": "5b004c08-6711-4432-b204-5b5f8f0d17e0", "value": "T146642B22A3D17C64F5264A719E2EC6E8761EF9504F5B77E73324AA2F08712E2C172731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377189, "uuid": "dfa0d53b-5bd2-4c11-9efa-0f857298cc33", "value": "067710d045234604093d7ae15ed3e5e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377189, "uuid": "e3594058-f005-4886-a8da-9941e666f8cf", "value": "6144:ymHcVAhdBjbCMlsciEQvguJf7/uX9xH0:y963XCMfnQvgMLuzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377189, "uuid": "63814375-c2c9-4ca3-9f50-e0e5c8f20943", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377189, "uuid": "adff4a8b-908e-4e9d-aa77-154f8fc909a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377189, "uuid": "f22ae46e-d5e7-4bed-9d1b-95766c6387b8", "value": "07750999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b182fc1-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346924, "uuid": "582cb671-9d47-433d-83fa-1bc7fc678f72", "comment": "Malware payload (Amadey)", "value": "a464e64f1012cafbd93e9b17cb1db9fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346924, "uuid": "3a2d7b6d-2ad8-405d-9b0a-765bbc4b4acf", "comment": "Malware payload (Amadey)", "value": "af729e6d8bc9ce5456a89485aaced3356938f11be9e31b65caacb1fc1e79be76", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346924, "uuid": "81e71ecc-1562-42cf-ac94-77bb593d924a", "comment": "Malware payload (Amadey)", "value": "11b7d037ee698d44d87214ac2dadbf5bd781c1ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346924, "uuid": "462b4cc9-2767-477a-bfdf-a3266b7c6b55", "comment": "Malware payload (Amadey)", "value": "1b97405fbec85ca294d47491efc28b9c71e413b9aa04f0e84eef2d19a922cfcf3b62711ec6e6740ca6c9a78cf9a27af4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346924, "uuid": "7eaeafe1-efe4-4ab7-a6c1-5bbc3d34e92f", "value": "T12F051202A7D49473EDB417B49CF702831B3AFDA58C7887A637449C8B0D73690A9B13A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346924, "uuid": "eef8c4ab-f8ff-4297-aea4-12da3206fd4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346924, "uuid": "807351f9-4308-4f99-9ab9-f29162067ecd", "value": "24576:cy80y5IDuKfipRM08dog1einv6USulGlgUl:L80ruKqpRM0H7invRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346924, "uuid": "44715c9f-6774-4d7d-8f45-8bd627accc9b", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346924, "uuid": "fd6a4299-2808-428b-b294-347bbcd92d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346924, "uuid": "fa3ec3b8-97df-422b-b871-b451108e1e40", "value": "a464e64f1012cafbd93e9b17cb1db9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a789ffdf-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685376768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376768, "uuid": "cccd106a-305a-42d2-ab2b-b9f344535eca", "comment": "Malware payload (Gafgyt)", "value": "3f3a490f4d6a9bf22fa8c680c62de821", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376768, "uuid": "d31ff823-e327-43c6-bea5-ddaa8515c222", "comment": "Malware payload (Gafgyt)", "value": "b0ca062d56e32d1067f59d4fd6bb74e1bcde16b3e88414b14a66d8e591725303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376768, "uuid": "3fb881a6-76a9-4915-8692-fde9f46db926", "comment": "Malware payload (Gafgyt)", "value": "7fe6855088428239d896b72423f33069d3a2cc23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376768, "uuid": "d20b8083-ab7e-47b6-8d80-545fb94055f3", "comment": "Malware payload (Gafgyt)", "value": "fbd9ed42b255611cf67487d56c274f28472e04fbbf5c530a926e7eb15bd968c90d768949f4d3943da4b0c6156d20cf9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376768, "uuid": "bcb6b2c6-2783-4557-8571-05cfc4f6e8bc", "value": "T110A34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376768, "uuid": "00261cac-9501-4f3b-81e1-671477a0db6e", "value": "3072:YWCjQrLpnr85EdT9Oa8vqbVr7T/CEgmqAgcVyZIcBI:Yf5EdTbpr7TWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376768, "uuid": "fc266946-1b08-414c-8a40-72fb8e3e735b", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376768, "uuid": "4e5684b5-9e97-4f3f-a96c-f5a70a6746be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376768, "uuid": "5389b320-395f-4f8c-8084-8f5fcba8c083", "value": "3f3a490f4d6a9bf22fa8c680c62de821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab8554a-fdc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1685324912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324912, "uuid": "9e4037bc-0bd0-4187-99c1-ff0ece78e938", "comment": "Malware payload (LaplasClipper)", "value": "4eee6a99eb6e64650469196952f9f9fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324912, "uuid": "0699612a-f24c-4cf5-82d4-71f7dacd35f7", "comment": "Malware payload (LaplasClipper)", "value": "b17670d28e2cc95784b4bb1ad7a8b3eae5e69b27896f7b755f8e7550f767e116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324912, "uuid": "56be2ba4-a0cf-43f0-b92e-279cf6c7ddc9", "comment": "Malware payload (LaplasClipper)", "value": "f526aa5b0e48790473f9da6e4dbdfe874158b149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324912, "uuid": "11b4c9fd-120d-4160-a756-3bea00add863", "comment": "Malware payload (LaplasClipper)", "value": "aad3e44e0f4702d235b326a3b3cd4093998cfb6a9f3f20a1af1eb24057abc817c72029db54186a4087b034063aa96c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324912, "uuid": "8bc60769-9ff1-4f67-817c-024f6d49b84c", "value": "T10D3633E3FBE87181FC1A92FC9C8AD93C2B9D9C490170DFDD1418A7AE1179600D82B6B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324912, "uuid": "38786c15-c95e-4064-b0f3-b94b00f413f8", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324912, "uuid": "f5bd8b18-f2ce-44df-8ff9-12d2695ee0a6", "value": "98304:JPoB48l+avKBBXXO9G4/YZHEIkfhsg11omqL2b8UnuaAkLcWO2yb7Mw5R:JQZl+aC3XX54/+Heig11IBAZAkBO2O7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685324912, "uuid": "709a75b1-8aec-4d56-bbdf-05d0efb49f3a", "value": 4919296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685324912, "uuid": "e931fdbe-94ba-4a32-8669-192156dd7236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324912, "uuid": "1769c76d-99d2-45a3-8204-ecb09e01b2bc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492620d0-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Nitol)", "timestamp": 1685348692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348692, "uuid": "4d103ebd-51ef-46c6-af48-16df766753d4", "comment": "Malware payload (Nitol)", "value": "8743c3ae51102822d1b9f23a9340a22b", "object_relation": "md5", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348692, "uuid": "bb60969e-f184-4654-b454-8f82a21884b8", "comment": "Malware payload (Nitol)", "value": "b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007", "object_relation": "sha256", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348692, "uuid": "dfee8cde-e0fc-43d6-aa1e-b0efe63db199", "comment": "Malware payload (Nitol)", "value": "6ab86675bffdfa441706f72406cfaa67c8b2fb53", "object_relation": "sha1", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348692, "uuid": "e7a1dc19-c321-48af-97cd-f3235f6fca67", "comment": "Malware payload (Nitol)", "value": "49d95dfea141669cf42580f45880fc9e04d61b58fd0414e16a371335a6c69171e3b1f43ee9ddfba07e32702a23d0efbc", "object_relation": "sha3-384", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348692, "uuid": "f10c89f0-862c-41bd-8043-293d0a51708b", "value": "T160F5BF29FF5968F9E416037A6974663D7F5AFE71AA3E041B20813B2B2C70243152FC97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348692, "uuid": "1137f805-23c7-490b-a0ad-c7998fb27422", "value": "61c15265856de3815ca705df0a21cae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348692, "uuid": "b5031804-27a8-41ee-b5f0-41c01e2d449c", "value": "98304:neO0TPRHtdCuUyxIkzKw1kdVlOZFLOAkGkzdnEVomFHKnPr:nCRTgw1kdViFLOyomFHKnPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348692, "uuid": "22ba981d-f33c-40de-835b-5c02b43e8e88", "value": 3469824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348692, "uuid": "375e3474-2d75-4d12-93e7-46f23828f36b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348692, "uuid": "75d27857-1957-47e4-965d-3a9675ee05ce", "value": "07754899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e41b84-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685348529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348529, "uuid": "3833372f-4d7e-4bda-ae00-61f3155d3eaa", "comment": "Malware payload", "value": "594a86d0fa8711e48066b1852ad13ac6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348529, "uuid": "2b56d6d2-192d-43a5-8af0-e4818b6cbbfb", "comment": "Malware payload", "value": "b49d777b48ec591859c9374a2a707b179cb3770b54d9dc03b5c7f3ae2f06b360", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348529, "uuid": "8de1cab1-0368-4b57-9bd7-89e6ba41807b", "comment": "Malware payload", "value": "35b840640e6a3c53a6ba0c6efa1a19a061f5c104", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348529, "uuid": "90c1353f-e44c-467b-b2af-4816e064f009", "comment": "Malware payload", "value": "148c3bb29cbc75a46fd674fecf6aa1945d664707685e5efa9d20f707281400438037ca3d73206a46aa61f17d05b9b1f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348529, "uuid": "4ca6cfa9-2e70-4612-a7e2-cbff0e25a065", "value": "T165416E202EE50725F3B38A3998FAB311D9777C05DE018B8E009243851465611F9A5F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348529, "uuid": "983cbfa9-5716-4002-8162-d9d48cdf4ae2", "value": "24:8s/BHYVKVWba+/CWnC7hHes+cTLdd79dsHhGO:845aO7hHes+8dJ9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348529, "uuid": "edfd8978-b7e7-4dae-a3fe-fa10e1757171", "value": 2114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348529, "uuid": "f40ebed2-56aa-478f-8f19-650b28a5315c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348529, "uuid": "b94cd42f-8d92-4944-86cd-2a27a0ca1629", "value": "04451999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828df03a-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1685391309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391309, "uuid": "654fcf67-9719-4ac8-8eb0-426fce32c8ae", "comment": "Malware payload (LaplasClipper)", "value": "075dda551c4b08c6990a66c6a8a321ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391309, "uuid": "626d0e2b-6b85-4947-bdbe-cf1536260f6d", "comment": "Malware payload (LaplasClipper)", "value": "b78a994b62bd9915e90e163aefb4b0a136a5120147867984d4ea2e278856fd34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391309, "uuid": "f0e3eece-5a03-4be4-adcf-b3109224d566", "comment": "Malware payload (LaplasClipper)", "value": "96584e94127ee8a34cc9a6aeabcf9900d7d756e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391309, "uuid": "6beb9c33-e743-446c-a62a-72bcc8b23754", "comment": "Malware payload (LaplasClipper)", "value": "5d722f577eb0c8bb693cb68e677493d51002d44e8bfe02f788630c8f16109a474d71a494f49f9ab0321d0c5e10150c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391309, "uuid": "1c70cf6c-f0a0-4c56-9ebd-f2ad284fc56f", "value": "T1F0E38E1DA79CED21D76C297E8181802C43F8D9D5A613EB1BADC873DD2DB3BE18509A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391309, "uuid": "13eb6268-c0ab-47d2-9c78-c9ac0c3a4655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391309, "uuid": "3f931ee0-3b05-4916-b9da-39e8b777ef88", "value": "3072:dhmpd790ZYtYNELivndRvHKusvoh9Ept5DQz0Um022227UxUX2Uj2K2000U2U2Ur:d0pJwE+jvH0oIprDE0Um022227UxUX2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391309, "uuid": "2d99713c-22bc-4e19-8f4d-4b406c1c08c5", "value": 154120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391309, "uuid": "964ba100-64d7-465c-ad49-adff9e49d68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391309, "uuid": "60e9476f-3d1f-4e35-977a-e3ae75913bc7", "value": "075dda551c4b08c6990a66c6a8a321ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158a86b0-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365356, "uuid": "7fed8afe-ed3c-48d1-8859-1b6e87166620", "comment": "Malware payload (Mirai)", "value": "bc3722003326397f26b60de9515403a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365356, "uuid": "f0b7f5e5-9c32-4b84-bde5-11645cbfe52e", "comment": "Malware payload (Mirai)", "value": "b87214300145b5a96483cc9dac249395d72195dda7010e668bdbe5642bae4385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365356, "uuid": "4bad73a3-67f8-4bc9-a887-8edc215ed766", "comment": "Malware payload (Mirai)", "value": "912dad20ba7ee6db32f74824e58c59d2ddd51528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365356, "uuid": "03f547f2-1acb-4dd3-9b78-fcfcf04b29a8", "comment": "Malware payload (Mirai)", "value": "f03e340b528530e456575f7c5263c74a995dad98a08898f775043d42521419c3521c2fc88cbae2e5183170815a8a2438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365356, "uuid": "bf20a7de-9f49-49f5-8a28-c69896346508", "value": "T130D319076FA00EFBD85FCF3702D6866114CEE86623913B367138DE687B4758A5AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365356, "uuid": "add6fc99-0352-4f70-84d4-7b62ed7ce3c5", "value": "1536:domHwDYHUlNabbdyNYSA0FY4RFV8WQBt+EGTPC6DPLMyZ4my1BiwhpnB:doCacSr3dV9QvxKTMvmMBiwhpnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365356, "uuid": "69f4798d-8df3-4a7a-8821-dc281ca7b844", "value": 130862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365356, "uuid": "566d0704-9520-4ee9-b82a-d7ca6f8bd5af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365356, "uuid": "f1700dad-e73f-4195-851e-713b185a519e", "value": "bc3722003326397f26b60de9515403a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef297db-fe0a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Covenant)", "timestamp": 1685355708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355708, "uuid": "b8407795-b2c5-4c3f-b083-c379f03ebde7", "comment": "Malware payload (Covenant)", "value": "807e6dce48c56f1d0e3786249c813883", "object_relation": "md5", "Tag": [ { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355708, "uuid": "0a8400a3-ced2-4e82-9b1e-0135fef36421", "comment": "Malware payload (Covenant)", "value": "b95781c20c5a77c56384ae5f239aff908709dd4502437801d880f7702e2da862", "object_relation": "sha256", "Tag": [ { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355708, "uuid": "ba8b8de7-1647-4908-94d1-0eb78336e5f8", "comment": "Malware payload (Covenant)", "value": "f414ac772d67c2baf39f3653de0a61b253f1f454", "object_relation": "sha1", "Tag": [ { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685355708, "uuid": "ed103f4a-9342-4c5f-8a90-803721583816", "comment": "Malware payload (Covenant)", "value": "c1e0f3138fc78bdc82ed0807df4bf91a5b192d30c3e9d4e1d61ff0f72c68e39b5212b009a15b84d4c12818484540a84b", "object_relation": "sha3-384", "Tag": [ { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355708, "uuid": "52e9993e-6acb-4555-8814-17fac156e381", "value": "T12732D81A36D8CE96D27EDA382CE3416841BB964F5011DACF2ECB958F1F73B805911F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355708, "uuid": "a3558d90-5313-4f34-a9e9-79e76b1b9761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355708, "uuid": "8d910d29-8d75-42a2-925d-84ad31d0b31c", "value": "192:WCCewMqaNN82yxXfdlumhiCp7ue8Xaxb9Hms2Z0L2fEWiasqiNW0R/4:PCeNi3dhWe8XaxbFh2PHi3W4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685355708, "uuid": "f89419e7-d37a-4d62-b99d-1c9c12433813", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685355708, "uuid": "b7f3825d-ef8b-43ee-b4fb-5f126b2049d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685355708, "uuid": "e59e017a-7ac8-40d1-9e88-c387629d1243", "value": "grunt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389f241b-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346947, "uuid": "43459df1-cd43-4472-8dfb-38c09d3e7470", "comment": "Malware payload (RedLineStealer)", "value": "f7833f8b8b7893f49bbece991df42e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346947, "uuid": "0e1900f2-3ca1-407a-9fc8-a6e4472d1587", "comment": "Malware payload (RedLineStealer)", "value": "ba4520cd547ed12862cfbc53b27ba746de75b708554df831106284310db98c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346947, "uuid": "ed8571a4-1a85-42a4-a00d-f6d37b980819", "comment": "Malware payload (RedLineStealer)", "value": "866bcd07126ed0d4700b07de04880cac67ee8ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346947, "uuid": "e5d43b95-fc1a-40a8-b228-0927cb06e7b8", "comment": "Malware payload (RedLineStealer)", "value": "5e2389a3c88bcd94ed3111d520ffed23423e55aa707abf09c63f8f9b472b6b02de4c3539d11e4b7ce39e385cb95f6fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346947, "uuid": "ea0c19f3-88ad-46fd-9f1b-1b5990d91fe2", "value": "T1FB0522466BE89473EDF417B0A8F342470335BD228C74439B3784AD4A5EB26E4A53536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346947, "uuid": "fe69cbe5-37d6-45a6-84ec-260ca67ffb39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346947, "uuid": "9db92f1c-f1fe-4cb4-8913-a86e739e0df7", "value": "24576:5yfUDWwOrOJBctXWm6yA8OOpbbLDeYnr6USEUCD:su7ctX8yFvpbKYnr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346947, "uuid": "35c9b644-cf9f-41f4-9277-2a6b0d4d4bc6", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346947, "uuid": "ddc7518c-c0f3-4583-b901-1b5304b6b527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346947, "uuid": "13d90b7b-4f5a-4480-b516-bd0cbd9c1b70", "value": "f7833f8b8b7893f49bbece991df42e1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6820addd-fdc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685325552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325552, "uuid": "b60b7240-36ef-49d8-8784-3e35968f1d78", "comment": "Malware payload (TeamBot)", "value": "a2083b71588da5b0e181d5a91a7e5136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325552, "uuid": "74d0d15c-85aa-4c83-b367-7dd7e42e334f", "comment": "Malware payload (TeamBot)", "value": "baaf76a5d567125252c32a834369f3658341d8224c4a058275c6760c43d7545b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325552, "uuid": "46acd921-7d99-4560-b54a-cbfee9c96a28", "comment": "Malware payload (TeamBot)", "value": "4fed907e379e18d51f8b2c31a8ccc6c1f84b7239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325552, "uuid": "e8597570-7688-4a70-957a-3695f37caaf9", "comment": "Malware payload (TeamBot)", "value": "f18dc4745424df73b8ef63290a5175addd761f39cbadc90fb509ac60d6e6ee9f59c0736f42794f85da9f418a29e974a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325552, "uuid": "e26459cb-ca04-479c-bcd0-5518cdbb1ba6", "value": "T1F0F4D05392E13D50E9268B329F2FC7F87A1DF6504E497BA922195E1F06B03B2E273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325552, "uuid": "ff6f3408-63e2-489c-a262-d5fba39d5d36", "value": "65c93b10b21b6000b67df4ef3ebe15bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325552, "uuid": "ed8ca977-dbc0-47d8-a69c-d24e9232e1ce", "value": "12288:mJMVxqjTIJdbGDbIdIbWCRCmk0/tB+hn/k8hgN5bRJRi3NRk:mJMrdBGA+bWunr8s8eP1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325552, "uuid": "8495e1ae-43df-42be-8a84-cf1e0979344f", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325552, "uuid": "15768cd8-58f7-4671-9b5e-441e974c852c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325552, "uuid": "470cc193-4363-4a74-8c1b-884fc6aa0342", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc26d813-fe37-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685375085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375085, "uuid": "a40a3223-ac2a-42f0-a20d-3562e704fa07", "comment": "Malware payload (AveMariaRAT)", "value": "7d310b60e4d718586a4ab5204bb5d911", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375085, "uuid": "c5b98851-6cac-4fda-8dd5-94b8f660d8ed", "comment": "Malware payload (AveMariaRAT)", "value": "bacce527c834b5fd91baa48334910a8e050d7d2860425909834dae789a3bb183", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375085, "uuid": "f7102c2a-4758-4a85-96ad-3b024c3743f1", "comment": "Malware payload (AveMariaRAT)", "value": "8491f726cb1eb0d56d0d56f8c93e563420cebd8f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685375085, "uuid": "e48bef5a-2a6f-40b0-b47c-70ed75f9b4cf", "comment": "Malware payload (AveMariaRAT)", "value": "fa4c0f3fec30635a3d0ce472fdf863ca2bd7a71b7a1eb6f0d216030b55aecc7385b55d06c6f471a401c46e9501dcb35f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375085, "uuid": "0be567ff-df84-4119-9843-5ab0430c6ae9", "value": "T15F930B8163F85B13E6B92BF10C7514241BF27E9A6C75E3180DA178FB3A65F448B60B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375085, "uuid": "f1cf96cb-a440-4fa2-854a-8d73721504e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375085, "uuid": "f91b01b3-6015-49fc-9c4e-9af8318c756c", "value": "768:Uc9Sqbc1z+naQ2yzLMCXiDgiCRjZ55ZySYmFYTGtKOgm8Jr+XXdPQYF9bWToVcOy:tSqAmXiDgvYmuTCzWrQnJthYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685375085, "uuid": "b0380b68-d05e-4765-8a4c-8ff9286e2536", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685375085, "uuid": "625dcccd-a133-478e-add7-8b59ab40d785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685375085, "uuid": "09cf5171-65b7-4f59-bc54-78b14129d359", "value": "rBillofLading05-25-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e499d73d-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371287, "uuid": "1ecbe2e0-6375-464e-b48d-c64d0dd0c902", "comment": "Malware payload (Mirai)", "value": "ffc1f6b85a19797aa5523ad892a4c289", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371287, "uuid": "f0829bcc-57eb-4162-9a3a-73a46794dc30", "comment": "Malware payload (Mirai)", "value": "bbecf0075a3928ac90e836530e10b49ed46f6bd50ec193c0040a14f9c1764c3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371287, "uuid": "7547b968-052b-44df-9d59-db6c094c599c", "comment": "Malware payload (Mirai)", "value": "265deee6e1e6f12bada30370944dd21c964a80ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371287, "uuid": "678be305-45cd-4cc6-ac00-1760915be9c3", "comment": "Malware payload (Mirai)", "value": "ac3bc6976689072dbc061a05908f9f025ffb2a217557b45d1b29075c43344cc1f1b485f32557ecd9ada44f0e61eda4d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371287, "uuid": "bfa82c9d-68c7-4cc7-ac85-0c40413f2c7e", "value": "T102E34B13B6240F5BF8D20EB4242F17A053BFF99025F1B685699F8B2A4A35D372446ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371287, "uuid": "91a45e2e-8a94-48d9-9cc2-7532ddba841a", "value": "1536:9Rhc7AzFMtRcsM7TPe+KLgDg8jVVP0rqAQJZcI3clbqzIAZU0HCmWJEVaKIS:PhoLrR8jVVgc9MIzIiUL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371287, "uuid": "e9453e7c-23c5-4e0d-9df4-de3dab6d763a", "value": 149556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371287, "uuid": "9f451425-60f7-4209-b5f6-71fbd80c5220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371287, "uuid": "7d678b7c-d72a-4f95-a859-03d7f47c440d", "value": "ffc1f6b85a19797aa5523ad892a4c289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3ad6ed-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685354016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354016, "uuid": "826be1ed-77d8-4f5d-a9c6-19402a690596", "comment": "Malware payload (Formbook)", "value": "ce1c55a5196da204d9f949b097e67060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354016, "uuid": "7851dfbc-9479-41da-9742-0720ffec8aea", "comment": "Malware payload (Formbook)", "value": "bca5d8c8e6b1abbf2f9ed462fda3dc22c4f3b37ef2bd6f2bd6772c00fe7dc1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354016, "uuid": "8b48a48f-9f60-4e5d-9c8d-542020e21a25", "comment": "Malware payload (Formbook)", "value": "bee3d05da7b8913368f16f34306dbfbd1bf4fab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354016, "uuid": "7cb6ab3c-c3bd-42d7-be38-ac15524cee12", "comment": "Malware payload (Formbook)", "value": "7efcab47a15f02680fd3218f1b3e59778aa4a8f133aea6448302ed9172479667b3d3dd472842848cee9bb7f5a17bb604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354016, "uuid": "e2d49f8d-0fd1-4d7b-83c3-c5b663466089", "value": "T10BE4116536793F56D47AC3F988303A7493FBBA6A7032E34A1DE7E0CA7664F044640987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354016, "uuid": "62dcb507-0e91-40cc-8093-b093d2de1f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354016, "uuid": "ca47679d-ca41-43cb-9ff2-c0ab5fa15bc5", "value": "12288:V0hmzZBEP85JpsN74ypvfv3jVTGEbaZwqje4Arb++mZfFGB1v:D9BEP8jmN7tHPRT1beP1Ar23GB1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354016, "uuid": "ba9b91bf-9641-431c-abb4-e31d44151f9c", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354016, "uuid": "9e86e513-2727-4ade-a72d-a4eca570bf39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354016, "uuid": "d4a30917-a220-433d-a521-2861c3890bf9", "value": "LIST OF PRODUCTS FOR QUOTATION#00052523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2c9e7f-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363411, "uuid": "49d47339-84f3-493d-a239-ae4948162b29", "comment": "Malware payload", "value": "142b694156e9e48747a888caf006262a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363411, "uuid": "5e08ba8e-4cdc-4fbf-af5b-c92aa07ca0d2", "comment": "Malware payload", "value": "bd75c9a48a56db435466368f45031d5dfe6e8ea4d6ae84604b8b94709e64ac80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363411, "uuid": "13c9cb92-ca83-456c-bc50-1a83c57e9b47", "comment": "Malware payload", "value": "d9009ad6e1f4d0531077495f6cf411696c7d70ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363411, "uuid": "f8a245e6-a0e9-476b-a470-0ecf52ac2ece", "comment": "Malware payload", "value": "9d62fc362ada9f9d9378b64a5572c406f170da9ec739a9345d5d53231da8b3a82b74ede459128c1a98eaa6b1b2cc5662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363411, "uuid": "224e7084-73f7-4f4d-aa56-0c2a4fdd3314", "value": "T1ED540283E1E18878C061EFB42D6AE156BE337D562D74792832DC89CE1F27950944F3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363411, "uuid": "dad3d630-36e0-42fc-b775-fc3cc2ef1665", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363411, "uuid": "b058d436-dde2-4827-a304-99a6ae6137a0", "value": "6144:r/2Uwg+sVjxzEFykCWuJnYZL9y39S8neivDHhTF+lLoLm82:z2Ut+sVFz1RY7ytS8eijhTF+UmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363411, "uuid": "babd9e98-e725-41d1-8dd4-72c7c87c0f9d", "value": 300553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363411, "uuid": "6e6e0e21-9856-47bb-aabc-bec6220e8a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363411, "uuid": "db258cf7-25ac-498a-9534-bbd5caf6b0db", "value": "SecuriteInfo.com.Trojan-Dropper.Agent.15960.3798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183c9adb-fe0d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Generic)", "timestamp": 1685356771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685356771, "uuid": "fa3b860b-7af5-44b5-a35a-9ebe7e506c3c", "comment": "Malware