{ "Event": { "published": true, "date": "2026-09-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-09-09", "timestamp": 1791369585, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f8ab7fa2-c2de-452d-9253-82d6d7dbfd8d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6ba53a-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788948111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948111, "uuid": "7cecd88f-89bf-492d-9afe-ac279564618f", "comment": "Malware payload", "value": "802fce1faa23819d13898618d76a44c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948111, "uuid": "1b123ee7-46b8-413e-89b3-ddd681f83390", "comment": "Malware payload", "value": "00b0045e9e28b89946e7e839ac910f1f2e6f3c28937839aff3b0b41008c80188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948111, "uuid": "030dae7f-1102-4bb8-adf0-28f39d2311bc", "comment": "Malware payload", "value": "0dfa8da1747cd53bfcbaabd59c7bc7104d7929d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948111, "uuid": "5eb13acc-257d-4eb4-b80b-08ef7e7d426c", "comment": "Malware payload", "value": "a7bc2e8baac3198cd18f683811bb5d60b3bd358d822ac119e6fbf575116201a4d05714d773684ea483014fa379ff1cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948111, "uuid": "f2fbfc2e-d7eb-444f-8965-81e10008fbbe", "value": "T163C4E189F2063E86D0D7DD361486C5905B5AE4AB73F397093F43A6BB386D2724F28349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948111, "uuid": "aacebcca-2815-414d-9286-5644149a4532", "value": "12288:3dtDDHctFiVB4V7fs1CIxz2DKz9UxDC7gpCGtGtf:3dNgIVB49s1DFBDQUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948111, "uuid": "b907bf65-5844-43fb-961f-9ac8d8a51b8d", "value": 578920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948111, "uuid": "ad1337f9-e651-4dcb-8be4-e4085931bfcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948111, "uuid": "ac4fe6a9-a47e-4b25-a238-0d940bf7f19d", "value": "00b0045e9e28b89946e7e839ac910f1f2e6f3c28937839aff3b0b41008c80188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dace59c-ac72-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788974342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974342, "uuid": "6767a6c1-202e-45d0-bf89-a6a93b7584f9", "comment": "Malware payload (Gafgyt)", "value": "d1cf11cd15db74e46d48fef4f2fbd26b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974342, "uuid": "e1c2472c-1ea9-4e18-9626-f34627ca1f89", "comment": "Malware payload (Gafgyt)", "value": "0127b1c544bf05f115ed84412b84c1873facb44f9887731833e668ab5c6d850a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974342, "uuid": "797522a0-b68e-41c7-9d74-910486a379c5", "comment": "Malware payload (Gafgyt)", "value": "bacdcad60eb2dd5eb6d55c94653b18bd89767e85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974342, "uuid": "bc2e5dea-06ac-4d7d-a9d1-28bbe5753852", "comment": "Malware payload (Gafgyt)", "value": "ad0ece62ff6eb8b86c084c1a0bb46eeb9813747e227645ecf10cffa1357be4fc4fc66e806e5ae3c25f0502045e79875e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974342, "uuid": "c259d425-bcc6-46ce-95dd-3e553fd6b152", "value": "T116443B15E4504B53C2D317B9BA9E865D3B331BA593DB33019F38AEB02FC2B9D1D29920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974342, "uuid": "fb422245-05b0-4ef9-a915-f12c31977aa0", "value": "6144:ju/MmFlJX6aJrIt2ISYN5hXw+cqIYomWltImZTkampztb:jaJFjX6aWt2Xk5hXpIYomWltImJkampt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974342, "uuid": "9a57b5f1-8361-4f0c-acd5-10e4288e764b", "value": 259448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974342, "uuid": "c8afec47-7e87-4f64-9fb3-60158bac7bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974342, "uuid": "74800c42-89a0-4a06-8600-83e8da548f19", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f11547-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "c9bf0dc9-dbea-432d-a9e8-6009cfd50df4", "comment": "Malware payload (Mirai)", "value": "7df4d0a1739799b2e8072ee5c58eb2a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "d11395bb-8baf-4fcd-923c-b48a476533d5", "comment": "Malware payload (Mirai)", "value": "01f088986fee84c670c43f81e81a90e638c27ee07fe33142a755290c9b22ad52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "9e4dd1e3-8ee6-4626-b6ff-496d679dccb4", "comment": "Malware payload (Mirai)", "value": "ed87efbf48962bd0db1d6fbfb86282aeef8cfef2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "96f0dfb4-5e14-4fa9-b564-caae7b3e46d8", "comment": "Malware payload (Mirai)", "value": "566c0deda52483e44ae01d8726dd9efb8e5d8612d88d77eb01dcf15dbbee1d003cefab009bd964f039d53779601985f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966273, "uuid": "fe50a63f-65a0-4f78-9fbd-dd4c976e77cd", "value": "T1CA51B1C432174A30BFF29D9EB5F658647080E191E6C5AF51DAEC66FC864CF0826D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966273, "uuid": "813a22a0-3114-4b00-ba08-453f3173f91d", "value": "48:vXg4gagggugg7zEg7gqgdgsg0gEuUfg7goz:vXg4gagggugkEg7gqgdgsg0gEuUfg7gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966273, "uuid": "784fa7de-0a51-4b66-b9af-80ae3cbc988a", "value": 2877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966273, "uuid": "60342896-c8f2-4d2e-91f6-008952ff3ed0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966273, "uuid": "f08dd244-8409-4bdd-8e81-be19e57910fd", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb67f9d-aca0-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788994129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994129, "uuid": "4b6791e8-c338-42a7-bbf4-5dadbd2b03a8", "comment": "Malware payload (Mirai)", "value": "a3c5918459747db7ff9f9a45fba2d271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994129, "uuid": "1b20c2cc-f7d5-4fd6-835f-6203ff3b01e4", "comment": "Malware payload (Mirai)", "value": "032ff0fadec365884ba081187b5375c8b9b6b5c671843f9f9188bb7166be335a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994129, "uuid": "0e935b7e-955e-41ee-b443-9a595b8f4ebb", "comment": "Malware payload (Mirai)", "value": "fa64023a77cc5afd2fd356d5102fc0cdc9eaeb28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994129, "uuid": "8463bf93-f949-433f-a081-59a9a13be5b5", "comment": "Malware payload (Mirai)", "value": "7d37192388e24549e0526d6c48f1fc1b7a168795ae9a5adda8be2dd1f320136b074c880e798059921077f3ebb61aade1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994129, "uuid": "a6a5e582-1ad8-4a5a-b177-c4b855308156", "value": "T1AC24290DF902D8B0F07291F1069EC3F17E31A4F75237AD62EF2B2AB5BA272915D05259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994129, "uuid": "84c72145-bdfc-44e2-99c0-7625e5b22c9b", "value": "6144:Pt3F38HEaCZO6KRQ67sbYqm8KoLDkq5n6DO:uCZwRQ8sbYn8KofkS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788994129, "uuid": "f56c3c8c-6535-4f1f-b671-d8b7df1b8198", "value": 218584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788994129, "uuid": "19c04023-94f1-4408-aa07-4d72c3472a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994129, "uuid": "0cea0637-90cc-414c-a8e8-2aa12e13e20e", "value": "titan.x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89e45bc-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963704, "uuid": "ec0bcc7f-d18f-495c-9cae-a19b6c591f32", "comment": "Malware payload (Mirai)", "value": "c9505328185912a8b644745cf9d43f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963704, "uuid": "fa7ea9f9-c98d-4c27-846b-e440f9d25794", "comment": "Malware payload (Mirai)", "value": "0360d6515be904484ca730558536335d69fb05e667e08a5ceab2c7ee7839943c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963704, "uuid": "6269ec00-535c-46e0-838d-59595711e984", "comment": "Malware payload (Mirai)", "value": "1270e7a3d15a8f76923533d7ac583582cf4b367b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963704, "uuid": "36e81b40-53b9-4c29-9eeb-18620b591fb2", "comment": "Malware payload (Mirai)", "value": "9c1d8ff785115d4ebc9d0f7969377526e9b6b2e810ebaa782613c331da45130b9a11a7397d5bded85650850f673adab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963704, "uuid": "ca0569e0-e525-4f3e-ab14-ba624a4c7d60", "value": "T11F042945F9409A17C6D612BBFB4E428D372A57A8D3EE3203DD255F21378B96B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963704, "uuid": "6c0b25db-778e-4c38-ab81-8cbbddaa0010", "value": "3072:rYCelxRDIW0J3cfi3MjWwahuCBpg40aODlJDzD7jAia:qNI9Mj+wku40FDlJb7jU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963704, "uuid": "8590b658-6cdd-4be6-b3c1-6d475e2c58d7", "value": 182880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963704, "uuid": "4cdb6c7f-b293-4afa-a9b7-e9c47bdae5c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963704, "uuid": "1b31f4b5-ff44-4295-aa02-405b79e6dbde", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970bfd88-abf8-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788921959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921959, "uuid": "fcc37553-57df-4fff-a687-4f6a49396ea7", "comment": "Malware payload (JOMANGY)", "value": "0de073777b10edd83ce98b2934cde708", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921959, "uuid": "3d7f8ecd-3f4b-4441-8397-3966043896ab", "comment": "Malware payload (JOMANGY)", "value": "036fff70e9d3305ecb0234e79d3ae373aa348ba0cf30d5526bcb13d2f51da0f7", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921959, "uuid": "436396e0-ee05-4e90-a853-deebb3076e79", "comment": "Malware payload (JOMANGY)", "value": "55458a70a866c20cbed364a1402bdfa0e6bed1cd", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921959, "uuid": "6c7c7208-ffa6-4d9b-90d2-4d300ecb2f46", "comment": "Malware payload (JOMANGY)", "value": "6b8cdaf7e0670b3089fb4b55a7b87e76e9f628a7c74b0509c0a853fd8a52cc2de7e32294dadb60e7f6a7829c2310c0d4", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921959, "uuid": "608293df-03d9-41b1-b2c0-d90cedf1eb2e", "value": "T1AB236C6516857C14AA99C8365D7F2F0CBDAD43E6314492EE7FCA3CF28C4A6AC920861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921959, "uuid": "8bbf029d-d212-4242-9ef0-8b2e9849849e", "value": "768:Ir9NyXsZztCc9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:WHusZ8cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921959, "uuid": "a36741e4-5b42-4561-9dac-6b4efa1dfa11", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921959, "uuid": "c6f6ce5d-3a92-4c7a-ab68-a02ab5f5c9d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921959, "uuid": "e9d3c41c-9c7f-407b-bd56-61ee477416fe", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae8eb2a-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788977344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977344, "uuid": "d8b94072-b8d3-4a1a-9964-884f4466cd11", "comment": "Malware payload (VIPKeylogger)", "value": "b947b36de1b70c4351aa3f81529c9f92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977344, "uuid": "d21529b2-1c72-4d35-b80b-e9c6ce6709c6", "comment": "Malware payload (VIPKeylogger)", "value": "03ad2fb00fda119f1ccc4a52622aea505965332d5744fd6d1f502daf7a8f39f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977344, "uuid": "b2cbfe10-8e92-474e-8e55-87e2dd18d774", "comment": "Malware payload (VIPKeylogger)", "value": "49be60d4d74e3004c25908865b52be236bc8e45f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977344, "uuid": "17165ab5-9af4-4784-b27d-46d53511287b", "comment": "Malware payload (VIPKeylogger)", "value": "aee4928d9f94459b3eb9d3e614f3634ba3e6ef8b49ff44b5c32a4f6c910c7505fad1b4b6339bf6dc1108a7676d54b0ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977344, "uuid": "4c8c4266-2735-4ca4-820f-e7c48c6d5538", "value": "T11145222EB939B0588CCA7126623963B1C44B5EBF23375BCB2C10FF95A542CB59C62717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977344, "uuid": "2615745d-6bcf-4e21-a6ca-2317155acfdd", "value": "12288:oK+VDw5AVVVVP1nd8URMHazbIjYve5lia24UuAl6cEqrzl8N5sTs5wBVVv55u5Ac:In/zbIM2Litp7cVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977344, "uuid": "24e9d5f6-e3b4-4698-8ab9-cc6c44a9c699", "value": 1272122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977344, "uuid": "28d145cd-f5da-437b-8dba-094852b3becd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977344, "uuid": "dd0c3285-552a-4f88-8284-2dad1ff85aaa", "value": "bank transfer pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9c4427-ac49-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788956837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956837, "uuid": "165e4f9e-998d-4fd3-977d-670ef8cc8d9c", "comment": "Malware payload", "value": "59622343e4f1952099312c1ae08a632a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956837, "uuid": "9939cdd8-edae-43d7-ae3e-3404b501a37b", "comment": "Malware payload", "value": "03eb40ad7c6de54e0588b95f35600ec032ce8027e412b8c29f3335403d15d55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956837, "uuid": "45ca2915-49a1-471d-9cd3-b9831087b25b", "comment": "Malware payload", "value": "e5a2daa38f5e4a28791d30661588eae15ebece84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956837, "uuid": "6a85a789-dc9c-4cc8-a34c-3780b2db888f", "comment": "Malware payload", "value": "0b9c62c156dbc2971e77593a26cff11c63f7e38edcc0db4bdd0d84af66a0d85aad68fd0a9f1e783a321b74519d932f6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956837, "uuid": "08d4bb88-a397-4d75-a1f4-0d8f8e88b930", "value": "T13648F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956837, "uuid": "c7de9674-cf18-4db0-8ebf-d0de2a30f7fa", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956837, "uuid": "86627dfb-2c14-4ce9-a917-d938c5142592", "value": "1572864:1Pp36F/iKRzZo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZj:1PpIlZheuXpX/z/5NivOcC7hlTrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788956837, "uuid": "19217ede-2a7e-4284-b38e-5eab1bbb4bc6", "value": 116966156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788956837, "uuid": "b6c72f20-8213-4f6a-bc46-56ba6a59a538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956837, "uuid": "e7b4aec3-3a08-4076-b2a9-97987f6a0a06", "value": "ExternalMM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6424cfd5-ac60-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788966542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966542, "uuid": "b1c8cc76-db90-45bb-b9e2-e9e7ed122737", "comment": "Malware payload", "value": "db30c45a572340a275105fde29235024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966542, "uuid": "064abf5d-8c67-49b8-b348-dd2f84d6f404", "comment": "Malware payload", "value": "04206a0fc6e8483297e1f4c32e33838a49ab98ccf5282f5e19d3f8e0e6ce2d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966542, "uuid": "86b0e0bf-4d27-4932-ace2-14071604c99b", "comment": "Malware payload", "value": "e74d85de7e18ec8069f798db5504b05fcb8e8de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966542, "uuid": "2c112a9f-3edb-4965-b08b-36ebb28157a6", "comment": "Malware payload", "value": "eb0c8360333aad62ec95e7f7800eed49c40842857809ad22deee35aa38289511c9aa9997296a49f236327511f41e1c26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966542, "uuid": "53963904-0785-4345-a584-e7f7f616fd26", "value": "T13A46023BA18BE53EE07A5A353972911058FB7F6D65124C069AE4F48CCF360B01D3E6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966542, "uuid": "66eea749-baff-4ada-bc4b-943a70e0f073", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966542, "uuid": "03eef03f-b9a3-4250-8ea0-7267c84dd3a0", "value": "98304:s5OqMwrURINHAa2JiCdJ9YKzoFOqQtAwKLoa2ru2A44D5kmF:I/MgURXNYKzogqQtAwKLD2S2r4jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966542, "uuid": "6f4669b4-1d9d-4d4c-a1d4-aac2557837ad", "value": 5475832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966542, "uuid": "16899ddb-302e-4932-935f-361815e4161b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966542, "uuid": "fca7d862-4bab-4df1-ae28-221965eef02d", "value": "04206a0fc6e8483297e1f4c32e33838a49ab98ccf5282f5e19d3f8e0e6ce2d54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf50e3c5-ac6c-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788971849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971849, "uuid": "fcbd0e1f-ef81-4118-84d2-d138362d444a", "comment": "Malware payload", "value": "eab178d35378b3a667740bc2b782675d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971849, "uuid": "ff76b509-bed5-40fd-a55f-6668b01ae458", "comment": "Malware payload", "value": "042c2f6e7e31c13f860804ef9d7b9db38a9231caa041a724888f308d4b96d59d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971849, "uuid": "46d8a264-3140-4a93-ac0e-8c2d8b950fbc", "comment": "Malware payload", "value": "a7d9cf824c138cffbc504b125d651c8c63ecc414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971849, "uuid": "1f5671db-92c6-404a-9b7c-54e84e1b8879", "comment": "Malware payload", "value": "cd470fb184a4b7190ecc978a2202a587f450a77815645a623ac10777d6e141aa9ab09650c4d06cc26d1ba80e1dbad1b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788971849, "uuid": "da2b2d48-c9a5-4639-b5b7-373e9b947219", "value": "T13AD21A3AEA725913C4D499B895F3832CB9F9425F647D4A163C6B0EC4EB91AC06113FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788971849, "uuid": "1fae101e-20a4-4227-8616-c6c058d7fea8", "value": "384:6ysT8AllDko1OxoUmdKzN57tSezXasmFFU+pph1K7R2O:6ysTZ3OxoHqBNeO+3K7EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788971849, "uuid": "4f74ec6d-e2ee-47b2-945a-5c4bdb410b21", "value": 28836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788971849, "uuid": "87314888-a9f9-4f18-a42f-67e4207401fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788971849, "uuid": "52a16e21-2b4e-4db8-bf45-9ce2643c5f29", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16d9b0b-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959799, "uuid": "8916d29f-2c27-4b37-b614-65b9a1167c35", "comment": "Malware payload (Vidar)", "value": "39aaf534b97090283fa1de688717eda9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959799, "uuid": "bf78e448-ea7b-4f66-ab05-e3a00cc3f184", "comment": "Malware payload (Vidar)", "value": "0503eedfc228441b19bddf52de9998468c474ea9ffca5ef47152db6d7fd069c7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959799, "uuid": "504e37fe-697a-4303-a8c7-9d1245ec1f40", "comment": "Malware payload (Vidar)", "value": "65a11af40ee2d42ec42b2a61bf9926a573205912", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959799, "uuid": "f76360e7-3924-45e1-9e91-71e282e1db80", "comment": "Malware payload (Vidar)", "value": "00fdb6f258ad660a118cea24d3973774be4d1143d0d01e37f52d5a4c66750e2b21d2ec37d939f2027875f41b7e43e6ea", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959799, "uuid": "372696d6-5296-48b1-96ae-d9b668fc82c4", "value": "T1CDB56C71A2C2A1B2CA4D33742A3E77FD9D709B222B04CDDBDBC4FC186E691D256B1416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959799, "uuid": "53d695a8-9f3a-4221-a958-cfec6fb0ef45", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959799, "uuid": "a4b634ee-360c-4591-b393-6ce07974df5a", "value": "3072:1OBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyXzdE5xD:Q/rLVPW0nsP2Xy+TJfWzWrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959799, "uuid": "06391874-3ef2-4f2d-b692-3bde1b5497d0", "value": 2327708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959799, "uuid": "538fe30c-a442-41ed-b0a1-ac4b38e7734a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959799, "uuid": "442a082e-7c0e-4d75-a189-312ba49991be", "value": "0503eedfc228441b19bddf52de9998468c474ea9ffca5ef47152db6d7fd069c7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2bd42c-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1788977239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977239, "uuid": "b0771ae3-fb77-4929-bc0c-1f047e0c4c24", "comment": "Malware payload (LxBaseRAT)", "value": "770ed77c05a84309c8f076063d096a03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977239, "uuid": "10b314d8-3e05-4c03-afc9-2572147f52ac", "comment": "Malware payload (LxBaseRAT)", "value": "0528fe72a89d25c2dbe6780ce633b7bc4405c9a2e6022b7ed14337368eaf500e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977239, "uuid": "290dd41e-d3f7-45f6-ab3f-8229e3d51ecd", "comment": "Malware payload (LxBaseRAT)", "value": "4557d7a9fbf85a4bc0305967f91dd447beaa3dbe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977239, "uuid": "98efaea4-dbb9-404f-be77-084dd6904d29", "comment": "Malware payload (LxBaseRAT)", "value": "1bc1c638ea197dde123a46ef8b89d9a8bb40d9fe0f0a3cdfe3c71748edcd3328706ad8d12d846607e746e49467481ae9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977239, "uuid": "e0f0148b-4ead-40a3-ad6b-547c26161beb", "value": "T1FC2523069FB9A86B433154FD54DE530B6ED90BD880D899B8C24CA4C60DD8A1F5FFBC1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977239, "uuid": "d7107096-0d13-4892-826b-48b936306884", "value": "24576:RHPHM+ch5x15kLnDCefRX0YJh7mYeY3e5cL:RvH8mPRbxmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977239, "uuid": "a65e22d9-5be9-492c-a701-85b1cd744af9", "value": 1028227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977239, "uuid": "b4dcc73b-778e-4473-8743-55192633c76b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977239, "uuid": "c2cf6850-31da-44a0-ac2c-9bf3ad087c63", "value": "PU_Q-SW10-321313.