payload (Adware.Generic)", "value": "2454278357cf4eb1f38b2a04c8cf46c7", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685356771, "uuid": "4ad3e604-bfec-4669-a220-6214921a5f5b", "comment": "Malware payload (Adware.Generic)", "value": "bdcdf7a0404f6bee2d17a4f967c0f477a1a6736fdd3a2356a64a3bb0660e8b50", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685356771, "uuid": "2c0c55c6-be17-49be-858d-76b08234b308", "comment": "Malware payload (Adware.Generic)", "value": "b387c998364ea79af62c450f50bfaf078092b8bd", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685356771, "uuid": "5d7e2c3f-3f3f-4461-a309-448308122191", "comment": "Malware payload (Adware.Generic)", "value": "a9e2a28a7733afbfeb8ef540fec9ec133fc546333115b58eaa41500c066e6847fa301ed5b00790f2a0bf49a4d2189f9d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685356771, "uuid": "ba538800-6750-41fc-aee1-d2dbfb07c26a", "value": "T1EF75BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685356771, "uuid": "03b44220-6739-469f-8634-f3536e1aa6cc", "value": "24576:M7FUDowAyrTVE3U5F/3nKic6QL3E2vVsjECUAQT45deRV9RW:MBuZrEUTKIy029s4C1eH9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685356771, "uuid": "03120023-423c-4177-84a9-a9cd67eb8268", "value": 1673322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685356771, "uuid": "9b65ecc6-457e-4c3d-abd3-a48c62bcc4d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685356771, "uuid": "aeb2ced6-ef3c-46cf-a22f-f835fc16f546", "value": "24542783_bdcdf7a0404f6bee2d17a4f967c0f477a1a6736fdd3a2356a64a3bb0660e8b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4412787c-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685353838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353838, "uuid": "c0b2a940-ab2a-4847-8a2a-bb1493c10125", "comment": "Malware payload", "value": "c5bf2655401abea43725fc8a6f937a09", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353838, "uuid": "d0055860-3236-433f-93c2-3396315078bb", "comment": "Malware payload", "value": "beda64eddc6af62587cdce4cc8eff3d9db773c3be94d85bad1fcdb8afd5b29ba", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353838, "uuid": "8e366057-0545-4b7a-afae-fa734d61aaa0", "comment": "Malware payload", "value": "5371bafb0ff0f25df85e6926ba6c9d05a0f53272", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685353838, "uuid": "3a08a0d0-8931-489b-a936-3e443df33ecb", "comment": "Malware payload", "value": "9979dcb2583bf5b4b37dd7a680a810a9e03100db97f7b156a29dd7975770fdaba695be178eda2038d4d2cf21f772862c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353838, "uuid": "93cdb6ee-df9c-4885-9bf2-f2622a320033", "value": "T155765B8B72D512ECE0DD0F331351829053E9A5363BA45EFE4A208714A57B5B422EE7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353838, "uuid": "3b6fdd22-7442-4a18-aa99-683a6957c201", "value": "fe63e322309337ee09a198afe547e82e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353838, "uuid": "b1f0f40f-4f62-48de-b9c9-ed75057c1652", "value": "98304:5TRyGg0UuY3YEZjv3iRv0rGMmeMn6dL5SjTYTRm9T3y4jKswqh2WmtPb:59yYwYEHGMI6dQjT8RM3y4eWhjmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685353838, "uuid": "fd43efa5-09ee-4ea8-b82b-2dc172a966a1", "value": 7391232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685353838, "uuid": "b6c0e72f-8b37-4526-8e62-f8fb071e6b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685353838, "uuid": "ce391b1c-cdcd-4404-9c8c-afa1f063ce39", "value": "c5bf2655401abea43725fc8a6f937a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7661ef20-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377115, "uuid": "5a068da8-6c85-4374-9bdf-17517818dee9", "comment": "Malware payload (Mirai)", "value": "980dbf1d392af3c013888651ff5aee0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377115, "uuid": "4d9e4331-7748-478e-86da-f40b56128930", "comment": "Malware payload (Mirai)", "value": "bf864075fd9d9e76c5a2db8d0c867c0b1e331daff997f061c6fd19787df90acc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377115, "uuid": "22127e75-fc86-4022-8b5c-8725a9051cd2", "comment": "Malware payload (Mirai)", "value": "2651b486b27037244c48a88ceb0ff1c46083d41c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377115, "uuid": "717f372b-4c4d-4522-b467-276b25cc0a81", "comment": "Malware payload (Mirai)", "value": "b4b094305117cce744eb69449805be46612f0e32810adf536d71f0fc1f2ed88792cccf8a14430816f81dec02f933a3ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377115, "uuid": "3ae004e8-c542-492d-855f-4a0ea015d66a", "value": "T1EA93B51A7E258FBCF79D823547B78E22965837C62AF1C141E19CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377115, "uuid": "6176e4ca-1d8d-488c-a7c5-8ab469ef6ee1", "value": "1536:AKzqmzfphPukFhyxCXgHI/eFLFH/Dh1THZjvEY2QPU4:AKqYhuezWI/eFRHN1THZjvEzIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377115, "uuid": "b3e99b81-453b-4e2a-9db3-1949f0622637", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377115, "uuid": "18be8339-cf6c-46cd-9229-794f17f37d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377115, "uuid": "e2a5f211-ede5-4933-bde0-06116f527032", "value": "980dbf1d392af3c013888651ff5aee0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aa8ca4-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363419, "uuid": "ac4eda59-d8cb-4a0f-9597-540d6cd80cb9", "comment": "Malware payload", "value": "3edec1d8ac7797c849aa3998522449dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363419, "uuid": "0c1dc3ac-517c-4495-a6e9-0f1ad91a19ab", "comment": "Malware payload", "value": "c04c9af44ac55ad0ac68316661ee1bdf105444ce06389db25c4b8ed56ac3a807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363419, "uuid": "77d03c11-68b1-466e-ac07-25a4bb75a5a5", "comment": "Malware payload", "value": "82d4d5498b1802c9828dd9e6ce5dee65070188cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363419, "uuid": "8d12150e-fad4-48bb-bb80-91e55a1c701c", "comment": "Malware payload", "value": "2af9024875094978c30047749cd6c92352ac5541b56daca0145edcd54db854d76bfe62cdeeafd5fe488a6d692c7b1b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363419, "uuid": "ba20dd9e-8a59-46f9-a101-6a9af249af77", "value": "T125452325026C983BED53AB749D96B42D957A79A8A43134B930CC0BCDFF3F1E29907316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363419, "uuid": "7a01ee4b-114a-439d-8a1c-5b28df278946", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363419, "uuid": "ddf9fbc5-2639-44c4-9c93-ce90a263e36d", "value": "24576:v2U+Z7yWesL3VCBuUjxrOQqX6LsI4o2DgOpTipiJwZ8YaXag:v2XGC3ABum1p/74o2BpiY6aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363419, "uuid": "681afe48-2280-473f-b489-5b2b41cd4dbb", "value": 1218471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363419, "uuid": "c6cc7b63-7acc-45d2-99dc-e7ca483c1726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363419, "uuid": "7fc1f8cf-63d6-4954-bbcd-07c1cca070d3", "value": "SecuriteInfo.com.W32.Injector.CLDS.tr.16742.18565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ea1ec7-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363396, "uuid": "f855ea09-bd67-4d44-89cc-ac1c22fa5c7b", "comment": "Malware payload", "value": "3569d4699479667b63cd2ecc799eca45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363396, "uuid": "25b89163-3587-4364-9d8a-c216f43db27e", "comment": "Malware payload", "value": "c1c5398e825fdc2fffe1128c9fdffa5e37fb3ea3cdce24eb0696f0446457da10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363396, "uuid": "f10c5f4f-7374-40e5-9736-df1c3e91c99c", "comment": "Malware payload", "value": "686d2f88ee04d96acb470d4a01b78dea9c33bc3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363396, "uuid": "2c80c7f4-6e30-4619-9de2-a2c909819cd2", "comment": "Malware payload", "value": "16cc6f5113fe76439d3090d52a8178940b9543b549342b4fa8add31d92f2bed128c67a6f926ec25fff57ebc2565b2630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363396, "uuid": "25f49f47-0b4d-4562-ac9f-4d572488beb9", "value": "T1F5A35B57B53CE0D1F4861630EC5295F98282FE36DD689F2F38A0BF5E347A1D62826D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363396, "uuid": "2a7b2786-b7dd-4048-a750-d67e9cae16a5", "value": "6873d060ba22d3087a435a12c7e388d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363396, "uuid": "8854ac2d-005c-4842-b634-7234bb14559c", "value": "768:neMgpG+md/DgtGExXcGlCeMgpG+md/DgtGEt3zy2mtDgtGE4mdgG5gNw:z9+gDgdsD9+gDgJjtmtDg0I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363396, "uuid": "a4d51312-0e65-4024-adc0-0ffa295173a1", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363396, "uuid": "7e67aaa5-5d9e-43a9-b77e-064238b940fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363396, "uuid": "06592f03-7cad-4e33-baeb-7369814a0f14", "value": "SecuriteInfo.com.BScope.Trojan.VBKrypt.29825.12395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb1ffb5-fe46-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685381531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381531, "uuid": "1a8c1bab-41b1-407a-a118-ea09d8f8b759", "comment": "Malware payload", "value": "07b0f47e2c9fadf6bb742405b1fa712c", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381531, "uuid": "95547433-d01a-4496-b6bb-bc39158ed0fa", "comment": "Malware payload", "value": "c32974b865152c6ca3c5f0cc787319dfc2b32ea1bebc1f37f6c36d2ca75439c8", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381531, "uuid": "14c0c249-cab1-4fbe-b299-af10e002fb9a", "comment": "Malware payload", "value": "a8a180da98881d52e61210b533c057323ce40239", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381531, "uuid": "fcd59c71-b804-4b45-a524-96f319870d55", "comment": "Malware payload", "value": "70e607ab93fa6fe800edb2913c9e894110c81140b6c46234c7eec86b386b58a805a5fb61b322bab4be0df06148e2751e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381531, "uuid": "983937cc-c8df-4425-8cfd-9459b0dc9410", "value": "T188924BF72F2091DC29CFCE87BF196E9D6D0EB4BBA6FB9485927D8518C486884E215C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381531, "uuid": "b6c58af3-703e-436f-908d-675e5e93bbe5", "value": "384:gNLREyvneA/D+Yj2G4BI3XmFQWW79Qc9Pz8UHmxQpVoz8UHmxQpVuz8UHmxQpV7i:gklA/Pj206M9rN8UHHzU8UHHza8UHHz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685381531, "uuid": "157e784c-3f94-4f16-8452-403e0d070806", "value": 19983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685381531, "uuid": "67d94a2b-60e0-4e0a-b931-cdab82fd4841", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381531, "uuid": "5981feea-788d-4adf-a088-d545ecd25ab9", "value": "\u0430\u043a\u0442_\u0437\u0432\u0456\u0440\u043a\u0438_\u0442\u0430_\u0440\u0430\u0445\u0443\u043d\u043a\u0438.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1ce9d1-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685348748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348748, "uuid": "c3cdc3e9-aef4-4681-8d77-84091a702c2c", "comment": "Malware payload (AgentTesla)", "value": "b8d9f8d65c19f6cbe0ec043200f9e377", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348748, "uuid": "dffbc52d-7771-4376-a199-6a4dff8c447c", "comment": "Malware payload (AgentTesla)", "value": "c4647cb1eacba6281228502443db52aaba6397267164221359cb57cabf55c10f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348748, "uuid": "bce49510-3b75-4cdc-976c-9fda0072d36f", "comment": "Malware payload (AgentTesla)", "value": "0b83cb4b67e4af47636b6b25d8286a330cba3e87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348748, "uuid": "2352ceb1-1eef-422b-8d5a-589a4a79839d", "comment": "Malware payload (AgentTesla)", "value": "6132273febf5bb728e0daf1fa1702bf4aaf063feed2b9167e46c492c2a016b2553b0bbed3f1485b75c3fdd47cc0f9082", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348748, "uuid": "4e603f18-b85e-4204-8d48-d26e9f5e94a2", "value": "T1F1F31917BF008656E8580F3048F78B962A61FD446F524A0B3219F72DFDF17E49E2AAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348748, "uuid": "93ecf76f-8fbf-429f-8c86-46d5dedce07a", "value": "3072:5fZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAU9Z6AFsTye4X:ZZ+RwPONXoRjDhIcp0fDlavx+W26nAU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348748, "uuid": "c8fe1467-52de-4bfa-bbbd-b9a67b5764bd", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348748, "uuid": "d2ccd5b0-f3b1-4b99-8915-6074efef3bd5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348748, "uuid": "626e12c0-8de8-49a5-b7df-07b9df895a07", "value": "09455899.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1132f8-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379671, "uuid": "9b863821-d425-4391-bb97-512349f60218", "comment": "Malware payload (Mirai)", "value": "9ad4744d84f7d1401b42a909a22ec891", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379671, "uuid": "dfdb444e-502d-4cb4-95b8-ee41eade1c7b", "comment": "Malware payload (Mirai)", "value": "c4790d78ec7231e4b78660eef52fb5ee07967f7f4446e6084f4fabc12de1c2e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379671, "uuid": "02f77ec3-d3d3-4542-9872-c20c66961bdc", "comment": "Malware payload (Mirai)", "value": "1f6ade068021d1958cfa821178706c6439ab32c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379671, "uuid": "06caaa3d-a552-4431-803c-f1efc1c4cc6a", "comment": "Malware payload (Mirai)", "value": "0687987bf71b38f32c692c49c167c7c8f3a67e88b53c9d533001657917ebbacb1793010940e84660d674e57cdc8eab35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379671, "uuid": "95f96ad6-bff7-4a37-836d-9986f2021aa2", "value": "T1E7F3A53E7A21AF7EE168827107F39F70CF9529D326A19341E26CF6185E7128D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379671, "uuid": "c5ef0e0a-5a24-49d2-bf97-cbfa25b43399", "value": "3072:B7esBFP23rWfOB7ZOOyGCWKmrThPaLEne7rNb:1euCloGCrmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379671, "uuid": "d630b31f-02e2-4373-8b29-15edfb335cd5", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379671, "uuid": "1bec13cd-42e9-465f-98ce-8019e44fb1c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379671, "uuid": "9f3e8f06-d087-4c35-929c-2dabbca193cf", "value": "9ad4744d84f7d1401b42a909a22ec891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e15d78-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363399, "uuid": "915308cc-210c-4c82-8a6d-41ad63ea5f3f", "comment": "Malware payload", "value": "5a146939dd2499655ff430b1a4f88ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363399, "uuid": "f718ed9b-e583-44ba-a95d-7bb0d449bb5e", "comment": "Malware payload", "value": "c4b3802c333df84e2c408926281f9ea18d3b01f2a706362043298b10fa042879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363399, "uuid": "dd18df23-45f8-49f8-a9a0-27ed78e3a3ee", "comment": "Malware payload", "value": "eafc0e17b3dd3bfe2cdc6d0e90426cf7375a7568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363399, "uuid": "81e63839-6e22-46ed-956a-90a0091063f9", "comment": "Malware payload", "value": "d5aa45876d79834050677c64efa9ca04359123a3235a7d4f990670d97e849bfb1fdbce2daf7ba5390bf45b8465428c9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363399, "uuid": "41368396-4c2e-41e7-a005-da80e2740413", "value": "T1C25302CDAFF08D3AE1E05332DA68589CE61279D85197898FDA7C934CF1A3F865170A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363399, "uuid": "049129ed-fefe-45da-aafd-d48d06dab29c", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363399, "uuid": "1dce6da5-224c-4c2a-93dc-0c28491d59de", "value": "1536:fzwq/29edfZRhdzum6gS45nwezGdhpbGwumHCuEF9zQla+H+fOGHYj:8HeBru1ywKGdj8mHMXzQJHoOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363399, "uuid": "b6e7e26e-ec89-4bad-b0ab-bff0e0c55a5c", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363399, "uuid": "2497317c-a961-4a92-823b-59fa7c98898c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363399, "uuid": "a2a3f6d7-8480-45bb-894c-46c7180ef378", "value": "SecuriteInfo.com.HEUR.12917.12196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d939e46b-fe32-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685372986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372986, "uuid": "b9a66031-f7b1-4fb7-ad3a-bea9fd33cca9", "comment": "Malware payload (RedLineStealer)", "value": "b680a07a6774cb6c8e2f9ce1968f21ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372986, "uuid": "bc92b4e2-6cca-49a3-b18e-0191e2451099", "comment": "Malware payload (RedLineStealer)", "value": "c4d252efb23f087a2c2efdb8bc64b97a9976c0f85995a50e18791f4538fac454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372986, "uuid": "ec77dad4-453e-4897-be78-bbfb11a4cb2e", "comment": "Malware payload (RedLineStealer)", "value": "a6db9b015242e8e8f7be1a1fb7573d028bdd3ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372986, "uuid": "d70666df-2253-446d-b6d0-6ffe97c2c78c", "comment": "Malware payload (RedLineStealer)", "value": "94dfd86a1219538b88a53aee4625ed621dd4d7eca6646c2d7e3add644925e1ea2b7e8f85e7bf2291df906450c10d2585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372986, "uuid": "8c8deff4-e82e-4c2f-802e-8c495aa2666b", "value": "T10564EF11328DC176F457247985E4DA729DA9B8342B2F61DFBBC4076D1F213E2AA3078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372986, "uuid": "c6d263dc-1b47-4c47-b723-8ed51f6a9e0c", "value": "a723f6c3947c7a9054d33c021115e563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372986, "uuid": "9636656e-e35b-4eea-874c-eb9ed62bd1ce", "value": "6144:zM+sQ5784eP/IF0ysUw8cLa/3nCY6meOcQQxmwfrD:hsQ5g4s/IKn88afnCYjedPzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685372986, "uuid": "fe2893f8-1caa-4b6e-b6b7-69e9fd59bb1b", "value": 328952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685372986, "uuid": "8e51a7b7-9868-4fa7-bb47-66faae0910bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372986, "uuid": "136507f3-52a4-455d-842d-669e05232243", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85306725-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685348364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348364, "uuid": "114bccd2-fdce-4706-ba3a-300cedd61d1e", "comment": "Malware payload (Smoke Loader)", "value": "5f1d3cbf74ef96295c45dbd1e3681728", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348364, "uuid": "a4efb466-1e67-4aa4-bad9-6c2d099cb726", "comment": "Malware payload (Smoke Loader)", "value": "c59f124751c86d7bc758592d7a38727b02a041a56928c2a523fddea2bf69c728", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348364, "uuid": "3443e56c-98ad-405c-b5f9-454791c18bf2", "comment": "Malware payload (Smoke Loader)", "value": "021fadff7fac2ebbd8217d8bcbad10aabafd7b0d", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348364, "uuid": "577a1cbb-4a71-49cf-b1e2-2a012020612f", "comment": "Malware payload (Smoke Loader)", "value": "4c93f5aba2755da6c8ae383d065c3d0b11d2408df696423f121ef52681a8de33134a2e43a007c5f4ae963f72b8532f5a", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348364, "uuid": "49e57c61-0dbf-4082-b96c-d420a3d2c834", "value": "T11E642A03A2927C55FA264E719E2EC6E8771EF5504F5A77AB1338EA2F04712E2C172331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348364, "uuid": "6df1ed9e-26a3-4de7-b7d9-337e41904cb8", "value": "1552eebb89b3841e6a330c0c93657732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348364, "uuid": "67f1da7e-09f1-43ff-9b09-48d8e6b7a5a6", "value": "6144:iepLJvcHIJ1ARF2KT/Z2acS807MNZEKxh7:ienIIDa/KHPEKxh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348364, "uuid": "8c242b13-d81b-4681-afc7-4aeccbfa90d4", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348364, "uuid": "541dda9b-f284-4f00-9af0-d6bb4e3f9667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348364, "uuid": "3972bb61-92c1-4b85-8d14-cd4191866ee5", "value": "01521099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa2917c-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362439, "uuid": "26e56b1a-c2f3-47cd-9473-e4c090454711", "comment": "Malware payload (Mirai)", "value": "e1a68b122710c4e7794c166e83baaa48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362439, "uuid": "ec3b02b4-7cb6-4af9-9f34-f4826a451660", "comment": "Malware payload (Mirai)", "value": "c5d8d8a5dab00ff9bbe22fe3ca35a61f8922c2abcdfa1475ca3dbbfec8aed50e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362439, "uuid": "ea9c6a7b-02a0-40bc-b42c-5c77d7fe071b", "comment": "Malware payload (Mirai)", "value": "6acc628198e0e4a3d31d077985ab69e79dae06a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362439, "uuid": "f226d725-13fb-4ac6-8e8b-adf7e58a9f54", "comment": "Malware payload (Mirai)", "value": "49b4ad8d5c9c76666c1772418469189c0824ffa1edf5dcf9ea97aaa26383d8af6ae7d0cc72efbfb732209f093402fbdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362439, "uuid": "6935b723-e225-433d-bef1-b071692b0a57", "value": "T162338D36C87F6DA8C5444638B82249342F63F50885A7AEFA9BC187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362439, "uuid": "ad21beb3-d3c1-41ef-bc69-361fc4511451", "value": "1536:0ndIcnkW5wtdl4ZhTZJNexd+3+4keEtCQtd42+:0nFnkW5IEreO+4ke0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362439, "uuid": "fc683dc6-097a-4619-a1d2-9ee7ee6fe10f", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362439, "uuid": "a5bc97f1-238f-4f13-a37d-18574abab97e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362439, "uuid": "0afe617a-9b48-4a8a-9b8d-dbb2eb50bb52", "value": "e1a68b122710c4e7794c166e83baaa48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bcf941-fdc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685325004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325004, "uuid": "acdbedfb-569c-4ce1-9ea2-9437ec37592b", "comment": "Malware payload (ArkeiStealer)", "value": "c34c9f6da736440609c557af44559343", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325004, "uuid": "bb407346-513c-43cd-a272-5a2336256ee1", "comment": "Malware payload (ArkeiStealer)", "value": "c649852afd98806ac7489287ef10ea4f2e0aa833a261b209ff8a20204e4465a6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325004, "uuid": "8c5d685f-5c13-4f26-b15c-ad219d2bf530", "comment": "Malware payload (ArkeiStealer)", "value": "aaf35574a48d52b7d7e5a59d9a071cb28e063ca5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685325004, "uuid": "0354f592-a5d1-421d-9412-0bd0988c788b", "comment": "Malware payload (ArkeiStealer)", "value": "3b7bb757703c2f8b68e5a06574f5aaf3107e284db84261ccd1e8f4d0826399a429a0b39b936015efcb6bc19225c53fa6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325004, "uuid": "d9726b0a-d49e-46ce-8adb-40231e9ca0aa", "value": "T18F846C4392E13D54E9669B729E2FC7F87E1EF2508E497BE912189E2F04B03B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325004, "uuid": "ea971355-4b4c-4708-bb8f-17d8c1f23f1e", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325004, "uuid": "e2fae1a7-3b6b-4995-a11b-6e54e1068186", "value": "6144:KkO3aHbHR6V6GP4fiEUTK7eoAVC8UPHoEKXFQM:LYUHYVN4ftU4EJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685325004, "uuid": "19405952-7a60-404b-9894-4261ecec269d", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685325004, "uuid": "2cb72592-c506-4f0e-a110-0db83939edca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685325004, "uuid": "50f2bf06-73b5-408c-9941-b1d1e634f3c4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefef1af-fe4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1685383223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685383223, "uuid": "8ce29bcb-3afd-418e-b4fa-9e5bdd333499", "comment": "Malware payload (XWorm)", "value": "029de17186084c62bf9a74ffc348e2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685383223, "uuid": "b6651d09-4f8b-406c-8c5d-9e976095b4f1", "comment": "Malware payload (XWorm)", "value": "c64e61aaa97d1744f8ec61dbd9ca72f3f5443bf534ee98eab39832338be39204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685383223, "uuid": "6b802e94-05db-4bd7-8ef7-a460ebc408d2", "comment": "Malware payload (XWorm)", "value": "c53ecc3cf11204d40be376889fd8b67df18a5cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685383223, "uuid": "af7496eb-9d08-4d90-b37e-59825e5eb275", "comment": "Malware payload (XWorm)", "value": "c5d03ac0d5e9293135aada8ae9dfe733d7a3321e426477a54c1a943243d31024bb7347a998b04f0c5d416525c9bbea99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685383223, "uuid": "26e8acbb-587d-4b07-975f-a55013f30e69", "value": "T189933A0773C8C769C06D37B264FB915447F0B5936472DB8AECDA42EA1E123D14E42AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685383223, "uuid": "31f728f2-1851-4f3d-8834-c82b242e195a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685383223, "uuid": "979defcd-09e5-4b29-a1aa-2b2ea472d7bd", "value": "1536:AkPDsmE5ALiM2LXXXiv3bw77X/HqZhM7uPxO:AcDfiNuk7zHqjMGxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685383223, "uuid": "045114c2-5a97-4330-90f8-09145204dffd", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685383223, "uuid": "203ee7fe-18f0-4571-8fa5-238097024d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685383223, "uuid": "a5b6960e-2017-48ad-a5c6-9a16c508997f", "value": "029de17186084c62bf9a74ffc348e2c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdb4a6a-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374017, "uuid": "90177fe2-1e38-4de7-9d42-0a22a9c0bf26", "comment": "Malware payload (Mirai)", "value": "1a86bd74d57ffc43ea76ed5731630010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374017, "uuid": "0e2d46d7-79fa-4ddd-9021-7b301e7732c0", "comment": "Malware payload (Mirai)", "value": "c7ff9eab4e6f1f3ba2c1ad24ed6bd2d261a4a556721faa8e41ba8ee207dcfd72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374017, "uuid": "8bbc4a1a-43d5-4484-bc38-54c8ce30dfb2", "comment": "Malware payload (Mirai)", "value": "eb7c608807848b7f455aba4d7f233252c7b17531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374017, "uuid": "1a70eee9-d0aa-4cee-ad97-d634dbb4b3fe", "comment": "Malware payload (Mirai)", "value": "67abdb641a803b709d82f4aff0198934e96952ccb654803256d9b3da064d5a202c2eb47444e3d4dde4fc0d889d2c18f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374017, "uuid": "55a135ef-7fe1-48a0-9ad5-f2597d612a94", "value": "T176631945BCD29A2AC6D023BABB2E519E3321B3E8D2DE3117CC105B2477CA51E5D37A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374017, "uuid": "7e89a3a5-50b6-4f9b-ae8b-f9aac1d727c4", "value": "1536:fXPJwdk7gUwccfBrT3vTTIl54wUPlGSXYZPykrWpEaEuw:fXPJwdk+tfNgAltIZacWp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374017, "uuid": "fc2cfe6a-56c8-486d-a9a3-89c662fe91e5", "value": 71992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374017, "uuid": "6633922a-b6ed-4a5a-afc0-f9e6895d4727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374017, "uuid": "91f0152f-96f5-4f45-b319-fa2d463fc972", "value": "1a86bd74d57ffc43ea76ed5731630010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce33823b-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377262, "uuid": "e153a18c-ba32-4e07-bf0c-a5c3992edc49", "comment": "Malware payload (Mirai)", "value": "a8ef71fdba94e6577bbf1079a7c45b67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377262, "uuid": "41d29037-75c5-4b37-8164-9245b561aee3", "comment": "Malware payload (Mirai)", "value": "c94bc5ae3a0811f0687bf84d0d5f2847ac13884f409b52d784a833edc45d003d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377262, "uuid": "ed2e32a8-e16c-4923-bf37-bc3b6f6da59c", "comment": "Malware payload (Mirai)", "value": "d077fffb4f815b093942e1025100c277b0337e4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377262, "uuid": "5e7f50e0-b435-4884-b6f1-eb063dbd92a4", "comment": "Malware payload (Mirai)", "value": "44945880e35dabd3897f8d8869579964a58b1aba78af54af17ae6eb2b61ce083c0c4edac007f6a5f9dc7f6162ed0a163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377262, "uuid": "5537ac6d-45c6-4cd3-bc50-494a77564b42", "value": "T111336C36E0299ED0C5560234A4AC8F751F13F1C893136EBB2AE546B26853D6CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377262, "uuid": "b0cefb80-fcf0-4d03-b4f7-636f4b695a02", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9mPhhGCZQoVjfjmCozw:Oa4U7G7SvT6ftBrPh0KVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377262, "uuid": "c50bfdb8-6803-45ae-910c-abfddcd23de9", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377262, "uuid": "c62d8add-95e2-48a2-bf1d-02f22b83d0dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377262, "uuid": "4eacdda9-37b9-4b3a-80bf-263d4af72b53", "value": "a8ef71fdba94e6577bbf1079a7c45b67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8236f9c8-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377135, "uuid": "f2bc498e-9d93-4347-a1ed-0898f37a9611", "comment": "Malware payload (Gafgyt)", "value": "9d33c77e3d34b2f1a8fde2dd830fb6be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377135, "uuid": "40e6fc02-f963-4d16-8fd2-80ece566bfbe", "comment": "Malware payload (Gafgyt)", "value": "cb7834d0959ffc969761bd76aacb603cbe45d1bef8670d3c5d4b9ce1d4fa2f70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377135, "uuid": "dc2e36be-b2cd-4469-885e-e40c91c770ab", "comment": "Malware payload (Gafgyt)", "value": "63ee9f555541a20f6c597f75a7dea5760ebd8c89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377135, "uuid": "ff4dbe50-3ca9-4b44-88f9-dd457bd03a14", "comment": "Malware payload (Gafgyt)", "value": "25cffb8771c9f9472cef8cc76b1df6885bd88f688ee884173fb4b46df282d5fcf9e5236bc5a0e6369ce5cb92a56c87fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377135, "uuid": "ce0d8e6b-ede4-49c8-9a06-708e23512d0c", "value": "T1EDB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377135, "uuid": "aaa9e81a-18ae-4884-ab52-f39d558e0fd5", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCnB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjI0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377135, "uuid": "83060408-46fe-4644-b34b-8835f1300b0e", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377135, "uuid": "7127df0d-7bad-4a48-9dd2-f373530c81b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377135, "uuid": "d5a5887f-837f-4406-a0ee-8f6c2c4e0f74", "value": "9d33c77e3d34b2f1a8fde2dd830fb6be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbae23f2-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374332, "uuid": "5b7e1975-1f85-4de5-bb93-eb47051cc1e1", "comment": "Malware payload (Mirai)", "value": "1cd5ac1f9942fce1e1ab2c4516827d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374332, "uuid": "5da46aea-b1a2-4a74-8630-7db105ff3c53", "comment": "Malware payload (Mirai)", "value": "cc88cc61b32b1c2290a8fc83b60507732aa3d86260a2e27efc854cce7321d493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374332, "uuid": "c00e5903-6ce1-49cd-bcdb-0f294d4786dd", "comment": "Malware payload (Mirai)", "value": "6b26048bc37563923dccb88380ab8130806fc539", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374332, "uuid": "dd26fccb-3662-4ed5-8262-981f0b327628", "comment": "Malware payload (Mirai)", "value": "81c401d0259c5be5c512b131b218bced244364cad9d1e424f75303ecc97acfa98eee128e4453fc819bf47ddbcd454161", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374332, "uuid": "b10ecd20-4fa6-452d-820b-f45baaeba35a", "value": "T18873AEE2C4652DA0C2684138A5E6AD381B13F50196732EF04E168BE2650FEECF55E7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374332, "uuid": "3d1fa437-2edf-4ce2-ba24-2f805dcc4361", "value": "1536:E/jnwcbjimFwJaFwtO/WlP1Y1VOCGmpJuy5o109G0NUxCS/wB:ErnwmiuwJCJu5i1QCJC109GkUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374332, "uuid": "fd1cdd84-3dda-4f72-a1e5-9dcdf14b512c", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374332, "uuid": "2d00a98a-7e52-451f-9bab-4103620409b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374332, "uuid": "19018ba2-d78b-4a9c-9cf8-c0268f4c13e9", "value": "1cd5ac1f9942fce1e1ab2c4516827d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec670b0-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363412, "uuid": "9bb48285-6f4f-44b8-ae8a-1a6f87ba94c5", "comment": "Malware payload", "value": "557d2af1b05442a8929cd7abb7939808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363412, "uuid": "50bba68c-dd41-47b9-9901-05837354983c", "comment": "Malware payload", "value": "cd7aad4f486c1629fc12f85582557c3bd34c4ffa147b29e4b8f36e7dee3be5b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363412, "uuid": "e4272e7a-f3b2-4841-bcf0-c7cf3a095d3c", "comment": "Malware payload", "value": "3b37fff6a6963686d89d60e21cb610228224325d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363412, "uuid": "777e43c8-e6a6-4a8b-80bb-b8877f40bf3c", "comment": "Malware payload", "value": "adff5551383457934997dd6c8d4cd1583aba3bafb49626681f0d80d7915d5f7570128217d4dd58ab9dfb16f80a85b00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363412, "uuid": "f373d12b-59c8-4c23-a0fa-d5ee27ae4d6f", "value": "T156829D99B310CA8AC58C05322913DAFC76653D3ADC255E177AF0170F3E32756ED12A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363412, "uuid": "0b40d1f3-0497-4035-b25c-1363788470dd", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363412, "uuid": "87c37920-165b-49f7-ba20-0fcf3369dfc1", "value": "384:B0LDTs8hsF6qtK8lzQ8+Sych3mYvCPHx7/GP:GLXVhaTtDE8VfCPHxTGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363412, "uuid": "317d62d2-5d20-49bd-9506-f3a02b04ef0f", "value": 18378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363412, "uuid": "8577e321-ca61-480d-85dc-b07c12c88ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363412, "uuid": "1954ace1-549c-4279-beb8-44c4301d91cd", "value": "SecuriteInfo.com.HEUR.24835.28293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d1c569-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371591, "uuid": "5572d096-6b7e-465b-8161-8f2df026a216", "comment": "Malware payload (Mirai)", "value": "d2d08734fa697c7e03a05e8307a0435f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371591, "uuid": "3f1aa528-6837-42b4-8a2f-42d015ba466a", "comment": "Malware payload (Mirai)", "value": "cd7ec25de399aaeaa8bb28d2be78168325c5fcd8a21c630b42b8e9b3bad158b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371591, "uuid": "824e233b-47ec-41a0-aca8-06b435a9e067", "comment": "Malware payload (Mirai)", "value": "5d21ef1fbaac25b46504e691cf07fe6912479a93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371591, "uuid": "5ae0cfb0-83ff-4b9b-8962-99bc8756c502", "comment": "Malware payload (Mirai)", "value": "525d33720a94d1d6b17725fcfbabf6c5f8cf061b01d5cfd859fc545735dee80efceed0dfd1ef7fb72b5d0492394c41dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371591, "uuid": "c1aebc5a-42f7-4037-ae1c-1d515842b682", "value": "T17223F19E69C87B83DBD02972EBABD2031D3175047C9C1B209B2EE96F4C4664C529FE5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371591, "uuid": "81376dcb-756d-46c8-9a1d-bd21935c9849", "value": "768:8m5gQkZb6ifu/Ggh9OHApqBt1m1UlFzXn+PtwhHya80lfeA2Fdphg7C:R5mb6itgUAcXR73+6hH+AS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371591, "uuid": "9db03c2d-1db2-48dd-95d2-986787d15253", "value": 48200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371591, "uuid": "e4c05bfb-2444-4a16-984a-7caf50bf6897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371591, "uuid": "5edd4103-07bf-464b-b77d-c955fdff1c37", "value": "d2d08734fa697c7e03a05e8307a0435f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1505e8-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685348592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348592, "uuid": "afa3e03d-54ea-4ae3-852c-8f1e230d0e40", "comment": "Malware payload (RedLineStealer)", "value": "220ae494fd2c82dabb2748896eb61893", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348592, "uuid": "3a8bba56-af68-4e7d-8079-f0112fc37960", "comment": "Malware payload (RedLineStealer)", "value": "cdaa2f9555806238f4bc504833cdc7c663cda8a6b6679136e8dac7d1600963e7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348592, "uuid": "cae4a24f-a720-49f6-9ecc-da4e030e7eec", "comment": "Malware payload (RedLineStealer)", "value": "ca826875d62a4cd5fb1ceb03e8b87967e9915824", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348592, "uuid": "b22e35ad-fc65-4f93-af9b-ec96ece7f64f", "comment": "Malware payload (RedLineStealer)", "value": "684142f8515b6e5ca0012cf4b5b5fca44c9ae8e25c8b23f0d5f27a6b6f8ed3e5d3e93975e82286a81adf84a20a780f36", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348592, "uuid": "04ddd45e-a52c-4e5d-a455-3e3d3cb8fbe7", "value": "T136F3E568364BA57EC96F883D9C600CD06B7CAC921246A7079D8FF0E9793B7919F150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348592, "uuid": "78ed2d20-279e-41ce-a1fe-bd91b657ef6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348592, "uuid": "30dd2c94-36d8-4a19-900d-e6e17302a14d", "value": "3072:irGkzIa8WuPMxNo/i6qVOg+uA+Eie8e8hF:iikzZEPtb+Eie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348592, "uuid": "8b7e3961-b8de-481c-a552-b7760e110e71", "value": 171763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348592, "uuid": "4cd260d0-7e6a-4645-904f-28f197ee36a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348592, "uuid": "bec9474c-f817-44a8-80d5-f1968044ae78", "value": "05410099.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61e6c6a-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685354029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354029, "uuid": "d0f8062c-5e26-429d-9af3-a2509b97dcde", "comment": "Malware payload (Formbook)", "value": "e30387e36a96a8096fa27d66cc692c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354029, "uuid": "784bb5ff-8262-4116-af4b-beb02c4f13d2", "comment": "Malware payload (Formbook)", "value": "ce4538d962580d2b52a8cb68aefb500eaee8f07dd01c1fae3b50b4a40585131a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354029, "uuid": "9ec8d203-ce17-4e67-b539-346721ff6619", "comment": "Malware payload (Formbook)", "value": "29b7a5a2b105167be0d4ed913595766994491143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354029, "uuid": "ef2aac18-9a34-4f89-821c-6d0ac7aa285e", "comment": "Malware payload (Formbook)", "value": "5b78d9ba75ba46e1f33838c411c1d6ef24bd8765745cf6fb607d5a0aed3ce6bc5aa2a2552ce7c76cfd4d7f1cffb2e529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354029, "uuid": "b975a04c-c943-4b2b-b3ce-23a37799e77b", "value": "T16F05DF4D93640287F1662B75C67D3F3902311C7C75A1E7D8BE96B64BAEE1B92043322B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354029, "uuid": "b8df55d9-0b2b-4a34-ad29-51294752a633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354029, "uuid": "7e464502-e55e-41fc-a6ff-68ccf0c0f0c3", "value": "24576:9sIduK1lmFxUiGjCAH+xCbyVTRYbiQuPAK:/TmFxU+Ljeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354029, "uuid": "7ecc4e40-3be6-4539-8632-78920768441d", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354029, "uuid": "5254b59e-e670-45a7-98ba-0ca3453c2bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354029, "uuid": "bdf0115f-6f87-4db9-8354-f20f45317735", "value": "Release Pending Bokings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eea37c2-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377103, "uuid": "0dfa63a1-4bdc-496f-8ce2-a15301a3baf7", "comment": "Malware payload (Gafgyt)", "value": "2e90a060abbea7962511838d988bfa02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377103, "uuid": "1e73b667-fc9c-4bcf-919f-3671e0cf8546", "comment": "Malware payload (Gafgyt)", "value": "ce821f565f645fe93c3c960d6dcfc8f130941450437af80b810e3917f95af058", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377103, "uuid": "7a741d2b-bc1b-48f6-b05f-3f2f37d34bd1", "comment": "Malware payload (Gafgyt)", "value": "4cc514cf49ced8233cbe9f4f0ae95da23e5e8792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377103, "uuid": "8f179d18-cd6e-4070-9baa-1cfe6a66d372", "comment": "Malware payload (Gafgyt)", "value": "9cb7b94e3a4b96e3585ee3d6288ce706a0303673bc4bbf106cba5d985fd9f311ab03b6110c0fc6876bc3c43c9e1c6ea5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377103, "uuid": "b583f231-dea3-42e8-a8d4-cb9f0378a520", "value": "T16A733B03771D0B93C59BAEF02DF727F187AAF96112A66580A10EFFC41372AB02515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377103, "uuid": "71d223ad-a3a3-4c24-abfd-7e1439256b04", "value": "1536:lotQm3qLiuNGOHBIeFaBXzI23mJn2vobXqNaWBZZz1k8iVmX02q2//8fBgj:lotN6LiuNGOHB4jI23a2Q4ZI/VmX02qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377103, "uuid": "88deebf2-dc48-4cba-a996-00484b07c898", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377103, "uuid": "cb007135-124d-4547-8dcb-f161e667aa61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377103, "uuid": "e692180a-c1af-4f84-8ee1-64f6e4148a68", "value": "2e90a060abbea7962511838d988bfa02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa09fe1-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346333, "uuid": "a71c8952-2342-4522-9951-84e4157869ef", "comment": "Malware payload (Amadey)", "value": "45cbaafe4ba076d50b658e4e9a79a2e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346333, "uuid": "531d3be5-21ff-4ea7-adc7-fe25ba8456ef", "comment": "Malware payload (Amadey)", "value": "ce9782e93e8f68a9cf4b8b810707e1e03dcca7f0f20468c16262a04aafe0d238", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346333, "uuid": "9232ac52-2c3d-489f-bce7-009e1bdb5dc6", "comment": "Malware payload (Amadey)", "value": "ae6f0676bd2d88abb8e0404c3a0fd204fc86fdf1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346333, "uuid": "1c9956b8-0998-4d52-9699-8fbf2296080c", "comment": "Malware payload (Amadey)", "value": "80410fcbc3523bd58cd36bc1588f0631c9092536d718322335a4a5d550b8202301a02b1fa7faecab35f4c2a729cf5763", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346333, "uuid": "3e4b35ac-ccc6-4f56-b2e8-487c096f9bf1", "value": "T1C2352206A2F98473DEB12BB089B797830A76FC61AD7053172795AC1F5C623807931B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346333, "uuid": "d468934b-4ea6-4ce6-8eef-ca1ddcf28e87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346333, "uuid": "d023398e-e288-4355-a967-f1615a9d4163", "value": "24576:Kyr/ngbxzh5LjRqjSTEDaDnvMUS2wvtsQM8T6qS+S00owfAgPspb8o:Rjg1zhJlqWIDAnvmqQjGqS+Xgoby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346333, "uuid": "27bb6af6-ccef-4749-bf38-9777fcf346bd", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346333, "uuid": "b0aaca2e-dc42-4ef0-9a53-4733115d5426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346333, "uuid": "6b593000-9555-47f4-a860-d1c0b80a1d6c", "value": "45cbaafe4ba076d50b658e4e9a79a2e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31025671-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346934, "uuid": "1987da2f-f057-4972-b500-2620b97d3af6", "comment": "Malware payload (RedLineStealer)", "value": "ef30115e0f26654028123186f57e5b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346934, "uuid": "06c466e6-a87d-4ae6-aa22-20525a08a866", "comment": "Malware payload (RedLineStealer)", "value": "cf04c28617cb5c602f5b1e6925f5a153574a3437e12ee8f0f9ab86be11277519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346934, "uuid": "9bea8ee0-7484-4ddd-acfa-1eed58074cee", "comment": "Malware payload (RedLineStealer)", "value": "4cd6bafb4c23ed3d0d3461b5526996c5db0a9982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346934, "uuid": "acc98f0c-9ac3-4bf3-81c0-80b5ec217d4d", "comment": "Malware payload (RedLineStealer)", "value": "b78602903e9b299cd05b3b49c3e1218e4142c06530d86fd11c07bb945fb1580f73a44a20d1b684d6f4bb3271de948382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346934, "uuid": "4bdf6e4d-01ed-42da-a2cb-eb40f61ef30e", "value": "T107352212B7C98063DDB957B09CF203970B3A78B16870125F1799E86A19732E0ED7672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346934, "uuid": "3ef8d715-00ce-4824-a4ce-aa192584ebf5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346934, "uuid": "795fe605-07b0-44b5-8a56-b122e59bbffb", "value": "24576:Wym9cH40WgbuX7TG0lISe6ke7nh4USakrQZdGlErFkCTA:lrYHE+7Sre7nh1TGle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346934, "uuid": "a289556e-e3db-44e5-afd2-588e1441a09d", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346934, "uuid": "afb6b759-48dc-4d45-83db-f3fa3cd02c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346934, "uuid": "69930038-ace4-40c0-aaa9-ee315ec809f5", "value": "ef30115e0f26654028123186f57e5b45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9384044e-fe1b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362991, "uuid": "40b3e5a9-ab6c-46f2-84af-36304a239b77", "comment": "Malware payload (Mirai)", "value": "1c53ec9a4cdabe9be5de8efe7ed17117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362991, "uuid": "c626a6e5-c586-44c2-8068-fd677508bd09", "comment": "Malware payload (Mirai)", "value": "d039d4a4949d8aa73c40b03fc365748723fdf955315bb6e12a4afd6b76b4c05f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362991, "uuid": "c2dd5a71-6cbf-4f5f-9d93-2e10823c22c3", "comment": "Malware payload (Mirai)", "value": "a371d8bdcafb4129496ff4a8836a0cbde8feb17b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362991, "uuid": "71321691-814b-41c1-be06-28b532daab6c", "comment": "Malware payload (Mirai)", "value": "08a404c0397e5bd14b24d880a3fa904fb7c06b481625c7d05b0d105b52c63eda7413dda1b0ed2b4dd0388818c588a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362991, "uuid": "7e535df5-24b6-4df7-b636-2643c5fb4965", "value": "T1B3934B4692A3D5B3C9C71B7802E7E7360531F893171F9F02F35EEEF59A12594709A20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362991, "uuid": "c6ce1007-3066-4da1-9c24-c276cb06e9dd", "value": "1536:xsqcahTl941PHFaYs+vZNXbU8d8vZgMVSkhwmxJKvahGANbpLpbmVLh1ulOT1o:xs11PHgYs8XRa2cSUwmPKHAVzmBh1u0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362991, "uuid": "90be4cb2-5386-4457-80bc-918da76ceee5", "value": 93934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362991, "uuid": "320fd50c-bb2c-4f89-ac14-895d4a176971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362991, "uuid": "e55d320e-0706-4ff6-8f3b-aa30faf7ee0d", "value": "crsfi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a00cbf3-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346654, "uuid": "29dc765b-4b4d-4b36-9478-0fe1458ac4ae", "comment": "Malware payload (Amadey)", "value": "75c4f191baae81a7376f5c6192a37c48", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346654, "uuid": "7afb568c-d887-4770-98ce-4a80753158e3", "comment": "Malware payload (Amadey)", "value": "d0475c0f382a9ad1b5d987cac779ebdef14a8ed6fd353a826a73695b6d4bed56", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346654, "uuid": "707bf7fd-2c00-4dc9-8a27-6561435a4a40", "comment": "Malware payload (Amadey)", "value": "839a0804241d9a3503eb8dee8e589c63bec9ef1d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346654, "uuid": "82d1886a-27d5-438d-8834-a1bcc269a06b", "comment": "Malware payload (Amadey)", "value": "e176b295c17c38dcd8011aba551f40222e09a08949639bbf82effab06c8023c245115d0325e28125b24cf64fda805e0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346654, "uuid": "a699e839-0056-4286-8408-fc35c5740eb1", "value": "T1FE05220357E44473E9B51BB578F342932B36BDA2283487AB234A684D1DB32D46E3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346654, "uuid": "b8b767bb-8666-48d2-8549-e86a8785bb3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346654, "uuid": "0df6d365-d079-4e98-a94b-9367c9e92bb5", "value": "12288:vMrgy90c/CguMfWO6ywYA4CiGXCb7pep8hoMfVeKClPgLnwfzhheY6lUEQ3US2zc:jy9YO4TiGX8p28hOzgMbePll6USo2ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346654, "uuid": "061446e7-3fc4-45cc-a3e4-7ad00f99d3f8", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346654, "uuid": "d5b28a34-0b09-466b-b968-90daa4b15630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346654, "uuid": "3a6a79c4-f14b-4244-82ac-54a15b915000", "value": "75c4f191baae81a7376f5c6192a37c48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bef240e-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685387432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387432, "uuid": "6cf3de02-183a-4662-897b-827d6cc0386c", "comment": "Malware payload (Mirai)", "value": "2d6ac6edb29b75b147e376ad7221a217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387432, "uuid": "7c164ee7-31e7-4613-b874-0ec9841bf2f4", "comment": "Malware payload (Mirai)", "value": "d0a19b4a570d11010ee08acf68c399d490d31c423f94ff64019b3bef8cf3a5c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387432, "uuid": "d8eb0070-143b-4a63-8511-f25a8f806c91", "comment": "Malware payload (Mirai)", "value": "df02c1022825c3d3d567381c805e9067658b1623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387432, "uuid": "8ae89a27-5838-4ab5-a0fc-73341cc6b055", "comment": "Malware payload (Mirai)", "value": "5632a2c8c4f395469b1c77f6266e3175fb83698f0ca4912b1d0a2575d89afbafb6d00d900f101e80dac6b815f425a055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387432, "uuid": "bba2c86a-63e1-49b5-9ebe-0c4b59c68c45", "value": "T141A2D0D93144160BDF8271BE6F1296462BB12E7C338FDFBA3A29B50E534E215268C0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387432, "uuid": "a295ad61-997c-4dd8-8d6b-e93357cab991", "value": "384:M7jgtZ3KwNS5pY62iOYtJjSBuc+VOFj3zZp+ZKlRYx2WVS499dGKHi:r7k5pYXMtFcQOFvCol+x29VKHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387432, "uuid": "5e7f6092-5045-452c-8671-cc678441ed70", "value": 21332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387432, "uuid": "6259b405-0b11-468a-896b-3d5f683cf9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387432, "uuid": "2213306b-e0bf-4c14-8851-4e5f16913405", "value": "wshindex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f31a26-fe4e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685384867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384867, "uuid": "cd759ccd-6bb4-4144-af03-08d2111f60fb", "comment": "Malware payload (Mirai)", "value": "687be0db64e721cafa547f1717c5e7d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384867, "uuid": "c6636aea-234a-4134-a342-c33f4b7fe5aa", "comment": "Malware payload (Mirai)", "value": "d11d572a1404d32ffc062ad741c29588ccd4af2da03aafa8081d059119e2bfd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384867, "uuid": "5ec272e4-60da-4b6b-90f7-0188097e5d1a", "comment": "Malware payload (Mirai)", "value": "c817451dc6d72adfe602330fa333058db45d7963", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384867, "uuid": "3fe97ca7-1560-45d4-9cf5-7f4eb4c0c123", "comment": "Malware payload (Mirai)", "value": "342988fa498181916ee78a689055b61ba2c4f0a8774c4a4a8222d0de937737f2fe928d4cfa62d71a36716b0a6f3b47cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384867, "uuid": "5cac6501-3af4-4497-b5d8-6a7f25bcdc0f", "value": "T1D5E2F178AE0405FEF48D64BE427C1743BD525FA9A2A76C827D80A0B49E072D599C7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384867, "uuid": "d91522e1-81a0-4609-be7d-fcf2cb727dd9", "value": "768:JgmeI3ZV7A/9k9mPf+JOcEXVigSwPPnNOoslXh1YSU6DCJgGlzDpUYsyU:Jn3H0/W90fMFai+k/VGVqYZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685384867, "uuid": "691d4bb5-51d7-4420-9ebd-fdad25af9f5c", "value": 32444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685384867, "uuid": "88d59ef0-4fc3-4ade-8981-bea3b1f55ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384867, "uuid": "1161cbbe-cf51-4c0b-a11b-d58912a2e3e3", "value": "SecuriteInfo.com.Linux.Siggen.9999.19908.21489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d25c3d-fe55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685387670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387670, "uuid": "8a23a2d3-243c-48e2-ba3b-308edfbbcf27", "comment": "Malware payload (Formbook)", "value": "9d2e1a7c7ffe298bd5d8ad7dbde23479", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387670, "uuid": "acb51a44-cb0b-48db-b906-723e443b5ca8", "comment": "Malware payload (Formbook)", "value": "d15393560f3366bf8e1cc8d9eca6e5bfb5a35e26d7217e4470fd121bb12d6ab7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387670, "uuid": "3d754abf-4389-4551-94fd-b8148a14e9af", "comment": "Malware payload (Formbook)", "value": "07f9f56646da1d7a1ef9c89c05732a8efa13d216", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387670, "uuid": "e8f4f9f6-62cc-4073-bc83-af4b9222cb09", "comment": "Malware payload (Formbook)", "value": "5fe1fc1e289bb4b724e40e8773538dc3bbcc2391d96dfc74edbe5cb48ef9c1a373efa20eb4479b98072ba0012f511667", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387670, "uuid": "f6434865-cb64-4d6d-b27f-80a54dab38e4", "value": "T1EE04D0441AC28472C66D6774C0338D984AB93D37EE917A3F8B18F52E38B1393D556B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387670, "uuid": "26df29bf-8f27-461b-90ef-0776021692e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387670, "uuid": "e0b59ab9-d105-4f20-84ae-663d9a10e672", "value": "3072:zeOMawcjtdQs5ibI8TmXcp5gy9IKL2kqsEcu2M4S/xaJVYYPwtz:zeJktdQs5I96Xcp5M2WsE72e/xowt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387670, "uuid": "f119dd06-4bb7-499e-8e5a-1e3076a0bf56", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387670, "uuid": "36b3d214-d8a5-4594-8385-7ff7e5738a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387670, "uuid": "808491d5-1c43-4b49-bea2-b245a8204f65", "value": "09473499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95981470-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371584, "uuid": "6ddfacb2-2891-4b29-adb1-4f430a55b171", "comment": "Malware payload (Mirai)", "value": "c0cd382194139ab031d1b24eb2483328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371584, "uuid": "9893660c-babe-469a-be08-562e7099ee77", "comment": "Malware