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91871430-ac07-11f1-ab4f-4201ac107002", "comment": "Malware payload (OverlordRAT)", "timestamp": 1788928393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928393, "uuid": "fbe3da58-c287-485b-a845-7eab6763fd4a", "comment": "Malware payload (OverlordRAT)", "value": "75115dd0ac51d507ace0dfe843ba659e", "object_relation": "md5", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928393, "uuid": "f0a79606-8931-4ed1-8563-305c8180b83d", "comment": "Malware payload (OverlordRAT)", "value": "05619f43a3fc34d50709f784dcb7f7c47c88d0c32d5b6d8d0c0e720d68de1a81", "object_relation": "sha256", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928393, "uuid": "ec8d9bab-7acd-4db4-8bc9-61b2dee01173", "comment": "Malware payload (OverlordRAT)", "value": "436b22b0bfc2051bed6df0b4555dec003d977c87", "object_relation": "sha1", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928393, "uuid": "0d85798b-327a-4879-9462-691537d1d407", "comment": "Malware payload (OverlordRAT)", "value": "59a4b2233b5d9d43d93d76b2fb3df066211f33ca8218767bb54e00fe56559b3fdcdd87ff92c26e7e3a6d4ee626e07a42", "object_relation": "sha3-384", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788928393, "uuid": "567a3f8b-0150-4ec2-99c0-6fece85bb614", "value": "T162A5332AEF6812A3B707D87F9A4BB06E5A270DC5CFD9096CDF186E5E1442FE49440E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788928393, "uuid": "f2744448-e5f7-4960-900c-d2b7e70c639a", "value": "49152:mfSunvmoTtTNfLGhPcXkQUpJxYoBsXCJ7Rcl0zx:mhvPzDGhPc0QYxOC/zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788928393, "uuid": "7b6d5096-b60e-4080-8cb8-83955d5889c8", "value": 2075353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788928393, "uuid": "c33cf5f4-89f9-4cec-8e8b-c830068c8262", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788928393, "uuid": "e24b8c4b-baf5-46c8-bfdc-0c664a04f17e", "value": "\u6240\u5f97\u7a0e\u306e\u78ba\u5b9a\u7533\u544a\u306b\u4fc2\u308b\u7d0d\u7a0e\u901a\u77e5\u66f8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf24953-ac22-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788940089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940089, "uuid": "84cd08ac-1859-43ee-81da-5db8b8c46bdc", "comment": "Malware payload (Vidar)", "value": "15b1626202423980370ab5789803ac75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940089, "uuid": "14d52cca-7b51-460d-907e-249975d3e8af", "comment": "Malware payload (Vidar)", "value": "066f74af1398ed730c07f281018946359d16d6e8eccd6c99d9ec7e606d55005a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940089, "uuid": "d6322bfe-fe16-4b45-bc54-9c1b8699d186", "comment": "Malware payload (Vidar)", "value": "e1cd54f6051ef3645e79ff31d684cf96eb74ac27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940089, "uuid": "6ad5a6a3-9ab9-4687-be62-12a9171c06b4", "comment": "Malware payload (Vidar)", "value": "3908ea256b2db3ac9e9223913767ceb3bd6ce026fd6d0869690bdb5e36b13982d9c68a739d2edf31c1e9f18d428e9c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940089, "uuid": "f4c91e5d-12cb-4c52-b754-e6f5a670617f", "value": "T1E2965A0B799541B5D4999E35C03E9253BB257C8CCB3533A31E906A742F39BE0B9B7B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940089, "uuid": "322159bd-fbee-4d02-a97b-a2c42c21638a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940089, "uuid": "e857da87-b5bd-438a-bd98-fa7eb3e8c7d6", "value": "49152:b/JxQQx2CGLq0dqFU0PxQF1NfOQv+mUNwD0VVw83m2QNt8tI3WHZteBFgd0q9EN7:bn9RQFD0VsU3eBAB+BIVDgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788940089, "uuid": "1c5ecc4c-e255-442d-9cab-3b9b374dbbe9", "value": 8671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788940089, "uuid": "750d9e33-1e00-4973-9055-755d9809a2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940089, "uuid": "57262dce-c4b7-4ee2-a869-e56a6041bccc", "value": "066f74af1398ed730c07f281018946359d16d6e8eccd6c99d9ec7e606d55005a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24dbac0-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966270, "uuid": "fe4352f5-7d11-46b1-8cd8-044945e4b960", "comment": "Malware payload (Mirai)", "value": "f98fdb3e6de0b62a33529658c6acf43e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966270, "uuid": "0fe65b5b-67ee-45b9-ab60-af3a7a6787df", "comment": "Malware payload (Mirai)", "value": "087f195491afe6a74d389c34bc945156d75099a9b03dd2ba98e0929ec48239bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966270, "uuid": "86958ac3-fdcf-494e-a950-d7f673946cfd", "comment": "Malware payload (Mirai)", "value": "c0fe10962df7749639ffda053c47a0bf08be3b53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966270, "uuid": "a67b2233-d945-4e08-882f-15488fa6aa51", "comment": "Malware payload (Mirai)", "value": "1e85d706b1d3906d834c9edeb321b163cb90424e97bfd161e30af9dd680a83e5e6f201bab86fc9e609aaf9872971ccdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966270, "uuid": "3fb7725c-7b2b-4e49-9a31-e44eb3a0b26f", "value": "T15E5193D532164A34BFF19D9FB5F5482474C0E092EAC5AF06D5EC66FC868CF0826D86A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966270, "uuid": "9c55537a-d2de-4e70-b64a-53fd69ea4dbb", "value": "48:vXo4oaogouog7zEo7oqodoso0oEuUfo7ooL:vXo4oaogouokEo7oqodoso0oEuUfo7oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966270, "uuid": "5a2c4962-6cd2-4113-80dc-b00650df34d7", "value": 2891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966270, "uuid": "d4a74926-1a6a-48ff-9f4d-6cbbf74d9546", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966270, "uuid": "9e131364-8979-4a12-b225-14c4771aa633", "value": "goahead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29613f95-aca9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788997796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997796, "uuid": "b59bd38c-e941-42a7-9a7d-cf0d5ef4751d", "comment": "Malware payload (Vidar)", "value": "56dc8b4906ff5d5995e35fd3316ff46a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997796, "uuid": "f6a36cd8-bf63-4eb9-ac35-818e48e252ac", "comment": "Malware payload (Vidar)", "value": "08d463f435f20fd7f4f42ec3c9a5ca6f9e47059d7c93a3f002513d06a5f60b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997796, "uuid": "335cc9d1-e3f7-4e5f-8716-a6c83a682e4d", "comment": "Malware payload (Vidar)", "value": "786f528d1f90d462ea5680825846940324d0f06e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997796, "uuid": "1efd26c3-b24c-4eb5-927a-5e2d3883e25b", "comment": "Malware payload (Vidar)", "value": "c02a4987dd90445c5cdfb9e22dd5bc0932f2e9ddeb676109370b32e328e77b7c0940fbd74f469744e1108fba513c0a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997796, "uuid": "69a4a286-389e-475b-8bbd-570864966c11", "value": "T19D567C037B81C1B0D495EA7AC4B6515077B87C4D833433AB6EA5AA302F263D1B67AF64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997796, "uuid": "615241e4-694e-4062-93c5-c5a93fcb555b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997796, "uuid": "224e90c8-0599-4fa8-95dc-169bd7a3bb90", "value": "49152:97nth69UVogsHnt7H1OjkxlNYQyRHV1cUr3vwaPMasNc4iUT038SOHf7PwnQ:9yhg0b/sH7wSkSUx3ToQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788997796, "uuid": "5ecf5ac8-d4f3-4d86-97cd-d889f57527c5", "value": 6340608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788997796, "uuid": "3d0c88be-b113-432a-8871-7a0d460a502e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997796, "uuid": "7794371f-c760-4017-a84c-fdb19799c460", "value": "08d463f435f20fd7f4f42ec3c9a5ca6f9e47059d7c93a3f002513d06a5f60b03.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d2c882-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "14ed241e-2fef-401a-8973-141daffff93b", "comment": "Malware payload (Mirai)", "value": "23d4082a8f33a1c5fa1aa718f55fc254", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "5e8af9fd-c453-4baf-9ece-f63ee117f8d6", "comment": "Malware payload (Mirai)", "value": "0a05cbd40204ac1f50f0e00344edaa7c1f7920eec8ec773db759710c6f759d1e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "7115b474-cb18-4f04-bc9d-e03916561a87", "comment": "Malware payload (Mirai)", "value": "9a01e81e3e6436f735b0ce05421f724fd4f9a08c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "7ca2a9bb-8bcd-40ba-a5ff-a8c25900245a", "comment": "Malware payload (Mirai)", "value": "993b2a0a051ca5e6d6d6be437953be771e334d737a308523dad6bf092ecb044601e1584fe09cb4aad9ba50e5b0c5f8ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "218bb220-114e-4613-8173-b84a6d774400", "value": "T12753F11821695D14FCC6A13CAC36FF47AD38A45DF6185F83B4F2703C6CDA9A0AE5B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "4e2181a7-6114-44f1-a464-eeaef437c443", "value": "1536:dYpTrRZjj+c2C4TRuztedS4NM9lzTuoBL4pu6JIfhpnouy8DMB:6lll8uEd7Sl3uoBL76moutDMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963452, "uuid": "3d82203c-07a7-4f63-9c2e-77ee4566035c", "value": 60976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963452, "uuid": "09322893-69b8-4927-a85e-f163d754d419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "a2e5d239-801c-4633-a3d6-4904a8ed7919", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6334927-ac49-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788956801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956801, "uuid": "27614af7-fab4-429d-a4b8-c0c00573392b", "comment": "Malware payload", "value": "d8691276e68b5513552bc8652d8a08ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956801, "uuid": "992b8b3a-a211-45c4-b723-4026bb6c1525", "comment": "Malware payload", "value": "0a90074c5f06e9df0bf7ed12a26f831c0e5d39f01537bbe9f3bb03f3e0d3fa54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956801, "uuid": "f5f1fcc7-db90-4e6c-8ed0-6dce325e8016", "comment": "Malware payload", "value": "123eb3b43478441d203e81b72120bb615cd975a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956801, "uuid": "239bb077-aaba-4ae0-81aa-adb6f2e40df6", "comment": "Malware payload", "value": "7d1051323ada1811c0147a5dcc360696f07f957713b570b14ee74bb7fb734c1828ef36b224c4188a900bb8e61fe264eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956801, "uuid": "9117159c-e842-4f43-9699-f4a40c8892bf", "value": "T1D9383359AF72D53FF913E072D12816E5726DD09087238ABF222ED49EE4E3F015B88197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956801, "uuid": "ff69c5c1-9793-4c92-9c97-11bdb59f2e8a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956801, "uuid": "f15a1075-5ac2-48f3-9a0b-9252651a9548", "value": "3145728:OiTm4v/iTwAqH1nKMnY9NYJo+sUifljLcs22/3:pC4QwAqHpKZ9NYJoxZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788956801, "uuid": "3ff47050-d383-4a81-9dfb-ef60626b0397", "value": 106030136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788956801, "uuid": "a5e55cd1-ecdb-445b-85a2-07eb44742ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956801, "uuid": "176aff7d-cad8-47f9-a065-97df9f7d8b22", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ba9301-ac65-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788968801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968801, "uuid": "927fc988-b1f2-4416-8a31-fcccdf16b844", "comment": "Malware payload", "value": "20493a905fee90e8241076ebe2bf1774", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968801, "uuid": "71e8590f-ab7f-4466-ac2b-ca7ca598aa89", "comment": "Malware payload", "value": "0c6edb79b5d6cebf85df95036949be190e300ffa93d50da19a1f7d046ab9ba47", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968801, "uuid": "81defa78-f065-4ba0-8600-3e67e59d3d34", "comment": "Malware payload", "value": "3be52cf05f679d75e7d5d961a99704e42e30ff31", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968801, "uuid": "c6876eed-1347-4832-bc9b-5602ab9c0b9c", "comment": "Malware payload", "value": "6cc06259bc08cfaea7a31199aeb872844b7620c8fc4e05dc1649db63cf6b371e06cb724daf5cb077d69e5c4c5da6e5f5", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968801, "uuid": "a7f0d596-cd69-49be-9736-f18f299e1528", "value": "T1293649137F5A20D4C09EDA38C93A56157B307C8D5B31B7D71E91BA30AE667C29CBAB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968801, "uuid": "545272d8-3556-474a-90b2-70583eb562b6", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968801, "uuid": "74417ac2-79e2-4c9d-8b19-61ea12b1bcc3", "value": "49152:WOyK7vy1V6aNP599tKgkWjlXhqRqhTTGOn23YDKmrVM+R0xV7n2fbjzCHtZ2WsuY:WOLa1UQtvuzkEYaMYR12D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788968801, "uuid": "712c4c2a-36b1-47d1-840b-3df1542d5747", "value": 5143984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788968801, "uuid": "7bbb2b32-bc3b-4034-a054-45336072cf51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968801, "uuid": "916633ef-00ef-48bb-a7f9-336490a0c0c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb3939-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963528, "uuid": "36e929a1-0959-4321-884f-59f9def03fed", "comment": "Malware payload (Mirai)", "value": "ac82c2e7445caa2ec5cd595292a7b939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963528, "uuid": "3f04445c-c3cf-4983-b090-d4e8072b37a6", "comment": "Malware payload (Mirai)", "value": "0cb396c099dbe4be7ec069c781e12543d6b9aa9ea1feae6d6416c9584c30df2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963528, "uuid": "e8185bd1-957b-4456-83d4-8f70a20ffc29", "comment": "Malware payload (Mirai)", "value": "9c6d87ffd8e82293cb8f9a50a3fef146e29775e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963528, "uuid": "56a964cc-128b-4b5d-84cd-126715ff263e", "comment": "Malware payload (Mirai)", "value": "56dffca73024b7a7026888ebffd4499f772f3f67362f17cf5a068c830b7886ce8535953948406bb9d95a326eeee19d25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963528, "uuid": "ca97818e-e410-4904-9e77-b212074e53d4", "value": "T110F32B51FF83CAF3E40304F081EAAB3F5A30ED1A4432C559EB657EAAD5539D5E20A364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963528, "uuid": "25a803ed-6a29-4acc-a5d4-f66eb960b358", "value": "3072:tohH0V3JL6BTMTeZRf7tzJVhDvAhstnhx:tI0n6OyToutnhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963528, "uuid": "e885d781-3949-4008-804c-79be3e0d9ffd", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963528, "uuid": "f0990d9e-ca4c-4bee-ac21-6b43f18f0fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963528, "uuid": "fbde59c9-3e25-4bae-8959-b57b2e06bb67", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730a281d-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946810, "uuid": "5fe29fd3-860d-48da-bc32-4aff76dc2b00", "comment": "Malware payload (Mirai)", "value": "288402a818967fa36b6dc7fe2b73bb0d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946810, "uuid": "62f6617e-ccf4-49b0-9ad5-8df1fb07c845", "comment": "Malware payload (Mirai)", "value": "0d21996c45d6dd42c1259770c3b7ac0fc42b3122d0b8968ac7502af117ec4683", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946810, "uuid": "d71dc5cb-da91-4a51-a91f-e9c85a4931bc", "comment": "Malware payload (Mirai)", "value": "1d674fd01914cf8a49fc108b90353fe0fe02f228", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946810, "uuid": "91482232-81aa-4803-853f-39f30ac0e850", "comment": "Malware payload (Mirai)", "value": "993623bab3e2698fde220cbb32f1095d2a12a59dd97421c4276eef8c41980d85b8c0b34f9ab59b39d2f1f93e900cee64", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946810, "uuid": "e3831aed-31e9-4799-a9d4-90e65428644d", "value": "T1A1148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946810, "uuid": "e4938142-820e-472a-bad9-6c536d506182", "value": "3072:hcHZcggly1tJmajThwnKBDMOzsjJjL1lCRHUKG:hcYlAJ9/hjzsdjyyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946810, "uuid": "916f6c2e-5c00-4bc7-b14a-82882cd06d69", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946810, "uuid": "d10023cc-6e28-4d17-b8da-d00356788f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946810, "uuid": "2d8b0200-1da0-4c7f-a0d5-9b1df852c4a8", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbeb35ed-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959817, "uuid": "131ad427-1949-4546-b466-ba4ea9d78653", "comment": "Malware payload (Vidar)", "value": "10e47a480fa3d9256b6c1b0853ec1748", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959817, "uuid": "b29d030c-5393-4ae1-a02d-043877af2eea", "comment": "Malware payload (Vidar)", "value": "0d2bdd3fdaff165c48f5f1d17b6037b7333e2893dfa09166d74610a128da3253", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959817, "uuid": "796e486d-d7b4-4643-a14c-32c4fabc8b0d", "comment": "Malware payload (Vidar)", "value": "27d581daba17b0370f21777393d60124616aac99", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959817, "uuid": "83ce2500-173b-4e88-a8fd-87a8995fd52f", "comment": "Malware payload (Vidar)", "value": "7247872888c7a65fb59ae28aa59cc7639483b49cb506e31984af413c7f108caa32c549df451666a16febe61ffda3ada8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959817, "uuid": "a247c93d-b743-447b-aac9-0ff439a4d8ce", "value": "T176046D71B3D2E072CA592274292F77FC6E70EA121700C9DBEB94FC1C5EB96C12AB1456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959817, "uuid": "d3ed1571-d609-4dbc-8cf9-c626e8feeca1", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959817, "uuid": "b20d2d5f-2d5c-4bbc-a1ec-d49544518ab8", "value": "3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyKzdEpxtpW4T0ntug:A/rLVPW0nsP2Xy+TJfLzW7Odb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959817, "uuid": "05a69587-20a5-436c-a0cf-4f7046b4aa19", "value": 184312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959817, "uuid": "609a7605-f5ee-4f9a-bbba-c0175fd07fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959817, "uuid": "7b92b147-4f73-416f-a839-518f23256805", "value": "0d2bdd3fdaff165c48f5f1d17b6037b7333e2893dfa09166d74610a128da3253.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a694b2-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788950465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950465, "uuid": "0e9a251e-6cfa-4ac9-a304-166f679958e5", "comment": "Malware payload (MassLogger)", "value": "7aeb2c04af8c8e3a4b320b45b0ae9a42", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950465, "uuid": "2386ce7c-1906-444a-ae84-23a4b842866d", "comment": "Malware payload (MassLogger)", "value": "0da8191da6755e5f1dac0e6117c2755b703a335227bd447cd8f5c3bef9af91eb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950465, "uuid": "384264a5-202d-4363-835e-dd45544140bf", "comment": "Malware payload (MassLogger)", "value": "b55bf84740010f4386f77cdaf38e279df1130bd5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950465, "uuid": "bf94603b-569d-41f6-9281-7c03adf5637c", "comment": "Malware payload (MassLogger)", "value": "33a846f83f2a0aa0a26d540e988b722928191f397f6d51df956c0725640b6cc3b0d250c8fd96ad28355f3eaf5eeb3220", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950465, "uuid": "c74e036e-dbf8-4722-988d-787f2edb94a4", "value": "T1EC25185DD006C9C04D76222D3239EB0DEDE4066BF985C622797EBB1CFB6492F4707A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950465, "uuid": "13f99900-585f-47b9-ab26-b3f5a43c99f9", "value": "768:y2tSGx5vF9+qQ9+tmyd0wgZ9iHisalF5pjHKv17Z/NGyZanSy:9xZF9+X9+tEZIHXGF5pjHKvxZRZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950465, "uuid": "c7463377-54bd-41e4-a4dd-939260ed23bc", "value": 992735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950465, "uuid": "885934c3-eff4-4cb3-bab2-db237f351a30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950465, "uuid": "6ab0b739-e47d-4cc9-b3da-027795bd45e2", "value": "e-dekont.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586c0ea4-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788977259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977259, "uuid": "5d4ce3ac-34d9-42f9-bfde-3e359267f475", "comment": "Malware payload (PhantomStealer)", "value": "2b7325394915219bb9edeb4818a4dba3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977259, "uuid": "16124a66-b5c8-4ea1-bcc5-0635c18aaa4e", "comment": "Malware payload (PhantomStealer)", "value": "0e263519e6b4acbfe349ff2f79f5e627446a3232bbe1a697e6102cfc6f43f99e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977259, "uuid": "23b68db2-417b-4842-a3d4-d5166a95b12b", "comment": "Malware payload (PhantomStealer)", "value": "b8e5e98509710b240cdf0c472ac87e4d3efb899a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977259, "uuid": "5c1f60ea-6d75-47c5-b280-4d8bcb7dbb12", "comment": "Malware payload (PhantomStealer)", "value": "1c2aa53d56adbbd18c5b2c77bf13ca513e9aa3ba0ac91730c940e68b8d6115b137a392feff99db95f1d3cb1010784f5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977259, "uuid": "44c5196f-c9a9-46b2-89ae-fd9d56e0af97", "value": "T15EC6C669138090736726675ED137C930AA0E251334C5DB29317F97287B7AE0F9B6CBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977259, "uuid": "5ee37519-e593-4947-8de4-6685ab578c8c", "value": "196608:OUgxn2q+TElH+ENijomkrvU4z8U9wmBWwsu8:YH+EHmkDU4f9wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977259, "uuid": "4af40b65-f07f-4457-b97f-990f1704fd38", "value": 12024209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977259, "uuid": "410c509a-8bbf-4fae-b56c-033a32e77cae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977259, "uuid": "875f2254-4bd9-491c-825d-9222ce11c1ba", "value": "unrkuboh.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acffc1d7-ac15-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788934452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934452, "uuid": "09928ea7-0c73-473f-80de-f7550e611857", "comment": "Malware payload (Vidar)", "value": "789514fc075eaed122ba149aa923213f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934452, "uuid": "882a1c2d-9750-4af2-9daf-399cba618e25", "comment": "Malware payload (Vidar)", "value": "0f04e28d1b5b47110a3b0894afaf2bbc5292f08ba29172ce54a54053692053e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934452, "uuid": "01cdcee6-067a-45f1-8558-f73f4f5608ff", "comment": "Malware payload (Vidar)", "value": "123cf86b42289a3306d5f4cb817a54ff4fd20499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934452, "uuid": "0a36285e-b4bd-4f15-9fe5-13325d05f22c", "comment": "Malware payload (Vidar)", "value": "10015eea78a3958dff5ef47d04f4ae1e1ccbf1d22f2e5fdba7874ad27c288e6fc2b3dd7174bdb6320a87387029c3f14b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934452, "uuid": "95cd02bc-2e8a-469b-a21d-b1500208876f", "value": "T10055FA8ED4825374B396FB63821EE6625DF6334580328635CF5A7D359F02EB0A029EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934452, "uuid": "494a1ef1-2ae3-4904-b51d-68885f5d5517", "value": "12288:3t/1grHv9KeEuAZ7bD57RHBIkP6d3g+6SYd/YIsbHcdTQ+MA9U:3krP4eEuVYdgIsbH/VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788934452, "uuid": "663e910a-fd6d-415e-8aec-2ab7f7c497af", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788934452, "uuid": "50fc84a6-b214-4437-8661-de1edbb876fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934452, "uuid": "0f33aec5-278c-4cf4-a412-fcc2e36df5c1", "value": "7c8ed10f74e02899d7f2bbf4324e396e46830e8d2265282726a3d4841746f9f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9fba18-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921455, "uuid": "2151f8ba-926a-4438-80bc-b1ccda4e6beb", "comment": "Malware payload (Mirai)", "value": "2ea727b781d6fae2e3970102ea07537a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921455, "uuid": "57f2d0bc-091c-46cc-82b7-f743c5575924", "comment": "Malware payload (Mirai)", "value": "1002269048f762683b0f553c5634460fa709390598b3cf2b7021bd6c453c08d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921455, "uuid": "c2eebd21-4dd6-4562-b875-84cc07f56c1f", "comment": "Malware payload (Mirai)", "value": "6d78fb1af0952923320af6c4e96dced2a04841e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921455, "uuid": "3c8cd76b-b4dd-4b48-91e1-efaca34972bb", "comment": "Malware payload (Mirai)", "value": "1c212c76948ad0d564d8a48c10655520ec4f364c8d89f95420ea8f0d403309b0a063288fc958611ecb27b350e3508369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921455, "uuid": "4d23e0ef-ae36-470c-b3a6-49d0f237100d", "value": "T1B133026227AE2AD291B05777FC33BC16669C17F95C6730993CF05A1977C48024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921455, "uuid": "8560abc3-4429-4a98-bb7b-a161ee7d69a7", "value": "1536:s9O/ZMAXIxNUk0VzL9O+LcPqF1aBexo4opKZbq:s9O/ZNKyNL9O+LGqFUF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921455, "uuid": "889da8a0-b09f-4f02-af0e-7eedefc6413d", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921455, "uuid": "395bba0b-8613-483f-8776-9ceda58a51a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921455, "uuid": "ae7b1f01-2534-4183-8f0f-5da47f191090", "value": "1002269048f762683b0f553c5634460fa709390598b3cf2b7021bd6c453c08d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b4b56a-ac31-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946281, "uuid": "1c27ad48-1867-4e21-82f9-5a8879e951f1", "comment": "Malware payload (Mirai)", "value": "1506de9cc22750312a39b67929c0341d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946281, "uuid": "42032ca4-efcf-428f-8783-cf412f6742ba", "comment": "Malware payload (Mirai)", "value": "103197dfa2e2fd4d70c07e12ed17e2ceac9696781d1e981037a727a557b5181f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946281, "uuid": "da0b5cac-7e1c-404c-a87b-466dae63cb29", "comment": "Malware payload (Mirai)", "value": "212388fe1c8fde4c01c8e2f625ccb93850501f3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946281, "uuid": "99d7a297-77b7-4dfe-8e24-1c494ae2327d", "comment": "Malware payload (Mirai)", "value": "8431779ca903bfd5716984c493e5e8be13b2fc83118c352e08f589ec2f21d38c89e2d19cdcddc239189dc714cb2b4d06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946281, "uuid": "a815ffff-0077-4873-8b1f-961211b60e18", "value": "T10783D60ABB604EF7ECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946281, "uuid": "7f762a7a-09c0-47f6-8521-b545cda4ae86", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946281, "uuid": "6a93ec77-0512-411a-9c9e-617af18aa5c7", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946281, "uuid": "2633c277-5c74-40f1-a2af-8ac7791e19ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946281, "uuid": "a720baa0-c4ea-4142-b175-0efc79ad555b", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f453be-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946811, "uuid": "d2ce6283-6bee-4bb1-99af-a8fccb3d3ff3", "comment": "Malware payload (Mirai)", "value": "f81475a58e8ff4b92dd0898936ea771d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946811, "uuid": "5c11b23f-5ecc-4d14-9084-635763d7a48b", "comment": "Malware payload (Mirai)", "value": "10404dfbded574b817c106c3d32e111b779738c100de1d3de8bb0841571b2df9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946811, "uuid": "8f64ec53-ac48-4c91-916b-0ad04ce02aee", "comment": "Malware payload (Mirai)", "value": "dc4e7b5d910629f81772c17e68b7eb69a322dcbf", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946811, "uuid": "da7e21a0-08db-452a-b2b0-c5d1cb3457f0", "comment": "Malware payload (Mirai)", "value": "7f718880cd673cef0307fc94e9b6e4783f3b038a09be99259f8136969a30863e0e191cee210bd962966447886a39991a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946811, "uuid": "d1065a04-e680-452c-adbe-0c6cc88ccfe9", "value": "T191D3CF32E0086DA0DD2117B43476597C0340DEB40BD59282EFBEE59E28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946811, "uuid": "3f55e068-3f34-4331-8c97-5e5d408928dd", "value": "3072:kNOlV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0ZJa:yOlo2ubIVv3sXL5NZmOJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946811, "uuid": "1c85cbf1-2524-4aaa-a151-e340f54f148e", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946811, "uuid": "1872854a-a4d4-4431-a9ca-f9c79d331c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946811, "uuid": "ba3f1258-9059-4be0-b6d5-3828d92bbb4d", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccc53ad-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "4c24732d-187e-47a2-8a38-42753e31810f", "comment": "Malware