payload (Mirai)", "value": "d17b898066550e46ae7984da455f859652ad98a806d73138254989353c0a8fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371584, "uuid": "e8e47947-8b42-4f81-8cc6-bd4ddc663b13", "comment": "Malware payload (Mirai)", "value": "5d8d2de4cad1194f8e46b6a12a9584789ca6cad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371584, "uuid": "de642019-8d17-4700-819f-7153fb22ef64", "comment": "Malware payload (Mirai)", "value": "e40f34c64b32009fba72ea997d9ae8c5baa154c9faea45deffddf83a9bda720ae56b983f24a7febe7f967ca4d14f2de8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371584, "uuid": "3172ca01-61f2-4290-a45f-90580322d489", "value": "T1EAF2F13833525A8ADFACEF35DF5F3D10FB78AE08CAC06A5161E964C27AA22C40114468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371584, "uuid": "48711b11-66b1-4aba-af27-66b4d332f97a", "value": "768:ooM8A4/Ll/Li3MDrFGHLUP73pf3XzPbFYpCApAnGgjNaGbK1UzAy/:ooJLl/Li3MYUlfXzxYOnwGbGpy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371584, "uuid": "2e6b0a44-441c-48d1-a389-ab27325adb9d", "value": 36356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371584, "uuid": "c37786da-859c-4cd7-94a5-9f47acc6720c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371584, "uuid": "c2ec776c-10c6-4f8b-805d-9717dd710369", "value": "c0cd382194139ab031d1b24eb2483328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d9b442-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346652, "uuid": "126f068b-8c2f-4733-ba04-9f4c715c034d", "comment": "Malware payload (RedLineStealer)", "value": "b6642eac9fdd15620d99d95510892cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346652, "uuid": "bbef407f-9b27-4f8e-a648-16ecd515adf4", "comment": "Malware payload (RedLineStealer)", "value": "d1b662e9f9ce5c41f57fddb7261420400f63c0ea3f12917ce1819f8fed87c6fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346652, "uuid": "dadfcc16-044c-4e25-9516-5c4bb80ad9db", "comment": "Malware payload (RedLineStealer)", "value": "8bc8407b574b8384ed5f953369d8309b25703bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346652, "uuid": "80c09beb-4e4b-41b3-86dd-d925ac8fc684", "comment": "Malware payload (RedLineStealer)", "value": "df9f6146fff42292d527d6c2ff481537470f35c0b0313a4ccbeb7e0f8269a67d8a79fbac981959240fd87d4fdda878ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346652, "uuid": "53779d89-dcc4-4ec3-b3ef-5b95ce436ffd", "value": "T104052303ABE89173E9B51BB098F383431A767DE1683583576748880A1DB39C4BE3577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346652, "uuid": "7899b2cf-fc8b-4cd8-b34a-01c2aefe5f60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346652, "uuid": "300face0-68e6-42e4-88c4-41725383b670", "value": "12288:fMrqy90xW5oAWgAWvoxN3S+xWg+pmQFTDEQiMTBObnH6tRyafg1hevOnDEQ3US7g:lyQrUADxN30gNuiM4bqWne2nI6USs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346652, "uuid": "a9108c3c-0f5f-420d-bb92-63e8d7607f55", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346652, "uuid": "e3dcf212-44ee-401b-9e35-de5c8a0e347d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346652, "uuid": "f8f8b0ce-da36-47c0-b662-d0cb66edc774", "value": "b6642eac9fdd15620d99d95510892cf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c774e933-fdcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685330436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685330436, "uuid": "50410db2-fa89-4291-820f-ebbf8f1aefe2", "comment": "Malware payload", "value": "a82df55a03a3dc038985a30f797cef24", "object_relation": "md5", "Tag": [ { "name": "chenliuming", "colour": "#4380E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685330436, "uuid": "96661b02-db6a-4c35-a512-c6c58404e442", "comment": "Malware payload", "value": "d1d74ec1039ff5aab99faf99bf70fb07f6b4c763a0c2fbc08b702ec9dcb03834", "object_relation": "sha256", "Tag": [ { "name": "chenliuming", "colour": "#4380E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685330436, "uuid": "a12ab29b-17a8-49b9-a671-4dcba6724a87", "comment": "Malware payload", "value": "fd30147c88f65ee9c83da7fc98c75c02a2fa7b8f", "object_relation": "sha1", "Tag": [ { "name": "chenliuming", "colour": "#4380E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685330436, "uuid": "83edabc0-e21f-4863-8fd3-da4f529ff5d9", "comment": "Malware payload", "value": "f785e9ed89ea9c348e842d4d0ee85cf78079f132d7a9f1983d055c3e4302f31fa29d5ce472dc90268448f06a2819c81e", "object_relation": "sha3-384", "Tag": [ { "name": "chenliuming", "colour": "#4380E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685330436, "uuid": "d526e92b-2f2d-4184-97c0-1cee11dcde85", "value": "T1F5B6D2391CBE1237D1A6C6B5EFD98826F444DDBB3222193660D3B6498336D4369C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685330436, "uuid": "606d5e2c-0596-4de5-9ee4-83645b71f201", "value": "653f54fa293295fba0e4b1347e7c50b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685330436, "uuid": "415c9e6e-5788-4b35-b280-abacaf9eef70", "value": "98304:xnwgVIXh9xYacrRyyVyGHAeBSut+aFNnLlPLeqNZ8hY/LKbxabdDkEduupRlQgWm:u/YaolX+aFFLlPKQ8hY/RkQWslX4ge+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685330436, "uuid": "bbf4d7f1-889f-4d22-b2c6-afdcae7d4eb8", "value": 11460608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685330436, "uuid": "074372f5-cc9f-4f81-b566-34b0e7d81cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685330436, "uuid": "0e6eb7e7-ba39-47ca-acd4-a1527e7a7f55", "value": "setup-unpacked.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abf0529-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363405, "uuid": "f946a3d9-235a-4566-a30e-0ff12dadba99", "comment": "Malware payload", "value": "650b63eee6225174eb16da1bff426172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363405, "uuid": "26471c2e-5ddf-498f-bdae-476965b37a28", "comment": "Malware payload", "value": "d1fef2756d1668d3ced3eef4a33c93c39c9c56ff10dd12bca3ef0c5dd7248afa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363405, "uuid": "4a7b18c7-8657-4e68-a733-0f27a6cfdd15", "comment": "Malware payload", "value": "26c43988b9f34ba977f2ad5476c47f3618e166a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363405, "uuid": "25ff739a-6e0a-44ad-8b2d-b10c64326496", "comment": "Malware payload", "value": "5981d638c0128770afd1f5b7fab26964c4d53138da8e8b10c2d8baeee4d767411cbf6131f85a85285af09cf5d12804e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363405, "uuid": "5f72eae0-4489-4bd1-aed9-926400fabb8a", "value": "T1A0A2CFEAA1D1BE23C543D5F8B23262E83B4EEA725765376A5A1171CB2CCF0804878D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363405, "uuid": "d9b245c7-5636-48e1-b2a7-70cdc976c384", "value": "877748d2bd07ecaa85c8717c883e7f08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363405, "uuid": "a74c9ea5-a668-4f44-86e6-abf5645416e5", "value": "384:DhKUNsKnI1fRqOYrjeEsuhTM1UyjKRvKdxAoHAwsZfN:VruKnIh8/eEs+Tpe4SdxAHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363405, "uuid": "98244dd6-5113-4a40-ac85-34485bc55f9e", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363405, "uuid": "2464d123-4d24-4a68-a856-b680bca763c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363405, "uuid": "331b7cb0-fd2a-4fd4-8ed9-a46494cf055b", "value": "SecuriteInfo.com.Trojan.SuspectCRC.99.8371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cd080a-fe54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685387536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387536, "uuid": "7aaef7fd-83fe-43d8-b6d0-88e7a1bbad85", "comment": "Malware payload (RedLineStealer)", "value": "9284e8c26e77fb1b1544e10ca1a7a6df", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387536, "uuid": "b5fd2568-80cf-4a77-bf77-01b9a8d31f00", "comment": "Malware payload (RedLineStealer)", "value": "d24ccf73aabca4192d33a07b4a238c8d40ac97a550c2e65b8074f03455a981ca", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387536, "uuid": "c47469bc-3304-4f80-8c34-e5b8c1fb6a8b", "comment": "Malware payload (RedLineStealer)", "value": "4bff1222b22f4d921cc6570798c11878ba13f80e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685387536, "uuid": "9262de83-bbb4-4295-b3d3-4830fd727e9c", "comment": "Malware payload (RedLineStealer)", "value": "dc9438bebb4ecaa3e026dab2cbc76da477b3c0691f0366c91e88f21a2af5918aba2ce0f5376382ef2b60e1fbb761e609", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387536, "uuid": "4b810d10-acda-4d9b-a2d3-ad766f5a9015", "value": "T144051256A2D88933ECF5177418F703830A35FCB0AA72822F2669E98E5E735D4587173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387536, "uuid": "bb1f94fc-aa12-4b0e-a9c1-dfd1d6e6cc55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387536, "uuid": "d75cb910-36e4-4acb-8b4d-24d9128cd350", "value": "12288:HMrcy90JC1nUjY+h3gzq3HdpD9J+4l5ZqfYaIrDDlvtzL32lPX2uwHRYR:DycLcEWqX3D55eYa0flMv0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685387536, "uuid": "cbed3ec5-34e6-4aaa-9803-a93b8753ec94", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685387536, "uuid": "1a6b04e6-592d-4189-8f6c-1360a87a7795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685387536, "uuid": "cb83b72f-ae28-4b0b-ab28-c4043b0eabea", "value": "05848199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d2d598-fe53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685386833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386833, "uuid": "877bf0ae-7e8b-4307-8e1e-2c11adb627e0", "comment": "Malware payload (Mirai)", "value": "828c98f8badbc454e23fda1452d059fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386833, "uuid": "411973ad-7fa2-4c2d-afb4-9f850690e1c0", "comment": "Malware payload (Mirai)", "value": "d56b01cd17ce33041c6c8580a21142959b96cd15e2d669ed683701a602320d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386833, "uuid": "59ee175e-c2ed-4c81-a407-557ae677942a", "comment": "Malware payload (Mirai)", "value": "2e4a85164d0feec38248cc7857d9de7026393023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685386833, "uuid": "ca249192-aa6e-4868-8b1d-9dcb7f030918", "comment": "Malware payload (Mirai)", "value": "d3516785547447fedb764eaf27950bf7b19891b21601e8d8b29398e897d9b37633fe7d83adb71c9d915d6ad0f68b89f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386833, "uuid": "99645c26-0c2b-458c-acdc-2d416c459637", "value": "T1071329C4A943DDF8EC1502B02276F736DBB6F07B211DED97C39C9527A882A40D9472AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386833, "uuid": "9f7ae933-e3b8-4340-9826-591c6288421b", "value": "768:AdjgKRk+hJeQby4WIY/WXoKmY3Mgi+XxGU/ObPqgFD+EeoV:Ad0KRk+hJeQby4WIY/+o1Y3MgiEs/7qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685386833, "uuid": "d8581a3d-d62c-49af-b465-dd54282ee632", "value": 43356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685386833, "uuid": "ea385941-419b-4e1c-a937-63fb33a45c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685386833, "uuid": "3017f644-0764-4693-97aa-1e12081460e2", "value": "TRC.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7569f7f0-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346619, "uuid": "cde59072-2521-43f8-8e68-d3af4c55eb18", "comment": "Malware payload (RedLineStealer)", "value": "5520471a5ece79c5e8ba3d714f44316b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346619, "uuid": "d8a83b57-45b4-41fa-a69a-45c0f6eda218", "comment": "Malware payload (RedLineStealer)", "value": "d6394c6b006d997397b7bd28b9e06ed14520bafa312a519cecd3f8b3163066dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346619, "uuid": "532ab02b-b2c8-451b-80eb-4943ee21c920", "comment": "Malware payload (RedLineStealer)", "value": "364358aea1b724c5352a25e4ca479313749892aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346619, "uuid": "b0b879c3-15ae-4d45-8ddc-16a16ec976de", "comment": "Malware payload (RedLineStealer)", "value": "a444b81bd1a6e41ab3cd37e8f18cf60a386844f190496aae292688175ad1bef31279e9d55d6d2f46deb98d62e7ecb770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346619, "uuid": "7732ed88-c14e-48aa-8774-398238bba9e8", "value": "T1D0051206ABED4033F97417706CF703871739BDB258B4826B53855D9E2DB3A81A83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346619, "uuid": "847d47db-8d6d-466a-8d43-e3ee1ca9c69f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346619, "uuid": "a70e742e-b304-434b-a50b-e58eb3646937", "value": "12288:YMrTy90dJQy6HZ6RpdnLN+HNhbIxa/2bbsHEfBFfHxheeNn0EQ3USnmWD6f:bycmgDFAbIxa+tJLeOnF6UShG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346619, "uuid": "bf7c6ecc-8253-402a-ae82-bbe9cf712f60", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346619, "uuid": "2b53633a-015b-4e7a-937d-e51732136be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346619, "uuid": "97944e81-a74d-40d6-ba78-747b0e2c25d5", "value": "5520471a5ece79c5e8ba3d714f44316b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50ad27e-fdf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685345545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345545, "uuid": "d705a665-80f4-475a-be27-ec3c9dbfffc7", "comment": "Malware payload (Mirai)", "value": "c437cf9d0378046fd7452503eec06b2f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345545, "uuid": "cc8ee2e4-8812-4686-85c7-d1789ab9f686", "comment": "Malware payload (Mirai)", "value": "d661a2eb46380a121dd4625e9997b857b1911494d68cb06cb5c06a19e4a5a028", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345545, "uuid": "b96a976f-faa2-47c9-983b-a4c2edc86e1e", "comment": "Malware payload (Mirai)", "value": "f7f775c4006efc8205050e6b8601ae6deeecdbcd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685345545, "uuid": "195c3cf6-d4bd-4a8b-b6aa-a27d5cfe0ef5", "comment": "Malware payload (Mirai)", "value": "a8a2f9e3275819588de23611b3c702b1e4cbe334dc57a92a0ba1b568cf827caf1e76246ffffd8eb36aea1eccff6638d5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345545, "uuid": "46ecf666-4353-47ce-bcd2-db4c49a56f95", "value": "T12C330907F681C0FDC49AC174476BBA3AE93771ED0238F2A67BE4EA223D95E611D19C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345545, "uuid": "b73e8add-e5fb-46c1-a256-c4bf9035f80c", "value": "1536:Ru31CxXVpHlCrxsNnVfvj5F+Hr2r4DaEXzd0OCUjCY5:Y1sXV5lCKNVfvj5oL0GaEDOVUjCY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685345545, "uuid": "9092726d-e926-4d75-998f-2e0b8e20dd83", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685345545, "uuid": "baf9d2a4-bf98-4c66-86f1-2ffa0b20ca14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685345545, "uuid": "ccb1e83a-ad53-4807-b631-7bf54cb833ab", "value": "c437cf9d0378046fd7452503eec06b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03b4995-fe27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368220, "uuid": "a1323be0-a5fe-44ab-8ccf-6a6b4db8ebb9", "comment": "Malware payload (Gafgyt)", "value": "f01e53695fd31d689c69b74e1bdc943a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368220, "uuid": "cbc45706-fa22-49c4-aa87-2bfc95dbf7ad", "comment": "Malware payload (Gafgyt)", "value": "d709599bbe8467f2d63b8a74c5645dd974a8691daa6ff78317831b989a212bbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368220, "uuid": "629dc543-b5e2-4349-bffd-49ccd91f9874", "comment": "Malware payload (Gafgyt)", "value": "30955fa0e7d2bc5fbc3791aad1bd814a4e81a6ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368220, "uuid": "688a4105-b0ca-4a16-9f1a-bfc0f9fb7508", "comment": "Malware payload (Gafgyt)", "value": "e251673e8d6a7befb687569b898c9d9a7735799b3a275dd04fa944e5711b5d6c6db7c70f4242854c0dd3913430241604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368220, "uuid": "b4e0e4a8-4d47-4c4e-90ad-25fcefae5ff1", "value": "T128931A41F9408B27C2D227BBE78F439D37366A54A7D7330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368220, "uuid": "28b35592-65c3-4724-9c6f-12271eb20739", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcv0NPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFG0NPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368220, "uuid": "31aaa67b-7f6d-4f23-8b9c-fa797a88bc62", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368220, "uuid": "d9466752-4d01-4f0c-a35d-1e3166375443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368220, "uuid": "dbb6c9c2-22e4-4005-8227-4604e27f5196", "value": "f01e53695fd31d689c69b74e1bdc943a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf98cfbb-fe70-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685399599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685399599, "uuid": "5f048bb0-57fc-4b2a-8756-95f2206440a7", "comment": "Malware payload", "value": "b643455eaa1520aa3945085c3e4dfb6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685399599, "uuid": "0447a1d9-55b2-4fbd-8027-80d0da2fd154", "comment": "Malware payload", "value": "d7b868f493e722992d65f30fbc56ba9e054d7ada677b0ba4f380fb3d1b2f395a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685399599, "uuid": "16853f5e-539b-45ac-a9e7-3e37193da4bc", "comment": "Malware payload", "value": "e0e496c5bca7704a89bc3391f868c9f731149c18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685399599, "uuid": "5deaba1a-1b34-4f28-b686-48cacac2646c", "comment": "Malware payload", "value": "5be9f792f94fd72b72ba861ad43fac9d9aff0ccaecaf284e89c6a31664bda0fda70f678e2f1c97580e2fd0d15d3975a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685399599, "uuid": "670f534b-a06f-4545-a938-7d9c7c95e1d7", "value": "T148F42213AAE492B3D8B5473429FA02970731BCA69D39977E2245AD5F0CB32D46C31B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685399599, "uuid": "870d6e44-f3d4-4d46-bf12-db02f14cc989", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685399599, "uuid": "ce13356e-ff54-4bf6-ae87-2f7563d3388a", "value": "12288:aMrmy90tgBVIvyyMNEJ7TGZRqcyEJpjnWGYvfFjxLIlVIO8sfkWt033kNVLBOCFe:gyzfIvyZCE8EPWGYHFdS+Orfd0HkNV/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685399599, "uuid": "49c3916d-e3af-4c93-9225-95694d5c847f", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685399599, "uuid": "60e9347a-51d8-4b4a-841b-1965bda45088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685399599, "uuid": "90517ee4-82cb-4485-8cc5-e7196960ed8c", "value": "b643455eaa1520aa3945085c3e4dfb6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3566572-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377191, "uuid": "d08a4381-69c1-41c0-bac5-50020ec2d506", "comment": "Malware payload (Mirai)", "value": "25d4fdbbff3ec51d42f130ef13b41955", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377191, "uuid": "c7519c0d-cb34-497e-ac2c-f20748aa714b", "comment": "Malware payload (Mirai)", "value": "d7db706210bb56cef9fba792b9fcfe1b622966c0605344cb3121df0c1b9db174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377191, "uuid": "65565f8b-6c51-43de-9b70-63a9968adc4a", "comment": "Malware payload (Mirai)", "value": "df876c825ae7af7757e899e68ec766bd00ae1092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377191, "uuid": "7a8557fc-827b-4cfd-8eee-3f72ef4afdd3", "comment": "Malware payload (Mirai)", "value": "aa410fba49f3aafbb86e9e12bf281165464941291c36422a11b4e434baaff9de5c7f32e111988f83de9b1d104b3345ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377191, "uuid": "4fb86502-e6dc-4b29-8c26-5106c5f2c66f", "value": "T1D1432921B53A1F17C0E0A47D21FB4B59B2B15ADE26A4C64E7D720E4FFF216806943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377191, "uuid": "1a6f66ca-f399-4aa2-b143-713b9165c1bb", "value": "1536:dfRDxpsnPDtGPPGJ5dLo0SsU+0F3FgppZ:ZFYvSsGF1epZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377191, "uuid": "7dbfb830-b6c9-4454-b418-f93a70dd105e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377191, "uuid": "151637f7-a562-4950-9f7e-eff0f77fd45c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377191, "uuid": "ecdec848-1169-4664-b1a8-e92244822b03", "value": "25d4fdbbff3ec51d42f130ef13b41955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac03acf8-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685354012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354012, "uuid": "87fbae7a-24cc-4783-9d8c-679d8b0f039a", "comment": "Malware payload (AgentTesla)", "value": "25660bd0a435d365787ada9fa9962f1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354012, "uuid": "1ed48d50-e261-47e5-a9c3-c8c7918d5ad8", "comment": "Malware payload (AgentTesla)", "value": "d81fe0f6ced7d3ddeacd0ec978b74f95ffab537811a586370d3566800cb6d208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354012, "uuid": "78a02b25-3d44-4bd2-b260-4743a906000a", "comment": "Malware payload (AgentTesla)", "value": "4a43dcf989339bb5e6d325d09f8fbdfc3e46436b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354012, "uuid": "b9fa6126-55fc-489c-a2c7-7fd61bdc563f", "comment": "Malware payload (AgentTesla)", "value": "6e743db230a9ee638634c1aff724dbe4c83ec54972d17af2be5b16dab4666986e1ba40f77ee6d549145fb6362df87767", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354012, "uuid": "b57850fb-aaa2-4036-8f9f-6373034be95a", "value": "T129421A3163788533C62A07B61853E3400377E7479965EBEFD8C4229E9EE33064A632B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354012, "uuid": "8f5f7b97-a577-4279-a2e6-9fec81e40a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354012, "uuid": "10f53100-6c2c-4e32-84ad-4d6b89f3aa59", "value": "192:+ITP1ffffffaLjL+LfLqLpL0L0xolLiMiE46oMDBC44CGySos9uuNUSSSUUUQfwY:+IBffffffaLjL+LfLqLpL0L02lLifE4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354012, "uuid": "22ecd278-f9f4-4233-a22c-acae9236623a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354012, "uuid": "d6ba61ff-48da-48c8-87d2-b381595c3d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354012, "uuid": "efb40b6e-1a14-407a-89f8-d5a19c555b1c", "value": "INVOICE1008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d74532-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685348182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348182, "uuid": "102c6134-5bc2-488e-ad42-794781055981", "comment": "Malware payload (Gafgyt)", "value": "258d0909cc787df408b45750e3f42b2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348182, "uuid": "8cc4f34b-7ab8-48af-bd9b-9acef0ea5fd9", "comment": "Malware payload (Gafgyt)", "value": "d9e744002672fa1649b09e8d322025203c282cd03f22fdfb573becce41427972", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348182, "uuid": "38812987-6e1d-4853-aed8-3d80069a8c3d", "comment": "Malware payload (Gafgyt)", "value": "af25473eaf9a192e833edec03160b5b21ae9b490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348182, "uuid": "6f4b207f-529a-4dbe-8b09-ba64402f8dbe", "comment": "Malware payload (Gafgyt)", "value": "93b8ab5ad3427fd8f531253749bbf69c188477804cd714e7575e528a9558dd0479771186b9f5775611bd1b442a590856", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348182, "uuid": "296b13a4-4880-47cb-ab98-8e7acf083372", "value": "T171C34B42B58740F6C9074934709BFA3FEE72D5BE4223CAA9EFA48D36C667401061B79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348182, "uuid": "805ee2b2-f070-4683-ae92-304e209510b3", "value": "3072:5pv0iBKQguBBmX8WGNQ1S0HULbr2kLtgt5Z:5pv9BKrujFWG6S0O0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348182, "uuid": "5742563d-37e4-4506-bd8f-ba28973530ad", "value": 128240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348182, "uuid": "bff8b872-625b-422d-87ab-4515c9d5b0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348182, "uuid": "a91df6ef-1e02-435a-a6d9-26317dae273e", "value": "258d0909cc787df408b45750e3f42b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f439e789-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685374320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374320, "uuid": "b8628e56-eb53-4bff-a69b-d1d2f394c91e", "comment": "Malware payload (Gafgyt)", "value": "269a30bb9159269453c571a9bc93f144", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374320, "uuid": "9bf430c8-6c25-4d65-a904-353d25317a7f", "comment": "Malware payload (Gafgyt)", "value": "da30e263d01e0a3cd95e29ac7e95c2674da40f35c438e6a4389e21c9d63ff8f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374320, "uuid": "7a58332f-c9e4-46a6-84b0-82ab87963850", "comment": "Malware payload (Gafgyt)", "value": "ac9104ba08a6a2aff48a973dff85079792f27d98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374320, "uuid": "44c1be38-b824-4f7d-b786-106d580f491d", "comment": "Malware payload (Gafgyt)", "value": "c372e3b65d6bed58ab3afc4b5cad8c3720a39a93c4ae3e1db9f1423b3898b3d4054b77b78cee2483352ccc01c385d1ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374320, "uuid": "4a657f2a-c9f4-404e-90cf-1354c39603b7", "value": "T19EE34C46EA808E13C4D52776BAAF41893332A764D3EB73069D185FB43FC6B6E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374320, "uuid": "552d0312-b72f-4c9c-8af9-a771b852c508", "value": "3072:NNEijGVEWJgJX/FEERj/9iOpMN643Rse6oJ5D3UvM/9x/aeaX0:NS7VzgPEEtNpMN643Oe6GD3YM/9xSeak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374320, "uuid": "f855096f-3952-4082-a46a-e46e0bb09d7e", "value": 156958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374320, "uuid": "0a398b48-2698-44b4-ab95-bafc31ae5390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374320, "uuid": "0e58600b-afa4-4ded-a8a2-bb950ecda858", "value": "269a30bb9159269453c571a9bc93f144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cb5e2b-fe33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685373467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373467, "uuid": "fd3e5eb3-8660-463f-9932-9c85a0fc9ee0", "comment": "Malware payload (Mirai)", "value": "5a22225cc0d7025076c0b3b0e97f8ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373467, "uuid": "e886d070-c9ba-4bb3-b51d-34973b6df33b", "comment": "Malware payload (Mirai)", "value": "da6d4de9dc5ac43fb272581f4506d62e81783a3583abc34437724a779968ef6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373467, "uuid": "7679f5bf-8dfc-4d63-be97-7c857af14fbc", "comment": "Malware payload (Mirai)", "value": "67b4b9eb6fa6e0cef65f6a016812fb03df25cac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685373467, "uuid": "418e43f7-17d4-4c20-a91b-45332f117210", "comment": "Malware payload (Mirai)", "value": "8889a2bbdf4c1d131168b2974982900845800f0e33a06833edc72e72e5143291047c6ff21a8bb7d45179bcc07bd26aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373467, "uuid": "2ea5b2d9-197d-46d2-bc1d-1b789d3ad8f0", "value": "T14DB2E195D6FB2BC3C2919336E0BC9A4DE1721AC10346850A5109724F939764F9BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373467, "uuid": "d388ec75-9662-449b-85b7-9f6a84b0a52b", "value": "384:MCDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLR:P/QOC0Yhn6ROHWFlAcwNEFCnNBxcF/c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685373467, "uuid": "30729599-0744-4241-abe0-91fb4d861c98", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685373467, "uuid": "c8de5f3d-50b9-4c26-9996-3a4ca42f483b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685373467, "uuid": "5de532e1-9eca-48e5-a829-f7304b93069f", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265f0268-fdc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685326300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326300, "uuid": "a70fd108-845c-4c4e-b132-cf2cfeb42c86", "comment": "Malware payload (DCRat)", "value": "b7e869de46a46e65ec4decd37181dca6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326300, "uuid": "c287146e-732c-48fa-9adc-d60d27a62201", "comment": "Malware payload (DCRat)", "value": "db22afccf4e8415e7a44f2b4d77ace21209dc4bcf558024ad9ae87820fed4857", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326300, "uuid": "4e233f92-bd9f-421e-9920-e31ed726ea55", "comment": "Malware payload (DCRat)", "value": "a5e10733b276e4d2c7aeaeb4277d6803fa89bbc8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685326300, "uuid": "6fce0dc3-1ed6-46dc-8e57-ad0fcd07730f", "comment": "Malware payload (DCRat)", "value": "10a4884b90e806545f56bbe7a83706096397c2b9871d3966d542588484e83057aeda52360a86b2af1a4ea175688a287f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326300, "uuid": "1b7f5655-40a0-465c-a42a-30de536f4d4e", "value": "T1AC4539017E44CA11F0191633C2FF498497B4AC507AA6E72B7EBA376E65123937D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326300, "uuid": "3502db3b-5790-4085-9d17-15df8de8f8b0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326300, "uuid": "a4ac1571-018f-4023-b866-f84a073ed4cf", "value": "24576:U2G/nvxW3Ww0tOGJO4DEsW9rJ89Zl7GdhTzZx4xy4Vg2aM:UbA30OGLDEK9eGUtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685326300, "uuid": "01a822a4-640a-4b5a-881f-bda4655e2a0e", "value": 1164911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685326300, "uuid": "c5f1da4e-36d9-456a-a81b-1ca149356c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685326300, "uuid": "4c8dca4f-ed83-432e-b9b2-aeb176ddd8af", "value": "DCRatBuild.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac82b38b-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376776, "uuid": "5afe82d6-7ef3-44d1-a77c-2c1f94b376f1", "comment": "Malware payload (Mirai)", "value": "b87c116bde8b3f6a04aaeb585e7abfc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376776, "uuid": "0252c791-770a-42ad-a1d0-bd38d6fff4aa", "comment": "Malware payload (Mirai)", "value": "dbbec5dffb30bd3c255a976d5fae245f0d64263d03d6411ba75f7d16cd2b49f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376776, "uuid": "1e74f1b5-a336-4770-818b-3443fb45f506", "comment": "Malware payload (Mirai)", "value": "33a9ac161351fccf073ba0f9b2fb83d09b02d80c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376776, "uuid": "5cf569f9-f613-4023-bcba-6d4beab531a7", "comment": "Malware payload (Mirai)", "value": "bc822a63f485dd454d6b8fc5dbbcdee09796608af6a42b02c161da2b00616d30fa587216a4fe4c26114fc212b2b281b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376776, "uuid": "14838ceb-a143-4cda-b883-bf8807a066cd", "value": "T14D33F861B8926A1BC6E0237AF9AE558D332063E8D2CF3217CD201B157BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376776, "uuid": "cbdfa045-c7e1-4c1e-bfba-923e2301f12c", "value": "1536:aymy2hHuA6bBvUImk2ifflvYU6Ioh+kWXXkQ:aymy2hOkdU6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376776, "uuid": "86af9300-fd6a-467f-bdac-f976a09fb7e6", "value": 54652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376776, "uuid": "b7242163-5783-4c86-bc58-cb123b834a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376776, "uuid": "bf0b72fc-80d9-438c-86af-98b3f8365f62", "value": "b87c116bde8b3f6a04aaeb585e7abfc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e72b6c-fe27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368207, "uuid": "a8772e4f-f059-416a-8f2c-3a0ddacf4464", "comment": "Malware payload (Gafgyt)", "value": "3970cadca4e21fd179e602829a4edf95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368207, "uuid": "fd8dfb13-3eba-4894-b9ae-0988980e0253", "comment": "Malware payload (Gafgyt)", "value": "dcb428d6e331a1e43d76d7063484117ea38fcf7992b2c066b9b20509f69312d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368207, "uuid": "d52fe468-1884-4dad-8ead-57be42675713", "comment": "Malware payload (Gafgyt)", "value": "58d3bce8ec9ce67616812cb693009c665032691e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368207, "uuid": "94bd4705-f1e9-4871-a969-246c1d5a9b42", "comment": "Malware payload (Gafgyt)", "value": "edaf6608d015cc57eebccb627bf19f26224c50ac83a9b3c479edb66ddbf76586ee706b19fc710489a555a2cca8a1d1eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368207, "uuid": "a134f5b9-6bbb-4bc3-8ffb-85fab08331fe", "value": "T142734B47AD618FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368207, "uuid": "34ec0ca6-fea7-47a4-a058-d00e5a359d94", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/C03yzTN7mj9VqYLe8f26e:v+eefvyoWWF/b3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368207, "uuid": "1a9b0b20-8b6e-479e-95d0-98d4edce42ad", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368207, "uuid": "7ccfa387-6940-4b8c-a724-df188ad3e330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368207, "uuid": "91266909-02f8-47ac-b7f3-af8613c58525", "value": "3970cadca4e21fd179e602829a4edf95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb1269-fe28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368472, "uuid": "67dbd7e5-bb17-4fbd-9f19-ea36f48e3eb5", "comment": "Malware payload (Gafgyt)", "value": "4116ea7e0b3883481182edaa2e41c83b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368472, "uuid": "4694719d-0ffb-441b-bfd9-74c87ad27bc9", "comment": "Malware payload (Gafgyt)", "value": "dce2bce684cfeffee65bcaa364bcc4bf55c808f7fe1eb33e36e9c16c2ecdd41a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368472, "uuid": "54abe1a0-a485-4b8c-af6a-ae30d8644fa8", "comment": "Malware payload (Gafgyt)", "value": "a931101f5abe31263069f01ac095ca8ce41e16c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368472, "uuid": "798ba2f7-9558-43ba-965a-e4eabbd7fce2", "comment": "Malware payload (Gafgyt)", "value": "0735eaf1c2f6f18ed6f9fcbefa594971bae1af64825641bd39ed18eb860f879828702912429c3de4d61e33cecaed8542", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368472, "uuid": "aa746984-3b50-4afc-9116-f52678f65a8f", "value": "T16BB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368472, "uuid": "97d10509-b97f-4f59-8f7b-87049e982966", "value": "3072:b6an17WtsWhdgYJe0D6mbPbmTQOWsXAOn:Wan17WPJe0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368472, "uuid": "c7c17682-1b51-408f-bd57-1a6f41c2aed2", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368472, "uuid": "1e8d4a79-f505-4b73-88d0-9651834dbb9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368472, "uuid": "4c4a2172-fe54-422c-bfe3-9310dc75ff86", "value": "4116ea7e0b3883481182edaa2e41c83b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe38a9bd-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374337, "uuid": "2e11d677-c95d-4087-a02e-4de50ecea511", "comment": "Malware payload (Mirai)", "value": "bb7fae203ac419d5ddabf60373df541c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374337, "uuid": "2d417b17-5fb3-4be6-ba63-03acfe985602", "comment": "Malware payload (Mirai)", "value": "ddf75274395ada8368bd27af06ad90072642f4f8e05f444f1d79d5bf261024e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374337, "uuid": "5cc78b38-d3ff-4212-9e8b-de8bac20df3d", "comment": "Malware payload (Mirai)", "value": "26edc7cc93b390f888483d632a3af938b685bb2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374337, "uuid": "9dc0257d-4922-4063-9818-154a18b70ae4", "comment": "Malware payload (Mirai)", "value": "78778cda5ce3df6b95877ab9b00fb14d42123f19d40ab3394c1fe41e0e529ed873dc06e248a4835ae42b77a1fe2cd71e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374337, "uuid": "3278de03-d3b0-47af-b73d-4750bf511500", "value": "T114831881F98B84F1C50B4D3461A7F63FCA31E57A007597ADEF8A5F35DA23A01931724A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374337, "uuid": "8c593ac8-99d1-47d2-8b95-896254beb0c4", "value": "1536:CguEb8iCr/aVol4JI3Fmbs6x6QG7tZj3/e/x5IzdtB3/yvkjgawhD:CgR8iUaWlF3Fmbs6Ezt4/x5+fp/yvog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374337, "uuid": "acab03a1-a327-4e46-9817-a077629f8544", "value": 82800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374337, "uuid": "f0e11d13-5601-4e25-b002-6b7157d46300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374337, "uuid": "f6354099-c3e9-415e-8172-1b45bfcf5009", "value": "bb7fae203ac419d5ddabf60373df541c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e42b7af-fe46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1685381289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381289, "uuid": "3c5215da-a6a1-4d05-9a61-f29c028024ee", "comment": "Malware payload (ModiLoader)", "value": "d25e61a090ba1f949df8e01c61301b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381289, "uuid": "5b34e339-6e2a-47bb-8207-c248fdfcef64", "comment": "Malware payload (ModiLoader)", "value": "de33fd9d4c89f8d5ffad69cb7743922d8d22f54890f9ca69161edce001cba9ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381289, "uuid": "15019735-9640-4232-a460-c6af51469102", "comment": "Malware payload (ModiLoader)", "value": "082cea061e945c15812e123d40794031382d8eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685381289, "uuid": "ce4ca313-da09-4cf4-a2a6-778049fd57fd", "comment": "Malware payload (ModiLoader)", "value": "0f9497d6065a9fd92a2144e5b17e7adc6c7dd55533085e05cfd4ca0421a27d52d15c3abef604125317f8642c5ade697a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381289, "uuid": "38efdf87-2dc0-4c06-9efb-935a75f0c87b", "value": "T1C625AF62B3B204BFE26B1E368C57E355591A7E2019389456B7A67C4CCE3A3413D39EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381289, "uuid": "2a7ea8ec-c572-484b-9266-4acbab4f5c6a", "value": "17581eeef5c5b8e0637670877fe87bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381289, "uuid": "fe446066-f6e2-4817-9a71-d582cfd6dcc2", "value": "12288:jRmIcCn67ZSgSZcKqe5aITzOFjHYsHlTs6EJqdvcFsymAkm4crYFoT:jR8zS0GTzA48InMvamcrYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685381289, "uuid": "2000b0b6-e913-4f94-b77a-bd32bf9a7275", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685381289, "uuid": "4a3c1d7e-2701-4b7c-a5c8-1a82d48e094a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685381289, "uuid": "ea520fbc-2bda-4860-97d5-230b03f194fd", "value": "Urgent Inquiry_Purchase order June 2023_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f051f0bd-fdd7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685333941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333941, "uuid": "e3bdf19a-5662-4aa9-bb74-5b3718e7a7dc", "comment": "Malware payload (Formbook)", "value": "71a7fe01a3c2c02294e4904babc3d8cc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333941, "uuid": "992232a7-701a-45d1-8eb6-b27360b77edc", "comment": "Malware payload (Formbook)", "value": "de80076c4c1d002abd45622a0e79f3f823560d66ef4ef66055ab1a88341d16a7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333941, "uuid": "4294c290-d395-4f04-9d90-96d46d343bb7", "comment": "Malware payload (Formbook)", "value": "af08b7bb2d0c2472e37ddda4b8cf731f0c382b0f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685333941, "uuid": "ca703c0d-0fee-4516-88b6-43920f76e476", "comment": "Malware payload (Formbook)", "value": "9ed4ea4dff3e1c87b966fa4931e16da0febb920be8e50dd0694c679ab40144ca3949f0544cfd3bcf8102df8f704d743d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333941, "uuid": "ba75d708-4d13-497d-8aa1-e5a4e3231029", "value": "T1B0A4F18973831937F78881794752D611C4C0AEF17262A6E7FF41ABAE1C193931A3B1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333941, "uuid": "c892a127-ca40-43ff-aa39-9fcbf6189470", "value": "6144:Ulo8+BdQIbJ7nuwKn4YkjKZh2Swxj1ZcCVWoaVCau4OILldONlLxFYKV7Pr/Xo4c:Uefo5nrk2Yq3RslKKVo4mSA/pOfNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685333941, "uuid": "d809d86b-9744-454d-b098-fb0fcd7d2c8b", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685333941, "uuid": "3696e347-0e57-4963-8f60-797ac51b082e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685333941, "uuid": "7474a9c4-5d3b-4183-8190-1e46d35af925", "value": "71a7fe01a3c2c02294e4904babc3d8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4300cf82-fe1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685362426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362426, "uuid": "cfc4615c-1ed2-4724-99db-17df520f6d9a", "comment": "Malware payload (Mirai)", "value": "b0c45734ef29c8c45dadba18dd8b8d8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362426, "uuid": "57cdf4ef-1f37-4345-b16d-7b21702b36dc", "comment": "Malware payload (Mirai)", "value": "dfa6230c84d7ef9763ad39a0c32d706be51c061a052ad2845b158bd410f82687", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362426, "uuid": "8f7a1418-0203-4942-a5a6-0431e38990e9", "comment": "Malware payload (Mirai)", "value": "951476754f3352409e134bc9cd3508476d9b6238", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685362426, "uuid": "43e26ff9-f5a4-4eb6-8d3e-83f63e42f480", "comment": "Malware payload (Mirai)", "value": "4b80ba83d3d39b140f4eb2ad5e267eb3f19e587303ceb25b663e78bf7c1ae8585b2f6c5ad7c3571b3a1bd37238f2c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362426, "uuid": "59a89f15-79ac-4369-8097-ccfd7c09d89e", "value": "T1E5D34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362426, "uuid": "47b126c3-9c2a-4e63-9458-ac510e080b0f", "value": "3072:ZgauByoyut54A17i5tmFz7rRUQ0Iq3DHUAYM/9kAYj:mauB3yut54A17gmFz7r2QqHUXM/9zYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685362426, "uuid": "75b55da3-e7a9-4692-a071-804b498f339f", "value": 136306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685362426, "uuid": "c3a17d96-cdd9-478f-9442-88c46bf5a431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685362426, "uuid": "dc96daec-a01e-4277-ac03-b01b4f9926e7", "value": "b0c45734ef29c8c45dadba18dd8b8d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6564e1-fe3a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685376265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376265, "uuid": "bd2256cc-a546-460f-b40e-fbe18a9cca3d", "comment": "Malware payload (RemcosRAT)", "value": "3dd7917f2a79694cfbc0fa0cd1f240f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376265, "uuid": "c71c8b9c-f966-41a2-9263-fd6bd7efd2f7", "comment": "Malware payload (RemcosRAT)", "value": "dfdf69495554eac6436be0c085e8856c7de4aca3eaeb7e503f5ae7ad90a4f0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376265, "uuid": "5ccb0b11-86d8-4dd8-b4e7-e626443372c5", "comment": "Malware payload (RemcosRAT)", "value": "7e0070d2d50c0d190a378a75289cedac95f0e189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376265, "uuid": "02518d53-8e22-455a-a2f0-bcd62df4dc75", "comment": "Malware payload (RemcosRAT)", "value": "b52f27c5cd165a78572635ce43f6ede83e4c0f9052a1af0b55f389af627f23dfb1ec9b1b54801e3e604fa2d3495a47f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376265, "uuid": "aa9a6fa6-1eba-47b9-835a-d39e073b5c14", "value": "T183A4BF01B9C1C072D57661300D2AF775DAB9BD202926497BB3DA1D9BFE30190B63A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376265, "uuid": "ebeec6c2-5e40-4332-88c0-a1ac7ff70aab", "value": "3f3d4ba55ce3e8f736704310c56bf5aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376265, "uuid": "d687cdb7-f0d4-4dc2-92be-5e1982803488", "value": "6144:41EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZiXXPcNV2OhX:41EZT90uNQzYgScBvnn/XpTs/Zi9OhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376265, "uuid": "09c29248-a45c-43e1-9d64-7507ad34a66d", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376265, "uuid": "c33e3b5d-5cdf-4424-af29-4bb83d0cbf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376265, "uuid": "7997ed36-5de8-4ef9-80c9-524c43e4f994", "value": "xffa8yu1wWRN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c71f22-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388115, "uuid": "95ae0bd9-f479-4059-b612-d91915bed3b5", "comment": "Malware payload (Mirai)", "value": "33ec366fe45091c14071bd52d267ad79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388115, "uuid": "feb8a74f-0163-4d92-aa10-0ef6779f12f5", "comment": "Malware payload (Mirai)", "value": "e0d7af0aeef6c2ab1d266e51ffce066deadec6ca98fc269a170a6180e9fb383c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388115, "uuid": "bd02531e-9d10-46f9-b756-4669a0deeefe", "comment": "Malware payload (Mirai)", "value": "a9ceb019508c3e7e9c59210a6fb5a5bd75d5314e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388115, "uuid": "4a1ee3cb-3655-44be-8286-2a81024e8a86", "comment": "Malware payload (Mirai)", "value": "8b84c68b2867a8083e72ad99ca5b4038b8e9a03e04fa2af13595f278b422f592fff983d35a45900613c4d066f4ef4c80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388115, "uuid": "91fb8757-30b2-4c0b-b340-d376e5f3fae9", "value": "T15A53830ABF651FB7DC9BCD3709EA271524CC651A21A93B397934D818F24B25B1AF3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388115, "uuid": "18404e87-cba8-4363-b4a7-a4924bd4cb69", "value": "768:TDXNhNHDdYgyVwcwjT9aq4K/grTec5TxeOeGTeXKF9AuRXiiIsQGo:TDPRDCginDfbvT0KbhhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388115, "uuid": "e60f9857-eca0-424e-b6ee-a220c23857a6", "value": 65444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388115, "uuid": "b4be7f7c-1063-4428-b2bd-6f02573a7ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388115, "uuid": "304902d5-b380-4997-8239-5725e70f4b6b", "value": "33ec366fe45091c14071bd52d267ad79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aa789f-fe21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685365348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365348, "uuid": "0c3f2334-8bf1-406a-aecd-a37d484416dd", "comment": "Malware payload (Mirai)", "value": "d117184a806c3953180cb2380adfeb77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365348, "uuid": "b248a1c1-20d6-42f2-8dac-6b616e5cb391", "comment": "Malware payload (Mirai)", "value": "e10eee4f653bf67ec91a781fd9fd25a1dc28a5306b6d9132eab8d4a9c0f5d94d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365348, "uuid": "48eebc4a-bd42-41c0-b768-3f8834b0df49", "comment": "Malware payload (Mirai)", "value": "baab09dd111bc8030314c5fed0b1314712302c5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685365348, "uuid": "eead41bc-cf9e-4496-a547-364c15ddce74", "comment": "Malware payload (Mirai)", "value": "b4808e42e60fda8d97f29280c04d63f6b7b580baf38d451cdd775b752c0654b7de2b739886b0d851c7071c8a3c6a17cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365348, "uuid": "964371d1-bed2-46ca-85be-c220450fce69", "value": "T1DFB34B2277794A27C0E6A43941E78337B3F69B852930520BBE659FCC7F0A6E031573A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365348, "uuid": "8d2e4305-89c6-41a1-af4c-7fe488738849", "value": "1536:es28iSDTxBQ6edXuuLJK4i0LNnvVQkRLVqdPp0GtYGkQb7tmIWmBwVrFG4IoB:aqT3mTLNukbop0zYbTWmBwV5G9oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685365348, "uuid": "16f16a98-57b0-4188-a1b6-559920fd42d1", "value": 116907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685365348, "uuid": "aaf88275-ebc7-4687-aa43-291dda6b9c3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685365348, "uuid": "fa0ffd60-e739-488b-aaac-720329353606", "value": "d117184a806c3953180cb2380adfeb77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9701338-fe67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685395776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395776, "uuid": "f80def6a-3b36-4d3a-8299-8afbe9378c51", "comment": "Malware payload (Rhadamanthys)", "value": "cbcda16b57cbddf2b6b2dee3c5c2e598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395776, "uuid": "5f9d00ab-db90-4033-8089-f39a2dfd67e6", "comment": "Malware payload (Rhadamanthys)", "value": "e2160fb0cdb707aa84430207c6357cb9bc099ab4cbbc5299d8be7208a41a718b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395776, "uuid": "21371fe8-02a0-4144-8f47-ee08061bea10", "comment": "Malware payload (Rhadamanthys)", "value": "885683b7d9f86e8181fadab50feddcaac3631610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685395776, "uuid": "bbc6ce29-f100-4d9d-8897-e6bba22c6c6e", "comment": "Malware payload (Rhadamanthys)", "value": "22c2b693d53675760b7af16357fc08c3ad4bac3612744fee9356d3cebc029c88dfaa5343df1c30222b38c74cc45d37a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395776, "uuid": "8b0c4d62-d04f-461c-815a-1ad37590ddfc", "value": "T137C49E0362E27C65FA6E4A358E2EC6F8771EB9504F1537B712185A2F08712A2CD7273D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395776, "uuid": "f9710096-5f92-408c-b2bd-9d705c78ad43", "value": "d0fa90ab077085f07c566a80dea00339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395776, "uuid": "5fe47090-a53e-4e35-95fa-eb256b1fa5c6", "value": "6144:QkAe/uEYWJmRI/3/JXnqmalwYVclXX0d2Sd8sZlKtwa8NI4TnU/L8jsCmc0:QcvY5Rw3R5uwSc1pS1Zlow/Uz8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685395776, "uuid": "d467e29c-7384-4be7-a4a4-2944adbbef41", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685395776, "uuid": "21cf6215-b2b7-48c9-954a-3df7c31cd60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685395776, "uuid": "422f2644-58b4-473b-9193-3f12ec60f523", "value": "SecuriteInfo.com.Win32.Evo-gen.26890.14513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceec5209-fdf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685348487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348487, "uuid": "4785c0df-93b7-4cba-8761-a0f74e693911", "comment": "Malware payload (Amadey)", "value": "b9e4d4dbdb7eb7d75fa87aeb53dde92f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348487, "uuid": "5d76a0cd-0447-4a52-a58e-52e660489bcc", "comment": "Malware payload (Amadey)", "value": "e224286fe0e8031f05372f7a45f2fcf7052f6f10f02231d0e3139c90378e91c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348487, "uuid": "5eb476a1-6076-4df0-8986-6ec2083125d5", "comment": "Malware payload (Amadey)", "value": "481b212ba1ff30a30c2c3a4ea8480482890a4efc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348487, "uuid": "d31eba44-67ec-4fad-b340-620b17075d8d", "comment": "Malware payload (Amadey)", "value": "535989a64c63b6464297dd6caa1171ae17eac2e246a2a6cef1d80840939b19bd0dd28df9407f8479c8cdef543854a351", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348487, "uuid": "25f2919f-7759-48e1-b7be-39cdac3a1e90", "value": "T12D051253E7D88022D8B52BB098FB13C70F39FC61AE7A831E27595A5B9CB2594553032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348487, "uuid": "bcdea1fc-dea4-4c66-a3d9-86ac3c658f82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348487, "uuid": "9f7dbd8d-6f43-4401-affb-7fcc7728547a", "value": "12288:yMrEy90jg8T+bia8oXSMf0tG61iVh+6NarZ5uBP3G44PGzwQvMUE2sPX2uOxRGX4:CyP9biarSNGVMPk3KuzlvMUwvUGX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348487, "uuid": "c1b256a2-3df2-4f97-a721-c0430fb037eb", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348487, "uuid": "8b9cef1d-fde1-4e9e-9111-4f0cd939e59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348487, "uuid": "d9ebcc88-5869-48f3-addf-9d7e934ab0c9", "value": "03729399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5490db54-fe28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685368468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368468, "uuid": "59dd0c55-bf9d-45f6-94b7-1576e62ab5ba", "comment": "Malware payload (Gafgyt)", "value": "f5bf4e0aa5bb99033c3e801e192e9c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368468, "uuid": "3e2cb696-be2b-4d3f-bf65-295ebf80953e", "comment": "Malware payload (Gafgyt)", "value": "e2cf3fe8caf047c23463a265ac73536cc77d6a179f030c6409cc042b8652f608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368468, "uuid": "cd9038c7-048a-4fc4-b89e-2a53bc23ab86", "comment": "Malware payload (Gafgyt)", "value": "c9afdf2ab3f4db728f17a14610231fe32e7eac7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685368468, "uuid": "0d55aa31-8f28-4e3a-b381-0f83467b9f9d", "comment": "Malware payload (Gafgyt)", "value": "3c53facc4f1c339bc4ff56241dd539b269ca4db38aa065a716ee34a77bdb081f2ed855d5cc8bb9a6ee27d8f73500a0a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368468, "uuid": "fb160838-aa84-4ecc-a68f-759880ccdbf1", "value": "T13F930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368468, "uuid": "e728d0f6-ebe7-479c-8551-39912592ed32", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOx1ePczYrmREqQ4b/X7XSee:OQ2HYBv1WT4ePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685368468, "uuid": "2cecb85f-2199-4cc4-9bb7-c6ba1b6b7258", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685368468, "uuid": "0d3cbd66-cb49-4faa-b591-78df47886347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685368468, "uuid": "122f1e5f-618b-4e2d-af63-3738d86f0d5f", "value": "f5bf4e0aa5bb99033c3e801e192e9c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a0883b-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374315, "uuid": "ac4a9e98-9d10-4dfb-9e41-196fa3ba5cac", "comment": "Malware payload (Mirai)", "value": "765ee026c5ee1d3799583569083f44f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374315, "uuid": "a0bf24b2-c0f1-4bdb-adf3-8ca8bd5cb87d", "comment": "Malware payload (Mirai)", "value": "e35e1b5d32a1f984e65c824a44c4f9494425f1348d66fc7696ec1515ee3e38b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374315, "uuid": "988a91f6-d547-4d45-8b62-fff76de745f8", "comment": "Malware payload (Mirai)", "value": "3022d10c849441f6dcd6703bb4da1da1d27e7ecf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374315, "uuid": "425577c5-560a-4510-ad99-3a919be74f77", "comment": "Malware payload (Mirai)", "value": "9a44cfee785529eef8a9863f7db6da751dec3f825dcd3b75a59edaf3b832ee8738104382343086a29e2a7528703963ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374315, "uuid": "5efd0712-d9c7-4985-9cd2-08d20fc70027", "value": "T181737DD5B8005EBDFD5BD6FD81224A0DBA2172004FA30F27B66BFC936D72195AE06C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374315, "uuid": "c5ffe247-3291-4acd-ac4f-6dfcfef01990", "value": "1536:REpVkXRN9UcdJgH4cLVImWtHqUr7dBzsPn9qjQXwmZoC8fysB3eXr8W8/w:OodDgH46IhZ3rOVKx6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374315, "uuid": "1d17e3a1-79bb-4ee4-b7f2-a2c576312460", "value": 80236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374315, "uuid": "0800c805-64e9-43cf-b0c2-ab8e28eb7fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374315, "uuid": "07724978-8363-45cf-a846-1b682291b3df", "value": "765ee026c5ee1d3799583569083f44f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf453031-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377237, "uuid": "13daff6c-2f14-4999-9b55-f0052ad7a2e2", "comment": "Malware