payload (Mirai)", "value": "f55b7da2a5b235d57be1cece583e0871", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "0e2ebef0-6886-43ba-ba70-e4a6750bd719", "comment": "Malware payload (Mirai)", "value": "10d62fda2484e10c7470d17dab025efcd1d772a08d26e6403fe15ba4c5b42c18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "28fa1e74-feca-43b9-b22a-db60edc8b4ce", "comment": "Malware payload (Mirai)", "value": "c6aa8feef5d50a27eed5259ea5869b94e1663fad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "853237fb-ad3e-4c39-93f6-b80fcfe3dc1c", "comment": "Malware payload (Mirai)", "value": "efc2cbff463765f35ff7314c8c5170b8749dfd888a1582b96fe35a4f6dc6b27f741f149f4bb664f7f93c97460e651d1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966261, "uuid": "4a5a3b5e-2ebb-4465-92a4-af8216cc3d02", "value": "T16F515495B3024831BFF59E9EB1F49814B080E052EEC4AF05D9EC76F9C94DF083699953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966261, "uuid": "2ca27be9-949a-4353-874e-6454b912df30", "value": "24:vuOSTaIOSlOSrOSFOS0TvkaUoOSJoOSVOSWJOS7OSXOSNabg9OSaOSA+Ol:vuRbRlRrRFRgpRJoRVRMR7RXRE0RaR7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966261, "uuid": "25e6a311-3bcf-4a2a-b725-fe3c6794dfca", "value": 2723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966261, "uuid": "1b8f28ef-b61f-4633-9c1f-dacd075fc524", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966261, "uuid": "8ac81710-b962-457e-a167-dcf8f1442e89", "value": "bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724197f6-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946809, "uuid": "b09c1788-9464-4081-8264-d78069637158", "comment": "Malware payload (Mirai)", "value": "f0abd3005f614850cbb9cb64a0167bcb", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946809, "uuid": "153cc755-7455-4dcb-ad07-4aa1e5c8d67d", "comment": "Malware payload (Mirai)", "value": "11de45f98073961456ac73a3fc4e6706dca3966b6a13edfbb0a67379a155a938", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946809, "uuid": "2b44c381-c8cb-45b0-adec-c5338232c188", "comment": "Malware payload (Mirai)", "value": "cc1df8e263f49efb4cd63725f8792a5d5c28f392", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946809, "uuid": "9541a25f-5879-4e50-8e8c-d9afe88e7016", "comment": "Malware payload (Mirai)", "value": "6cf4f28e299eb1216471a9f1900bbd14fc6f4a79ac11440614cd114a0e495850f2a1cd0a74fb8c267e25693c1c8d5565", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946809, "uuid": "48ef1551-58ae-4ff1-9049-cc3726a4d16e", "value": "T1FDB3AF87B1907ABEF0A49E3FC4135E26A6259F705583173D71BDF9906E3A3903292F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946809, "uuid": "1b4d663e-0397-42e7-bb8b-704e888d1225", "value": "1536:NoOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzW8rSx:N1xKlGWnqTUcXgZS5gZ7CSXhSzUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946809, "uuid": "cc1c6221-c47b-43f8-930b-2ec8b9718300", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946809, "uuid": "244acf25-3a3c-4f39-8f58-afda88af9559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946809, "uuid": "11962fdd-2c8a-40ef-9ce6-a8cf5bad7efd", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49581037-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977234, "uuid": "8a6a92d4-97f1-4be8-b2c0-6a1856325bf4", "comment": "Malware payload (AgentTesla)", "value": "670562cffe77cedc5fa0df9e2dfe685d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977234, "uuid": "3157ec16-efaa-41c9-9f8f-29ae9ea68a96", "comment": "Malware payload (AgentTesla)", "value": "131f34f1b44a32e03b0b3b066f56b9d0c5c1308b6b13aa8235506dc832d1a01e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977234, "uuid": "94452a4a-2d9a-4261-befd-a9000d27965e", "comment": "Malware payload (AgentTesla)", "value": "5586eccf35083138cbb1f0e9778e2aab18f11d61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977234, "uuid": "cca8e392-fe96-47b6-9537-9998bb0c200a", "comment": "Malware payload (AgentTesla)", "value": "20dc1133b9b0074ca1c7be12158add618a874f6d20fc218002af5f0998bcc91e3c567ff1ec2455b60f69fe04f216be65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977234, "uuid": "f8eabe5d-ff66-496e-bae9-5aebe4044ffa", "value": "T16AC6A368030B9431B73D9B1CE939E9228509215312E4EF1F317D97A87BB9D47638C9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977234, "uuid": "7a2ba5fd-f7e1-4a68-94d7-c8dcf6c16407", "value": "196608:tpA6/kkizndR0xE6cFl/FtaAH/y+qEB5q3s8twBeTaIe:iXFlK+lq3s8twEZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977234, "uuid": "831e117a-a4f6-41fb-a7c5-30c14e659589", "value": 11495457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977234, "uuid": "838b45ae-335a-4f09-b937-6eb88de587a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977234, "uuid": "5d71ca0e-d413-4812-b4e2-d7f064f88a61", "value": "Q88388712.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f3be7a-ac0f-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788931814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788931814, "uuid": "76380b3f-35da-4226-b1fe-bac3386fdcef", "comment": "Malware payload", "value": "d040367295fc37f90ac5b126c47b0185", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788931814, "uuid": "8c003a85-089c-424c-9623-1df033b69e4a", "comment": "Malware payload", "value": "13960b7e69159907f67f84ce6398d29f73686602ef2c36d837237288f4fe8785", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788931814, "uuid": "b535bf98-1260-480b-a975-babeab998aab", "comment": "Malware payload", "value": "d414406637dc083cf3fbb3ad113d141b1fef69e7", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788931814, "uuid": "dbb7ff18-6935-4060-8da6-d5ed80f62cd2", "comment": "Malware payload", "value": "f5b655b625f4fba410f552dfeb9e1eb5a7f375a5ceab252c7c57188ccafdd08a38f8bd71270fa9a34d9ad57dd7467fcc", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788931814, "uuid": "c8514b53-d172-455c-9a1a-e64cdf08ad74", "value": "T1F131419F41201E315003CA8D77B2394CB25EA6FB289FE7D0DE4D0DA95289BCCF951B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788931814, "uuid": "2c9c9de8-92e7-4bd0-9ca9-f1f20882ae3f", "value": "12:UOi6OPayIhbI6bfIKoflbAU76bAfg7dGLGrr6zSw8i68FdGmez0F60OAGlcagNKy:OGrfolN84kGFpGtDKuYxAA8APgFC2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788931814, "uuid": "c7b55dde-dc40-4308-ac91-1d5d18440abd", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788931814, "uuid": "1492f059-6e70-49f3-90e2-50b453f3aea7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788931814, "uuid": "c5277094-beef-4ced-a9ee-ef514045d2e8", "value": "13960b7e69159907f67f84ce6398d29f73686602ef2c36d837237288f4fe8785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0f1e2c-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (ModiLoader)", "timestamp": 1788977349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977349, "uuid": "f9815df1-3bd7-43f5-bcba-87eed4a73541", "comment": "Malware payload (ModiLoader)", "value": "267f586b3b4a03bb52b98291c31f60d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977349, "uuid": "184d2e33-6472-4098-8d54-432941e959fd", "comment": "Malware payload (ModiLoader)", "value": "146b4f27f3519fc00831cd242ec59eac51ad80343f6f0189ad062a3a0d44b848", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977349, "uuid": "1a0600b2-c4af-4afd-93ca-ec8392bc84df", "comment": "Malware payload (ModiLoader)", "value": "70fb640d04a67a04948f39fcee09acb0c513d417", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977349, "uuid": "c53c992c-e6fc-4645-b63a-ef7bcd8a95d4", "comment": "Malware payload (ModiLoader)", "value": "1780b3b5737ca2953d7ebcabb22555d556f3f8f7bd258d26f4b1cba08108bcc8efeef51bdeae0f58aac5404c7dca25bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977349, "uuid": "1331fad9-5385-4eb1-a8b7-22809240488f", "value": "T137C6F80C3914DAD314792D3A8C8CE9D7BF11EBA75561EDC2797C2A5B6B78B213B34220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977349, "uuid": "1ba91ac1-93ac-444d-ac0b-03f02bdf7570", "value": "98304:okArg1JDca3FyRgpHpKFHdONE4lcBNVxVLZzHCYnH0a3D8qL/jiCbHA4kcW:3Ug1Nca3FyyZ6dONEWeNj+hAimC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977349, "uuid": "e5080be3-4691-46dc-bdfd-e3fda0a3c460", "value": 11635625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977349, "uuid": "d1cf41bf-a0f9-499e-bfb6-b684bbef2d30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977349, "uuid": "19d3bd01-a713-4392-8bed-5fbd24478053", "value": "Doc 0018861308002341u.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8afa64-ac1a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788936441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788936441, "uuid": "7a238fa2-ce05-44bc-b034-fc49d77b6a7f", "comment": "Malware payload", "value": "43ee8d2378a0dc48379b39dbc3b85a70", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788936441, "uuid": "33fa7bc6-44ec-49ab-a9a4-c40e2406e9c0", "comment": "Malware payload", "value": "14d1f8b6f6afbb322322a037a45f326d7d257848991974196d9cb80a3fb47d90", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788936441, "uuid": "d6384bad-e1cb-4365-8b7e-a3852c2a9af7", "comment": "Malware payload", "value": "dfd8d6c21c8cb06d93f35a825cccb4b03fd956e8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788936441, "uuid": "6b0ff44f-5f42-477e-b77a-220b85541d75", "comment": "Malware payload", "value": "0520e2d9849ee8f9677f441aef95a6e39c74096a916d6c5eb78b42f5bf89e5bc24929243fed55c0aa99dfb9113b5a783", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788936441, "uuid": "af1d0a42-d25a-46ec-beae-55f08dfa35ea", "value": "T1903353A49270ECFFE1BB2238E49BA2355178719947DF977906F06871FD506938210BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788936441, "uuid": "2f77a548-8a06-407b-b0ec-906d46471690", "value": "50d0d1884889bb77dc39b3f77d667512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788936441, "uuid": "e8260c2d-6f9d-4c73-be70-e4f07642019a", "value": "768:hZQMY0XW2uJ83mhMbGFfW8AU24r3+Rw9XE1x/nS:hZQMZuVW8AU24tXux/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788936441, "uuid": "c77d7fb2-eec3-4555-bb2a-b8fdcd203123", "value": 52054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788936441, "uuid": "46b3a012-ba25-4ad4-bf96-dd167673bda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788936441, "uuid": "be48c382-a30f-428b-a644-0ebf0e626cbb", "value": "duser.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fc28ad-aca8-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788997395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997395, "uuid": "46e82e47-b13a-4010-b652-c939c11d9c4b", "comment": "Malware payload", "value": "bd13493deb961a17d1a45b21113adef1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997395, "uuid": "6881b4a4-2329-459a-a506-86e1ac4745e2", "comment": "Malware payload", "value": "1555f8caa68d8f9db9c19a3aef43acb516c9c850be4144f0bd3a2d5d37e77df0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997395, "uuid": "388c196b-1da6-47b5-9c70-51a7e09b702a", "comment": "Malware payload", "value": "3fe9c98352d8767b25ddf1021f5798d99b1f196e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997395, "uuid": "f74d695a-7969-4af8-84d4-7b93a4043543", "comment": "Malware payload", "value": "2effda0275bb8f413d4ee2c43abb005c0bea4aded3facbb796433d86629a2d39fbcb30c12574c105de0058a571bd1cf8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997395, "uuid": "0adad7c3-34df-44fc-8ada-5caeacb78a7a", "value": "T10DF05CD06708D2D44551E582AE59942AA683C4769A2A633C6671F52FB0F0240C73B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997395, "uuid": "c572a890-f62a-4e1c-8ff1-03ab3ef167be", "value": "12:3PnHbVPpvyLorEJf24bsKZAJwnGgGAFromgRzR9hsWSq:hPO8E9Xb+WemozxUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788997395, "uuid": "05e1c9a1-7c44-44ab-9986-225c8480b18f", "value": 461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788997395, "uuid": "8395efab-5cb9-40f7-86fd-f42d49dd15a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997395, "uuid": "7ce908f2-8a1d-46ef-bd80-9b3220f66f71", "value": "2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8857379d-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938256, "uuid": "4fbba5d7-39c5-4b61-b4b3-a140228475c9", "comment": "Malware payload (Mirai)", "value": "670a01255f9af8c59f00603f6550bd2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938256, "uuid": "88aac4f1-8ee5-4ec4-943b-81b2f3429209", "comment": "Malware payload (Mirai)", "value": "15612d87e4b1d45699cdfdba08d1ce405e87c95757c6bdac4d819f9d5d99c777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938256, "uuid": "9c7a924e-19c5-4d2a-9bf8-d5cc8913ae09", "comment": "Malware payload (Mirai)", "value": "9ebf60703ca13fdde3b8ecffa741355f22f01bc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938256, "uuid": "ab344939-8efb-4a27-b7b5-ae284cfe2d3a", "comment": "Malware payload (Mirai)", "value": "33b108b5145de868a77b008b16977bda34be8ce698c3d10936d115fed2ea59dbb8279fe4623978c5e3c39683c951107a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938256, "uuid": "49be10c4-c714-4b12-b468-a06a33fd86c8", "value": "T1D5B44945F8819F52C5C136BAF75F8258731757A9C3EA71069D189B383BCB99E0F3A202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938256, "uuid": "bc15105b-17d8-45c2-af1b-d47629acc6df", "value": "12288:ERPArUPxSWT1bXnygNVjQynxM3bU4aLYNcjp4M+zlm/I04+43:YAnWT1bX1TLA1llm/b4+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938256, "uuid": "1ca4aa94-1976-4853-9fc5-91d836360121", "value": 535240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938256, "uuid": "97b579c5-146d-4156-a6e9-4dc401b64819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938256, "uuid": "3c5458b6-6f64-46a0-ad86-5966cfc88e60", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360b7190-ac62-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967323, "uuid": "c6a2fe0e-b1d5-4cce-97ef-d066342a874a", "comment": "Malware payload (Mirai)", "value": "5159cc6e007d057a3981ea50d1cac5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967323, "uuid": "3195c9f7-633a-4490-b3a1-a71f2b6678ba", "comment": "Malware payload (Mirai)", "value": "178f533ef8e1a2515dc4bb1f3ba6a8ee13ca02184475fbfce38137025afe4dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967323, "uuid": "4c787ac3-5896-4308-b90d-b88bc0fa1bf5", "comment": "Malware payload (Mirai)", "value": "3344d607e41cdcf3ae8186bee11f922cbba69526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967323, "uuid": "33bbe8af-32fd-45f3-aa1d-40d1bc12f9b4", "comment": "Malware payload (Mirai)", "value": "dc6ed88cabf197737efd5c823e81292c880493f7018d402fa377a399ea9e622c9f63236d907dd56134d1072e0d29104c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967323, "uuid": "76017521-22f8-4127-847d-78d2269cc30e", "value": "T16434C61F6E228F6EF269CB7447F74D75975823D726E1D680D2ACC2101E6028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967323, "uuid": "73cc74d3-d1e3-4e3a-8bd9-e350c129c99d", "value": "3072:5fwNcub0Zod+CB0Tgvgdgs1gxJ4pZ8LQFFqGwguPb:5fwN9o6d4TG2gPMZXFFdOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967323, "uuid": "5cfbe780-c7ac-4fd7-bd96-cc374c587d95", "value": 240228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967323, "uuid": "a9272859-8596-4544-ada6-ebf1fee37b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967323, "uuid": "9ac91547-ea45-4f28-9e1b-46c2e2cbc5be", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10026016-ac3b-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788950509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950509, "uuid": "489b80dd-9d9e-4657-9cf9-7fc4222de795", "comment": "Malware payload (JOMANGY)", "value": "dcf683d26157563a64a92424a1738aaa", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950509, "uuid": "a793e093-d269-4f74-8001-b26b2b8d3c5d", "comment": "Malware payload (JOMANGY)", "value": "18a6fc79bab85bef501f3bbc45adc9f483706a42b1b47f1b4f1a7a4036c20ece", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950509, "uuid": "8dec7cb4-c5b3-4a30-9cca-f6051bb52823", "comment": "Malware payload (JOMANGY)", "value": "6003bc8d5e83ac9e08988db74ec7abc912e3c772", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950509, "uuid": "4dbef101-152c-4f22-9ba6-24eb60ec8616", "comment": "Malware payload (JOMANGY)", "value": "a76c88806e473002be936aab1835a802966cbdf5b4617561d3f7391da900c0cfc5731f777322ab3ce1d85048266a9b8e", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950509, "uuid": "4cae2daf-ae0b-4452-ad05-063ee304700b", "value": "T1B6C27D966A867C44BEC94B3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950509, "uuid": "f2a50be0-01bf-4936-b384-c798f795e053", "value": "768:Q8vCB+25j6es8RB9FYpMSUpi+20qUpi+20YQX:Q8l25J3d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950509, "uuid": "abe4267c-f3b6-48fb-8822-306975860d6c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950509, "uuid": "51083aeb-8642-477f-8172-dce2958eafce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950509, "uuid": "cabeae6d-a0f4-4ed8-923f-6a939dc7a539", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2b538d-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788977106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977106, "uuid": "d7352fc5-d4fd-4286-8250-e906b95d52a0", "comment": "Malware payload (MassLogger)", "value": "f11fe371f71eb910768190ab6005d507", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977106, "uuid": "acf46d40-2865-4ea1-aa9b-1d09fea29699", "comment": "Malware payload (MassLogger)", "value": "191b660282fd35f08fe70e20aef11973f20e4de6b25b4491290978ae16eed6bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977106, "uuid": "08e756e3-a2fd-4caf-91ea-e62febc1d43c", "comment": "Malware payload (MassLogger)", "value": "67e0157cb34d521e8ac7221a9d81423c096782e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977106, "uuid": "01442220-5d3d-438c-9601-8159f044f17d", "comment": "Malware payload (MassLogger)", "value": "5b5d4c401c97a7dc0daf3a1b8d5bda130ec299d36e6becebb82ef61d12941e89ce77651630c021d1a985c0551961ab8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977106, "uuid": "232d78b7-200e-4bfa-8ce1-15c9fa6b5fef", "value": "T1A1C5E6A536DF1287982A7761A48D37844F1E80241F43A7CC34DF065A931B68F76A4EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977106, "uuid": "bf8ca359-d9b4-4885-89eb-0896007ad5ef", "value": "12288:OdS0DrW/pTFTrUe5FiiY8tGUmHyF1ky2+TVtijlkc7:3CW/FZrUeBQ4/32+AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977106, "uuid": "12d5fe92-42ae-4a20-9621-161aff142eaf", "value": 2578106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977106, "uuid": "4cb91d9a-6690-4934-9229-e8cc97920d25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977106, "uuid": "852595d2-e8a6-4ce2-9212-16dac570c3e5", "value": "RFQ-L10502_978.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffd01ae-ac99-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788991016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991016, "uuid": "c5e4366a-7b4c-407e-8d98-f6d08d56dc8d", "comment": "Malware payload (Mirai)", "value": "f9b422302de1745bc5be7dd683a5955f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991016, "uuid": "8d83e8e2-d085-4ad4-ad77-4b0893a42c02", "comment": "Malware payload (Mirai)", "value": "196938d9b109f97a8bd4c8f4e998afc68a9bf7e91bc7e84e32f8f99c0fe02b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991016, "uuid": "401aee04-ff4a-414b-bdaf-35d201f77421", "comment": "Malware payload (Mirai)", "value": "4d07719e8680fab15f907eb07c6f62c9c0410413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991016, "uuid": "2b316987-fb7c-4d2e-96be-b4b9eab466b5", "comment": "Malware payload (Mirai)", "value": "8b2ec59b2be198e6b2652e2f949abfe6189b59523bb47039e9256ee0c872bbf777b16930db341df44dfb7c1721c0eaab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991016, "uuid": "dcb93689-e6fd-4fc8-b82b-4485211621e5", "value": "T137158D5AF1B370FCC55BC031436BDB726931F46911216EBB12C4EA392D91EB02729FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991016, "uuid": "cefdc5e8-ea12-4ad2-9ad3-4569702e01d9", "value": "12288:K5x4kI4Pf/nLPVMYeLxXmc52Wd+33MmyHIiH5k:K5x4kLX/nLPVGLxXmc59dmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788991016, "uuid": "32202e5c-c432-4b52-aadd-fc22d8436106", "value": 884808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788991016, "uuid": "22795e2a-796f-463b-9d43-a7a2bd59e0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991016, "uuid": "dc1e103a-c3b7-407c-afb4-0d339d5e55ff", "value": "pryznet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354fbcf7-ac62-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967322, "uuid": "018801f2-c00c-420c-8f89-84f5aa14bdc5", "comment": "Malware payload (Mirai)", "value": "38f0a29ecfda3d742e2b3162438ae33c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967322, "uuid": "48a3cd0b-4eb2-4c75-a117-e21fe84ade22", "comment": "Malware payload (Mirai)", "value": "19b8116e5264e6f2f1c6b22fe224367e790dd930656df1c66b321f7db046aba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967322, "uuid": "3cbaed56-91f0-4c1e-8994-9082fd181502", "comment": "Malware payload (Mirai)", "value": "497c315335aa4c5466fb196b95e96b127385b9fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967322, "uuid": "b85f5fa5-92d5-4829-9d7c-41cf57e5f7b1", "comment": "Malware payload (Mirai)", "value": "f09332f68ec780b513ad262f328f9d6857cd65af1f1006e1720bed1ab5022f83d21800efab332095f5692a344f9c712e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967322, "uuid": "6979715d-5822-4f92-8136-d030b4a2657d", "value": "T1BF34F80AAB610FFBDC6BDD3701E90B0624CCA41722A52F767278D918F94A54F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967322, "uuid": "58c52e95-d8be-4b8c-98dd-b7471860a0ec", "value": "3072:qwyHR7g6BI2A5a+gzN05ZfIEfyxrVyLTG1EhT2TfE+4:byHd56H5Bw0UE69VGl4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967322, "uuid": "15232155-d6f2-492c-8c27-6155f4a6a69b", "value": 244324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967322, "uuid": "b1e8dbad-07dd-4723-9c10-c0a5abdc0483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967322, "uuid": "6ab2cec5-835e-4716-94b8-5a06ef383717", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd37476-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943127, "uuid": "9233e80b-2c27-41a7-9abf-9c584e85c140", "comment": "Malware payload (Mirai)", "value": "7dc6baf18446bf79b6121b563ba445b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943127, "uuid": "afe72cc6-ee96-4183-9114-7ba6cd79fc9b", "comment": "Malware payload (Mirai)", "value": "1a49a2c9c9a3522d55d2a19a44e7c8c67d8954d27a747ce4841281ab2703277d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943127, "uuid": "51a39770-8fed-463e-b9a0-77a00f6042e0", "comment": "Malware payload (Mirai)", "value": "01e24d4f62d88134b07be18cfa2abc5786e63057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943127, "uuid": "de0a1b1a-d924-473d-82fd-7e7638c9cb87", "comment": "Malware payload (Mirai)", "value": "13bbf6ef648a7b38c6cbf2ee1824492c8ea1cd8a7b797b9b3f814c1db7127d0e3d71a3b3de2d4fa705aa84103c385073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943127, "uuid": "bd4a2a8f-cb56-4cec-a24b-a9bb3a5edef9", "value": "T1D7539FA5C5ACAE58CB1441B8B654CD388723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943127, "uuid": "72b12bad-d113-4393-82aa-8fe121499be0", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943127, "uuid": "b2d71560-cac2-45a9-a352-12412259db91", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943127, "uuid": "64c18209-d85e-4a33-aefd-e663115479a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943127, "uuid": "2a001fd1-232b-4d71-a05d-f98f82c3e30c", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0674a1c1-ac20-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788938897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938897, "uuid": "badf8dda-cf06-4a45-b664-e26f4e54170c", "comment": "Malware payload (RemcosRAT)", "value": "9024d73c9a1c65a6a098c00c71d35812", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938897, "uuid": "539a8925-3489-47dc-a83e-d9672dc6653e", "comment": "Malware payload (RemcosRAT)", "value": "1ba0185702904bf91cb543088f6dd0ed480abe29a2b14ddf93984e19d66ec627", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938897, "uuid": "582c720e-2a6b-4685-8ae9-e889e96dff7f", "comment": "Malware payload (RemcosRAT)", "value": "02a520907343c9e30ba958824687811487722c70", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938897, "uuid": "58df88a9-4902-4039-a051-b9c21ff9587d", "comment": "Malware payload (RemcosRAT)", "value": "97cc8de8b0c2da5e81dff0b408d62d4487fe50c99eb02b1dfc2343436a0e3c7a9d63716293b36dab0346fc3b090221d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938897, "uuid": "23095f60-5740-46ae-a6c2-7d28beded981", "value": "T1E48743ADABE57B834C19D6ECE0E87412627F6E81451CE1244DC5B787A3E70E0191EB8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938897, "uuid": "347cbcb3-938e-40c8-a48c-fb25042afabf", "value": "3072:njgiIfUtY3y9pvMLfYnzaS3XqykypUkwhiCHyrIX/37e5BEl+dMfE0yNmTz+51M:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938897, "uuid": "a8001b11-4374-4932-9853-63007cb02f4f", "value": 38320972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938897, "uuid": "d300413b-9fa3-41e3-9fde-a9c8c4c93f19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938897, "uuid": "99a3b7bf-cb32-4716-bb4f-4ac538e0cac2", "value": "FedEx Shipment_Docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69bb190-ac1b-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788937072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788937072, "uuid": "95976ad9-abf4-4e81-869f-cba150252564", "comment": "Malware payload (JOMANGY)", "value": "6939acc5de2ab0cea1eb90e4144817e2", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788937072, "uuid": "6ba78cb2-41d2-4d25-aaf4-a47fdef801fb", "comment": "Malware payload (JOMANGY)", "value": "1be9796a1fef94a018432fc4e73119ff1fedf6657bcc3b024c87606165fa629c", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788937072, "uuid": "f7e67bf3-5a23-42e9-8f38-7b06c82f2b65", "comment": "Malware payload (JOMANGY)", "value": "fcb97e02bd6be4f6cee9743f6ec6df034423f151", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788937072, "uuid": "896e6c60-f933-4606-b7c0-d95adc129e1d", "comment": "Malware payload (JOMANGY)", "value": "8438c301ccef58d842592349e4628e95d7a7f51e30fb3a8fcd8e3851a2e52dc3c68ee19a5958e3cbedbf771d8c02541d", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788937072, "uuid": "f4617591-0ec6-4a53-b2a9-65c92030e335", "value": "T105236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6ACA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788937072, "uuid": "d8207b38-471b-48e0-b034-fb40a02e789f", "value": "768:kr9NyXsZztCq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:CHusZKcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788937072, "uuid": "e8cbf8a1-c5e1-4e69-8cf9-5c4698499a42", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788937072, "uuid": "4c23a618-1a61-4b75-bac6-51248703e012", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788937072, "uuid": "c30d8b58-3dce-46b8-b745-0d60724a3c86", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e84b32-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788977301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977301, "uuid": "9be0e837-88c0-404a-8348-5117ff4f60cc", "comment": "Malware payload (XWorm)", "value": "8cd4b1149a00c34feb3d4685b217ede8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977301, "uuid": "6a3494a7-b7c6-4b5f-bb43-75f696ef2d41", "comment": "Malware payload (XWorm)", "value": "1c24c06835417f3a502b06a4d248799c19cddb5c348c43a7982eb40c45ba6546", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977301, "uuid": "92ad9f79-a1d9-4507-bd3d-07174741f290", "comment": "Malware payload (XWorm)", "value": "c7058cd67dbe9d49868413081fe8374aab88b568", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977301, "uuid": "5e853621-941d-482f-a9e7-705963c89269", "comment": "Malware payload (XWorm)", "value": "9702a557a918c4df3a6508c6b06bb5396a43f768a444bfe1308ba62074f7bb39c8ebc0366060a600599ae317d18e1ffd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977301, "uuid": "ea6b28be-4f3c-4c2a-a24f-4b1dd82a41cf", "value": "T12DF418170B7C3B379BA113611829C50A63F84EC6DC76AF09662DC4B4AD78E1F16A49FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977301, "uuid": "ae21f2eb-d35f-4d2c-9f44-686fe1779a48", "value": "6144:RnAn6ntnAnAnDnAncxnAnsnAnAnnnAn4nAnAn9nAnAnAn6nBnAnAn4nAnnnAnQJ2:xJZo/zmNgB2BFRQ7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977301, "uuid": "ed6cba00-9c8c-463a-b205-c0a748640ec3", "value": 788723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977301, "uuid": "9efcd380-a5e3-4742-a3d2-3583506119bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977301, "uuid": "7afc2e88-5957-4e4e-9181-b26ccd81295d", "value": "IMG_006297118252753800816278354-0092026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da86b4db-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938394, "uuid": "e91e3187-ff04-4893-9de1-faedf4a007ce", "comment": "Malware payload (Mirai)", "value": "08c89b05136fd8655481a1fb40e72f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938394, "uuid": "a64949df-6248-46b5-b117-74db0823ffe1", "comment": "Malware payload (Mirai)", "value": "1c8f427afe2ba8b0ca2f93ddc389b6d60a83b9d0fbd62c2d5bbfc56ad2960a28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938394, "uuid": "22dfc162-86e7-4fe4-85aa-20f90bee27c0", "comment": "Malware payload (Mirai)", "value": "1cb12d9676a2161ec85c99cbf0648fde2273be84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938394, "uuid": "a8caffd2-f6ff-4e04-9a0c-9a40cec1975e", "comment": "Malware payload (Mirai)", "value": "e2a314d206e18f938709a1997b09ad519cfb24501750651429710067d179988117081adde72e40a1b573a05bc128d0a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938394, "uuid": "c4142aba-a1a1-4e5e-821c-0c4f2e2e5bc8", "value": "T110D38D52A8D0AEF6C292477861E7D4384736EC096F931DF6F2199DF8504B9CCB09E362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938394, "uuid": "f055d42a-49de-4c3b-a0a7-2d9da8b1dfef", "value": "3072:AF0s474ZSRxVqxQ/n9Lj/+oPf85e/pKn5dq3/:AF0s474MV6QVLj0O+dqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938394, "uuid": "8985eed2-9b22-4a23-94bf-4f26c34fad9f", "value": 141744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938394, "uuid": "d5ce5f8a-871e-4cdd-aced-edec7f8dc12e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938394, "uuid": "6500a0e6-99f6-4776-8848-e1a8b99a4434", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8305dd27-ac77-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788976472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976472, "uuid": "04a858fe-e230-46f9-a9d8-161248e8de29", "comment": "Malware payload", "value": "2628df6a76b10059523f8196d293ec79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976472, "uuid": "0b383dab-2f11-4af2-8a99-1e59037710ae", "comment": "Malware payload", "value": "1c98d149fd358406a2fa77fc2c3bbf4f65d04d87f81a2402eab155b186b97cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976472, "uuid": "e9f8bd25-750f-4edb-9049-8bd19d513754", "comment": "Malware payload", "value": "e19939c5299c6deb50f122c89d46e197e049eaff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976472, "uuid": "256c6fe1-88e9-4ba9-8a2e-2c6b134f2b9c", "comment": "Malware payload", "value": "af49ec03bd8a65f1747e4fdb03cbaee09a35048fb6591db0601ae8e9170de9f5b4f76735bbade7a0a6f356313cb67f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976472, "uuid": "b336f596-1859-43c2-957e-576eb9f44117", "value": "T197B5CF16E3E415A5E92BC678CA158333DBB178925720D48F12A9E7162F33ED19B3F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976472, "uuid": "7a0ffda7-6a25-42e4-9e9e-d1c125be9477", "value": "9c7008618fd230928820bf0ff9216e94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976472, "uuid": "b8722a14-40af-46ee-a84c-e1a7fb07990e", "value": "49152:Nms/45jqiMdOOmzf4UKDkfQTBPe0ylhXj8wyNhH4MK4CMwv:Hox47Ifwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976472, "uuid": "00e71674-9d6d-4bb1-9ea2-630bf9eb111f", "value": 2446848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976472, "uuid": "6210d995-f330-4199-b136-eedcbf427e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976472, "uuid": "6b2fe68d-4787-4d9f-be66-be06ad0b9900", "value": "file_1951c3c55f06d767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df20652-ac66-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788969135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969135, "uuid": "7c1c7441-34e4-4075-aa5b-a698f03b5008", "comment": "Malware payload (Gafgyt)", "value": "8c4d7ed009779fc9851697352b773492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969135, "uuid": "5194281d-054b-46b5-b5ca-e495f21c9509", "comment": "Malware payload (Gafgyt)", "value": "1ccf31b1dde2c944bec6238ff60a4eb5f28df74b11814706bcaddaa4162c0c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969135, "uuid": "b2684c71-3e9a-4e88-9277-f4eb52336bd9", "comment": "Malware payload (Gafgyt)", "value": "04a54fd189998f8da0f88eac7c48468e2330346f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969135, "uuid": "06b335aa-3f08-43b7-b352-02cf717d81e7", "comment": "Malware payload (Gafgyt)", "value": "cad35daad1f8ea22628d3d62f20fa7623f55506940dc5c8723d7dcb786001ebb411c18fe53bc37c4e435b44c4ad3636f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969135, "uuid": "2fce4189-ee8c-44d2-a811-b5b307e5d64a", "value": "T17154B729BB615EB7D84FCE7301E68911188CE18752D97FABB2B4C618EB4B90F44C3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969135, "uuid": "e1f6b31f-7e6d-4dd0-bada-0bfc4a823d8f", "value": "6144:mnIrSWUnnp3R+mB5hKEXsYZTJ+VmUoUGsBYNXbkJqh9Zn:33un665hKEXsYZoVmUoUGsBYNXbkJqhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969135, "uuid": "9857fb67-83c6-4de6-98e2-fe74f459c46f", "value": 305520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969135, "uuid": "d939a895-698b-4a54-be84-76fe1731309a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969135, "uuid": "99b22c25-a634-45f4-a8e3-22dc7eef400b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b13e46-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788946806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946806, "uuid": "5173087a-88cd-48dd-a168-3297e751850d", "comment": "Malware payload (Gafgyt)", "value": "a3aeb0c0c435754032ef1f3b2258cd65", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946806, "uuid": "fc556c36-d6eb-41d2-ac73-575fab6965b3", "comment": "Malware payload (Gafgyt)", "value": "1d6cbc5c3ee170cb70f2474d5c19e6e32dc50c4ccf93cfb3ef4d218d16d4791b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946806, "uuid": "2770ab04-ca76-48b1-bb2b-571294e26361", "comment": "Malware payload (Gafgyt)", "value": "e83fdcf69372cab4c0296c8530b0639ce53c41c2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946806, "uuid": "2911fb52-6041-41c1-a96c-4476b854a1b3", "comment": "Malware payload (Gafgyt)", "value": "6d0fb0f1ddbcfa91c9476fa633b2e36afbb23874cf6ad32629e0f1a5c77e71892af081619c87205303c39e44078c5473", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946806, "uuid": "9a103335-0f00-42cb-801b-14423822e853", "value": "T14D5301609173E94BC663EE75EF1DED295000CE848A123F361FB98555BA712A8E71CE33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946806, "uuid": "f910d381-3b47-4938-9c8e-cf279aa6b244", "value": "1536:RNMwRj1W6DZg6NjH3bvskfQOGpw3NupB06Lkg4azHC:fJzW6DZg6NjLvlQbuoFLGazHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946806, "uuid": "420ba62c-63f6-4dc7-b676-6d0b970c199e", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946806, "uuid": "d59eb524-f914-44ca-83ab-aced186066d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946806, "uuid": "272d55fc-9729-41fc-acf4-01e27a10e6c9", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c620f1e-ac39-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788949832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949832, "uuid": "4aa7ce03-f434-476f-8c51-b56c024cbc6b", "comment": "Malware payload", "value": "13a323effbb39a88a60d9ecf30457881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949832, "uuid": "40c5b3b6-6ee3-42d8-9e46-58992a6bd6d9", "comment": "Malware payload", "value": "1daab220e056619a669c55819f849fb1feb5b96a236d0b3d3f7f517cf768580d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949832, "uuid": "4aa2bb78-5462-465a-a32e-42b5d8504ce1", "comment": "Malware payload", "value": "bdcecccbc6a631ca53235b6863f3529b94c88377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949832, "uuid": "3baf5b63-9be3-4b8d-8c00-8d296ec7d77d", "comment": "Malware payload", "value": "421627ff3a3e13ca9d7dd183fb9fe59ffab42f57441a69dd26db2d11e2f7a20af2ac0aa2fdcd3c4b65448a2c0a40513f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949832, "uuid": "279c1058-d924-4343-b5f0-3436c9a85609", "value": "T176D633A8B7D109FAE8E7403C6961C552F3B271811FA5E1FF07E05A292E3BAD58D3C254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949832, "uuid": "05b426cb-c04c-4248-bced-856474e3f369", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949832, "uuid": "96cfa4b1-27c9-45dc-824c-4b5516840bc3", "value": "393216:QOqmn7LRLXEAphVtnIUQSg+S+atoHPvF7/Lp:LqqlLRphDto+SptovvF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788949832, "uuid": "0a53e130-ab57-4bfa-8d1b-47791ef07f52", "value": 13411213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788949832, "uuid": "e7a0110e-5b00-4b19-9548-de8c91ca960c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949832, "uuid": "05a49353-274b-4368-a843-267c624a6796", "value": "solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d151af01-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938378, "uuid": "503104d4-6608-4ef3-8dde-80c2d6f5f686", "comment": "Malware payload (Mirai)", "value": "668c58f9355e23d028d11fb1668c4663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938378, "uuid": "467087cb-3041-4847-b293-f17af426e6cb", "comment": "Malware payload (Mirai)", "value": "1ebbc4a1144452dcb2f5091637b131267687de171c268dcaaaa0733de5089d6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938378, "uuid": "d3fb5176-b9d2-42db-a77e-5fa5651fcefa", "comment": "Malware payload (Mirai)", "value": "6482992ba9c293d3bd95f86e4208d7649bf1f532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938378, "uuid": "a16ba2c8-e4bc-4a34-abe3-882f4f0f39eb", "comment": "Malware payload (Mirai)", "value": "083cc4420e48013c546a6cb96e393155ce1f9ab627a09ef1355ae34ae7737fab449ddbadb1cfc51eebf9b8202e338a79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938378, "uuid": "9995aa70-d5ef-4bb6-8bb2-2256916ae39c", "value": "T1DEA30846B9418B13C1C21BB7BBDF86643B31A65897D73302E919BFB42F4369D1F2A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938378, "uuid": "3a8bfa32-5b45-4ec9-8a1d-7f1bf0d5429a", "value": "3072:8jaTdEjuejpW0f8H9BYTJQbAaOicKHvCOSk31qg0qn:8jaT6yeZf8H9yteAaOdKHvCJk31qg0qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938378, "uuid": "7b84aabb-367b-4036-9755-78d93ae6a170", "value": 101463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938378, "uuid": "36332b29-6207-404b-913b-112e88450564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938378, "uuid": "fa707dd1-08e2-4bd6-a70e-98eb1d7d92bc", "value": "main.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea93e6e2-ac4a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788957318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957318, "uuid": "0f29233a-65e6-4ca8-8125-d7e06efd6e78", "comment": "Malware payload", "value": "12e0bff472a9c2f496210a3e1dd12b00", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957318, "uuid": "e72d410b-9e13-4022-811a-3940787ceeed", "comment": "Malware payload", "value": "1efb1c8ab1728fd7e125352c738888d7368eda5801b06f3e11c9d9b88f5e1e8f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957318, "uuid": "eb9ff763-0e58-44fd-8198-6ef711de36f3", "comment": "Malware payload", "value": "e81b0bfd17f6cec06e0eefe30fc64f8807fa043e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957318, "uuid": "9ea42107-041b-4351-9d88-627a6a5402b9", "comment": "Malware payload", "value": "b9c7009f24670db54c5dbe96c8188fa2f2198ad7d85f1db37fd72800652b580d5d390ac49018d91901ff82244716da2d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788957318, "uuid": "a5fa31f3-e27b-4d6c-98d0-90269f33fe72", "value": "T1AC36EC3DCEE8423FC2B7C929D9CA4A17F89A091B230CED4A64D773D75526183BC9215E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788957318, "uuid": "7b37e40e-f55f-4636-8931-a49e433243b7", "value": "3072:3PGjMnzBbDVmBYNi9lNB3jm9kmpm94SwQSYlwEugwGi+mC211J9m9Pm9+mJaaRSA:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788957318, "uuid": "9528e840-f937-4ab1-b3ab-e1f189447538", "value": 5246976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788957318, "uuid": "e7190aa8-0c7b-40bc-96f2-3331ceb6552e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788957318, "uuid": "19518213-a239-489d-868a-3844069d064b", "value": "kukut.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee5a191-ac28-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788942615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788942615, "uuid": "6ead3660-5c01-4c25-8560-40f7027652ca", "comment": "Malware payload", "value": "ba32b8c1d61fe8f25c488d5c1d2368e4", "object_relation": "md5", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788942615, "uuid": "b98ea913-f46c-495b-b2d1-986647db3c17", "comment": "Malware payload", "value": "1f2a3a4d615ed1c0a067e01797ba7c18d19a07cc3bc00cf52aba3a7699142aca", "object_relation": "sha256", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788942615, "uuid": "15aa5a7a-f8d3-43ca-b778-e40637c097fb", "comment": "Malware payload", "value": "f065f3ac7b4ccd97a718939f18ef1569df2842da", "object_relation": "sha1", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788942615, "uuid": "97b1f2db-92ea-480d-8764-f4b224881d81", "comment": "Malware payload", "value": "df370a1fc7108934db16dc412168a14d10acf0fc56bd6dbb0005243a45d3451c9073c1a74db889cd6ef72f4a1f1c62f5", "object_relation": "sha3-384", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788942615, "uuid": "fdf0c5cd-bb70-40dc-9943-65e8b011f732", "value": "T1A148DF16E6414C33D5AE133539F743917B325C8AA2838756284DF1BD7FB32C8AB8A395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788942615, "uuid": "4c4cd12e-408a-4163-b50f-3c36166a48b2", "value": "786432:W5B4J60TQVqFhB7WnK+cCn4+lcyCSDD49AOmDXbPJD9zTSCKCujSIfDm4/J8p4uX:y0IWi0gTQJ04hJc1wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788942615, "uuid": "e4073673-b0e1-4a96-bf74-f6909f64bfec", "value": 115543111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788942615, "uuid": "f67bce3b-1553-46ce-9e3f-a4c2a5d864c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788942615, "uuid": "a06e3b4b-700f-43eb-b20d-fa3a8c6d2a40", "value": "FltPlan+Go_5.0.21_APKPure.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c558723d-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966275, "uuid": "16311dc7-41d8-4f81-9a0e-0d52b5b8a44c", "comment": "Malware payload (Mirai)", "value": "8e890fe393a7a6d5e6466ecb771b09b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966275, "uuid": "011e0fa6-6846-4715-8fa3-0006645c9185", "comment": "Malware payload (Mirai)", "value": "2008e5ce388cfa523fb4d08ff97bbf79582a15fee8aedd5bfc0d3c1855bcd0ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966275, "uuid": "772f0ee7-7ae6-41d1-a66c-338c90cc57b7", "comment": "Malware payload (Mirai)", "value": "a5ac9d71a194f6827928bb2fec4ba3a3680de509", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966275, "uuid": "95aaf7af-f408-45bb-9ee4-6fb95d4bb430", "comment": "Malware payload (Mirai)", "value": "8e61d37d8211dfc41dda5e3fb5b6c16b13ae47d0eceadf4855e355bcbff1a189e4f62f91587c7bba87973cf8391a1787", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966275, "uuid": "7162e1de-2904-4910-aac4-9ddfabf338bd", "value": "T17351A4D432164A30BFF19DAEB5F658247084E092E6C5AF41D5ECA6FD868CF0C26D8693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966275, "uuid": "16b4946e-54fd-4dfc-af71-bd08670242ca", "value": "48:vXQgi44Qgi4aQgi4gQgi4uQgi4g7zEQgi47Qgi4qQgi4dQgi4sQgi40Qgi4EuUfT:vXvi44vi4avi4gvi4uvi4kEvi47vi4qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966275, "uuid": "da0cee72-3915-402c-81fe-b34090b7e371", "value": 2891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966275, "uuid": "e7c4f50f-51cf-4a65-ba29-4957486ad85b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966275, "uuid": "dfc6ed1f-1d38-466c-a4ab-a0f0475a8d85", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77e2ec7-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977473, "uuid": "d80a46f8-aa5d-4d06-bc5e-0e5f457846e6", "comment": "Malware payload (Formbook)", "value": "b1f343ccc638e1a05381b05a95f4e33f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977473, "uuid": "10c46390-8d8b-45e8-8437-39f40cb297ca", "comment": "Malware payload (Formbook)", "value": "20b25f240fbdac8c212d7099657cc6520538f75a1cca5ea811ac6fda5dd1a591", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977473, "uuid": "7a863591-1f88-4162-ac23-c15367081d27", "comment": "Malware payload (Formbook)", "value": "868d7d819d9750e2606b7f2685c9fb6e13952d61", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977473, "uuid": "ecfa6353-96d7-473f-a02c-4e5bfdc2ff41", "comment": "Malware payload (Formbook)", "value": "ed82b5f937c088fc9ece51770f426edc64079b8c06e6aad8b1380e51ff925b4781dd12ff98f8ad85db8e556294322ebe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977473, "uuid": "0619e31d-5c51-4476-960c-356bfa317d04", "value": "T15C26B0515BC4AF64CFE4194BE4BC190A27F40BC9D80A55EEFB27B907ABEED04416E0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977473, "uuid": "55c7adba-0356-4f18-babc-2ad793b64dca", "value": "24576:A2QAy7nBFXehs2+8dkSCrcnhzsxL5xq5542e/WopmoQWRnmuQjuw/P29RKf0HB/t:A/TOdZsglqUWbQV/xKCMW4noaYA+fnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977473, "uuid": "20391bc6-a5f0-4fe4-a12f-b5d2be9ae03a", "value": 4762808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977473, "uuid": "9f9c2c75-0f33-4c93-be42-1f55d3b745c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977473, "uuid": "2b0257d2-6ddd-4159-a80b-ebf41d6bcce8", "value": "ORDER-269868-0056747.XLS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cea1d0-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788976799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976799, "uuid": "099fdad8-92e6-42f2-a923-ab19f8b6bd46", "comment": "Malware payload (MassLogger)", "value": "9b5c54ce14c52f17a60c0e75dbf0bb19", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976799, "uuid": "ffb9af94-fc13-4bba-ab15-1059c13689cd", "comment": "Malware payload (MassLogger)", "value": "20db845faf1dabbce7328385804288fd0f08556b101df6740f136c4911212785", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976799, "uuid": "7af46404-a0e6-447f-aace-e06b5b67dd17", "comment": "Malware payload (MassLogger)", "value": "55397fe7fea5e9260abde63474bf164440ef4e7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976799, "uuid": "2ef67502-1fe8-4ed6-bcfa-1c0bcc5dea76", "comment": "Malware payload (MassLogger)", "value": "299611f7975c18aa0ab207091fde6a085d9d1f6cf8fb2b19c3da9a6ca67c67972aee8a79485d4171a90b3576f4ed344b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976799, "uuid": "eaadbc3f-d516-497b-a586-0bbca3f59a89", "value": "T1BCC5FAB336EE320A0C587B966C8C5ED50F5EC5506AD365E8F0EE02D8670B14379E4AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976799, "uuid": "f797296d-82de-4035-8e4f-6f8f243a7934", "value": "24576:aB/BucT1lFG5QsEfsXe+VDzZQrmJdvo2eo6bh1ceQsJYKq:aycXcOkQv1ieNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976799, "uuid": "46de1255-f6a0-4ff0-bf91-e3e5442d7b67", "value": 2574442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976799, "uuid": "7f026551-5f56-4458-b19f-5c03d824245f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976799, "uuid": "246b05fd-02e0-42c1-ab1d-cb817cd1fa38", "value": "\u8bf7\u6c42\u89c4\u8303..