payload (Gafgyt)", "value": "d09e977026111573c46db9d42acf200d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377237, "uuid": "9918bf27-72a9-469b-a6b0-5bc1a70587bd", "comment": "Malware payload (Gafgyt)", "value": "e436f80cbf3accb70dcb75a3059ea70193d332b6d03d6b0b3b74fbd7ff92a225", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377237, "uuid": "43edcd62-8df3-444f-9210-2485f681a285", "comment": "Malware payload (Gafgyt)", "value": "1234c07634425e03caf2fc7ce8adb46d2572b405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377237, "uuid": "1e2185f1-21f4-4493-b158-1648fefb0844", "comment": "Malware payload (Gafgyt)", "value": "41ad9b30a94b5604219e115033633389a9389fa9bbd70ad2623090c76dda7dd73af7d96334cd135a1c8662c34d3dc87d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377237, "uuid": "cf31f263-6fd8-4d09-bf91-e71bb963a459", "value": "T1B4933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377237, "uuid": "09f1f055-94f8-47e0-9beb-1be7aaa63dee", "value": "1536:jW6Jk7jWNEqi+thy5ct1lNcdj333mX0Gq4/cOf3Tj:CwNzi+7C+lqdj33mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377237, "uuid": "269265e1-677b-4352-ab00-15b4a24d88e4", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377237, "uuid": "66a67c64-061b-4dc4-a2bd-0b2b104a80cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377237, "uuid": "cfc2f45c-8e77-4714-a00b-f41223b2be2b", "value": "d09e977026111573c46db9d42acf200d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c35b037-fe31-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685372320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372320, "uuid": "f5909fb3-e73f-4da0-8ddb-bafb1d713521", "comment": "Malware payload (RedLineStealer)", "value": "8af4b0f9e04c19a31170e86df45f3acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372320, "uuid": "d1729cde-86a1-4aa0-809e-553ab3374804", "comment": "Malware payload (RedLineStealer)", "value": "e5a86ae423826fc15d42cbb3d09d83e1ab930205ea76dd2b964181f2a3001b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372320, "uuid": "5049f323-122b-4f04-9f6e-c04d7547d128", "comment": "Malware payload (RedLineStealer)", "value": "9b5e86985ebd872343ed7416bf7124ab358b8ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372320, "uuid": "680ba60d-8872-43ab-8470-6f83f70a1500", "comment": "Malware payload (RedLineStealer)", "value": "b50a48c1878fa87e8a3abc513763d95dccc086d0b680f854343e2f1e777a2d17c59c70656ce57d562fbe8f8258a7a5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372320, "uuid": "7312a0b0-2072-41b8-8c8d-d2923569e823", "value": "T1F4052257EBD88432F9B517715CFB03A30B35BCA0AD7597AB1649A92D4C339C8A53032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372320, "uuid": "7bdca13e-0c31-485a-b4b9-0d2adfb7d310", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372320, "uuid": "50c25386-bcf2-44db-8d1a-fd11168f3e53", "value": "12288:HMrOy90SEODmTboqxjJ/nFOr+C7cgx6Lt3xzdDiQLh2xPX2uZVR/CjXm/:dy/QoqxdfJkcg0Lt3xwc8vH6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685372320, "uuid": "71b90846-db4b-464b-89d2-2f5e65c11b32", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685372320, "uuid": "9b84f431-5734-479a-aa53-8e343e39e152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372320, "uuid": "197aaa2c-1050-4912-8a5c-6a9b4706d64b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd81a48-fdf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346932, "uuid": "5fe1de3a-5987-4b53-9de0-7bbc947016fb", "comment": "Malware payload (RedLineStealer)", "value": "cff422758c113fdc676c068985003a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346932, "uuid": "80540edb-90e9-4d83-a2b9-9ff95898f0f9", "comment": "Malware payload (RedLineStealer)", "value": "e5ff4642018794dd10aaa607b54002da51342156a4ee64120f3f32741ea8010b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346932, "uuid": "46975200-6b2c-485f-9a3d-c766c5a12bb5", "comment": "Malware payload (RedLineStealer)", "value": "baecec7eead7d8ca0cf4e8df964a8eb1232f739b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346932, "uuid": "a5edf5ed-5c02-4093-8163-f90ba8934a4f", "comment": "Malware payload (RedLineStealer)", "value": "09d3e3e8528ad8b7a53bc7a1f3b6db73ed16067218e501d94775b2246fb3bfab8915e4fde3c352e3cfc3b79446ecc5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346932, "uuid": "bdee1eeb-7ae3-420e-ac6e-80452370bd60", "value": "T1D0051213A7D98233DE7A1B7058F703D31B36BCA1197882766319A54E4CB37A4A13637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346932, "uuid": "bfcf603b-bb3e-45c5-a2ff-b80124488455", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346932, "uuid": "91137596-f500-463f-bfac-92478f724afa", "value": "24576:Ly6OAqy0BQ2pUuoQ/XfUDz1eBvKgF8Oh4Lpc:+k4BGqffUDpeBvKgF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346932, "uuid": "f4019744-05a1-4eff-bc67-061f0692b099", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346932, "uuid": "0819f5ca-ef02-45b4-a7ea-055ef7b6ec89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346932, "uuid": "e0876c0c-f73a-4baa-ae89-3931d1125d62", "value": "cff422758c113fdc676c068985003a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af06435b-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685354017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354017, "uuid": "b0b77302-7675-4d7f-9d5e-5d14abc983f9", "comment": "Malware payload (AgentTesla)", "value": "87eaa4e11c207bf5dde9dc1f19d18a31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354017, "uuid": "051eb018-8c27-40a7-a126-1a491d6b3c48", "comment": "Malware payload (AgentTesla)", "value": "e6e3d8d599a4dfa1b02a095eb6e5f4bc30ae29562a96f9f801a70a9bbc774e84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354017, "uuid": "c3e7e935-fcb7-48c0-bac2-43b5450a8683", "comment": "Malware payload (AgentTesla)", "value": "33a5f35d4f34a4d8c36d289628d83e0b97f05209", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354017, "uuid": "757ddd2d-acab-4f7b-96e0-0ad0b0b37e64", "comment": "Malware payload (AgentTesla)", "value": "143edb218f78b230fa701f823472296dbe9878a2e5419675035dabbaa3c0c79e653dbb156b9d526efd5707e383757104", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354017, "uuid": "afa57f92-f8ac-41e6-819f-bfa5ed3f7cd2", "value": "T121E4125629A97F16D43ACBFA8830757043FB7AAD7036E3462DD7B0CFA125F420601A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354017, "uuid": "6e80b25f-095c-4900-a345-07fecd8c7216", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354017, "uuid": "8585c9eb-867d-4c9c-9faa-9865dcef9cf7", "value": "12288:sZ1mzZBEP85o2Xx91t+ujCrdDIVZsQvrK/jwCIT:R9BEP8nXtjKJIR2NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354017, "uuid": "ef85135e-7b84-40e0-ae80-fbbca1905469", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354017, "uuid": "5b03ca18-4053-4d18-88f0-f373adc0904f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354017, "uuid": "f205541a-0968-40b7-9a37-7a35e809037d", "value": "NEW_ORDER_9876_77389200_777666222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f6e787-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685377119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377119, "uuid": "97cde531-8d67-492e-b254-f08e2cdee151", "comment": "Malware payload", "value": "781d6ac8bc9fd79e010da59c4a070fdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377119, "uuid": "1b363097-ab27-47cc-b974-cd1d6c1614d0", "comment": "Malware payload", "value": "e6fcf81379b4fbd411f15153f5d802aab707c73c81679f0b747602fab36859f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377119, "uuid": "5cb3f73e-7984-489d-a31d-575dd5454677", "comment": "Malware payload", "value": "13b4b59e2ff47e8ca84fc56ede898e018904c8f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377119, "uuid": "7b616ccd-337e-434b-be65-4935e6388d2c", "comment": "Malware payload", "value": "eeec4917513824ed4259029ca7bae18bf0508481a54b93931c9a46164203df838ddc290d86d520bf53b09958e74376a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377119, "uuid": "f9ee2df7-e418-4b31-9fcd-49f96bc7abaf", "value": "T1A6A3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377119, "uuid": "5619a7f9-63dd-43e5-9510-28253c67ce33", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3nek2bS1jxlrimW+zWBSirHzai:VR/fymd2D3F2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377119, "uuid": "aab64150-74e9-4cd3-8ef7-d93cae81fae8", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377119, "uuid": "f4f13024-503f-45e6-a2a8-cc8789851ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377119, "uuid": "d5e1657f-5cfd-42f6-93e0-f45c93848093", "value": "781d6ac8bc9fd79e010da59c4a070fdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91e2192-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371617, "uuid": "80e63a96-3988-4bb2-826e-907cc664b223", "comment": "Malware payload (Mirai)", "value": "374ef52a28d4aa7e5909010d77f3f128", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371617, "uuid": "02a7bf49-ad23-4cc2-a727-691541912c55", "comment": "Malware payload (Mirai)", "value": "e87056fe1c0bc69b5b88598a76f532cc7b11ed5927b415e42983b85be3b36a2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371617, "uuid": "3a08a005-e275-44a5-91dd-e2ff4d90cd81", "comment": "Malware payload (Mirai)", "value": "5d45f46fdce25b1323c32c7c5f2e9bf45389b5d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371617, "uuid": "d69037a9-cda0-496c-9d84-fd191d650c0a", "comment": "Malware payload (Mirai)", "value": "06cd3aa556c43d58bdcad872552f1d820d15fb307345d7a1b99b9641b68dbb846088cf3d81cf2ee41b1521b91c6778df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371617, "uuid": "f6c9acc2-888c-4346-a51e-913c07b54888", "value": "T18D13F2C024040A09C7C3D5BC5963A41B2557AFB42D2D6338CB270B7AFDA9ED6F169AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371617, "uuid": "6af09309-18ca-40ca-8ede-4b5cfcb0d08d", "value": "768:92VVNh7lMuAw6pNQAkpARyfwSBI77EBgCcCEJe7WB95Bi+xG37X0:92Vbh5tiftyAYwSBKkgCcCL7WB9Hi+xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371617, "uuid": "34b2f942-b25c-4111-9807-2b74ecbb473b", "value": 42144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371617, "uuid": "2798a75d-d76e-44ca-ab28-c7e9065c302e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371617, "uuid": "49914fd4-2f77-451c-9e8f-0bc118635fef", "value": "374ef52a28d4aa7e5909010d77f3f128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a84b7b2-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377149, "uuid": "860f27b4-f11d-4508-8f04-5a417e76c798", "comment": "Malware payload (Mirai)", "value": "633d12e05f61599fce4b7c7d4168ce5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377149, "uuid": "755c1308-ac55-489e-af1d-8ee51d9b9b1f", "comment": "Malware payload (Mirai)", "value": "e918d2cb4f83a26fa601e273571f423c857f0af9bde0aa31f0819f9080f4b437", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377149, "uuid": "6fb0e3a7-0ebe-4fb5-b8e4-993c5c589134", "comment": "Malware payload (Mirai)", "value": "1696bf46c72b718584b5d5fd8a04e4ce0b55d857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377149, "uuid": "7e020839-076f-4fc0-a7e5-a4fdcfeee13e", "comment": "Malware payload (Mirai)", "value": "6ec815e5052e611fad15794f96c78ead5d691b1ef2a5b662e3a60066eee7d92be28d0d1b9ac993bd7aef876ea4e22358", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377149, "uuid": "7f7f00b0-2a2f-476b-ad87-c06c8dd22f45", "value": "T14DE2E0566C9721B1DDE01CB8D0AC16CD6B671BDCF0B5F0699E54D228F9C7C4C0AB2EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377149, "uuid": "dc223245-a0ce-42da-b2e1-4d5e7ce982fb", "value": "768:ahFnPgcz4YE7vIoHBHDv1NtYncAVMzk3U6:2nPxz0r5HDv1wcrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377149, "uuid": "c0bd5e16-f62d-4398-996d-5dce3c9755e4", "value": 31236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377149, "uuid": "2b12a52e-e523-4632-a261-4863343b6bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377149, "uuid": "252cf32d-4813-4b4a-9162-d225777c3121", "value": "633d12e05f61599fce4b7c7d4168ce5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da13ce60-fe3d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685377712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377712, "uuid": "359355a3-d9d3-4cc6-a7fd-0f47ea4881f8", "comment": "Malware payload", "value": "4f79aaa48d640102b836cc1d2789b94f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377712, "uuid": "d933bc0c-2045-4d58-b4f1-d45687346cb5", "comment": "Malware payload", "value": "e92385ff8e698a64e87f6848f9b2c62d33e303ca609f89ea0e1ffe6e7b0783ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377712, "uuid": "38bc4d59-900d-4f75-8cf0-f3ffe651d140", "comment": "Malware payload", "value": "5ab80d276b7614bebc3551c00bc7a1679b1e90d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377712, "uuid": "cf8ae828-aa5f-44f8-998e-e9e3c46f2165", "comment": "Malware payload", "value": "b417a662d1c8ae992aae2d7157aced860202fd7e0d57168d9609add7b034878ca8132ec8c00b3655b6ac349d517f429f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377712, "uuid": "3a2fe419-ad0f-49d1-aa29-67e8ca329c4c", "value": "T1AF765C8B72D512ECE0DD0F331351829063E9E5363BA05EFE4A208714957B5B522EE7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377712, "uuid": "e1826901-ffaf-4915-b085-5659c835837c", "value": "fe63e322309337ee09a198afe547e82e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377712, "uuid": "5e29e849-0a4c-4401-a67a-5b7ce9333d4e", "value": "98304:pIQrBuigQcbN1HM5CJ/vfMj0zsnjJBMCNcIA4PpUBxCRJ:pIQo3Qy6e/vUoYnFBMucUp4xCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377712, "uuid": "e99db5f0-3b8e-4f70-9dbe-fc65fe3e8c5d", "value": 7408640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377712, "uuid": "5bafde6e-354c-4937-98af-cdd54df8e2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377712, "uuid": "7696ee9f-4a31-4766-86bb-581acf31503f", "value": "SecuriteInfo.com.Variant.Lazy.345604.31413.20912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfabed3-fe6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685396697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685396697, "uuid": "ffa09b69-a55f-4fd2-8a07-977bff4b4d27", "comment": "Malware payload", "value": "6ffa6035b63e8be55d7c9dd0d6cc1b56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685396697, "uuid": "5e3ef25f-1e61-4e8b-bb1f-4a2f95a5d029", "comment": "Malware payload", "value": "ea6d07dfe0184b08a53161805d66a1bc1f7974367b8407968e1922d41366c236", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685396697, "uuid": "73c8710d-a33a-414f-9462-8c097fc7b9e9", "comment": "Malware payload", "value": "979fa7669c062c2e909a719fef22ef57f28deb9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685396697, "uuid": "a86f2a34-a4bd-49a6-8ad4-15bdf8d5e663", "comment": "Malware payload", "value": "c8addb2e98484828e3a2492be6d4b5eb0b113ebbdbc62017df89c52635a074d1be2cd9be168ebd565d63a714822dda94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685396697, "uuid": "c7cde1e4-c524-4591-8374-61fae66e910c", "value": "T1ABC4AF0262A17C65F6264B718E2EC6E8771DFA604F5537FB1658AA2F05702F2C172B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685396697, "uuid": "e997d510-b89b-4895-a3f4-f9b63896bf6c", "value": "1b92b40b68088f344c60bb50fd5ded79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685396697, "uuid": "c7c6df75-d95b-4bb2-8cdc-fced6c1c4c41", "value": "6144:GRi84s721X+mo7p0ebtorbzrjgxoOrwuup9rCOVkSFGSyBc8YIl8hZr0:GR3SXIjOrXLjlrZmgv8nOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685396697, "uuid": "90242c32-3887-42ba-97b2-6e1937cec901", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685396697, "uuid": "95299c41-ccea-4acd-92d0-5efb08651eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685396697, "uuid": "a6316cb2-6f10-49c9-ba43-76115c60b871", "value": "6ffa6035b63e8be55d7c9dd0d6cc1b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ff1ced-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363421, "uuid": "a126efa1-4114-472c-994e-a76c23e57398", "comment": "Malware payload", "value": "30a100915ac87896431dc5a4ed524437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363421, "uuid": "9917f46e-b89e-4957-93f6-e8a930a36c5b", "comment": "Malware payload", "value": "ec4af9764bcb941f48fce35f93fe7e0bd16f143522e51094a92d8b45716cc94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363421, "uuid": "2b6cffec-dde2-4da6-b0d4-3a373539681f", "comment": "Malware payload", "value": "a3709021b4c465461b9d666bf7e169449e3b04ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363421, "uuid": "a8e2bf74-4d05-41ef-983e-674e9e947918", "comment": "Malware payload", "value": "ec7c91bc0e1dd67a6be04902c4a5c86b3a58ad9382acbb4c9d32cd11786dd92cfaa5ee03f09d95562e2be0cd3dc03b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363421, "uuid": "0342cd42-7670-4635-a0cb-ea1cf16861b4", "value": "T15044D0BB0C614A39D026D97FBA1A31C9FDE41D6D6BC428AC198531F197F04A8B31C6BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363421, "uuid": "b349cc8f-b852-4e69-a822-75035e1d59bb", "value": "df6e1b1accdc0f1a184f99d8b06e43fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363421, "uuid": "4dfca365-ddd4-419b-a297-e8149e0798ef", "value": "6144:pCfWdWOr5x5kY/U3L2sIldWOr5x5kY/U3L2sIBdWOr5x5kY/U3L2s:sfXOrnqY/W2sIaOrnqY/W2sIOOrnqY/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363421, "uuid": "3a429799-12f7-4c83-beea-31293e6ed4fa", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363421, "uuid": "059fdab8-2030-4075-8859-b41a04c932c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363421, "uuid": "58bec174-5b98-4036-b922-9f40d48c5dea", "value": "SecuriteInfo.com.Trojan.Win32.Hrup.20902.10167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f76deaf-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379707, "uuid": "24fd795e-ef2f-486a-8da6-88ec36f90200", "comment": "Malware payload (Mirai)", "value": "f85d872a763baecd3a902e5ab35d14f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379707, "uuid": "3cb9394c-cb36-4be7-869d-1877d78589c9", "comment": "Malware payload (Mirai)", "value": "ed402904dbb8a9cc028ccd196388dac3ca3ff28c1dea71347dbc195b135e1107", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379707, "uuid": "69fb537e-8f61-4241-a844-0a0e09ac4f75", "comment": "Malware payload (Mirai)", "value": "d396728b44de2f317ce21b906ff9c8c4f9522fea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379707, "uuid": "c471de91-f510-4e22-9fc7-841180a30328", "comment": "Malware payload (Mirai)", "value": "88925accfa353374b46e85ff8ac10bb4c03934144be43d46c04f151ffdf0c2198a7e01fd5faa7016bebdf30f0a8cb629", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379707, "uuid": "1a82255b-6b0a-4f44-915d-dd99bd9c9b05", "value": "T112B32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379707, "uuid": "61ae5e61-ea54-4ad4-b5f7-baf7bbc888c4", "value": "3072:Uvc29uyIcxE/sZxw+OqVKZmm/QcuLmH26PNb:Uvl9jIg4sZxjOU4mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379707, "uuid": "109c7f5c-2a74-48f6-b261-3400e78482cd", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379707, "uuid": "98b3b176-7033-4b22-be8e-aef6a33194dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379707, "uuid": "d3db31c3-3804-4bfb-9085-fc8551fe3945", "value": "f85d872a763baecd3a902e5ab35d14f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e583f297-fe39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376013, "uuid": "9ea8a6a4-6de0-42ad-a533-a1310f291ec5", "comment": "Malware payload (Mirai)", "value": "cd2210867379aef7329dd7bd4cb078e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376013, "uuid": "e56a108e-dc2c-48da-a1e5-91f8afdf98d1", "comment": "Malware payload (Mirai)", "value": "eda24dd7b06730bb63713803ca1600dced9c162663aff1fd5d0693086ddb320f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376013, "uuid": "d4915a93-75ad-458c-890f-c8563c6c0c52", "comment": "Malware payload (Mirai)", "value": "ffe0e81e4032aadb91ccb803af7c6b55cb65d886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376013, "uuid": "1929f712-72b1-40a3-831d-c6bd6158a5ca", "comment": "Malware payload (Mirai)", "value": "bc86f21c03c7855776ee36459ca79f240152585b176bda4cecd498b71b1a5533b7f1500897c8405f1409ab2c13fe6bf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376013, "uuid": "63b91e9e-da57-4f83-b40a-a8cc88d9ec8a", "value": "T18AA2D012FF2880D7CE22B134CAA4AA987341F879A75D6E555FC0C21FB0E73915434E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376013, "uuid": "6bc17548-e9e1-4cab-983b-c8f08a7de624", "value": "384:MY1Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkfaQtI3TopibEjQ6Q8i2kdqr4mV7rSO:798o08kxofBE+Zkfa2p+Eo2dr/VlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376013, "uuid": "2520b5ba-b5a2-4a44-ad92-18ea6113f9bc", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376013, "uuid": "786dbb09-cd2b-419f-8796-3c623d0c77d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376013, "uuid": "32826aef-9053-4778-8b4e-e20e683a5539", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba68421c-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377229, "uuid": "4f1228a0-caea-4470-8114-611193cd750e", "comment": "Malware payload (Mirai)", "value": "921819db26111f1b3188790268872916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377229, "uuid": "9058bb36-a25f-443b-a117-0a189dc4aaa4", "comment": "Malware payload (Mirai)", "value": "ee3747f266fcbfccff8136c29025362d400a9861b891c74632e29dfec77ad6a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377229, "uuid": "45b3a255-2a7c-4502-bec9-dba1d64d7489", "comment": "Malware payload (Mirai)", "value": "10c23ddf198447375807cfc6e1570b134fad118e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377229, "uuid": "ced50496-dfd6-4400-a696-a5b1432525d0", "comment": "Malware payload (Mirai)", "value": "12f35f0f53e5b74313ba5c4210e3d69b8654e5310c885f6a913bb050332c64b2bbd47cd166cd781d7ffe0c09c0a5590f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377229, "uuid": "fada1b39-8bd5-4d79-960a-7b080a906a87", "value": "T121B2D119C0AE2E74FEDB7D345D41E2817FA19BDF7A62CDC016C15A110222D2C1F9CAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377229, "uuid": "7512625f-3795-4b11-b128-f9ed04942171", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo3/DqM4uVcqgw05X:2AApCdvwJr69VJoA8FZtxCo8SLx4uVcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377229, "uuid": "c6ea7799-f8f2-4250-927d-27d0e8a56c12", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377229, "uuid": "aed15af1-197c-495b-90cc-13adb5e5bf60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377229, "uuid": "256e9231-271a-493d-a87b-f64b665965d8", "value": "921819db26111f1b3188790268872916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74267688-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346617, "uuid": "baca0419-1505-4bcd-aec0-43901334ca3f", "comment": "Malware payload (Amadey)", "value": "102db0121bdce5bdbb39ff06368c35d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346617, "uuid": "751e498e-644b-4542-802d-c48819579c4f", "comment": "Malware payload (Amadey)", "value": "eedfce8e36570850f4dae74a7c0f54c7303f6d2132269dad20d250fd94ab6e81", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346617, "uuid": "b8c87a11-bc5f-4169-8d25-65ea50618e06", "comment": "Malware payload (Amadey)", "value": "fd43adcc7a811785aff4f978d0a5906c96f7e356", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346617, "uuid": "9a6a7ae7-618a-4de3-9156-dc7b7d568d2e", "comment": "Malware payload (Amadey)", "value": "a07f048d31e8fb04fcd46ec13d9ae292e0579e86f7a51ffb4ad7ac2047b7f4922e0d2c1106df63f5188485e339b1b4fe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346617, "uuid": "6451f60a-749a-43d5-89ce-33c6bfb65e08", "value": "T10C05228267D94573DEB5573088F203831B36BDA19DB483AF27041CAA1D726D4AB7273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346617, "uuid": "d155ff51-cf1f-4f1a-9047-649a8ff786a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346617, "uuid": "4478ea3a-6b01-48a0-868e-950843d039e0", "value": "24576:Iy4krcPaNRj569VWFkXCV9De+nr6US3mJ:P4nPaNRV69UFy8w+nrim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346617, "uuid": "e8de9fb9-299c-4e0d-ada4-6783d1d6d992", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346617, "uuid": "2434673a-ef9f-42f0-9d3e-0a322e7a9cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346617, "uuid": "8740d5e9-8f64-4295-a2af-6a55865ec571", "value": "102db0121bdce5bdbb39ff06368c35d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4cbec4-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Warezov)", "timestamp": 1685354009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354009, "uuid": "1c75f445-4474-4f49-8d7c-767992e12ce9", "comment": "Malware payload (Warezov)", "value": "6b7ed3abdd8484b313948ba83fde717f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354009, "uuid": "ba9d5ede-7de3-4f4f-b465-b0e2ef5d77a9", "comment": "Malware payload (Warezov)", "value": "eee33ed66c2e88e414a5887043db18edafa2fef889882d751f0448ed360efc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354009, "uuid": "2a6aff1c-2a97-463f-b901-d69aa08d17a8", "comment": "Malware payload (Warezov)", "value": "2318e1d65cef538f1cf88e2235a5dd350ff40449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354009, "uuid": "cefb9704-835e-4e3a-8f0b-102aa3a8787b", "comment": "Malware payload (Warezov)", "value": "41baa7847cf70cd0686b4e5b3d1cc918377b8764e51044013ea539ae3d3487b0852210f4357326963bf5b9853d6e07fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354009, "uuid": "35446f74-8bc1-4b50-afb3-4f452e6acbb6", "value": "T171B44A14EE5DD0B1E54B087D076A6A957BA05E7D836856D38F403E6BA2330C2FC3BD4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354009, "uuid": "0e2e56dc-8fef-4c41-b29c-ddd5f72f2ea4", "value": "1d1ca12745771ba3c77da58435c9e56a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354009, "uuid": "947147fd-98f2-44fc-be99-32dcc550f35f", "value": "12288:gYQZsuW9geRWQmkt5nZsCRUTV5nhsf8r1J3OIh8W:gYQZsuW9geETkPZstTV5na8RJ3zhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354009, "uuid": "c83c5a35-1d19-4bae-92da-ce576ab82e02", "value": 520196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354009, "uuid": "f9596e41-db96-4369-9e2c-25814da17454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354009, "uuid": "dd876904-8c87-464e-9f43-b753e5d43eeb", "value": "file.msg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98112e5-fdf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685346331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346331, "uuid": "117ad5b8-b900-475c-9bad-714ccab41dca", "comment": "Malware payload (RedLineStealer)", "value": "610c9497a3a49fe89b7693b4d18b8dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346331, "uuid": "6b03e409-3ccf-4690-bced-2700397d4e6a", "comment": "Malware payload (RedLineStealer)", "value": "ef7fce874d12e5cc216504eefd81847d036f3f61645496165eb02d4a6ff74f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346331, "uuid": "8cd0f0f8-fac3-4b7e-8633-c85fc011c583", "comment": "Malware payload (RedLineStealer)", "value": "6f78c77178ccbd0916d4aa16494d460b5cf0dd6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346331, "uuid": "d177934d-493a-4bd8-9b27-36352a588a4b", "comment": "Malware payload (RedLineStealer)", "value": "d6947907cb8ca0cf6351e5ae4b60d2250e73fa69d500e3520ccbc23211c94b7f71732485867433215e76060bbe934b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346331, "uuid": "5effe785-939b-46da-be2d-9b352171e96e", "value": "T10A05131397D44572EEB547B4D8F302431739BCB2883C936B2B996C8729B26E495B433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346331, "uuid": "e50759a5-c746-41c9-baa9-2f6e3df154c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346331, "uuid": "842a145d-4f14-45f5-ba6e-0956689d2e2d", "value": "24576:Ey9nnzXK82RYMxtpGtEhPLeqnF6USe+E:T9nzuRFGtA6qnFr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346331, "uuid": "b25bf418-201e-4961-9150-b82ceb49cc28", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346331, "uuid": "4805cad7-a3f3-4a5c-a36e-9dcb3cbafa8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346331, "uuid": "841fb5cc-8f18-421e-9498-212f43dd7efa", "value": "610c9497a3a49fe89b7693b4d18b8dd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488e0b07-fdf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685344826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344826, "uuid": "d456dbcc-c087-4740-aba6-a3783a0e7ca9", "comment": "Malware payload", "value": "2760f09238376ec1fce8c88de66618e0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344826, "uuid": "d73435e6-2fde-496f-a1de-57cce1b46b77", "comment": "Malware payload", "value": "efd8df15c4dd5d027d6b1e49ba4c563a763dafb83d599f98934d91d93331fa31", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344826, "uuid": "d74ed017-e218-4512-b3d9-28404713c7db", "comment": "Malware payload", "value": "d38c23177819c0c3f446b3fae44036c8e6ebb474", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344826, "uuid": "58696e6b-0414-49ee-af5f-89180bc431f4", "comment": "Malware payload", "value": "f7da82edd0bafefaf4ed2ccb303e96e303b5a4ea0fbeb577615bf52eb654e1d96eef4c300ce51c9bd10b9a7f18e17f82", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344826, "uuid": "4a5bfb8b-7a07-48a0-b182-5c4755666a58", "value": "T192E3F23394C3BFAA5B2F4D80A35519640CE93D5B9787D468FA8B34912DD4A94EF2CC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344826, "uuid": "3edfc1dd-7ac1-489c-ac2e-e04bece4c637", "value": "3072:4jaTjXYPpfiItdZlQ8FyP5vKkcTbp3Onc0x1:4jBFiAdZTi5pqp32j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685344826, "uuid": "937f2a11-15bd-413a-8c36-3ef08fc5c1a1", "value": 146532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685344826, "uuid": "500fe587-3ae7-4273-8aea-9883bef3b472", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344826, "uuid": "f7ab3bb5-cc56-4308-9181-6c88724ad546", "value": "image", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4335211e-fe18-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685361567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685361567, "uuid": "3b7e0d5b-d46f-4dc9-816b-5440ca33bc7a", "comment": "Malware payload (Mirai)", "value": "08e8e8da28bc8d3b1a96542aa0c73fdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685361567, "uuid": "369fc6a1-4b79-477c-bc30-91f39837ff0e", "comment": "Malware payload (Mirai)", "value": "f0148557c079a0f8fd9d779cd9ffc80998713b085ed08180ed184af31f68a044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685361567, "uuid": "9b68f1ef-499b-454f-8d34-c905cb120ea1", "comment": "Malware payload (Mirai)", "value": "dab983700ea4029a896f035cfe495dddb91f3a6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685361567, "uuid": "2ad3bf21-d9a9-4d45-b75f-c424b42f12e3", "comment": "Malware payload (Mirai)", "value": "1c1dc82457127dccce09a71eac06f85311054a5f87c6d88f275893fdda0c29cb8ce412257d5412dc00d580d1d8dec140", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685361567, "uuid": "093badea-4cc0-41f2-9f6d-f5aac376592d", "value": "T1B23329C8E987D9F8DC5115712027FB368676F03B101DEAA7E79CAA23BC49B81D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685361567, "uuid": "73ab76cd-5e4e-4891-ab13-f53a40ad95e7", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZhP/2Bj6NYc2dZKQDf6:ORKnAvjcV7ZIEJdxZhP/2taXSHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685361567, "uuid": "74233113-5219-418f-bf2a-7cba54dcaada", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685361567, "uuid": "804819ed-26f4-4bd0-8d71-9df1b3b18555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685361567, "uuid": "e5ed1bb6-03db-4f09-983e-de7f40e6071d", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c70226-fe32-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685372626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372626, "uuid": "35292f02-b5dd-4946-bbe0-f3b8c65e86c9", "comment": "Malware payload (CoinMiner)", "value": "f4e4532af8047a15ae7040a12801d18d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372626, "uuid": "0cc7ecbc-9db4-4a1f-accd-212ab6b4a2b2", "comment": "Malware payload (CoinMiner)", "value": "f1b14007a26d653067be8c62a58f74b016510a9319f397af6bc25563af031134", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372626, "uuid": "03819b06-30bb-4433-9fd4-7d026d3bf4eb", "comment": "Malware payload (CoinMiner)", "value": "3931db953fc1a08dd436bbba3d07f00c9010c0f5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685372626, "uuid": "838cd4b4-8bdc-4eb2-8187-eb4531f2f5ef", "comment": "Malware payload (CoinMiner)", "value": "f2c8df0b9809c4386e3b3c24e53a28ebb2163edf54b213f1b986b73f8d69b50608693147653a703ff9e63e72da55bf05", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372626, "uuid": "f64e6d86-4b50-45c3-85d3-98fa4b5aa718", "value": "T16B643B1BA2F17C60F92A4A729E2EC6F8771EF5504F5977A713149A2F06712B2C172730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372626, "uuid": "b5a59877-c9cc-455b-a847-043159a67156", "value": "0a261f793955a0334411687f62dd4035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372626, "uuid": "a8c59f29-2330-487d-a031-ee12dcc6a6ba", "value": "3072:pl9KGMGYbcp6z/CO0HL4LPvwo4DX6r4e4hXodaGhrOdf2L/5yX0eIGl1qoMfpT:QGTuXzELOXwo4a4eCodaGV405UoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685372626, "uuid": "438dbcb2-ff9d-4659-a2bb-029bbaeaa345", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685372626, "uuid": "88ed308d-b339-40f6-be62-6d20ec399cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685372626, "uuid": "820b7591-cb77-430d-a469-f4249deddd64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc738ae-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346637, "uuid": "96f1a144-ee96-4265-9810-50e82c0e6ed9", "comment": "Malware payload (Amadey)", "value": "1394c317317baf8d3702ce660ec36857", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346637, "uuid": "af1b82af-da1a-4e6d-8f35-db8dd1c3cbc5", "comment": "Malware payload (Amadey)", "value": "f25c22a37da21d429bd65c4708521cc752c207c8c3e56b483f69bcf74346a44c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346637, "uuid": "3a45c5fb-7f7b-4660-94b7-fcffebd0a432", "comment": "Malware payload (Amadey)", "value": "1b1e5f3eb794d346c6d75cccc42b9f7764dc286b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346637, "uuid": "e05dec46-2f06-4ffa-951b-1933d30f1b6b", "comment": "Malware payload (Amadey)", "value": "f983ebe65b4a93645b0f5a5439aba56c8068be42a4077285aab97c58884294b0d5080686a2554946bf37be0a397317f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346637, "uuid": "2619e571-680f-4681-92f9-ca713f40aa09", "value": "T1F405221AE7E854B3DCBA57B05CF20363133A7CA159A4837B1745684A08F39907E76B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346637, "uuid": "3bd443ae-9e54-4f52-a086-ab978ca09c9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346637, "uuid": "16f6948a-e9a1-42d9-9315-48773aac3ff0", "value": "24576:0yKrHayd+IklXI4tsN5BuX8LLBEXeOnN6USy:DCXZklXPyBQMbOnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346637, "uuid": "865f9081-7e4a-474a-8d0e-92e8556096ef", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346637, "uuid": "fee7f593-533d-43b3-9952-f8d740d68aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346637, "uuid": "8e8350e9-380e-4336-a894-63d9b192e9ec", "value": "1394c317317baf8d3702ce660ec36857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2461961-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685374209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374209, "uuid": "f5cb7a93-a853-4fce-b67e-3393a8412b2e", "comment": "Malware payload (RecordBreaker)", "value": "ca673e1c050a50d0560a615de08188b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374209, "uuid": "49297986-d6b8-4a98-bc43-b163b30051c7", "comment": "Malware payload (RecordBreaker)", "value": "f3052878865704277dbbbc6d8e38a009468cb0fa5fc911b426d26fd13e75b337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374209, "uuid": "da281641-5410-4bc6-9456-fccaf65434be", "comment": "Malware payload (RecordBreaker)", "value": "5c4cb8d58bd49d7e65897b2ef90d85feab31ed09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374209, "uuid": "4f9899b7-9306-4f8f-b7fa-8305649b050f", "comment": "Malware payload (RecordBreaker)", "value": "a3bb11a2767ef9fcc0872a6c6a97b27b60ad2559aa507aef3541c4660f6d1679961cdc435dce0cf2080ff5aed38d3068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374209, "uuid": "f740ba70-95e0-4cb4-b844-0ea0146ca35d", "value": "T143642B1362E17C61F5268A329E2EC6F8761EF5604F5977A72318AA3F08712F2C572731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374209, "uuid": "c13abf3e-113b-43c5-a5ef-85ffac71fd8b", "value": "f321b3f3cb07770b37ac8c5c955a19bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374209, "uuid": "ad9f51e8-602e-447e-82ec-8516f4709214", "value": "3072:WxNtAHL5Zisr2MMDn+SiThvw6FH6l8g8gBzf9/gliDS3vffpT:gtALesr24ThvtJ6+g8gAcDWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374209, "uuid": "058887e6-7385-4d56-9861-eb32f105c45e", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374209, "uuid": "a19fbb6e-4f9f-4f9e-99e8-2feaa53d4dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374209, "uuid": "9cbfe7c4-bf5f-4312-a030-e9282e10a4c6", "value": "ca673e1c050a50d0560a615de08188b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8e9fb8-fe14-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685360130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360130, "uuid": "cf1edc70-7467-4fa7-aedc-b9bf08446fce", "comment": "Malware payload (Mirai)", "value": "80c7b29d8da64f2237aad8b437580ad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360130, "uuid": "08965d02-1471-4298-b03c-abd6f7d6a2ee", "comment": "Malware payload (Mirai)", "value": "f3265477bc3925e1732ffe7ba4e56a7848da7171018b8142a3336fbad1e2f5b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360130, "uuid": "0bf79555-08c6-4ad0-a373-9455e9cb08f9", "comment": "Malware payload (Mirai)", "value": "a353f14b004d55f85b0a783ddbb95215f3cbb18d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685360130, "uuid": "df2ae49c-b4fc-4c50-a60c-2f028104ac6d", "comment": "Malware payload (Mirai)", "value": "5aa167c31570ddd7121f71116bf876f6720e8fefc017f96dfb67049cf769c0706df821ae94acd9554c7ff16991acdfc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360130, "uuid": "d310ff75-4b5c-4100-925a-584cc012eeca", "value": "T105B2B0ACC848258CE35D4E3D91BD07E6AD81F2A1724B4B8C5705AC09B73A44FABEC859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360130, "uuid": "ec9de655-e1ab-4c71-bbdd-ed22350daf30", "value": "384:SJOK22Tuj6RG9FbjDpw94gm2bjnPboVPBkgUYRWGVCzhMhHuf:SJOK/TIvHXDpwWgmuUPBdU4WM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685360130, "uuid": "ef4a3e57-7ffe-414d-aac6-fb22992179b1", "value": 24280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685360130, "uuid": "259c7250-2503-48c0-a3c9-0804d52cf226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685360130, "uuid": "d81c5075-2b44-4af1-9243-9dc4e6a80f0d", "value": "0529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea25d42-fdf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685344809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344809, "uuid": "ccda1f8b-0dc4-4290-9770-a58a77425825", "comment": "Malware payload", "value": "53e1a8b58930c820c6c93dbf1d3f9c05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344809, "uuid": "0bfa2e11-a0a8-482f-ac65-4761b1e98a2a", "comment": "Malware payload", "value": "f4cb886656b1df37c5aa015176024fbc2dafa1af1b4cc6f16b5ffc321bf9d8da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344809, "uuid": "6dd97b22-99bd-4964-8af7-f6aedbd9bc3e", "comment": "Malware payload", "value": "89613ae6c2018bea139626c2e56060000038dad3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685344809, "uuid": "eddc0815-6e09-4f5e-95c5-e44ac3ca9687", "comment": "Malware payload", "value": "119df8e69db52fdb27547703c1a4a01931d8d068d8455736e465986dfd0f087e0053479fc0d30ed432f0d1632210d439", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344809, "uuid": "bf82d749-c9a3-4786-95cc-e273f54d1b60", "value": "T16CE39D5FC30FEE69AF40B55B1C5891976CCCC54590AD9198FB978E3CE082E9E03BA391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344809, "uuid": "ce2e5bcc-e247-49ad-80a6-d6a6d838681e", "value": "3072:q1tsuws9R8V0pXQFyK7SWhoG85D33JpGu9UXPC8cIQi8DNMXqKKbzxcY:2Gs9CzFu4J6VRaENMXq3bCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685344809, "uuid": "d8bdd807-99d1-4eb5-adae-825fd7883417", "value": 155743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685344809, "uuid": "a9e2cc61-2e47-46b8-b69c-f37ae0fd87bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685344809, "uuid": "d2547b5e-0bff-4da9-8a2f-eeac9b2232ab", "value": "Loader", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060e6f59-fe0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685357599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357599, "uuid": "fd4487f3-9b1e-413a-9d19-276edda48359", "comment": "Malware payload", "value": "19a13206cf7155c2cca692efa200a932", "object_relation": "md5", "Tag": [ { "name": "condi", "colour": "#3CE6E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357599, "uuid": "f40ae224-bd76-4406-98c9-7c142342b255", "comment": "Malware payload", "value": "f5968ced46e935dbe5f5e82dc635dc85090b3edf17e399edd40474a69ce5be8e", "object_relation": "sha256", "Tag": [ { "name": "condi", "colour": "#3CE6E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357599, "uuid": "b3006763-0dd9-4ec6-8003-80f8cb67c79f", "comment": "Malware payload", "value": "80bb6a35968b732d3f34d766c0d4532e27846dff", "object_relation": "sha1", "Tag": [ { "name": "condi", "colour": "#3CE6E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357599, "uuid": "f13983b8-b133-4f52-88dd-9a7fde684a59", "comment": "Malware payload", "value": "7373d49f8585f5b6953da8026f7cca76408103043706ca616e109b70f8b7942e7b090dcabd907246cc533cac8f0f586f", "object_relation": "sha3-384", "Tag": [ { "name": "condi", "colour": "#3CE6E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357599, "uuid": "f001b592-f177-45e3-8186-df21ac050866", "value": "T1F1D33A07B5D190FDC8D9C2B48BAFE537DA73B42D1234B25E27C4AA261E4DE205F2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357599, "uuid": "dbdb4120-01b4-4668-8d95-6fdc11377a85", "value": "3072:tWUl6QrrF2YubVyBXdqoo161Iw4jLGilY1Zul8ouG:tWUlBrrl/u5Y8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685357599, "uuid": "2201f307-6480-4beb-aa6e-4b5588adf2cf", "value": 138920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685357599, "uuid": "b69d7dc6-47bf-4160-ac0c-594789ad168e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357599, "uuid": "5e90c1b5-8920-4e2b-95b5-9096bebc255e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecc6a3d-fe3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685376780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376780, "uuid": "a9154bba-2442-4909-93d7-b043c9089b02", "comment": "Malware payload (Mirai)", "value": "ced84e62f45af4185c5e508010bff828", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376780, "uuid": "b0964130-54bb-4474-8912-e1c8de28790c", "comment": "Malware payload (Mirai)", "value": "f5c87338bc83c0aaffd2cd37c07f72566df16fbc15eb304d9edd508bd8705cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376780, "uuid": "fa2900f7-4849-4442-abf9-83d7f9596198", "comment": "Malware payload (Mirai)", "value": "622a548f63ea579b6af352b1709c8b4895979b0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685376780, "uuid": "0b0cf4d0-50a0-4c42-a940-ddb5d7111a19", "comment": "Malware payload (Mirai)", "value": "7026e4a9159e1a94593fdf8330c234e46395fd178515e80946e41ab6644142cc3af882ec6dc2d901729a8dbf8ca981dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376780, "uuid": "d9daddd9-dc02-4838-8be7-45bdc6f77820", "value": "T1A0A2D0B4C0541E0CF7F69D3B4A30AAC33CA49F1D77A2E8B625532B00A676D64A3C19D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376780, "uuid": "a9f23adf-4e6b-4ea2-b958-a06bfec7449e", "value": "384:QfHIVg3M1Q7TN8W7Vg9dG9tOrHx23M2WxTNdedL0NKM4uVcqgw05VxJq:yIZsidGbOTxAM26PedLU4uVcqgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685376780, "uuid": "81bedf47-a5d6-40cb-bbbb-3b5176d46f69", "value": 21876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685376780, "uuid": "b9c6dece-875b-4ea4-bdd6-123bcbf30f26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685376780, "uuid": "456191e9-df1f-4583-93bb-be11abba011f", "value": "ced84e62f45af4185c5e508010bff828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf63e99-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388426, "uuid": "5dbc503d-86ad-437c-a35b-437a7007e004", "comment": "Malware payload (Mirai)", "value": "4522b768dee2f5bb3010422a601554a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388426, "uuid": "c710eb9b-70c2-4a75-8e7c-3fb1ef248e88", "comment": "Malware payload (Mirai)", "value": "f65ef733293387e2d900989db16bdd412c972c80879a45a05f8a16a0bcee06dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388426, "uuid": "14d09d48-c1da-49b5-9826-54fee3cd55e8", "comment": "Malware payload (Mirai)", "value": "a30d8d218f7cf1244f6e95caa64668e0cf074048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388426, "uuid": "5affce69-0106-42b0-84af-7a6500b03d5e", "comment": "Malware payload (Mirai)", "value": "bdc49de2496cb8ee6d04317cbc17b927d731b6c09de6616d1413da36341f8bfd59eff31957e12fd4bc0ceb3aa7456c33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388426, "uuid": "1ca2edd5-2b0f-444a-b26f-5e120c7af3c5", "value": "T17CB33AB3CC29AF58D664D1B8B0B18FB92B539564818B1FBE5976C2748043D8DF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388426, "uuid": "2ddeb82d-40a8-4ff0-aa39-25639e534f3f", "value": "1536:Kyv+LAeb4x/moSCuefKdoYw7vvwSaMovpWg7ZOjkT/lZ:KY6bgmoS1eCd60SHKpWoZOYBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388426, "uuid": "4b9a4090-279c-4c8b-b17a-734905a3f5a3", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388426, "uuid": "a08fd2b9-af8a-4981-9615-9b4e81073db9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388426, "uuid": "e359eda0-66bd-4f79-bc01-9d441f7d52b3", "value": "4522b768dee2f5bb3010422a601554a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6c8b9c-fdfa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685348674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348674, "uuid": "4b1e3f3a-56d0-4db0-bbf4-959e20ecf06e", "comment": "Malware payload", "value": "5470dba96e5c80346bab02ab12e37c03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348674, "uuid": "aaecbbeb-8f17-41be-b3af-62b51a16526e", "comment": "Malware payload", "value": "f6c3cc1bca1054d9a2fba99e7e93023c4b297ea284290398f12af311fda9b78f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348674, "uuid": "21e128b7-e897-40bb-bfc6-79d2d53ea80d", "comment": "Malware payload", "value": "a4005141b33a9e3eca71d242ada35526bcf4026e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685348674, "uuid": "fcf02115-1605-48ed-a735-b2b4e8115edc", "comment": "Malware payload", "value": "b6864b77e2a14a89a18e10379f4698dc472a2f0af673d98dc889b8877d01935ae989342dd34f80c5b3db3d1388c05f55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348674, "uuid": "e48c761f-38f9-497f-ba93-5da55f0e3d83", "value": "T12314123A0FEE110EEB2FC2F0BCA428E4DF15505C527BF5664474342AFED2EE8A685095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348674, "uuid": "ddddfd9a-1fc3-40ba-9be3-5f5618aefbf7", "value": "3072:SoO92pRgj0OuGSS3NuurKiw7rj3EWKp8r+z5BqoCiqFo7UuF/o+2t:2wgjp3SYuyReEWK2IBuiqFcUoo+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685348674, "uuid": "50f900f7-b8f9-49cc-978d-a1508d8da2e5", "value": 190670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685348674, "uuid": "cc6cecb4-c421-4d5b-a214-96c1c4f93117", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685348674, "uuid": "717460f8-bc39-483a-a26f-0a23532f8a15", "value": "07686399.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce82f713-fe56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685388430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388430, "uuid": "c0622628-3c83-4206-9223-18992447d71d", "comment": "Malware payload (Mirai)", "value": "b371fe3fd5d3e8ee6e402a2a828a9945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388430, "uuid": "85fe3d25-0f48-4c4d-84c2-aaf290a46057", "comment": "Malware payload (Mirai)", "value": "f724e87a9b7ecca0dcf3da11045f2ef982c71f5a752ba3fca786da8e04094616", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388430, "uuid": "1c860ccc-7f30-4afc-bb95-2a204d0c126b", "comment": "Malware payload (Mirai)", "value": "c06f0deecf0aae0cc876f943a8e2df5a073017a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685388430, "uuid": "8828ffd4-e186-41b8-8777-082aff3654bb", "comment": "Malware payload (Mirai)", "value": "67ca932a92ed88899d8d9a2a8a7ed8d484b977d641d674351c637f2b554fb4bb34c9cfab3d60340c44caaadc4754cbf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388430, "uuid": "150fb5a8-012a-433a-b30a-dbfa966772ff", "value": "T1E23308917881AA12C6E4137BF9AE01CD332523A8E1DF73179D222F4477C592F0DAB796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388430, "uuid": "1d7d35f4-421a-4f3f-b37a-5e4e13294b05", "value": "768:dyIAundhTRzhlkdLYW+Ifo6H5eoWQblBQEyDoQZKvtJwnPeThcT3sskHbrw3QPNQ:hAYTRdle7WQxBQRoQZKvt1KcsumhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685388430, "uuid": "8e563b70-1d85-4b96-94b5-ff4616e663a4", "value": 50644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685388430, "uuid": "22509ae3-15d0-414c-be3b-1f3dba01d752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685388430, "uuid": "48534b18-4224-497c-ab83-3a89d76c4d9b", "value": "b371fe3fd5d3e8ee6e402a2a828a9945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee3c97a-fe0e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Generic)", "timestamp": 1685357373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357373, "uuid": "d0361d62-66c1-4feb-91c8-1d522d0fb2c9", "comment": "Malware payload (Adware.Generic)", "value": "ced829a4149c928233acf1ff0c3cd780", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357373, "uuid": "c540871d-08ce-449f-8ba8-c71913107245", "comment": "Malware payload (Adware.Generic)", "value": "f95fdca4f8709816b40f99b492f57e383ab60dee9d34cfe1aa919e0c90dd48ba", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357373, "uuid": "80bdc551-9927-4f70-81f6-33cdec066355", "comment": "Malware payload (Adware.Generic)", "value": "abafd94c9b5d95329715d2b24e97e6cc37667b8b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685357373, "uuid": "32123d7e-bb3c-4788-9c06-9e9742ccbe34", "comment": "Malware payload (Adware.Generic)", "value": "dae4fa41823c295f87af5398334583c11812633b04de039a49ac0c17724035a4afd53da6fcfb05292938b0c784678264", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357373, "uuid": "103c3844-e090-438e-9891-11c6e8326c36", "value": "T12175BF3FF268A13EC56A1B3245738320997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357373, "uuid": "574752e7-fe8e-42ab-a446-467d1546e183", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357373, "uuid": "22aeb4e9-118f-4e55-acb6-f9fcf5e496d0", "value": "24576:s7FUDowAyrTVE3U5F/oZbVKic6QL3E2vVsjECUAQT45deRV9Rx:sBuZrEUkbVKIy029s4C1eH9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685357373, "uuid": "76e471dc-3260-4e1c-95d7-a103c3304984", "value": 1673179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685357373, "uuid": "049f00ce-089d-46c5-bf82-5f06e076f714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685357373, "uuid": "451f9fea-98b8-4218-9916-3349e8f5568b", "value": "Exodus Aim Assist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83395ed2-fdf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685346642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346642, "uuid": "9117341d-1670-4167-b692-108ad07a9f91", "comment": "Malware payload (Amadey)", "value": "96818320eb1fd479714be6bda61a55eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346642, "uuid": "96bd519c-c595-4f35-b33f-dc92ff774bbc", "comment": "Malware payload (Amadey)", "value": "f9d421ba1a152eadfc2afe9f3b673b3f2569520643030001c6153affff8ff4a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346642, "uuid": "a591f66a-944c-4a85-8b5c-212270ca84ba", "comment": "Malware payload (Amadey)", "value": "424b2430d89115ac2eb2f2865542e0428df98c6f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685346642, "uuid": "4cff618e-5edc-4413-91e2-4903bad66b25", "comment": "Malware payload (Amadey)", "value": "d82fa165a7fe165250a231573fc006770bc974d09ff9327e96e3241ec4fc83ac985e344967d6d7ca2b05c2dbed0b9020", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346642, "uuid": "eedd7d87-866c-41ba-b199-a3ceadce0086", "value": "T181051243A7E44573ECB50B74C9F212832A36BC719D3883AA7746680B55B3A857E3437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346642, "uuid": "b28b380a-fedb-4fbf-988c-cff8fc87ce22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346642, "uuid": "a19bc7db-85bf-4d1f-bfcb-edd35179428a", "value": "24576:8yBEBRiXlEuqJANc7TEH3sUpZVjLeqnF6USBc:rBCiX2uHc/ENwqnFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685346642, "uuid": "1a1f5c34-8dc2-4e6f-83f7-5c2d9a0bd655", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685346642, "uuid": "b151f1ad-9273-4c1f-aa67-e1fcbc3b2d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685346642, "uuid": "781e504f-82c5-497d-adb0-4b2ccf7a538f", "value": "96818320eb1fd479714be6bda61a55eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd9ead7-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377258, "uuid": "d7b1550e-8ee8-4903-b655-4047db577d80", "comment": "Malware