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a68a25b-ac63-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788967921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967921, "uuid": "1c0cb968-6ce1-4cb8-88f9-733917b3a56f", "comment": "Malware payload (JOMANGY)", "value": "0cec85d7bc4dfc8204f4fa238334bd20", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967921, "uuid": "dfb9abe5-9f00-4e93-a7d9-eb871dca1112", "comment": "Malware payload (JOMANGY)", "value": "20fb8f8e7f9540669206d04bd8bfc1d215c2b8c76cc782c2b5d167ae9e3e3a5d", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967921, "uuid": "f6b83bcf-60b3-4b8a-a360-32e3ced4c593", "comment": "Malware payload (JOMANGY)", "value": "bfd68f7a14df38dd56ec7aaa7a30248f554d8c5c", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967921, "uuid": "1e2dcf6b-df18-4b6b-b1eb-2cb678d0f9fb", "comment": "Malware payload (JOMANGY)", "value": "a150d46cb0dac0e95868a9cb51c90decdc5f3ea08a84e0d55d06c8cdb8cdefaf2015915ed239eea194629f647e362ce5", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967921, "uuid": "6dfce957-3c21-413b-96da-864d402f5525", "value": "T12EC27D95AA867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967921, "uuid": "57874ee0-2de3-41d2-96cf-708a92d890d5", "value": "768:T8vCB+25j6es8RA9FYpMSUpi+20qUpi+20YQX:T8l25JGd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967921, "uuid": "0ee2bbc2-e0f3-4a2a-8561-a2cba9d84370", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967921, "uuid": "f7933c37-1c8e-4fc8-8ec9-e4f9031b75b6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967921, "uuid": "35f756aa-7c71-43af-aa55-e491f807b3fc", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e25d16-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959834, "uuid": "9d27e263-1083-4576-8bef-45d7fffa521e", "comment": "Malware payload (Vidar)", "value": "7eb714c71553c344181454e7c729168f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959834, "uuid": "0ff2df67-be5c-486b-b3be-bb5298c66254", "comment": "Malware payload (Vidar)", "value": "212d88703d10b5452ebdd09f6a44bca33051069892d51f465b7f5d9f7901a29d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959834, "uuid": "5d4bea59-aa2a-4b3e-9fee-d1a60c5b5bd3", "comment": "Malware payload (Vidar)", "value": "1bc5e26d7c6341a1575105e131a98492ee04e044", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959834, "uuid": "b2cdd10c-c525-49bb-b6f8-f4341f8182b0", "comment": "Malware payload (Vidar)", "value": "d88ab679db3c58727c7030259f694e90c29ac299ee5dbd4595d43f35970fad789d6c5b32e595c4617531a5680add9da7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959834, "uuid": "e5ebcbbe-526e-4d1f-8c41-50080f16fdb0", "value": "T10E144A70B7C29172C98923742A3FB7EC5F60EB1217018ADBDBE0BC0C6E692D16B71456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959834, "uuid": "3a945b42-c61f-4f7d-ba68-2abfc561e547", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959834, "uuid": "43c03169-f7d1-4522-a33b-4c21dad332cf", "value": "3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyyzdEpxCRUxZZ8ZPO:A/rLVPW0nsP2Xy+TJfzzW7KUXZ8sUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959834, "uuid": "ce6aa997-15d1-4b12-9d7b-03e642690f8b", "value": 190416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959834, "uuid": "f1b725d0-f910-4f62-b43a-6a247cd59715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959834, "uuid": "a6b41f58-40ae-4fc4-940b-0077a35cae3c", "value": "212d88703d10b5452ebdd09f6a44bca33051069892d51f465b7f5d9f7901a29d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a330b7-ac51-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788959969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959969, "uuid": "6f68f9e7-370e-43ef-b325-cb3efb1fa31e", "comment": "Malware payload", "value": "7578e3b76270a807cd850e0aba0d026f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959969, "uuid": "a29a966a-0e4f-4de0-afaf-0be5ddffc153", "comment": "Malware payload", "value": "21349e975cfb3a88f4fd2e40ddc1f126a83b825b9b80b70b3d2e24161e80d72e", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959969, "uuid": "7a66debc-221b-4cbf-9c3c-3623851c8565", "comment": "Malware payload", "value": "6112dc7bcd72b35d9cf024b87f53816b7fe69bd5", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959969, "uuid": "947bcdef-48b7-4afa-8a14-cb8f89a3f00e", "comment": "Malware payload", "value": "6261ba39ca7eb262f89ba23ccb2a0e2af0bbfb2c65862a7286ff61f4d3a71bd46952848d03eb5d927ba11e8249a9f776", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959969, "uuid": "12ee9229-c3b1-43be-8328-9aed9f53f1fb", "value": "T13D67D58ABB41CEC7F80681316867DF946362F9345EB0C327355D2B1EAFAF1988DA11C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959969, "uuid": "75232b7c-8e13-445c-87f4-283e15d8ce3d", "value": "ce08ab0a87007f1423c570fdfcd13219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959969, "uuid": "aea18bed-754e-4600-a786-81d133eff792", "value": "98304:F+dP6pRLQCsrfv7AB7a4gm4mNSh6q+luaePEfUt:FY6HnAT/m3xq9ane", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959969, "uuid": "22356c6e-a50f-464d-8481-781384722054", "value": 31064880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959969, "uuid": "45a5e952-ee7c-49d3-aff2-1e97fe0baba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959969, "uuid": "8f995cf8-0573-4c8f-a2c9-a322cec7b06a", "value": "install_w1.0.10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81e3727-ac4e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959005, "uuid": "3062a118-fed9-45fc-bf89-81d082516312", "comment": "Malware payload (Vidar)", "value": "fb511a9bfb47854681354b2e80fa4f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959005, "uuid": "ad306ed4-855b-4a05-a951-bc50468607c3", "comment": "Malware payload (Vidar)", "value": "226618b7b83db7df35402a8d56dc5a55203616f2a95233f8aeed4e9f917be637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959005, "uuid": "8b6edf9d-4bd1-4282-bb6b-b3b4e690cd41", "comment": "Malware payload (Vidar)", "value": "ce7dba31ba9c37ba933de8a9de612981fc2bb232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959005, "uuid": "b5f27cd3-c85e-4e31-8296-99499be38509", "comment": "Malware payload (Vidar)", "value": "809584fcd73755a4686a182fb148c9ada1f08a83a2419f3230536a8e1e3b336408af599e5c206fdb343b9eab7abd79c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959005, "uuid": "dbf5cbdb-e07f-4a95-be7c-f07fd429ea86", "value": "T17EE66C1395C990A5C49AF97DC1BA53A87638B85EC63037B33E969FF02E21384DB74B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959005, "uuid": "beac75ea-cabb-4ff4-a332-da1e559c33e9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959005, "uuid": "afc90cfb-551e-4cbf-9462-ae396afa65bb", "value": "98304:0CKVSvGAQlmu3Jt6pkxcpQ85Dewi9mlFET4uMf:0CpvbfOcpf6wi+ET4uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959005, "uuid": "af1bacda-f7cf-43f7-acdf-fd437704ca9e", "value": 14376960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959005, "uuid": "7b341a28-40e4-4290-a481-03e35ff98090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959005, "uuid": "8714bfba-7831-4f82-9c10-dd55c728e15d", "value": "226618b7b83db7df35402a8d56dc5a55203616f2a95233f8aeed4e9f917be637.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75b1f89-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938388, "uuid": "ff78f56a-f845-4259-a88c-3d8fc25ade52", "comment": "Malware payload (Mirai)", "value": "b429a5910522af3dec5551439b90cfa6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938388, "uuid": "7c6516cc-30ba-4229-9ca6-adada20eb03d", "comment": "Malware payload (Mirai)", "value": "227af7644dd1ae414c0f36e6d137f05fa53bf58d62bdf0da4da3b1487cf53bb0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938388, "uuid": "f372c4d0-b289-451a-8519-0d9bca058912", "comment": "Malware payload (Mirai)", "value": "5bc20c0e1f2894425cd17cd4e5b7243cba5f58a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938388, "uuid": "3ab59cb9-4e57-4455-b117-34af80ef7760", "comment": "Malware payload (Mirai)", "value": "9c9ecf86632546d37b60e29b3bcc06b8bd457cb651f257fd3b13bc7ed8575f2d39cd0376066f0b1bc5c7ce0909de0744", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938388, "uuid": "b873fa8b-a357-4cfd-b7ec-0d17a4bf5727", "value": "T1C95193D6D22E8C22984EDF0BA771C2AD400163EF5DE3DBF0D96AC72541479F271A2726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938388, "uuid": "f0617521-8036-4923-9bda-a73bf475db33", "value": "48:py7SL787ay767rumy9LpnTy7vpyULgxgLyU/yYLfeAyY3yiLMKyKDy7LzZyBRyQ7:U7SL787R767rud9Lpe7vUULgxgWUqYLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938388, "uuid": "27df62d9-20ab-44e1-96f1-afd618fe6b98", "value": 2583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938388, "uuid": "55185107-c7a9-4201-8bbe-34d4235c6eed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938388, "uuid": "17cc71ab-02c4-4c5b-89bc-9910e6a7cddd", "value": "gpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef42312-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938374, "uuid": "35a84b47-9c29-4db2-9d78-69f6c0874d40", "comment": "Malware payload (Mirai)", "value": "0ec655cd7f1b87793d03cc677ef957c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938374, "uuid": "7070b89f-731a-4c39-845b-968094f70557", "comment": "Malware payload (Mirai)", "value": "2399e79aca23cc21acc2a1145f0042dc02cb698225094b2bb2a31a8ae3328662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938374, "uuid": "6015ecfc-a02b-44bf-ac48-5e8d38ff13c2", "comment": "Malware payload (Mirai)", "value": "c3496eacec6cdaafd030a6f55602f6485d6e94ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938374, "uuid": "adfe92c3-5e4e-4bad-a210-917c7d3d6356", "comment": "Malware payload (Mirai)", "value": "f58bb7fe37ba04c6af521c8609b201682b88a846115d376dc47d9d9ea1dbe9ef757c01a905fbb3b04f4b10997b47652e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938374, "uuid": "bc31cc2e-5605-456c-9405-5fd743a4f8cb", "value": "T14CC3B6167E21EFFEF65C86314BF38B2156D436922AA14346F15CEB181F3118D6C1EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938374, "uuid": "a863fd01-6572-497e-8dac-a6ec4e8f501a", "value": "3072:d8jQQIOmeyPKXXqEyQVYd5BDQvbYUH/y7WfHn:d87X6E3SQvbY0/y7WfHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938374, "uuid": "90580f01-2a3c-4e35-8063-15838e119f37", "value": 119237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938374, "uuid": "e5098e3d-a483-428e-8ef7-06d995cbbd1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938374, "uuid": "9058239c-188b-417a-adc8-8889bbf8c3c8", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8d9dcb-ac61-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966958, "uuid": "d27c5fdb-6204-4131-998d-4a3b9fcc98fa", "comment": "Malware payload (Mirai)", "value": "394a8bef1985a9643e98caf17c9a8ad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966958, "uuid": "1fb0ff80-1635-46f1-822e-44aaf33bf2a2", "comment": "Malware payload (Mirai)", "value": "24346331b1a364201e055a2fbebf7ede9fc0891785e0c96df4f5bf6e2b2c91e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966958, "uuid": "1a0418e8-234f-4078-bd71-38e336f7290f", "comment": "Malware payload (Mirai)", "value": "612f6a6e1998a94efe39b4e6a3ad51fcbd6b7012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966958, "uuid": "9ff15ce7-0660-4911-82d4-2fe54b147ab4", "comment": "Malware payload (Mirai)", "value": "391434a62e23b0485badeeeffecc31def7ee2b0bad6f63617af4520debe9f5f626a2bf0a6361e6043370181f7d1844b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966958, "uuid": "e592e5fa-8125-4be9-b2d6-8d83bdb8340d", "value": "T168A3123C9B158E64D5636677BF905BB438AB48FAA1D390F0F9AA81C741040C771E7BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966958, "uuid": "85960244-9299-455c-8dc5-24a4adbc4d89", "value": "3072:irejKpodo47ni4HjMZ7zINItKtzEHsvglePeVEY:ir+FzezIit7HzEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966958, "uuid": "8b3daf74-88b7-4179-96a7-24c0d0e2e1dc", "value": 107408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966958, "uuid": "3fadf578-03d9-4175-90e7-01fc98d6ec79", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966958, "uuid": "bbd340e9-2ea8-4413-a4ad-5a91c95254fd", "value": "wj0s.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eaf705-ac80-11f1-ab4f-4201ac107002", "comment": "Malware payload (GLOBAL)", "timestamp": 1788980428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788980428, "uuid": "547bad3a-a242-4b23-a988-7f5597367dca", "comment": "Malware payload (GLOBAL)", "value": "024c8c3050148a50363e6c3478ee137f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false }, { "name": "nvideo", "colour": "#CC64E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788980428, "uuid": "c7c84c65-5a93-4a39-bf29-865b6f77f631", "comment": "Malware payload (GLOBAL)", "value": "2436a177565db40038ce42446b01614e8781e62cd1da618a62fdc9cc31d1195f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false }, { "name": "nvideo", "colour": "#CC64E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788980428, "uuid": "f078def4-1b27-44f6-8549-ba5260b3f4fe", "comment": "Malware payload (GLOBAL)", "value": "96b077b2313e7d6adbc63db26b2ae26ce285a7e6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false }, { "name": "nvideo", "colour": "#CC64E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788980428, "uuid": "81316767-111c-4921-b578-0c51f0449008", "comment": "Malware payload (GLOBAL)", "value": "7c08ecb29aadd53e0ffccc207e4fb0085fc346c86b20e13dedb84bf3d55a8fe358193e4ccac43bafc962d29aa5588f2d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false }, { "name": "nvideo", "colour": "#CC64E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788980428, "uuid": "1e32588f-7468-4238-b640-2ea46f4469c2", "value": "T182356CECCBBCDCCFDE6226FD9080488CB65E9EFA6095E729137414E61987E94D321325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788980428, "uuid": "5b01e261-05c4-4fa5-91ed-961697f3a797", "value": "85163f23e57eda68a1b823867ed0e0f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788980428, "uuid": "af6f0ccd-5f16-4f31-998d-f3341492039b", "value": "6144:9fLW7v7dnvZljbwSYmha8FzKFERYFiugLCzxfu4Gsb:9TcFbPBa8FmmR6iu7xfIsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788980428, "uuid": "69286878-8a6a-4530-a7d1-8c2c9adae141", "value": 1141922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788980428, "uuid": "89746aae-d3f5-4a74-850b-32aee9668ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788980428, "uuid": "e9d65e43-4b87-4184-81cc-9fecec14dc3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7492d44-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788946898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946898, "uuid": "4247ae3e-cbc2-4ba9-b4b1-bf0b3fd42237", "comment": "Malware payload (JOMANGY)", "value": "2f305775ec0f4c8a936e00de03a01fac", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946898, "uuid": "c3a48fc8-8d09-4b60-9b84-2afc993748cf", "comment": "Malware payload (JOMANGY)", "value": "24468f6b6f17aaad56008ab5b1cfce38b9adeab3fca382f7e0483e19d839a3c6", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946898, "uuid": "539a90ce-2817-4dd4-b3fc-5c4155e79516", "comment": "Malware payload (JOMANGY)", "value": "c7dffaa2f6bf2607c62645267402e6e64afa0957", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946898, "uuid": "e2499a9b-4bca-477a-a775-4c6e7015ff93", "comment": "Malware payload (JOMANGY)", "value": "8588280014777f901d84888188f1b610a54f2dc255a0c814cb3d6fe66720a591f263b687ba33f9c739b6ecb1563bb98e", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946898, "uuid": "b98cdc0b-94e1-4b8a-8321-4c5217c2c594", "value": "T149236C652A817C14AA98C4371D7E2F0CB9AD43E6320492EDBFCF3CF68C4A69D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946898, "uuid": "d2a24918-173f-4faa-a599-1548ca79788e", "value": "768:1XOGVvm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:xLLcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946898, "uuid": "683c551f-5c32-46dc-af28-89a28fac7fcc", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946898, "uuid": "1226607e-7612-479e-9816-df0dedd50c41", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946898, "uuid": "6e1797d8-d3dd-487f-8909-7801b04538a4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771cf5ea-abf8-11f1-ab4f-4201ac107002", "comment": "Malware payload (NanoCore)", "timestamp": 1788921906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921906, "uuid": "e81f76e6-f8be-4797-aaad-8b950de3ba46", "comment": "Malware payload (NanoCore)", "value": "5cdd5fa5921ea6d54ebde06166d1ad9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921906, "uuid": "3017e3b4-a1fc-4a0d-b052-e56089e72c4e", "comment": "Malware payload (NanoCore)", "value": "2471a6c8da3933f1d8ba41a136fa0ca185801dfd26f73d2f8791449007153444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921906, "uuid": "45609e38-2104-4ad3-89c2-e252cf0989c3", "comment": "Malware payload (NanoCore)", "value": "8f06edf96f194a0818a2da85e631af2fced7d383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921906, "uuid": "ddfa51b4-83df-40e7-9f97-642ad07446e2", "comment": "Malware payload (NanoCore)", "value": "f44bd9964bdaeacf510983c12d2acd79c9e67369fdc43730d185938b85ab5232578dbe204005969a10c5ef641c6f2565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921906, "uuid": "8ee0c8b7-2245-4f96-b9c4-e4d9aa3a5e76", "value": "T1E514BF2577A94A2FE2DF86B8B12251139379C2E799C3F3EE28E455B24F163E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921906, "uuid": "0a391d3d-5a4f-4247-a019-0de94dbb1de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921906, "uuid": "77a7daa3-311d-4b7d-9b78-f61386115088", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI9pVWLjxKXC0CSlMBjJtS9v3v:wLV6Bta6dtJmakIM5UWvUo4MBNti/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921906, "uuid": "c5cfaa24-9b80-4f09-b0bc-1bd5260b067f", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921906, "uuid": "48903fc9-c291-4ec1-9719-4c47cdf7571b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921906, "uuid": "a2399392-a9af-4ba2-8f28-d0e4fb6c1870", "value": "5CDD5FA5921EA6D54EBDE06166D1AD9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3665225-ac76-11f1-ab4f-4201ac107002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788976097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976097, "uuid": "14a504e8-679a-4a06-addb-715d63352761", "comment": "Malware payload (AsyncRAT)", "value": "87b8bacb8ac3113dedf5b5121c70e871", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976097, "uuid": "625690ba-1986-4a16-8c6b-afbec19b51d8", "comment": "Malware payload (AsyncRAT)", "value": "24b3c5bac336fc1e6565b02d4085abf5f7e17c924407ee7467bd4eadf00e78a1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976097, "uuid": "28424cc3-bad5-4c9e-a2f4-89097e11faa2", "comment": "Malware payload (AsyncRAT)", "value": "ea18fea3b37df90313d5616e495b3d60b5d0f857", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976097, "uuid": "e6604201-1c0a-4d1b-a4f1-2abcdb2e8394", "comment": "Malware payload (AsyncRAT)", "value": "758c8b37dd92ccdb3dc553a719ab6c83af11e62fd34c984739f629dfc9170d44edf71d793e23d31609bd0dd0cbc9425b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976097, "uuid": "0f586ad4-6dc8-410d-8ecb-31186919f938", "value": "T1860501A82B4AD603D96597B84A31F2B41BBD2DEEA910D3175FD9ADEF7875F010D00283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976097, "uuid": "6db5ef80-f9a4-4d4a-a5c2-3d039597dd6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976097, "uuid": "f39162ce-c740-4617-bee9-fd814796860b", "value": "24576:Vs0aOEcA3VfnMb86uQniPXdM2xfMFkdTDmlw1qj0qdP:V6OLoV/MHT2xMF8m2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976097, "uuid": "3ce4d537-9290-437f-8df9-0e980d5aa290", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976097, "uuid": "8f56fe32-e24c-431b-b4d4-893c47209fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976097, "uuid": "330c44bf-055c-4ec3-8c14-cebcae23fe5f", "value": "Orden de Compra PO-031.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38926813-ac2b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943705, "uuid": "b9992853-804c-4a89-9e67-62a1c21685ec", "comment": "Malware payload (Mirai)", "value": "ca4a68cf1698ef771601df8c8a1a0785", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943705, "uuid": "789e21d5-a934-4b51-bfa1-373fc6cdd0da", "comment": "Malware payload (Mirai)", "value": "24e8580e8ccd6d4cb9c9f7fec52f57236bcc5dc1118137aca3d4377539fcb614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943705, "uuid": "06d3d8f1-ef17-4b22-ae64-355716b2a2af", "comment": "Malware payload (Mirai)", "value": "ee1f7f0fb3479fe4495f340f77d137f4da50b66c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943705, "uuid": "dfa91daf-2285-41b6-b432-0021430bb570", "comment": "Malware payload (Mirai)", "value": "bf544d8387c44215e62ef3488fca3162773d68e3181b746e7500f5960265b150f3b068aa25103b17a600b82a758129b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943705, "uuid": "66aefb65-12ca-45ec-9162-f4b984318fe0", "value": "T1B9931842B941CA13C1C21BB7BBDF86543B21A764DBD73302A929BFB41F436DD1E2A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943705, "uuid": "68f43c3a-ad4d-46ab-b945-8c06bcb935d1", "value": "1536:3ukcnKwF0c+B1/loYa9vavaOHDD/BDQdVvgvOfg1K1OKwyN0mdr51AyBTEbWmGsL:+kcKwpQ1toYa9idBkm1MO1McOTGlvq9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943705, "uuid": "1a1b9c86-7de6-4ce9-b189-3784e662a95d", "value": 92609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943705, "uuid": "2b78708d-2f0f-4676-941e-90dff3895ca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943705, "uuid": "a0386478-b02a-4cf8-9f9f-e584b96183f4", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e1396d-ac90-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788987370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788987370, "uuid": "410dbecc-4781-4130-b9da-c21a91bf738e", "comment": "Malware payload (PureLogsStealer)", "value": "988f20f1bf7bae589102f6fc83f45224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788987370, "uuid": "6305d3f3-de2c-4c88-9792-2b60ee4bbc6c", "comment": "Malware payload (PureLogsStealer)", "value": "25443ccdf2ed0da0d14bda3f9160e6adeebd4b7d9e947bdca8c990a45595122d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788987370, "uuid": "e9bbe264-f963-4542-ad95-1d1abdc1ffc1", "comment": "Malware payload (PureLogsStealer)", "value": "7d84e3e8d903f606910bdb29f8053125c8d21c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788987370, "uuid": "4a4c8d4f-9df4-48d4-a97c-79b6ce710e0a", "comment": "Malware payload (PureLogsStealer)", "value": "e71efc81915b7324571757cceab8f0d5a93cbfcb5ee420064aef7b1587dbcc0c5dc8108eadd1bafe7bf687187f8c1fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788987370, "uuid": "591e2f84-555c-4398-9bd1-9d0d4e4e239d", "value": "T14F8522987B4AC517DA6267B80E71E2B417B91EDEB401E2175FEA6EEF3936F005C04213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788987370, "uuid": "efb7565d-afad-4b1f-a8df-020bafc41d11", "value": "49152:zdQJZqUcgWgskWAPx+Lzcd0O1tsdv5iNB+MP:zdQJUp7Ab+Z5oxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788987370, "uuid": "a9beef42-625c-4773-953c-d93043dd1b9e", "value": 1718784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788987370, "uuid": "994b5cfe-b839-4c84-a3a5-bb7b013de3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788987370, "uuid": "dc76c2e5-9c6a-4892-95a4-dc29d293bff7", "value": "Purchase_PO-2026-0145.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758de64b-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788946814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946814, "uuid": "be15c4e8-fe3e-4588-83cf-54853dac23f2", "comment": "Malware payload (Gafgyt)", "value": "4368ca509123288af4f157d5b2d1a8d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946814, "uuid": "25f0f31d-91ba-4d52-92fd-ffe2465c7595", "comment": "Malware payload (Gafgyt)", "value": "25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946814, "uuid": "021715f0-cecf-4880-a0e6-50d6239c51b4", "comment": "Malware payload (Gafgyt)", "value": "e51c3e97cbda3aa97d2187b09bca0e3baba6dc67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946814, "uuid": "f4f3324d-f74c-478f-9c5e-9571f042b05b", "comment": "Malware payload (Gafgyt)", "value": "cf127afda6e6484a03237fbbc6598ec66afe1cafa6420093f81c94583df2aee87bd5281ae37496badad3941189c7797f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946814, "uuid": "940428d4-0507-4104-a6a1-0072aec01161", "value": "T1B6515EEE11809B719B08C54EBBF03534650BE59366DEEA44ED800A1C0EC5F8C33A5B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946814, "uuid": "47153b80-e02a-4e8e-a005-0f753b151a89", "value": "24:mr2JMqcbiBKhuZVE6EnE2EhEIOIbwZ+JUfxGhM3U:mr2JMqcbiBKhuZVVcvyeIbwhGhM3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946814, "uuid": "b29452aa-a2b7-4fad-852b-2d9a99acd75c", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946814, "uuid": "53eabd61-1e27-469e-9a74-fb39c6c236f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946814, "uuid": "a596f108-581e-4135-bc46-cf9507ca3b0f", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c388ec92-ac62-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967561, "uuid": "0f267977-0389-468d-8a98-2bb38a814847", "comment": "Malware payload (Mirai)", "value": "6868e0aa0a88e7eed8c516b2969f68b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967561, "uuid": "bde96cda-ee52-4123-8496-b89288fb1671", "comment": "Malware payload (Mirai)", "value": "267bf93bbe30fd1fa80cefb56f578b140361596cf23bca12c37ecf6d56b8b26a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967561, "uuid": "2c41d56d-6c27-450c-baba-6a2681134838", "comment": "Malware payload (Mirai)", "value": "b6c87574b68835d521b2f4d77d77b881b87cc9b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967561, "uuid": "24953a90-87e7-44e7-afde-8d866a5b20e9", "comment": "Malware payload (Mirai)", "value": "9b7a8ea5ee4e951c821ad5d3f1d739585d33f6e58a674a713a66f5c32d014c80f82bdb9c02990d0aa379fd0230f05235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967561, "uuid": "b9b2d045-e46d-4950-aeff-d25116d11fa4", "value": "T1AA62BE6D1B0226F3D867947312AD03802D7A0FFBAE03DC571989E9D3D80A4F461D76EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967561, "uuid": "639453d6-0968-45fe-b6d1-4e6150047362", "value": "384:UnxMbDo/EqEFZTOkQyT5aXJgGlzDpHbKYwrJDsV2V:Yxg8vEFZ60sXJgGlzDppMgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967561, "uuid": "6ed1faf7-90b7-49cd-ad93-930c6848ac0b", "value": 15948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967561, "uuid": "aeb6be84-5c01-4ee7-b5fb-e3448ceff0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967561, "uuid": "78e96fd7-a959-4c4d-a47f-8a473afbd0d3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9941a7-ac60-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788966534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966534, "uuid": "52acc9ad-095d-4e14-a4d6-5cf8182367b9", "comment": "Malware payload", "value": "e96e28b3824abf6496fd0971b3ba7459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966534, "uuid": "a2dbc007-d5a9-4826-8c7a-ad33e0c3c312", "comment": "Malware payload", "value": "26817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966534, "uuid": "43749487-c464-4a20-8e5b-df24d135b903", "comment": "Malware payload", "value": "1195b7ff7090587b1c6d38a959ff7e86ebf22cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966534, "uuid": "8e403eda-a6e4-4071-a179-4f560b609bea", "comment": "Malware payload", "value": "7bcf29415a8c8cd6e55e15ebab12651f842a95ecde517a82fe0be560fde66ccd4d19c51e4e2de0b7b15d1eecd7dcdd6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966534, "uuid": "a1e5cbaf-2eb9-4871-9e41-957360f66ebe", "value": "T12805AD127AE9D0BBD2421132CB1C6BF591FAD7680B3048C763848F5D7B359D1DA3AA1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966534, "uuid": "d9b5ba5f-821a-407f-9f2a-e8d491c3a100", "value": "6c5965af38ef4fd6158aa40e07982ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966534, "uuid": "98cea087-3d20-4f16-aacf-cde143984739", "value": "24576:DzwrgD+SHLYg9WITZMnYy4lbDiPw9ADbDmgZmz6yE:DU8RrYcWVvIDrdgUz6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966534, "uuid": "69434d0e-245f-4638-bc37-35119506ce78", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966534, "uuid": "7a6b0877-1a71-412a-bf4b-84dcdcee8041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966534, "uuid": "d52b4a51-23bb-4a8c-9ba7-037c96d98d51", "value": "26817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb881cd-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959820, "uuid": "2e547b73-8543-426a-9f85-0459969bb517", "comment": "Malware payload (Vidar)", "value": "9ad35c1887ab60c55f5a5db82c58fc4c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959820, "uuid": "dcfb8268-efd1-4009-bef5-ab5c7707517f", "comment": "Malware payload (Vidar)", "value": "27f06ccfdd754fd76036ab1714bd8ff9eb1e4845d2825df3c3c4efbd238f5f34", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959820, "uuid": "725dbe22-0f4c-4692-abf6-8a826edb193c", "comment": "Malware payload (Vidar)", "value": "7f04a8cbebfef0831ce30917fbc139e58d53f4d7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959820, "uuid": "c149a185-6b89-4ab8-9cf2-8b538bcf94b7", "comment": "Malware payload (Vidar)", "value": "5f3e744f2343bf0f9b299dfb80d78304a7c4989acdcc6b55c5d9c354a73c9bc2cd16cb633726bce6803e80ff8762adb9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959820, "uuid": "7c5bcb60-3bde-4d23-a8a0-b5c6767e2bcb", "value": "T10B646C71A2C291B2CA4E23742A3E77ED9D709B222B04CDDBDBC4FC1C6E691D257B1416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959820, "uuid": "c7179576-2f9d-4c57-abf7-7ad11790e21d", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959820, "uuid": "945e3726-c906-4d28-b415-a8ea672f2b14", "value": "6144:A/rLVPW0nsP2Xy+TJfLzW7y/rLVPW0nsP2Xy+TJfLzW71KT:A/rLVPW0WcJfLzL/rLVPW0WcJfLz0KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959820, "uuid": "caeceb6b-ebc3-4b23-ab61-ab9caef43095", "value": 331832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959820, "uuid": "942c1f60-ec40-497c-a2ef-aed6aba8e31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959820, "uuid": "4de5c4e8-87ac-405d-9cf8-1912a0100490", "value": "27f06ccfdd754fd76036ab1714bd8ff9eb1e4845d2825df3c3c4efbd238f5f34.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cd8f55-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788963942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963942, "uuid": "4939228f-e376-40a3-b830-7ef83f3821df", "comment": "Malware payload", "value": "a411cd1e1c34af21b4bd3f509ea95864", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963942, "uuid": "b6aa0c51-16e6-49a7-9446-cf9f436ee635", "comment": "Malware payload", "value": "27feafc31ae04e5e2ca5adbafc945e860572779e014b570da3fbcd0bff9190dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963942, "uuid": "ea6770fa-ee0d-479b-86e2-e8c6cd10ea8c", "comment": "Malware payload", "value": "8dcacb905ecb7e3cd1baf14764ecc3385b7a0281", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963942, "uuid": "d80bd48d-6f55-4bfc-a92b-24d7b5fad45d", "comment": "Malware payload", "value": "d7a6f0044f5e35109930c54d188f0c2dd5d27be35596a4abfef8544a81b32dc23273dbfbf06dd63b2cc4f06c66bc19f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963942, "uuid": "0718f75b-d74a-459b-8674-c5b1fb0033ab", "value": "T179363B17ECA546A9C0AEE534897292937A717C485B3123D32B60F73C2F77BD0AA79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963942, "uuid": "19144258-155d-458c-934e-7876135210de", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963942, "uuid": "74ca92b5-3022-41b5-b45e-69f821f44c33", "value": "49152:h65nRrdVNns2+k65ty7LghTdTiAY+xPt5Eh6QEbv0QCuErXNMHh9iWA:0RvUk65tyyTiAj9EQszTNMh9XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963942, "uuid": "ad79450b-f5c4-452d-9ca7-8dab5fe2802b", "value": 5010432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963942, "uuid": "1ef49de4-0b1a-47a1-aac6-b3f70269a49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963942, "uuid": "770585c0-8766-4d56-98ab-5a34553abe11", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717235e2-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788946807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946807, "uuid": "eae61e0b-ef6e-4db9-8191-8c5721e1fbb3", "comment": "Malware payload (Gafgyt)", "value": "b2da65c70b3134f75af2eda80d55611a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946807, "uuid": "62119a2b-e765-4d00-8a16-93c35ddee0a3", "comment": "Malware payload (Gafgyt)", "value": "2803f457de61e1e1690683a9a004e8e0e70a6116c6a0132761ec3fe888d14bca", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946807, "uuid": "913af5f8-2cd3-43fc-8f35-85cd95769623", "comment": "Malware payload (Gafgyt)", "value": "2cf032619a946fc135609a539adc3c5b57435466", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946807, "uuid": "ed17ccab-05e0-4899-b2f5-8ba8e83a8dbb", "comment": "Malware payload (Gafgyt)", "value": "76de791a9490daa39e3d815596bbf8beb800cc129d7f3a29f7a72a771ea286d035e52e893c57bea47545fe49d3007fbd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946807, "uuid": "4c51b7a7-fe7a-4e6c-8ce4-3d2b0632f8cc", "value": "T19053F2F3421CD912DE8EC53AE26DB581CB893FC54BA99427B5788C9DE114D04BF16E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946807, "uuid": "15de3dd2-ca13-47f5-8a59-0d9276b12e2e", "value": "1536:PV62D7aC5rE/7RheOslefeFOQrJS/od7E/sI1afxwAQF:fj6WlyeFfrsIFIwpLQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946807, "uuid": "e7a7e19b-1b4e-4f7a-99c6-19a45b13294a", "value": 63920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946807, "uuid": "99e98712-230c-4adb-a0f2-d921ab1ba5c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946807, "uuid": "9b6f1044-a522-45f7-950b-57600948814f", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb47d438-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938368, "uuid": "7c9de604-7838-4d43-bbcd-23b04df6b73a", "comment": "Malware payload (Mirai)", "value": "0b37d07e27ca688bc711223cc75617eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938368, "uuid": "2ea23597-0dc0-45ff-830c-2899e58141c4", "comment": "Malware payload (Mirai)", "value": "284a2824db8e93747e9c975b220603b5d257a10f81458db602d24ffedfee854d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938368, "uuid": "5be9ff8c-7693-4829-a289-a419e33466a6", "comment": "Malware payload (Mirai)", "value": "ebe64b0f65faaf365022ebc6081d4619cf665090", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938368, "uuid": "8e19409a-9d11-4a13-a7a9-5dd4c25d6800", "comment": "Malware payload (Mirai)", "value": "e3994c3a3fc254de20580810ff09ad845a457101df503d6484ece438e516ea547a62dcbaac2f295531b45aa1c53f1360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938368, "uuid": "25b14999-5c50-4d4b-84f6-a26879bd5e5a", "value": "T1C3832A03AD659FA6C1865BB416E38A310763FD154F572F7A7529EAFC4603ECC780A3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938368, "uuid": "b9550940-d8e9-469f-874c-28dea184058e", "value": "1536:70EZnVLjCp5iU9KZXmFT0vhICJ7Olf673hYQAXNevURnoH9H9EEVRn:7FnspwZZbhIteO3evURnoddEEVRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938368, "uuid": "1b404305-abe2-4f0f-a329-bdd1af083610", "value": 81768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938368, "uuid": "69ef5672-49bd-46d1-91c8-1f6f7b0352fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938368, "uuid": "7357d3ef-3948-4373-bd8c-d9dbea77e8fe", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0baea07-ac60-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966751, "uuid": "117de326-1361-4083-ba77-8152db172f11", "comment": "Malware payload (Mirai)", "value": "f7d4ee8470d8bf011e1e76d5497238ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966751, "uuid": "36728842-eab2-4fb5-9278-348c3d02222b", "comment": "Malware payload (Mirai)", "value": "284de7588b894176a57d660504c0fa44bbfe7d461698b72dd0e10e534e3f071a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966751, "uuid": "8c2f35fc-f5f4-4d9e-a79d-39ea004de341", "comment": "Malware payload (Mirai)", "value": "62b8cefe01a15d92380784fd0f57452e6c158b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966751, "uuid": "7bda7527-7c79-4487-b66c-6001150a7580", "comment": "Malware payload (Mirai)", "value": "5ace3643cfd8ad03c5fc6b7f951e15d33476b533b503a081a2632087d5bfe289df08780e7b97bdda2e274766e45ef820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966751, "uuid": "3a2c27e0-52c4-4816-8312-7b098b2018da", "value": "T17944D613E3404CFDDC7888F1125F7270B972A03B9726B587F65509B1AA9B96E133AED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966751, "uuid": "3370ddae-ab56-4444-b715-9e160efb4476", "value": "3072:olaiXVETCxIKZiwaXlagAN9JzFtHyq0Vj1P5tEbeuGt/4YUqHLj5w87oz1WQtQ4Q:YqL297tHyz5PrEbrMHLj5wd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966751, "uuid": "839d73db-bb1d-4b20-a17f-8d6f6408266e", "value": 272432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966751, "uuid": "3241c78f-8304-4693-bfb7-bd13ce987b46", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966751, "uuid": "a2331ec7-84d2-4008-96f3-d70edf1815b7", "value": "wj0s.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faeae51f-ac39-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950044, "uuid": "9f1960ac-301f-49d9-a07a-aacef85c1ad3", "comment": "Malware payload", "value": "6219d9dda3d6f860a82faf539bfc4377", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950044, "uuid": "57b050e7-d2f6-4ef1-ba69-783e9631eb43", "comment": "Malware payload", "value": "295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950044, "uuid": "1c6d9cb1-b303-4fbe-ba4c-03566fda23a5", "comment": "Malware payload", "value": "65344bd4db6e0fc48a1760802e354d1c2bc54ba1", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950044, "uuid": "843b2af7-edfe-4fdb-9183-1063ebab1d03", "comment": "Malware payload", "value": "ef6e198a8764a6c7903edecd8b510d0b9e2493e3dfbe5142e100a31081d788a3ca392692d46c948b20124a4fff52261e", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950044, "uuid": "07aa5e63-f3cd-4379-973d-fa705d03f29e", "value": "T164958D1ABAD53831DBFAD3B39BD3CCBD8527600052673C9F1A8A07C448497A87F6625D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950044, "uuid": "9bd7f7a0-4fe0-404d-aefb-4fcadadabc5c", "value": "162595693c097dabd1049ecf101d7821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950044, "uuid": "ea8436e0-246e-4569-b423-52279e739cde", "value": "6144:3WtQeaFzRrdjvF6ihJ9YGe7JTro6lEdCyW8ib78q7WfkI1Q4siH+35:3KRa5jN6i7onEd99i355w7HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950044, "uuid": "aa4f36d4-64d1-45b3-a686-66dac04bd2f8", "value": 2044928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950044, "uuid": "8b4f7074-7693-4514-bc39-62d23753c9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950044, "uuid": "0b760a07-3ff4-4fc6-bc57-ef74b9d35718", "value": "msgbox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89935c1-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977501, "uuid": "25997694-56f7-4cf7-a8b3-7c3556935ccd", "comment": "Malware payload (RemcosRAT)", "value": "d5a4284ebfab232f18361473d26945d0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977501, "uuid": "d8b22325-5c01-432a-b76f-9d9bf9cffa71", "comment": "Malware payload (RemcosRAT)", "value": "296670fe6d88022c5e99e6037bd6de889a5e4900bcf31332cc36ea9bb250f4f7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977501, "uuid": "83834e40-6e85-403b-9569-0aba37337e19", "comment": "Malware payload (RemcosRAT)", "value": "12a885e93ed3dc6caaae44a11eac462a1adf5c22", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977501, "uuid": "9cc9288d-27bc-4e38-8122-7f48c8a49168", "comment": "Malware payload (RemcosRAT)", "value": "7b7d7a6b8318cc3468b8a3e2ca9a2976578517e04d2f9b56ed887a913c18a95e3beb7fac2612022343534683ef4479d7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977501, "uuid": "31d49382-6557-45cb-a8a9-5397dce39794", "value": "T1A6A26D71CF2B26E28D6A2788EC840D4584FD50051D230AF57EFA1349674AF6CA3BDB5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977501, "uuid": "fa5f7a4f-2b3e-42ff-8d89-51379c65e3a0", "value": "384:s8VfsmJqSq5eT+RMhVSjcmoodFuY+Zr6LV9yecwHv6cJkOtDTqSGEDPcVLwb6q:JUmJqLsFDSImRAjrwVgecwyIL68DkVLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977501, "uuid": "7d320f93-bef0-4841-94e3-9f3a5f263fba", "value": 22483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977501, "uuid": "116aaf75-cb70-4b58-a330-cf4df5db79b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977501, "uuid": "a152cd1d-e550-417f-8c02-77a558987272", "value": "RFQ_6000412697.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8133205d-ac70-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788973462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973462, "uuid": "0957404c-b4e1-4b77-871d-55ae8b7d1ced", "comment": "Malware payload (Gafgyt)", "value": "71f1befb33f86724b97871bae00be05e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973462, "uuid": "28398484-3fcd-4081-9b5a-c4098741c5bf", "comment": "Malware payload (Gafgyt)", "value": "2a21b2ad7e799da1a8bdafbdc2f96f4100ecc4688c6f04b143898481fe359479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973462, "uuid": "86d4ad70-f570-443d-a88c-790fe4678c20", "comment": "Malware payload (Gafgyt)", "value": "0d6fc040c3a9ce09974215b03f6598aed3e1ceb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973462, "uuid": "b0c700d5-af2b-4c78-b953-be4cd63c69ce", "comment": "Malware payload (Gafgyt)", "value": "f87f8382352cf0ec7045911008d165596ccd4802ff05f6607dba807543af342970aac92142fcad6c8324d7eb7ba4289e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788973462, "uuid": "ea7242e8-607f-42cd-a39b-9d20e92c3caa", "value": "T1F9D319B5F340C072D24302B2106ACF365D31F7F3269AA52BD3A85DB0DE7618265A5F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788973462, "uuid": "9f6f1fdd-ea45-4673-b0dc-b1711a60aa3e", "value": "3072:37WHUVUGU1UQUEU6Le9j8Co+p5hfsHZfxB:36+HA3PfLeNp5hfeZfxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788973462, "uuid": "19ae5f1d-3c2f-49a7-a528-a6b494ddf354", "value": 131556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788973462, "uuid": "8d331cb8-50c9-4fe1-8c64-f4e0429199b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788973462, "uuid": "6c93c0a4-498a-4220-810c-10ea702b44a3", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4c9070-ac47-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788955734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955734, "uuid": "611d4179-07d3-4520-8d37-736adfe52ffa", "comment": "Malware payload", "value": "e5105f9aed5a0bec00a7d9607f13bd51", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955734, "uuid": "5fafa381-577f-40c1-93fa-2397ca19f58f", "comment": "Malware payload", "value": "2ace553de3d8c370341faaff1c128effbda2777cbcd5d399b7bfb2fc98b8909c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955734, "uuid": "829e3934-8a7c-41b9-a056-529f0b31b7a7", "comment": "Malware payload", "value": "71c31a27b983972830af70280ab98c1c64cc9c22", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955734, "uuid": "25717d42-9897-4bf2-9f94-351740fded08", "comment": "Malware payload", "value": "bb4e1639cc4574056d8a6bba443aade49b56befc172e279a25533f26c9dc92e2ba908e2bd90a9651e8d6fca6a17c4e1a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955734, "uuid": "d93b8d8f-b8eb-4cb7-9338-a3af851f71ac", "value": "T134B733D0F268A41DC5B3CA33DBB48A7956365C8C890191573768724C89BBBF80EE9FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955734, "uuid": "b3e9e1e5-20f0-442c-8734-71d62c3c9b4c", "value": "786432:66oTDYoyYFemoTDYoyYlvSoTDYoyYl4GoTDYoyYFSgOwgcXo5GhUExzC0TRDApvd:65INdxutRgr5kNzC010B15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788955734, "uuid": "93325304-ce36-4bc3-ad15-2733fcbce534", "value": 48432867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788955734, "uuid": "d0b74cd6-77eb-4a47-97cd-7c3b9e3b4d32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955734, "uuid": "f6715435-2d65-40e1-90d3-a9346e842ca4", "value": "SL TROV\u00c3O ENC.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa42eff-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788977236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977236, "uuid": "5b84940c-5816-4b91-b267-cdbd776f9ffc", "comment": "Malware payload (XWorm)", "value": "937a6b6425915eabc9d32ee5ae851a97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977236, "uuid": "0eca0a1e-b682-4232-a44a-2469945008ee", "comment": "Malware payload (XWorm)", "value": "2b4d1a09264dffe27f9b12199a4cccefe0fc1855e65f2b30c004c7343cdd26d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977236, "uuid": "a977bf71-0714-44b7-8cd9-dbf2e2998da4", "comment": "Malware payload (XWorm)", "value": "f4c4a1c1909c40b1320c8dbe329be6e830d41535", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977236, "uuid": "d0b6c8d4-0817-404a-9219-3346e817f018", "comment": "Malware payload (XWorm)", "value": "41ae80eca1d977ad9879177fdcdbf2192e7c30d97439d7b2b6ec2d423d72cb51f701f65a4a38700ca6ca202a788148ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977236, "uuid": "fd6e049b-3116-4ca8-9643-a390308981f5", "value": "T163E3114555C7398053376B7FB22AE8D4F76A076701804943B5BC7860AFF1E09EAE0DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977236, "uuid": "b89a9c84-9adb-4e8e-b0eb-e417d3ea5682", "value": "1536:LdX0lsg33Hphvz0pejnP9dqJMXVDLUV75QKXpfrI3t1whrlmgrntj4CAclzL74Ng:mnjP1Dt7FyYbdm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977236, "uuid": "eeb220d2-015c-48f0-8a83-ff7b11bf4f8b", "value": 149710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977236, "uuid": "7ad6d381-83a0-46da-af51-a87c86b27baf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977236, "uuid": "f69b5087-581a-4519-abcc-82ae0ea3e84e", "value": "RFQ#282606562.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a325c248-ac77-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788976526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976526, "uuid": "cc322f3a-dfc7-4fa6-9b57-923b321bb4bb", "comment": "Malware payload (RemcosRAT)", "value": "470bf6a7e7be2e1ee6a189ef7ba9df1a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976526, "uuid": "2c12cdea-3025-4fa2-b5c8-cdc31842b3b0", "comment": "Malware payload (RemcosRAT)", "value": "2d15369845235a9ef78e8ac0c0fec84d5883c3d11d48a85f7983fc94fcfc77e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976526, "uuid": "009b4936-afd8-42f3-8e50-611ba1a01b40", "comment": "Malware payload (RemcosRAT)", "value": "0e31e2841a6a5adffcb4a32e4e04738c54990eda", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976526, "uuid": "8a647f46-06cb-4fef-814e-c74371c2f808", "comment": "Malware payload (RemcosRAT)", "value": "738a8ce8631bb16314d47d153404d77473241f2a263390587e7de5e393e15754b5d29a6cae87589638ea546dac34ee58", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976526, "uuid": "2af22e30-93ff-470e-b61d-acfc41980e60", "value": "T1AE1523115335C6AA53B83A6838BE1B0F1BE44F5040CCE899DA56A5C2427FF5C7C768FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976526, "uuid": "58e13be2-c467-496c-85cb-005df2203385", "value": "24576:KsdfKNZT8txVUqMvysjsKUFcCovO1AmMZ0D:gNoR7cCJ1AmlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976526, "uuid": "719b350e-8587-4481-a34a-25bec6f05158", "value": 915126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976526, "uuid": "d557f052-de43-4d9a-9b1c-9d5f56cf065d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976526, "uuid": "0270ff8f-286f-4ed1-bc9d-1a9d5d7a34d2", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139369bc-ac94-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788988740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988740, "uuid": "fcf48d25-b56a-41b5-be54-a52774db3c78", "comment": "Malware payload (JOMANGY)", "value": "3cd3b580379ce3b75c1a7283f033bb89", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988740, "uuid": "2413df35-5e8a-402b-a987-fa4c902b0b7a", "comment": "Malware payload (JOMANGY)", "value": "2d4c0d148b5348f56d85dd86b1e669284b82b67a1ba6a6d9f313b4e1044beb24", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988740, "uuid": "3a0f14ec-89e3-4437-8ad6-1692279345f0", "comment": "Malware payload (JOMANGY)", "value": "1009df0d0803ace558aec8261a90f62af884c695", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988740, "uuid": "0041a816-e70a-46f0-872c-3bc68c944212", "comment": "Malware payload (JOMANGY)", "value": "4e1a795d1ab79035fa082da5b5b789d949d2a6b8c704b6db9d7e140ec7373a4b66ffcc272f4fa49f4e944bce5fc59ca3", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988740, "uuid": "5758ffc3-1b4f-4a19-95bb-ccc60ee6b4b8", "value": "T1C3C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988740, "uuid": "dafcfeda-b217-45a2-acc2-50179e41d159", "value": "768:U8vCB+25j6es8R/9FYpMSUpi+20qUpi+20YQX:U8l25JJd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788988740, "uuid": "c6e97a02-fa22-46e8-bcff-bebdcff0859f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788988740, "uuid": "c6388327-50c6-4995-a454-e3af00b4a318", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988740, "uuid": "a586987b-4e16-4c2e-bb5d-ab365e9abb54", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf42e8e9-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966265, "uuid": "65cba9a6-4dad-4045-8c38-6c954dca3777", "comment": "Malware payload (Mirai)", "value": "d0f1090bf153ef804624da532f9350ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966265, "uuid": "f7c9c5d6-2136-4d14-b1b8-0823b7299fe2", "comment": "Malware payload (Mirai)", "value": "2e048ef68915e4c777ce0ea7a5a17ef349a52036af6c3092aac5334d5fbdabc9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966265, "uuid": "bc267826-204f-47c8-a7aa-ea3fce01714e", "comment": "Malware payload (Mirai)", "value": "c635455d1bc316345d5f40d6fa4db369d6090abb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966265, "uuid": "7ce9917a-183c-4467-9df6-954d0f7af702", "comment": "Malware payload (Mirai)", "value": "fd951d5d95443e8d0800eefef0dea65ca47ddf4eb67f28c70e9e7e27bf4985398a55312a60bab808258b134498326d7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966265, "uuid": "fb525074-6639-4ca4-839a-6984fa62ec91", "value": "T15EB2D1A48B919B06C2B0B475E27C8F92573B15A0C5F639271B2092BC9A8245737FDAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966265, "uuid": "2aedc1aa-88eb-49d0-8f8c-71403dcb94d8", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BNL/LRzXKhymdGUop5huQ:4GaKQFH0rs3zWoDDRsjt7LB9U+BNL/L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966265, "uuid": "7fed6fae-86e7-430e-bde2-30f388be430c", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966265, "uuid": "f70e9130-c45b-410a-9fe8-694b34ef54aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966265, "uuid": "8f2c3305-a128-4512-955a-0b4b98a00700", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c667c429-ac3f-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788952533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952533, "uuid": "3be8c5c3-01ea-4951-a68f-7f8dc1b25ef3", "comment": "Malware payload", "value": "01cf59a1ba44fde4357bacf95a035555", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952533, "uuid": "e42a5a46-f94b-475a-8b4f-0998de247ee9", "comment": "Malware payload", "value": "2e261b3bda31076b64a40637f2c76b0980f3d7a534865aae6cbb54f64ec7bf7b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952533, "uuid": "f587910a-930b-41ee-b838-9038e87a2335", "comment": "Malware payload", "value": "1177076a260307ef613af89f278fea72c50a9696", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952533, "uuid": "9690d9c7-7612-4e56-ae49-a12e000776af", "comment": "Malware payload", "value": "f6840c7c6b7b27384dbb2e25b5f7d16b17051f254e0e3ee35f9440088eef0480095b127f35c330bc7328be5e00c55174", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952533, "uuid": "eff8c7d1-42a6-4892-890d-6878f1785f05", "value": "T135730157416E563FC63235369DE45D398E7332028AE5C8CFBF92D4510128EE48E87EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952533, "uuid": "8e18f3b6-4e89-488e-a00e-127dc03f7db0", "value": "1536:8Oy0gvyTITMtDeKhZb7dA58YOppSR+u1lyf+xFM3bQIcr:80DITMMw3dA5LmpSN1l4+/Upcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788952533, "uuid": "5c4ca6c5-e21e-4fa1-9e7e-872ef231eef3", "value": 75578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788952533, "uuid": "3ff192c8-5a10-4d2b-a667-c221f73d9a27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952533, "uuid": "ef9675a8-8d0d-4c75-afb3-68db1d44ac93", "value": "Krypton-client-1.21.11-NEW.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0908b7a9-ac7a-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977556, "uuid": "6afdc229-b2ef-4917-82db-7cbce41c49b9", "comment": "Malware payload (AgentTesla)", "value": "de18a6a79057886a3aaef22b0dffc1da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977556, "uuid": "6de04957-0e7f-4369-b6ab-07a506175f7a", "comment": "Malware payload (AgentTesla)", "value": "2f0cd2c04d3ce41cb72bac461592f5b654a76768d7ab1ba1b1aa3549440b176c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977556, "uuid": "7556b96e-542b-41e3-918b-c0736bc00d16", "comment": "Malware payload (AgentTesla)", "value": "be30dacf5520060952333a1f5b83a71311fe757e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977556, "uuid": "0978ae4e-68e4-448c-927f-2e5a7ae6b101", "comment": "Malware payload (AgentTesla)", "value": "aaa01a2b0c3d0475c0570d86e4c02a2932d415b9a1422e74b805d396d49fff11190de07329712cf06faf0b6fbd9d105f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977556, "uuid": "69ef8224-3387-432e-a4a6-a36a6edcda51", "value": "T109B2410A880DBFF4191A3559BA1B7436E9D003A5B83B684D798ECC5D3B7A5248FD34E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977556, "uuid": "5c65f59e-638e-4307-9dc1-632284acfcd7", "value": "384:KT3IdTlIwLRXvwmZStJQ/FWQR8VqbZpipmNFNVY7NQ9T3VM7Avw3cbeLIOBha:KTTw9wmZFn2SNBpmXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977556, "uuid": "13672513-8d5b-40bd-86df-0844fa5478d5", "value": 24634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977556, "uuid": "af6769e2-2806-4685-8a3c-3644325c2c53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977556, "uuid": "5973a8cd-3cf9-4cb1-9718-597f84de82ae", "value": "6-day itinerary list.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a62c773-ac2e-11f1-ab4f-4201ac107002", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788945104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945104, "uuid": "b5f04f47-228d-471e-8dc4-82c5b354bc42", "comment": "Malware payload (PhantomStealer)", "value": "26a1199087d38d15c26d4b34d7ab3c5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945104, "uuid": "926b9aa0-6b97-453e-9309-e5ef6ca45fb0", "comment": "Malware payload (PhantomStealer)", "value": "2f1f3032cbdf2c854e3e9f135fa4dc417ea5b3f81a4d1af058142ed20f83962e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945104, "uuid": "3b2bf2e0-0fdc-434a-b66b-e4768b374ab3", "comment": "Malware payload (PhantomStealer)", "value": "2270ba5701f6a00a56a206ec14c1f6fbc63eecb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945104, "uuid": "fa871c51-51d6-4338-a6aa-1041c14b60fa", "comment": "Malware payload (PhantomStealer)", "value": "dc961e199f37e9e183c24fe611fcea0f21c9da2a29d5ac4fc053b6fed46d1da2e641abcfaa056c8635c6d810a9960597", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945104, "uuid": "1825a313-33fb-4085-a1dc-05bd944ad567", "value": "T179C6F7891354E133B36157DC6235ED35A60A921716CADB1A727CD318BB3CE07A36CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945104, "uuid": "1f3907a1-5701-46aa-ad05-c7b0bc1e8489", "value": "393216:FUqpnQQs6BJvc0F9Hv0OeaUmY6X43gmJsLm:F5pnQQf9F9Hv0OeZmY6X4QgsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788945104, "uuid": "f2d10348-ddde-430d-8605-ac2dbb6e072d", "value": 12611377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788945104, "uuid": "d94179c2-8edd-429e-a5e7-44a2dc967a17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945104, "uuid": "956a8ffd-2f67-48d1-83c2-ef8a577a3231", "value": "6RFQ000919.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256b9e62-ac76-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788975885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975885, "uuid": "f58020a8-12bb-4a4a-b7aa-ca14c71b3ee5", "comment": "Malware payload", "value": "a5da2f99f8db469c01ba9d229d208430", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975885, "uuid": "e992723d-a1da-4db6-8f8c-5c31f1546538", "comment": "Malware payload", "value": "2f2b3bdb7985fbad154cc45d4f3400dfc208172ef8013525aa44c94f9267f2c8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975885, "uuid": "6350bc18-dc0f-405c-87cb-a87c6f426f65", "comment": "Malware payload", "value": "6ee70165f2a78bc144ae27801899b854997b0058", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975885, "uuid": "f61e7eb5-cf5d-4c5f-9041-19148fe66e08", "comment": "Malware payload", "value": "8f0dff66e70a81a52dd89845af94c6930b304293529c51d15ff15b54d21776487020a442aceffac47839926cf5516092", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975885, "uuid": "a8b0f826-ce63-492c-a99f-b0a1c4b7fc7a", "value": "T19BF423B6F372376645DEC3AABC419F89235631C1E8284246D4F24C2EE0E67CDE6145AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975885, "uuid": "fd7a8af5-0dc3-48db-a03f-7dfe0b8a8c54", "value": "12288:tkk9ZDaiIVOR5qO0gYGkVMFwhKvz+UpeV62r3macB7f+hRpfhbS8t:tlBa36qO+Gs6L+UpeYWmacFf+lBS8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788975885, "uuid": "c950f3dc-8a1a-4e6c-bd7f-897f14e0798c", "value": 736316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788975885, "uuid": "099ae442-5754-4565-8072-2e9fec9efe5b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975885, "uuid": "3ff2b38d-4042-4af0-8cbc-543db54b0c49", "value": "Purchase Order_PO YRS00262602092026.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6da15c6-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788943166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943166, "uuid": "eaf816d5-f935-40fd-b013-17a6f52c2063", "comment": "Malware payload (PureLogsStealer)", "value": "fcf6ec69935564f2568f696882ae6787", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943166, "uuid": "65335c84-0c42-489c-9c63-692b4b066922", "comment": "Malware payload (PureLogsStealer)", "value": "2ff0f91b50182de0114ea87d08cab555a40f26e482d950225da53289cbb6740a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943166, "uuid": "fcae6d70-d8b1-4541-8b26-4eb9a5838c18", "comment": "Malware payload (PureLogsStealer)", "value": "e25a74b58f8d09c6c080bbd373b8218a2d2a609f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943166, "uuid": "f58178ab-174b-43a7-b4a0-c15c107a6a35", "comment": "Malware payload (PureLogsStealer)", "value": "c96d4b01a1d206a0da89aebe76c975ac5610b9814525276de7c2fc596a9b1e511bcba36f205f9f9a6e494a9b19029808", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943166, "uuid": "fcdaa597-4690-4b1c-a460-167b27b27c5f", "value": "T11E65127C4A9869B51A1C77555BCFFB21073362B2CF09F2CCD29C52480757E82CADAE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943166, "uuid": "6532cac2-8656-49a6-aff9-30ca03ddfec0", "value": "24576:QZLtWkfKTfoJtF4AWI+obCrmtOlQHJXOdsaexvFAb3VXeSTwbvIat5:MuE/JbxpJF4VhY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943166, "uuid": "174263b8-921f-45bb-9a38-c861706ba8e3", "value": 1423475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943166, "uuid": "4fbfcc15-fa92-47b6-83ab-7540df046be6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943166, "uuid": "4db2ca22-3344-495a-9146-e43bc6c9e9cc", "value": "PO-048166.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1506fd34-ac58-11f1-ab4f-4201ac107002", "comment": "Malware payload (ConnectWise)", "timestamp": 1788962973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788962973, "uuid": "797566ec-a22b-4892-b9c9-66311bf033f9", "comment": "Malware payload (ConnectWise)", "value": "124f430aa2d2135d1f9f61f80ab46fd5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788962973, "uuid": "44c79986-9597-4a58-8769-6232c10a23dd", "comment": "Malware payload (ConnectWise)", "value": "301feb336c07f451bf16b05a068680a6961702e77e5b270af300fa029e89e8fd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788962973, "uuid": "886fd052-0367-4bba-a7d3-ac0979b40aa4", "comment": "Malware payload (ConnectWise)", "value": "52050080fa4f2506b4f37e68123b56a177b600d8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788962973, "uuid": "7ec2e2c8-db48-4dbd-a5ee-8fcd18345416", "comment": "Malware payload (ConnectWise)", "value": "804618d476efce8b6b00ce2c0694e08bebdcfa1d678724a1280bfcb659c565a67a97d048610731d2c7fd46c6c9f64e5f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788962973, "uuid": "cc8c5ee0-b7ad-4467-8cab-77fbc6b21a4a", "value": "T1FEA6232063E58466F1B70A3EEE3586F4597A7E25DE12C08F63A4791C6D32E50CA72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788962973, "uuid": "4c9fc74d-64c6-4c7d-8926-27880bd735eb", "value": "196608:1gHxiFSsYwwSA/OdB+S4xzeeTgHxiFSsYwwSA/OdB+EgHxiFSsYwwSA/OdB+9gHJ:12xiFxbwpaICe2xiFxbwpaD2xiFxbwpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788962973, "uuid": "c0b792b2-4b3b-4efa-8b32-526246ea9dde", "value": 10227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788962973, "uuid": "4eddc033-df3e-45d1-ac1f-7ea80cf95e4d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788962973, "uuid": "577bbdca-7fb2-4d57-a756-5f70c21ed9e0", "value": "301feb336c07f451bf16b05a068680a6961702e77e5b270af300fa029e89e8fd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fe2601-ac6e-11f1-ab4f-4201ac107002", "comment": "Malware payload (SalatStealer)", "timestamp": 1788972630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972630, "uuid": "2effd612-520f-4a20-ae3f-275f0beb054b", "comment": "Malware payload (SalatStealer)", "value": "fe0a1613760484a9f362326466bab179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972630, "uuid": "267935a0-da35-47eb-a82b-efff7ff5ee4c", "comment": "Malware payload (SalatStealer)", "value": "303f5bda665a8c6d4ccb0b9dd851a707bb3219c03793dae4ea1deaf8aa9c9cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972630, "uuid": "33f541bc-fc0d-472b-a791-cd8e5032ada6", "comment": "Malware payload (SalatStealer)", "value": "fd8b3d2d2c674121a4bc93849f0103db95004501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972630, "uuid": "75ee7d2f-91cf-4e55-9ebc-44df46ef5071", "comment": "Malware payload (SalatStealer)", "value": "9f25e51d3204fbd35f7ecf233df680895557369a7ab41808dfbcf791adb72cd3f39276550fac7445ef0dea90cc9305f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972630, "uuid": "0af3d855-b484-4049-9204-7740d2d2a018", "value": "T1D8C66B11FACB58F1E903583140ABB27F63315D048B38DB9BEB143B6AF87B6A11976705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972630, "uuid": "d6a1be0a-6cdf-4151-b397-b66ee39794b9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972630, "uuid": "fc06b313-77e1-4790-a673-87d1e6d0c222", "value": "98304:oS3RqkGTk7HeiIEaPsVrwb7X/4fIq4tG20CwE1a:JG2wECsVrk/4gqHoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972630, "uuid": "2b86e635-6b17-4b3c-9ab6-32d64cb52e77", "value": 12571136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972630, "uuid": "ff4a5652-1693-407e-aaac-bab29cb78d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972630, "uuid": "47c1b2f3-9fa8-4e75-a0f8-8e27d9e69b54", "value": "RKNobhod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eba15a-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963449, "uuid": "97d0e987-80f3-4485-aade-38958d283fbd", "comment": "Malware payload (Mirai)", "value": "db8e81f3619095b2305d3ae049c58a1e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963449, "uuid": "27976e7c-3799-48dc-a7c4-1254e4e8c0a6", "comment": "Malware payload (Mirai)", "value": "30cf1ad9d85803d4f7673877efb5172ac48c8cb38df123e9750717836fd8f0f3", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963449, "uuid": "4a8e56f1-684e-43dc-863f-39d078e7521e", "comment": "Malware payload (Mirai)", "value": "84ff8c15d18954c63c420ba0fcad2db10c371f25", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963449, "uuid": "272f6e16-ed8e-492a-849f-fbcae7bef7f5", "comment": "Malware payload (Mirai)", "value": "68552b5814f61841c1278c9074046fec83485bd965ef9cd07b9a4c8c57b8394ef53b64166fec0721a4d1b2e66031d33c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963449, "uuid": "e9777d46-7c54-4daa-8e2f-6e20858ee25e", "value": "T14B63021AD251356AF93756B48B270F96AD960E367C03E34D68DCDCC2CC4A1B3AC92F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963449, "uuid": "3b78dbc3-59bc-415e-98ec-cbac08fe7eb3", "value": "1536:ejCWsOOU47wqvDVmVbjviqblWxMmrfhSWjYz/Ic3WgE+hAjVbZUV1cxe7q:ejjNOxsqJebjviq+D7TYgGRzhMV1UV1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963449, "uuid": "1d14b418-0fb1-4163-baeb-cd5b92d9e08d", "value": 69492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963449, "uuid": "5004bac4-b6c0-4a26-b0d3-6d4151e52a2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963449, "uuid": "723589f1-8916-45f6-9308-d7931ec6db1c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52466b90-ac6d-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788972095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972095, "uuid": "2f57f15d-1a93-491d-a266-6331234f33db", "comment": "Malware payload (JOMANGY)", "value": "658aa70e65c0cb60648c71d0f48518a5", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972095, "uuid": "1b280194-be71-4305-8cee-217edd181ec0", "comment": "Malware payload (JOMANGY)", "value": "320fb75af1888670cf3aa1746d8a5f95c623ef46d98c793a8eb0e816390302b7", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972095, "uuid": "2fa71dc1-54f6-46c6-8392-492970ac71cc", "comment": "Malware payload (JOMANGY)", "value": "26225eb06765c20f7f403cc9c3cff9310226f060", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972095, "uuid": "14176bbb-02ce-4eca-aae7-9378379d6d21", "comment": "Malware payload (JOMANGY)", "value": "3366c573751d04adbe3f78fb6227549d0c8145efd1b94f7a70e32b68e238bee123e519af8cb2d66b08402533ab5a264a", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972095, "uuid": "d98909a2-a925-490c-a588-69a2924add00", "value": "T139236C651A857C149A99C4371D7E2F0CB9AD43E6320452DE7FCB3CF28C8AA9DD20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972095, "uuid": "4e48599e-7813-460b-b13d-ec343f457cc4", "value": "768:IVEJVIhtMr9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:WEJ2Mccr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972095, "uuid": "7cc963bc-4056-4d45-82a3-d9a0d6876c46", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972095, "uuid": "1748d5e1-5aaa-486a-89ee-690a87c05975", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972095, "uuid": "fbb74ef6-c223-4dcb-91b3-d9f697193d77", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784acb19-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788977313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977313, "uuid": "a2ba023a-c8b3-491d-8456-eed2fbe3ac43", "comment": "Malware payload (MassLogger)", "value": "e8a4824a0d55028048be24386fe36353", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977313, "uuid": "0287a160-9f2d-4334-b2ba-4b6cb1831455", "comment": "Malware payload (MassLogger)", "value": "32f9de8807790055275937570febcece6965d7cd9fc432fc8f6d823e4ae5c549", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977313, "uuid": "3d40ff8a-10c1-4535-9105-53e137729611", "comment": "Malware payload (MassLogger)", "value": "3d6b868f2bf0bc280ba406ba77f2e71473040cc9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977313, "uuid": "d17c874e-a171-4402-b2c7-3befc16da231", "comment": "Malware payload (MassLogger)", "value": "1e3cf39a3a10669bdcbaffd4c48c4cd3a297d6eb68db552043ee155640a3fb2376caa05c7ce25449bd0b89ee56955a62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977313, "uuid": "95dab440-c218-4948-95d8-17dd043ae674", "value": "T12BB5D7F333E9AA0AA92976D0F9CDDEA40B5E44091F9766D080CF1ED0911B58F66C1E4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977313, "uuid": "4963c347-34e8-4b82-b8b5-e0b485ed4691", "value": "24576:4oDBQTHZ/QlKCcKqUJfhCHdB+/fUWpci8ULcUxTCMoLY:4vbZ/QYA9JfhC9B+/6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977313, "uuid": "e3fc320d-8b57-4c40-84ce-58682c6f2beb", "value": 2467348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977313, "uuid": "56a06617-8043-4729-b9c3-49afe7d42983", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977313, "uuid": "344f2f1b-57d5-4e79-a72c-1e7b07474696", "value": "RFQ-L10502_978.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a526301-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977209, "uuid": "879f65c2-6ef2-442c-bc7a-d37c2037aab8", "comment": "Malware payload (AgentTesla)", "value": "c23cf711ab49b204f87d62b7b6e60297", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977209, "uuid": "fa1d8419-1975-4092-8bbe-4af8474d580e", "comment": "Malware payload (AgentTesla)", "value": "3509aeb7593e8a86abfca559a0f4146df2e2957b36b8648efb1a3a32fe954240", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977209, "uuid": "d0ecee6e-49d3-4abb-b2d4-ef864bd13c6c", "comment": "Malware payload (AgentTesla)", "value": "ca6279075c33d4e29b88b7e5cf544eee1db91b2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977209, "uuid": "d708624b-775b-4336-aeef-5cf5e52abb9b", "comment": "Malware payload (AgentTesla)", "value": "cd9b211fcf95cd70a18f2f65ee513996614e673a91709c1bfe315f0bcbd53eb863c5d4fbe44a88f520cde485df8146a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977209, "uuid": "a5c37b8c-d163-4aaa-90e6-08bb9694021e", "value": "T15AB6B3691780B63373606B9E813ADEB4E52E512315E5CB1571BEE3583F3CE076318AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977209, "uuid": "dfd45604-7740-45e4-8512-a45307d36ac5", "value": "196608:RXCTeV6onpa5k2SmwPgzRYefphJpxTOoh/FV2+CUxr6Y1zmXY8I3WuEmEkFC0fA:xNSMaFzCAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977209, "uuid": "23558c29-b0d3-4d3a-b3c0-6a4f5320fd07", "value": 11408905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977209, "uuid": "5a9bc947-f395-4cfa-930f-6c6587b74cc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977209, "uuid": "c491cef3-6985-4483-8456-efef8224cbbd", "value": "invoice.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe1d4b0-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950294, "uuid": "907ad812-b52e-4c0a-b841-74685ac473b8", "comment": "Malware payload", "value": "775350a89885268a4ddbc1693620f62c", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950294, "uuid": "8274d796-79a9-4d7b-8d80-f6805b0fd06e", "comment": "Malware payload", "value": "353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950294, "uuid": "df86cf91-f048-43d8-b74e-1d827a9b4f99", "comment": "Malware payload", "value": "8894ca6fd3fe082e721a8690b8125aaf0fad64ae", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950294, "uuid": "e8f070bb-0b1d-4e5d-a706-02d335178f50", "comment": "Malware payload", "value": "0e01d1f9bddd7499ae827353825378cb843b77b7ca5d978555ead7575833ed794ed073a6999d66453383c40a4d67d42d", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950294, "uuid": "6c9d2140-64fb-41fa-8949-b2c80c7db349", "value": "T1D4F2D64129AA3664378E1FBBB713B4C2D837084D389C0997F614BD1814AE613DEE6B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950294, "uuid": "8e18fb2b-b8f0-4523-8c00-201583d560c2", "value": "768:gBHp3X68+STHuizYBg8gk/VL7PlVvSseygvjsWs3SOcmBr1wXZpFE/CxIH/qn3h3:QBQBjNGsUBZUC4/q3zCFdxygbODckGiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950294, "uuid": "1ce13a56-03b6-4e6e-b597-118e62161979", "value": 35972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950294, "uuid": "4b6c7781-03d1-441e-aded-495fa5d8e08b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950294, "uuid": "9cddc76c-8b02-46f8-95a2-ff243af91dab", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27e58f0-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921630, "uuid": "c38c0323-7ff3-434d-ab6a-fec0be61e232", "comment": "Malware payload (Mirai)", "value": "0e27fa4fb576da50bbfe15a91e36198b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921630, "uuid": "34ca4472-cba2-46ab-9adb-6f65d5ad4cff", "comment": "Malware payload (Mirai)", "value": "35664b1b0720aaf383086d2de50e91dbd7fa83f89b8b0dda7d5c1c03ffccc842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921630, "uuid": "0c0746bc-aa04-4254-a6d5-e132657898df", "comment": "Malware payload (Mirai)", "value": "6775cbcbfc020bf073e0d747d2e70b6519fb8d61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921630, "uuid": "8e21831c-8ac8-4204-a131-d33ea3839630", "comment": "Malware payload (Mirai)", "value": "260047d5ae2272e70c9c104300dc5bfd91d9f2400061ac3aa6a9ed02b061f4ed48fa28de3c6f6c0fc6750b56b8b666e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921630, "uuid": "4bfb6760-daba-4c05-8235-2c390e07d197", "value": "T10283B44D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921630, "uuid": "ca060155-4801-4015-8831-036d23c3cde0", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+8:N0bY7lmZH0iL5iNl5GKjVXz38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921630, "uuid": "d1bf0968-9aa8-465e-ad65-870d08f7ae45", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921630, "uuid": "58358639-1c55-4016-a3b7-33dff4014fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921630, "uuid": "e58f0c19-4990-41f3-b766-a4571b864aca", "value": "ecee64f2446c402df5024227ab3217e82ce4f40fd3f509a306ce731de3fa71a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cb8508-ac37-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788949170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949170, "uuid": "5ea19938-6034-4b05-9285-a0179326f52d", "comment": "Malware payload (JOMANGY)", "value": "27383b278249dc81a36492b62d609a77", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949170, "uuid": "ac290d34-2070-4f2f-b0f6-73437382371c", "comment": "Malware payload (JOMANGY)", "value": "3610b4da85eaaf546d485095d626654e5e60716464bd5fb020ee135f3803f38b", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949170, "uuid": "e6a3fd92-caa0-448a-8c4a-8a6a31f2bdec", "comment": "Malware payload (JOMANGY)", "value": "e45cad6d9991b363a44beb4b0dd553dd7ebc2147", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949170, "uuid": "a5cf2ae4-aff3-46ab-9ddc-ba97edb7adb2", "comment": "Malware payload (JOMANGY)", "value": "677d7bb5a10312a4b086eab374d4045f10c0e378a34b0b9d8400e8dcc9241190acfa01ad8908adba63b85362a8255625", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949170, "uuid": "1c393765-bf3e-4cb2-963a-77d70d862677", "value": "T1D3235C6516857C24AE98C8361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6AD910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949170, "uuid": "2babf558-2d40-4744-a546-2ba99157d0ca", "value": "768:o+H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:o+wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788949170, "uuid": "b09fb63b-2869-40a7-aa6d-aa2c1fc9b976", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788949170, "uuid": "2b54a2a5-5d85-4a16-9500-cc0b4f5313be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949170, "uuid": "12176407-5c16-458a-9e35-706db27ad6aa", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5704e942-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963943, "uuid": "ed1f089a-fd8a-4c38-90dc-57d110039616", "comment": "Malware payload (Mirai)", "value": "e415488e8c1c044eb6d9028c254d0924", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963943, "uuid": "48433952-5a66-4ad2-a1c6-e2b6acf64d56", "comment": "Malware payload (Mirai)", "value": "37582ccc7d3f6a07b72ffc8b0968bf2296896f14079359df8096666df3deb42d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963943, "uuid": "b7558035-bb31-475d-90a1-731dbf9ba155", "comment": "Malware payload (Mirai)", "value": "4b49eac5c57fe5523f34c5ab9971e127161951e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963943, "uuid": "6b8bc2d8-16ec-4745-8dd0-bfc8173bc529", "comment": "Malware payload (Mirai)", "value": "650f70f77010ea09b9f78df299b188612fa19a5ca365d36c3986d78ccb00b7619a9f05d843cb22d676b5c074b31c497c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963943, "uuid": "809f0d81-2b9c-4d96-942d-5223fc5bb12c", "value": "T175363A17EC9586E9C0AAE130C9629253BE717C495B3023D72F50F7782F72BD0AAB9744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963943, "uuid": "4de7aadf-32b3-4594-89e6-02027ea20e07", "value": "49152:wNs3fwQmihXexbKJQqZLrvCyyUV28j5Ex9VSgdv2fZwl+IKTA/:7mihIeVvCyvVBEx8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963943, "uuid": "9ab0f333-c370-4284-9d45-2a769678616d", "value": 4882432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963943, "uuid": "c2bb0bf7-7b82-43e2-9b5f-0d7e7009a7be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963943, "uuid": "d74415c9-acdf-440f-9679-1594c5ecb5e9", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63fde4d-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788933232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933232, "uuid": "a9f28a1d-a2b6-434d-8adc-c9ca0baa84f1", "comment": "Malware payload (RemcosRAT)", "value": "5697c0eb030c4522f7554ed2e9e348b5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933232, "uuid": "0906f523-4607-4af6-ba31-c787afc86387", "comment": "Malware payload (RemcosRAT)", "value": "390eeb831f23557d33b8ad9e5ee75bbf89c9d468092f6254049474145786ab2f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933232, "uuid": "2d2e03a2-34fb-4138-8765-47e39f294869", "comment": "Malware payload (RemcosRAT)", "value": "ec27eac9cb6184f3a7b19388eecec007777c48e0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933232, "uuid": "0098e067-e95b-4489-a630-dd5b2b8648ef", "comment": "Malware payload (RemcosRAT)", "value": "c5aad4af53d67c3e72463d7ce38abbaab6565fce2908d990c2df19e41b18fa0d2ed922cd3711c42c9809bd0fdbada3c0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933232, "uuid": "4af08b7d-3f2c-4c3b-9eba-156420a9edf7", "value": "T188C23A359E673246884A17E6AC5E0C69C4FD4255146F10B07FE9331E6D4CBBCA3ACA1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933232, "uuid": "d1581102-848a-409e-9b33-6e02d889b91e", "value": "768:QUMwmJq4KvmZPy5sGNccSk50l/vlDP2Q7Lwsghn:RMwmojvmZ65sGNT5gnlDP2Qo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933232, "uuid": "51d56e4a-355a-419f-8d4c-57c70f18b4bd", "value": 27345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933232, "uuid": "c1592996-5290-416f-9ad9-a42edd99e70e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933232, "uuid": "50746b97-6a36-4088-918f-6d05fba97ef7", "value": "Thigmotactically.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8b6d86-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946801, "uuid": "af0796b8-0d8a-4c6d-b14a-ce813f149ade", "comment": "Malware payload (Mirai)", "value": "0dd1f1826e3776cc5c2465a7a8a0b55a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946801, "uuid": "2f41c134-cde6-4caa-a379-c1a9eea1ddc7", "comment": "Malware payload (Mirai)", "value": "3993adaf81efa67f955c632fe26525ec04de23a34df76febd566c5be3344b22b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946801, "uuid": "dafc54b2-14bf-491c-93a7-e5584c3be7ac", "comment": "Malware payload (Mirai)", "value": "371f08da1c3c75e2766fd7605d4f3e52f957ef9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946801, "uuid": "a77951a7-858a-418d-aedb-765d086d0264", "comment": "Malware payload (Mirai)", "value": "53a6b1ae40cc4f402f8cb61dd0b134b0c3fff5512174dbea811c2c032a5966c2016eb215ee0de9c2cd89389e323f9911", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946801, "uuid": "ffd081ce-9916-428c-b946-aa2c3eb54a55", "value": "T15173011ED64F56B5A8514B3458753CF838FEA2C285F86025BC0F40A035AEACA7D6E633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946801, "uuid": "e5cbc385-6b4c-4c45-bd56-ba119538fd85", "value": "1536:0AAeGFTJCROjhhcmg/ak4E/QuHUzqbRATNz466umzory:fLGZ5k4eQlzqNATEumzSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946801, "uuid": "a7ae778a-c5be-4c0d-a4e3-5822337173d0", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946801, "uuid": "9ee7ab2b-33d1-4144-a838-21d13e6c8f0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946801, "uuid": "30bcc403-0074-4c81-a69c-003709758f95", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48e96f6-ac69-11f1-ab4f-4201ac107002", "comment": "Malware payload (CastleLoader)", "timestamp": 1788970515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970515, "uuid": "2a8a453b-5899-42cf-b24c-40a879f3227d", "comment": "Malware payload (CastleLoader)", "value": "97353b3e2df7d26ccb7db04945493529", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970515, "uuid": "bb102ce8-1d73-4017-bb6e-068c6e544ab1", "comment": "Malware payload (CastleLoader)", "value": "39addeb849aa7bd86dd08c260d5cb1d9e28bb5b194d7739341f99d816d8b61ca", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970515, "uuid": "d9dcf9c7-da2a-4cf6-aa8c-5aebd5216081", "comment": "Malware payload (CastleLoader)", "value": "7aa52750b65d9cce6ddf8632986f60ca483ab95b", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970515, "uuid": "f5b4f5e8-13a6-412c-9386-b98514955af7", "comment": "Malware payload (CastleLoader)", "value": "8af036c3d79749c54e23655b2f56f3851f37052dfd333d02395a9282bbbb87cdbce329decd17116822a2fe94110fb5aa", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970515, "uuid": "9f3d7e8f-c68c-4064-a21b-e8db7d6efc18", "value": "T1BF348C11B245C47AC6614AB91428AE76127CBD348BD019CB73C8AFEA6E345D34B39F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970515, "uuid": "67537e7f-fba9-40b5-a9d5-87f589ffe60c", "value": "bdf7575fcc0b17ceb288719b350b3b25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970515, "uuid": "dc1983b7-5afe-417a-ac21-5ba67ce023fa", "value": "6144:OLV2+MSwbcFprQL9wNLwz/IDDmmmmmb0g:OhVoARQLXIHmmmmmwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970515, "uuid": "e19d455c-03d1-416d-b3a8-29f597215c21", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970515, "uuid": "9fc3af29-ec68-4d26-8702-3a2765b2bca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970515, "uuid": "792f74b1-8755-400b-8455-55c9c499af75", "value": "39addeb849aa7bd86dd08c260d5cb1d9e28bb5b194d7739341f99d816d8b61ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c19467-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "8af83a8c-d60b-4185-a7a3-b3f890191e2a", "comment": "Malware payload (Mirai)", "value": "0373fd99c0dc608d3b185d35810decfc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "275bb0dd-6bbd-43d1-89d0-67e024105047", "comment": "Malware payload (Mirai)", "value": "3a0e3316ee14f687b4a117a3ce4957f439d7a2eec69e8c3af564feec6133fd6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "68bdf086-1c24-4126-9773-7f9a9bdeeffc", "comment": "Malware payload (Mirai)", "value": "15008199c63a41437a435295c33b8919c37ed403", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "7e7e7a35-0ad7-4ea3-b77b-c7b7e49d2210", "comment": "Malware payload (Mirai)", "value": "333d5a1a50c31116a9ed0699385e250b045963aa0b35f8ca01f329648d8a891b39d795303b77d53b1ceeca73769e0055", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966271, "uuid": "d435e46b-c588-4b71-a776-7866664cf1f4", "value": "T1475193D532124A70BFF19DAEB5F6482474C0E095FAC5AF05D9EC76FC864CF0826D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966271, "uuid": "f03b17e6-d111-4021-be02-0d83f4900657", "value": "48:vX444a4g4u4g7zE474q4d4s404EuUf474ob:vX444a4g4u4kE474q4d4s404EuUf4748", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966271, "uuid": "82543e11-639c-4acf-a0c9-bf9b38332558", "value": 2891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966271, "uuid": "966b8ef3-ae75-4b1c-b5ac-05c9ca77c581", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966271, "uuid": "90535a7c-e3af-4bda-a82b-ea4896830ab3", "value": "gpon443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57654148-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963514, "uuid": "c0b96c45-e4fb-4687-acff-44d843583b62", "comment": "Malware payload (Mirai)", "value": "29d77b81541b205302afc63299e2ba14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963514, "uuid": "f02a9832-2797-497b-af63-0490a2c80add", "comment": "Malware payload (Mirai)", "value": "3a57b4fc28a66238c3092af3f3af17cb4df70bb96ba98b6db968e0dc2ad42997", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963514, "uuid": "ebd901f4-201c-4c4f-81e6-ff589585ae88", "comment": "Malware payload (Mirai)", "value": "6acde37196f22a2d42ae2c3f0ff05ae0071588f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963514, "uuid": "4272094b-45a4-4918-8788-6cfe0a7f5a60", "comment": "Malware payload (Mirai)", "value": "5247e681784762fcee0ad960a2f543ab4f6b817b083de1d3d96928518b929ad8b4ad5c2f4446db347b163a7f7bd9a21f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963514, "uuid": "f336985c-d957-4a1c-b6e2-3ea49fe8baa3", "value": "T10EF31806AA41AB01E4D736FAFBAE414533536BBDE3FA3002DD205F6523CA99B0F36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963514, "uuid": "0efc430f-fd03-4a56-a45e-a6785ab02ac5", "value": "3072:S0p5tJ7ODgigr/xSJ3TF8GanabKC/nJsPEahemn4gsnXzi:z5SCoJjF8GanGKC/nJ8LeA4gsnXzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963514, "uuid": "b77bc0c6-ea9d-468f-823e-1d7a1b48b11d", "value": 167252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963514, "uuid": "94872040-1a7e-457e-ba57-36c17cc00c2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963514, "uuid": "a8f8e781-9e0d-4d60-8ac0-28163ce13ac1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ecb004-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788977332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977332, "uuid": "aab91f0b-0659-4f3f-9974-15ec2b931e10", "comment": "Malware payload (AsyncRAT)", "value": "b0a9e716c4181d003ffd1c085739d160", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977332, "uuid": "26580f2e-49f2-445e-9774-866fdf7fb0d3", "comment": "Malware payload (AsyncRAT)", "value": "3cce5d5b945a0a250e29e575d19bdb3bfc1ec8c35613192b2c4edfd519262973", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977332, "uuid": "0cc1c1e2-e5c1-4b50-95a3-52d0b4a6dd1b", "comment": "Malware payload (AsyncRAT)", "value": "623e11092edf6ea8278ee7a0a26b67b0bcc5857b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977332, "uuid": "e637cc3b-d37e-4127-9c06-f5172470df24", "comment": "Malware payload (AsyncRAT)", "value": "2b30c85ea40893039cb7d03bae2616a1764234c3524f7562c444b5f3e167cbfa8b3cd511eb528bd100d2042bed4cc894", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977332, "uuid": "216bf62f-5bbb-41aa-9dd1-c854e600c310", "value": "T1C924E0254366CA2043797D44D86DAB270BDC8B21086C985C2F57D8D1D91EB9EF2FBC3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977332, "uuid": "edb686d2-d848-400a-ac0d-b69baef2ec1f", "value": "3072:9Atwjuk0fZXbiO9nJnKHMllZ7fqzBChaQsHCYvBW5dlPW4CC6+tY:95juRfZXOOtJnKslltqWsHdW7AfC6+tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977332, "uuid": "eaa9bfea-ba67-4b78-a6a8-09dd61d9923f", "value": 216812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977332, "uuid": "575f276e-d68c-479e-9341-3f954e8366bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977332, "uuid": "394c4231-e46e-4323-ad95-678a7ba30fb3", "value": "Halkbank.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18bfdf6-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788943103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943103, "uuid": "e0c914f1-bb6d-477f-af7e-cfd40b8fe77a", "comment": "Malware payload (PureLogsStealer)", "value": "1453f60f41fba3fbc5dcabd9e95d2ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943103, "uuid": "7236141c-9a25-4e78-8f83-4adb32ba4eb4", "comment": "Malware payload (PureLogsStealer)", "value": "3d3d00bfe41a79f5b8dc4896a115f8a57f9725b33f771edf0f5c69d813edd5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943103, "uuid": "fefb651e-3833-45d2-aa64-4d956525bc47", "comment": "Malware payload (PureLogsStealer)", "value": "16b436c5f167221c80d30d23db658fba8745088a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943103, "uuid": "c94ecf47-3771-41cb-89c7-a69ba385fc3d", "comment": "Malware payload (PureLogsStealer)", "value": "9392af3610d9576e650701106f3032b58668e06edd125fba062ba985aafcbc5d155850e323ca03c001cdc13bd4d4388b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943103, "uuid": "db65178e-d4b7-43fa-a08c-3527be4d78cb", "value": "T1948512686317C803D69587744AF2E2B406B94FCBF801D3475FE86FABB636B855D482C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943103, "uuid": "b3594918-8b2a-499e-ac87-c1dd96855561", "value": "24576:eZqj0qdPxhw2DQLnzOEqxGkrHV9gXEE5smy28EjU5tIcCRmvBNaYKtj:HXHQLZyXr1SXEtOMRKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943103, "uuid": "8b0e8d2a-3f74-4c74-9798-74e040f26dce", "value": 1734656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943103, "uuid": "764057f8-abbf-4453-b242-f6abdf85ed9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943103, "uuid": "68fc1170-06e5-402d-ab2c-9c62e01e70c5", "value": "B0727377374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc3cb1a-ac4f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788959340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959340, "uuid": "c3c312a3-ffe5-4374-872e-cb0794eb0e71", "comment": "Malware payload (Mirai)", "value": "cb2c69cc316d14c78730c9336d56a2b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959340, "uuid": "b642c63b-fbac-4ee3-b85a-e1afcaae94e7", "comment": "Malware payload (Mirai)", "value": "3d5773fa687585e149d579572b4916e384b72d7880d07ed3540f2648b2ba5e4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959340, "uuid": "8ca66985-8f17-4bec-b27f-af64805eff9b", "comment": "Malware payload (Mirai)", "value": "575a95370b65b729f06b9ef43d3f8b9a34e91aab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959340, "uuid": "8985f9dd-e7a5-429d-855e-c10aede02cd4", "comment": "Malware payload (Mirai)", "value": "aaa72a9b3cdb2eda58aa5069ae41b15ef80ba021fab378277caeb75759237a26e473701a88031f68e8eeb7ff654977f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959340, "uuid": "856013c6-ad55-49cd-bc83-1949731909df", "value": "T1A3344B63F3218CDED2244CF120A6B7B08D47417B98A720D3F95A9694DE9D99F213EDE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959340, "uuid": "259a4563-3390-4007-af91-1f23afcf58f4", "value": "3072:H7rOrqmlyuPut7OEl3/DUXWli7aoQYpAG5/jxZKhq4e:brOHAtkWlUxjxZ54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959340, "uuid": "1fdf34b4-208b-4a1c-bfbd-ac312b3c5554", "value": 246696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959340, "uuid": "96019096-c1e8-4891-8e5e-d627bdb88f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959340, "uuid": "b126f23e-2f46-481e-b9f5-dd96931867cd", "value": "3d5773fa687585e149d579572b4916e384b72d7880d07ed3540f2648b2ba5e4a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355824be-ac4e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788958732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958732, "uuid": "0bfcd38e-3f83-4774-96fa-de1164355be5", "comment": "Malware payload (Mirai)", "value": "8627b4a066f83ad342e4387d32c38dde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958732, "uuid": "1f2d8aaf-20ae-407d-9c9c-3a7805171043", "comment": "Malware payload (Mirai)", "value": "3eb72e97b05b1abb7ebb443fa52c90a9eeaacc911009aa7fc980a346f5b19a56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958732, "uuid": "e3e5c8fc-ac0b-4f2c-ba5a-ae0f9b507d91", "comment": "Malware payload (Mirai)", "value": "40415af0fac4974ba550259af67832f9ee67cfac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958732, "uuid": "a4a8eef4-ba11-49c6-8b4b-cf467aabfc57", "comment": "Malware payload (Mirai)", "value": "8a0ddbc331a23506a646ed77edbd7012553bd4feb4198bef975f0ea8e5ff6304033bd36e88123f53b8e3dd929f3627eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958732, "uuid": "872f6bf6-d215-4f7f-b37b-dc6ff913e790", "value": "T11844F863E3408DA9D29508F2725E72907A87037BDBEB3087FD254A61BB9E54F013ADD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958732, "uuid": "d41433a5-dc49-4e8f-9070-d43c5c103cdd", "value": "6144:k7zxmJ5iSRGrIqSQw7E6eUyiL66kSHLj5whR:kvxSiGGLgeUfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958732, "uuid": "7d2e1ede-087a-4cb3-962a-0dedf06df248", "value": 263588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958732, "uuid": "d8116619-3e07-4ffb-bbde-05b41c3e3a0e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958732, "uuid": "c94c5049-30f7-449a-868b-e2b7773a0bcf", "value": "3eb72e97b05b1abb7ebb443fa52c90a9eeaacc911009aa7fc980a346f5b19a56.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cc8e1f-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950081, "uuid": "9971f914-d45e-4f8b-9466-2093bccee2a0", "comment": "Malware payload", "value": "edf970a7c8c46d10b46dbe60dd281d0c", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950081, "uuid": "1ec5eaef-5066-4ed9-9d67-a8a37b005d45", "comment": "Malware payload", "value": "3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950081, "uuid": "9c34d433-a983-4a4e-8515-4b0488f87a94", "comment": "Malware payload", "value": "b46e801faf0488f0c6a94ce5e6a9d8ba1efdae96", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950081, "uuid": "72fa7e38-8bba-4753-b1a9-2ab8952d8887", "comment": "Malware payload", "value": "85028d6d0e000ce493de713391226181327e676abd7f77282164c081d30ee984c8d712ea8cd76d6622a71ed94fe6f5e3", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950081, "uuid": "248d212d-54af-43f3-9813-4e6f30e0ae1a", "value": "T18234F705739C69A8E86F4578474F25F3D3B2F44D0790EACB02A446725EA7FDCA8AA311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950081, "uuid": "3602e881-218d-420c-b1ce-ee9908ecc35b", "value": "5499238704fd996aa25323143b50cb5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950081, "uuid": "4fad68b5-23f8-4d13-a3fe-d1e2fa67756e", "value": "6144:rFx8yVxb8eluVxbotVxbxrVxbIqVxbHx0VxbnFVxbejVxbuBVxbS8AT6yv1VXb+c:rFxH3fo3I313z3Hu3F3g3e3S8AT6yv3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950081, "uuid": "2541b6cc-a7b6-471f-a72d-1e81d5738313", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950081, "uuid": "09f91053-a207-4ea3-b692-2c64f0ad8da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950081, "uuid": "871a8231-d8a5-4599-a72c-746f25b840c0", "value": "krita.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0ebc6f-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959814, "uuid": "309bacc6-2a27-4fab-8ea0-9a4f408b60a7", "comment": "Malware payload (Vidar)", "value": "4f7696041157fd237f1193712d5f98e6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959814, "uuid": "8fc7deaf-432f-4044-b143-d946defef9c0", "comment": "Malware payload (Vidar)", "value": "3f5c64d9d9ff47c116fe1ea7d62a1924486e7ddde80f8c27ff3edbd046129ccd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959814, "uuid": "0fec3673-391e-4da1-a6c9-8acf64e200b9", "comment": "Malware payload (Vidar)", "value": "e94785cb70204d80c900214a15c22ee982f84c31", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959814, "uuid": "228d7636-fef7-49e7-a341-573685564e24", "comment": "Malware payload (Vidar)", "value": "6b83c28665d0c5ef5d97d036e749c0ea725ca7123f89242766bfe292ad5bb6d533be365916066bd3a568fd6760af49d1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959814, "uuid": "cfec9320-f9a7-4327-bbb4-6a7a08edd184", "value": "T172D45C6177DA8230E6B27AB429FBA3585F31FD615F05F78B5380AE1D1D312C0AE70626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959814, "uuid": "43de60e4-bb5b-44bf-9a02-d1de194056e3", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959814, "uuid": "043c6ddd-c8c7-48b5-96dc-c96dd0d55dfe", "value": "6144:A/rLVPW0nsP2Xy+TJfyzW7e7+wW9JT24C5CMM33ze:A/rLVPW0WcJfyzfMJ9Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959814, "uuid": "7a1a45f7-7145-4def-a4eb-82980b1e212e", "value": 618488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959814, "uuid": "1094b0ff-6f99-44ef-8af8-7bbecd278fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959814, "uuid": "a41b9d8e-8701-4766-8393-47e86a4ed333", "value": "3f5c64d9d9ff47c116fe1ea7d62a1924486e7ddde80f8c27ff3edbd046129ccd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc92c3c3-abfd-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788924224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924224, "uuid": "42de947d-1abf-4754-824e-4bd58079353f", "comment": "Malware payload (Mirai)", "value": "2e0d8a526213432bf0952bdb08a569a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924224, "uuid": "51025527-1c54-4934-9341-971f972236d7", "comment": "Malware payload (Mirai)", "value": "410fe1699749582a576c43d760128856be27a6cf04a80c0e3ad880ab41aa7c62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924224, "uuid": "824b4e8d-e17a-45b0-9d6a-ab75c1a311f0", "comment": "Malware payload (Mirai)", "value": "757d51f7ffcacaaee4bddc7998e30290d623c1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924224, "uuid": "3ded3221-1a7f-4b25-a207-0306bc6ec9eb", "comment": "Malware payload (Mirai)", "value": "7008f65a1c529b57477b067b9d8c10797be722fde47d603a8cff92032488e890af472af399a5878e8f095e26b9ef0d47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924224, "uuid": "79630371-f133-4102-a21c-9b0b717b6c78", "value": "T18DC32901E5908767C2D2137AF79F429D37336F68979B33219A24BBF42B8179D1E39221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924224, "uuid": "3f7393cf-ba6f-44aa-bde9-34a5753f340f", "