payload (Mirai)", "value": "3747715bf8b1451d3a660b6c8ff5cf0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377258, "uuid": "c53d4b93-8614-4642-ac8b-71b0afd1c2fc", "comment": "Malware payload (Mirai)", "value": "fa554361b5c512c9aff1b040efdcaf1de572fb0dec1d59182d30ec4c91362868", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377258, "uuid": "f342793d-af07-4697-9352-c5b84c76ed0e", "comment": "Malware payload (Mirai)", "value": "05bec702928ee17ff4e4f1f27e7c7b7fb9222b2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377258, "uuid": "d788c749-e0b2-432c-9e9b-f1611d06836a", "comment": "Malware payload (Mirai)", "value": "11d6ec58f0845de3b9235c8dea8db30e5c6244d9b8048add2ea6f2036d904f3443ce3de45a5255cdf83fc9456076110e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377258, "uuid": "0a229ca3-4d96-4902-8e2b-5cf8bdd2077f", "value": "T15D333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377258, "uuid": "db51946f-d436-41f5-aad9-26a0fc414a39", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380DZ:dsfIBZeNlJDFj0imvppqmUJP6Lc88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377258, "uuid": "d4e5989c-278a-4eaa-8b31-23266f8401ed", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377258, "uuid": "6e0e131a-13b5-47f8-b457-2ba0a2ab188c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377258, "uuid": "36baae88-e5b1-4598-be48-1a282e6203a6", "value": "3747715bf8b1451d3a660b6c8ff5cf0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5891a75-fe2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371611, "uuid": "9b41286a-75a6-49c9-95a7-ea16ec0c2170", "comment": "Malware payload (Mirai)", "value": "3327413175f931b5e30c88ba984f6e2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371611, "uuid": "25032ca9-323f-4afa-9667-304c2fd547a1", "comment": "Malware payload (Mirai)", "value": "fab829484c7418a3f68c81acd625ac2e2da86679145dc29ac19cf72182183c26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371611, "uuid": "85a3625c-ddf7-450d-8edf-1f5dd2b6d934", "comment": "Malware payload (Mirai)", "value": "b6a1baef4d2371dddcbb42e22d237f23f08860c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371611, "uuid": "1bb193cd-e6c0-452f-898a-4f9dbc072107", "comment": "Malware payload (Mirai)", "value": "2a0ae6e111baf19f74cbc6b4cc0fbd89c73aa0e545370e69a266c1c9a581406cc896ed028637dfb8d08b9a1999c0689b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371611, "uuid": "dcfc64d5-e38a-493c-978c-25c441bd00a6", "value": "T1C403F1379A588BD2D1D28ABD94583257628BB57F10C7EB453CF6BE2195C2300CB85F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371611, "uuid": "ed9863f4-11a0-41c9-9800-13e20fefe01c", "value": "768:lCkVKb5z/qpnAV4O/nQz5nDvCqDVTOrIrcdzw4M5vnltJsCm9X9Y:tE5z/RVn45nrWrIrywj5nOp9X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371611, "uuid": "5233070e-c067-4353-a8f6-bd10d9e32220", "value": 40932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371611, "uuid": "e37df61e-bada-4576-990f-e2caf56215d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371611, "uuid": "5f1f97c6-3e30-45b8-996b-bac07de53556", "value": "3327413175f931b5e30c88ba984f6e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a34ba27-fe42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685379698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379698, "uuid": "5325336a-5bc1-48ba-ab3d-0441342314e9", "comment": "Malware payload (Mirai)", "value": "390ecdc50cc1739ef038d9845ba761d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379698, "uuid": "fe0cccfa-5b47-4348-a643-f33510053352", "comment": "Malware payload (Mirai)", "value": "fb335fbd925cc312965352d1ecaca216d5d274beea8201b9d3ee87f7e9324b93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379698, "uuid": "670cc3d9-896f-4caf-9e18-699a84d981f7", "comment": "Malware payload (Mirai)", "value": "835678fdd98d11fe3cf047503f1bee9ca6b41027", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685379698, "uuid": "e49d1007-4843-44a9-b86d-0c463570f76c", "comment": "Malware payload (Mirai)", "value": "e59d2063e543b17bcf013502f9731e94a077ecad77af22f5276c73caa4c1bbbcffa26732835f2b06365f6e7df1eec63d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379698, "uuid": "1ad0d874-a4b2-4579-9cfb-fd998a7b515f", "value": "T131A3F972E642CA72C44306F102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379698, "uuid": "9b63dac8-018a-4b23-8bbc-ac821f537709", "value": "3072:SOGAEtZoGZKWl6u4YTnbH6bimmFVcqq0G27ZT:SqEtZ755nbH6bimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685379698, "uuid": "e427a5a4-40a3-4601-9cbb-685e1271b5ee", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685379698, "uuid": "891d1884-c85a-4403-8c22-1fb96f855160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685379698, "uuid": "39289e61-240b-402f-bf8c-43dbad8c4100", "value": "390ecdc50cc1739ef038d9845ba761d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bc15ab-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377186, "uuid": "3bfc6e8d-2a78-491d-8c28-e4672228cd1c", "comment": "Malware payload (Mirai)", "value": "323364d62725e7ecc149e4519ae04af9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377186, "uuid": "5714c473-3680-4dce-8d38-c35619dc0529", "comment": "Malware payload (Mirai)", "value": "fb4128ebfe0e4bd47a6159439a1d86878d4c9b1bc9677953ee5e85786a7827f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377186, "uuid": "7aedde29-b5db-4719-9c29-386f341c3bc6", "comment": "Malware payload (Mirai)", "value": "4d93681c2caae260ec4c6520a9f2a294bea3f3a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377186, "uuid": "9fa5551f-201b-4b5e-a886-536edb8b56ac", "comment": "Malware payload (Mirai)", "value": "1ea6cee9446618ca7098511c4ab9fdecfe50badca7f9b016ebf08d983e994e8acb3246f89a713bac26d723a005ee400e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377186, "uuid": "5df3cc95-1f2f-460c-af5e-08a64e4ffd27", "value": "T168D2D0B4918448F6F5FFAFB600D8FFD27BE06655BDCE8D5232815F202230163AA448DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377186, "uuid": "d7a6bed6-a7f3-4d05-8fdb-205d82b72344", "value": "768:F9eCwAE/Nk3cCLPeTBDiWIYhPTalRtQmzu4uVcqgw0RNWX4:FgD1k/LGdiWIWPoXQmq4u+qgw0bWX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377186, "uuid": "df018573-1357-47be-9716-28dd9b29ccc1", "value": 30408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377186, "uuid": "75122916-0479-43a4-85e6-f788c55167a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377186, "uuid": "e14beadc-1d2d-4010-bdbf-3b6ac0b87fc8", "value": "323364d62725e7ecc149e4519ae04af9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493f01b0-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685371026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371026, "uuid": "4e9dd2e1-4773-4dfd-9641-813b14800cfc", "comment": "Malware payload (Gafgyt)", "value": "e0fccd7717b35d4208832e115d382931", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371026, "uuid": "bf8e7ae5-dc2b-4a3f-a61a-d8a5fb97ab14", "comment": "Malware payload (Gafgyt)", "value": "fc965c3e762adc9fb94effca71699a9784fa65c4f3a728a0d9bf524b33697f07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371026, "uuid": "b9c77dfc-8ec9-4057-8dee-42d2eb63f298", "comment": "Malware payload (Gafgyt)", "value": "56bb1b709b4538c05d48dce203ce2323507f2348", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371026, "uuid": "3b5d9aa5-7b09-41ec-8c54-6809ceeea44e", "comment": "Malware payload (Gafgyt)", "value": "f68065b251d25b311dd3adde2a9dbf42de90b3d0362dd27e92528f4f94549c9686a4afb8a32cbbd5cf67234ecaf7558a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371026, "uuid": "57abbc80-3a98-4738-a724-387b5afc7513", "value": "T129E3AF70E0E599E0C151173468F299791F52B48C52331DB3BFC5C9AA288BEB4F618BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371026, "uuid": "0579bb12-37a6-4db0-9a25-a5c5a8d1cb22", "value": "3072:1o8gogkTe7qGNE/4ztaPmZGkVLIjqdYEn9FyGp66Q:1o8gogkTe/E8taPG/eEnGr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371026, "uuid": "595a1ca7-e605-4b24-8428-96c4fcb9f0f2", "value": 148600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371026, "uuid": "61294e8d-9bc3-456e-867e-dc6ee2bceb9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371026, "uuid": "f314cac2-ea4a-4653-9d6a-8dfe5d294b9e", "value": "e0fccd7717b35d4208832e115d382931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cab56e-fe1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685363402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363402, "uuid": "2de47d96-dbac-4de6-93f3-1209dbe5d090", "comment": "Malware payload", "value": "4350b833cf122e75961f4054d77ba206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363402, "uuid": "cbb9b02c-55b9-4a98-866e-649c11220cd9", "comment": "Malware payload", "value": "fcea4d8953b4ab3a7a37ce4996a7b22ededf8de0f0939e44231f61e04f1d899d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363402, "uuid": "8cf03eae-49bc-4ea9-8c65-3a086053d623", "comment": "Malware payload", "value": "0118c1eeeb345a3d8dc6b1932f0ee665869768c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685363402, "uuid": "32edb95f-76bb-401c-b521-3d4d062ee713", "comment": "Malware payload", "value": "d8f719ad50abb2fbd257bb4d77c4524bb317ef16439ed0cb5a05a96e4ff215d7ee5384a8916fe574c1c0df78f1f11e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363402, "uuid": "635983e1-3663-43d7-99c1-4197d533014b", "value": "T17DB3BE439280DAA8F091C47EC93DD7D1D2579C70EC301DD2BA6EBB88ABB71605B50DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363402, "uuid": "96f94f8c-b524-46b4-881e-b2629d585de8", "value": "1536:5lq5wdFilmkWjU4oeQE9n20RhQ1qdAR5ewnzja/eQaCG/VICKZh:4yFyMU4QlF1xe+jamUG/Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685363402, "uuid": "a517bb7e-1737-4203-9a11-47a858535271", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685363402, "uuid": "7fec5038-d66d-4cd2-9af3-23402e574a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685363402, "uuid": "efd827da-04c0-4ba0-9462-eaee2820ce1b", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.6535.13902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d610cb0-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685377154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377154, "uuid": "7fcaa70a-29e7-4c09-b960-1f41433127f1", "comment": "Malware payload (Gafgyt)", "value": "2042863b042bbfa483f35c00a80ded19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377154, "uuid": "40b001cf-986c-4a2f-a1e3-b71d928a4cf5", "comment": "Malware payload (Gafgyt)", "value": "fd5c636d521999641014541bbb8b9f2b040585f3af054633a474002e9be5d237", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377154, "uuid": "ee616c70-6d15-43ba-87b5-9fcb667dda64", "comment": "Malware payload (Gafgyt)", "value": "fcf7ac917b03958fc2f850d4c2f5e5cffe90ebce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377154, "uuid": "e94b54ed-9070-450a-8543-ce495c103828", "comment": "Malware payload (Gafgyt)", "value": "caddda1f602f24406808258cd47484485e11683b9f037bf7fea0157d419cd302cba1b213acdd71a7667dbf3feecd0a05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377154, "uuid": "e53fde88-f172-4415-b836-a0cbe6ea5789", "value": "T115632A026741CAB3D0831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B62B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377154, "uuid": "aaf1e56d-c372-49af-93d2-cf400baa9815", "value": "1536:RRVYPCNH1jUdOn4JymPWBSgSh1MtN4r/NbHBDSDmd+l2OZ/fufYEZ:RRUCNH1gdikrEHM1IWrVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377154, "uuid": "fc617201-2dc1-4045-ba53-8b9fb94df52d", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377154, "uuid": "d325f771-a095-4660-ace6-93684a74ed03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377154, "uuid": "0a716daa-cec6-45e9-9a18-6668d12f44ad", "value": "2042863b042bbfa483f35c00a80ded19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f938ecdd-fe35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685374328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374328, "uuid": "be2f9b6e-82b0-4918-a1ca-0d121a6fe388", "comment": "Malware payload (Mirai)", "value": "34392bf984f2712cf3801924fc28f6c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374328, "uuid": "69961a5e-b9cf-4b3a-8e20-ec2ebc9accd4", "comment": "Malware payload (Mirai)", "value": "fd6566e924fa97d108cd3d138e2822d0c43436aee6555f26b443dc8bbfdf4724", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374328, "uuid": "979665fd-ff27-4a45-8232-32e1434e7517", "comment": "Malware payload (Mirai)", "value": "701c745d08da820efed3344c88930d02251a3179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685374328, "uuid": "78d0a4e8-9067-4f30-bdc6-4f951376348a", "comment": "Malware payload (Mirai)", "value": "8472e045ab4bebc88a6f4ac45e05f210551193e9390c49ccdeb06fbce5d410e6456e55379c759294d6701ec6bfe78d46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374328, "uuid": "b2387423-fc23-42d1-9b77-a9200ca0d441", "value": "T1DD831746BCD2CA12C6D423BAFA2E518D332563E8E1EE7207DC245F1437CA92E0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374328, "uuid": "ff371f46-8dcd-4506-8754-ac8096866ed5", "value": "1536:NUE009mvvkrkbw1C14d5X9NP8w5cVAX/kk3ykAgptshHI9w:NUEFmvvkrkjutvniTgptSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685374328, "uuid": "0388497c-8afd-4b01-aa59-1852dedc4873", "value": 83000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685374328, "uuid": "237c1972-002c-4182-af7f-7080255c578d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685374328, "uuid": "190d970f-8749-4dea-a0a2-dcd32d9f2e4d", "value": "34392bf984f2712cf3801924fc28f6c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c3eef9-fe06-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685354022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354022, "uuid": "0db3e89d-19f5-46aa-b556-c8c45887f793", "comment": "Malware payload (Formbook)", "value": "e7344fe54449154d7babd65e5ee9b3eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354022, "uuid": "0de0121f-61e5-4ee8-82ba-6304068efbb8", "comment": "Malware payload (Formbook)", "value": "fd775a8681200c469cfdbda94d5c9cde3454cb21a4a4783bad3aa647cab4378e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354022, "uuid": "3c23b635-88f8-49ec-b323-48b8a9b2d071", "comment": "Malware payload (Formbook)", "value": "591b092698eee1cc31f27776d546cab94827e5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685354022, "uuid": "4c4a2ae9-fd7f-4068-a01d-aa94cbdaceb3", "comment": "Malware payload (Formbook)", "value": "2ff041542e2a17f58e0ec34e95bff93c8ed825e0ba872890d27c6a0c0a39fde345ad2f69b3189f768aee1e8a5e7ca0e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354022, "uuid": "97fbf164-23dd-44f7-85e4-25fb465b17a5", "value": "T1C8E41268356E7F26D13EC7F980603A7053FBB55B7132E34A0EE7A0CB6166F410641A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354022, "uuid": "591eb2c2-f8ec-4d89-a213-ff2257fa6ab4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354022, "uuid": "1ac9a163-d4aa-4f12-a623-8a966fdf01e0", "value": "12288:6+MmzZBEP85DJzExn3bjns9bYW7WfXc7j8sjNDcUT7UM4vhXwiRQY:n9BEP8TOnrjs1Y/qYsjNDcUPUM4dwiRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685354022, "uuid": "15fd7e45-070b-4ead-8b4c-1c35b43d2349", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685354022, "uuid": "7dbfa141-be33-4aa8-a73d-0dce1b1719b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685354022, "uuid": "9df9e3fd-0b4d-4c6d-99df-ec8b30e58e64", "value": "PO-9192 & PO-9193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ac812e-fe2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685370772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370772, "uuid": "c2278b3f-768a-468a-9d2a-786062ff2617", "comment": "Malware payload (RedLineStealer)", "value": "95bc30cf058fafef3b3440e15e26b5b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370772, "uuid": "80cdd9e8-2f97-4ca2-9309-d046a4e60521", "comment": "Malware payload (RedLineStealer)", "value": "fd84fb6d3f652320b03c3b4b63529d6d80967949f95613067c45d64b93de7be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370772, "uuid": "5be28feb-1fef-46a7-a4bb-61204cd95ebd", "comment": "Malware payload (RedLineStealer)", "value": "3f0bb9bef3d30d6de706af1a48ca004d0f9275fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685370772, "uuid": "237d4c19-cca2-45a9-ab81-8acdee369a9b", "comment": "Malware payload (RedLineStealer)", "value": "37d9cfc9df6cb762fde3d17eb1e99a9db07def546b62d32f44d7009cd171541fffe3d6281bcf093723766e26f5e6e5f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370772, "uuid": "e955fd2c-a8f3-4a7b-9413-234a17938456", "value": "T1B5946C12A3E17C71F6264A319E2EC6F8761EF9504F597BE723189A2F08712E6C572730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370772, "uuid": "0cc32aa2-225c-4590-b661-448ae970075d", "value": "0a261f793955a0334411687f62dd4035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370772, "uuid": "2ad2f558-788e-4eb3-9ea5-33b17d1e75b2", "value": "6144:gnjufNTCSimbmfBzhAuCA6wdfu4K5QFmLYn0PvfFPxpFJQ:gnaTCQ6DTD6WW41rIv9xpFJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685370772, "uuid": "45c3ab99-541f-4f04-9ca2-3f54b3aa5572", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685370772, "uuid": "d57743a5-cc64-4f6f-ad52-8656bc7088a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685370772, "uuid": "ee01b454-0f82-4251-92c1-d5aca7624c22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d224966e-fdc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685324870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324870, "uuid": "3ff20be7-1d08-4e5a-abfb-805a9c4649ab", "comment": "Malware payload (CoinMiner)", "value": "54cb3adb1c72d73c3857a849f3e78c80", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324870, "uuid": "56330b2e-344d-40a4-bda3-0abb457ab3e7", "comment": "Malware payload (CoinMiner)", "value": "fd8dbe94e2d1acfd1a35053d2c643ef35b1146fbee7ad69536d0361ba32eb703", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324870, "uuid": "2fc014e0-b5db-4251-b162-0ba741e36595", "comment": "Malware payload (CoinMiner)", "value": "6c783a9bc56b98e5fc392d0c7ae6d00752d0cb38", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685324870, "uuid": "b2d69c3c-68d2-4c2d-84ac-11460d3c8a46", "comment": "Malware payload (CoinMiner)", "value": "86ab1c11776f5c41da72c579ef8a8dba002f847d13b04d590bea7dd85c253a74e261a6529c4385e4dbdabfd570a6e205", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324870, "uuid": "0856cfd4-688a-4a15-a743-1a3543300d25", "value": "T1B2C6D0E228E52DDFC9EAC97ACA46BC2EDA0FB835171B646360957371DAB3C407904F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324870, "uuid": "42147174-8ae5-490b-a55b-630b05f39443", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324870, "uuid": "2290a304-251a-4bbb-929c-6700ebb6a433", "value": "196608:hKHjNyAP70yeCW3wlx1K2xteXvc4v4WNe+ZHRW8N4O7NADtV6v+fcENo9:KNoJClxdefc4X3W67kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685324870, "uuid": "d507dbef-bc6b-446c-84c5-0f917f496dd4", "value": 12236160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685324870, "uuid": "d5bf5c6f-87d4-4946-8d0f-0a76e8e2fd85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685324870, "uuid": "56ee016f-2786-4e4d-b553-1d817adcfbbe", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838f26ce-fe4e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685384868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384868, "uuid": "b0f593a3-4078-4441-8f1b-22e400c7c1ac", "comment": "Malware payload (Mirai)", "value": "4cc4f8156edc35fa281527c9aea5bba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384868, "uuid": "92d4bdea-a6b2-4c35-a60f-2d69de6f6b6b", "comment": "Malware payload (Mirai)", "value": "ff20d9686565eaf9d5cadd3de9718cb89d164bb770a3ea1a1dbd6209a51e86a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384868, "uuid": "4feb85fe-4946-43ba-83de-62e9e36cb613", "comment": "Malware payload (Mirai)", "value": "36ffb542dd3639adefef45a7bf38740599acf81b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685384868, "uuid": "74674798-9010-42d4-b90a-5702fe313b5e", "comment": "Malware payload (Mirai)", "value": "d0b98aaf0faef604dd1ea9caed7454c2eac7d6f38c54f3884cce7f719395d93bfc7319f87f68f39aa71a13d938283183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384868, "uuid": "e4f6ef25-7041-4cc1-ac1c-9b301f31f6f5", "value": "T12CB2C078170100A5EAA7C5FA47E113612FA403B156434D29EACCFA8BA959CA1B947FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384868, "uuid": "066b4ec1-011e-49b3-b7d5-4a88df173daf", "value": "384:a3WEBXfrIOPMQXWFgjmIzbJNWR4SAyV/3Aw+w1M7QbMcfJgGlzDpH7uNj1JSE:0x88MD6jXXWuOR+X7QbMGJgGlzDpbuRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685384868, "uuid": "fe5ea50c-fee9-4a46-a1ba-6c154394a8b3", "value": 23776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685384868, "uuid": "ecc549c8-3fd4-4828-ad2c-967d87dc1d17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685384868, "uuid": "808bcfed-8653-415c-bec0-8b92550e1cde", "value": "SecuriteInfo.com.Linux.Siggen.9999.11042.24901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f62c48e-fe5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685391169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391169, "uuid": "c7d7d736-2967-4fb4-873e-1b5ad647dcb9", "comment": "Malware payload", "value": "3a856e6f7f1eec8ee604d77b5c76544d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391169, "uuid": "1e9df571-2e20-40e5-9841-8db1d3df42f0", "comment": "Malware payload", "value": "ff8e80ab6ce3241d81a9cf06a46bf84c2c348361f8881c361536d76ecd23d6ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391169, "uuid": "0208835a-b1ec-4797-8962-f2ce0150a33d", "comment": "Malware payload", "value": "be3e277fe4fa475ab61b46809891ca7595edae68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685391169, "uuid": "76a76343-a9e1-4242-85fe-ec7fab646757", "comment": "Malware payload", "value": "f04d90d7f180d356fa0a1fe8aa6e87640f505736a0d8db2c5354999841908b40393bf787ecdb75dfcb785b4dba0d8f2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391169, "uuid": "369f124b-8825-4e89-8d56-e48df76bbdf2", "value": "T15CF2E04C81617CC5EECC1C7E50A63BD25E9975C0B16A9B4CE7605CD2F32A10B6AAE873", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391169, "uuid": "12abee18-344c-4d0c-8ac2-e5d3f57e4ced", "value": "768:c1kNo4sPpZj92y6UkJ3UJoroVTtGHFoEs4lBWMF:ce24opLIJkEoCoryH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685391169, "uuid": "74e8829c-2d4f-47e6-b489-14de0aa3abfe", "value": 36256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685391169, "uuid": "2fff413b-cdc5-46ef-b110-71daf1c9ea46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685391169, "uuid": "cd3a6d68-7303-42f4-bbcc-3c8e5be6e8f6", "value": "3a856e6f7f1eec8ee604d77b5c76544d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb1dbdd-fe2e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685371031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371031, "uuid": "c28970c8-1df4-41b8-9328-2f45db7e666b", "comment": "Malware payload (Mirai)", "value": "942bf21493eb0401f3519803a09fc4d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371031, "uuid": "1aef5db4-35ac-4f4f-85fc-c29a5eb0823e", "comment": "Malware payload (Mirai)", "value": "ff91358296c2bd7bfae7108e955fb4fb404ef8484df4e4cf71a6ddf8fe861653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371031, "uuid": "186e1657-c1ad-42f9-a1d9-34fab5412627", "comment": "Malware payload (Mirai)", "value": "a7130aafb937b28fd879f2d4529379f1379951d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685371031, "uuid": "a60d477a-ec64-4cad-9317-8c865d8c2f2f", "comment": "Malware payload (Mirai)", "value": "b4feecd4733481245ac63506651a1c3006d03537cf773dd3885f46ca6b076e8b1d9dea409c930c8261cef5bd8aa13106", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371031, "uuid": "d4909190-fcf6-4d95-8b18-6060444e4872", "value": "T1C814E9067B210FF7E85BCD3745E66705149C581A22DEAB32BB30C869F64725F2AE3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371031, "uuid": "4b2de9ba-8c65-402e-8996-4153e4062407", "value": "3072:w/EBM7kVyTaaJV+vDzqKWryG0tBHcrIP0J:gEBM7kVy26c/UyBCIP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685371031, "uuid": "c9c6387c-bd43-4f79-af8f-8031d9700f9a", "value": 201168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685371031, "uuid": "9f20bd9c-af68-4a49-9f1b-a11990feab85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685371031, "uuid": "40e3b960-b496-46b9-a570-029a21fd14c2", "value": "942bf21493eb0401f3519803a09fc4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b39284a-fe3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685377123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377123, "uuid": "440c7d77-266d-4298-a0b3-93031b32b52a", "comment": "Malware payload (Mirai)", "value": "4adb15fd06ba47cbfb9a049e94927d2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377123, "uuid": "46ff8478-8656-436d-a754-c834fc8e510f", "comment": "Malware payload (Mirai)", "value": "fff34806348d652217a27bf41a3a85517b32d864707d2bcc624e39c770cb9aec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377123, "uuid": "8f83a393-7d1e-43f6-a61a-f2076da5550e", "comment": "Malware payload (Mirai)", "value": "d0ffc90cebdd7d2e4e54aa5f7e27b04ba3434623", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685377123, "uuid": "560ae4e2-0969-4767-8695-5e37b5d64fee", "comment": "Malware payload (Mirai)", "value": "90b3a79253dddd14a8d1b5088ed5e63dcb996e1a73ece3c0138e8a268d6de68ec9e044386b05bc9324c78c057fb1f624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377123, "uuid": "26d4dcf9-f7bf-4016-8e97-13c0893a0f21", "value": "T1CC632995B4029F7CF94BD6BA90170E05B92163C14BD30F2BA6A6FCE37DB2054BE26D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377123, "uuid": "48f6fdaa-c8b2-4bec-8bdf-b49ec6fd58d2", "value": "1536:xyoDylkqJ1F8qmIa8Ok/TxK7/9ZOnQW5TNkJZY:xyoDXqfF8qL7/NK7/2Q4NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685377123, "uuid": "04b2ec70-b8eb-46c7-8eec-34731d9d1dfe", "value": 72340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685377123, "uuid": "88235cbb-5067-4b03-8d3b-2e6ffe0ee010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685377123, "uuid": "96024cc6-4159-41ca-aaca-3845a45180c1", "value": "4adb15fd06ba47cbfb9a049e94927d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }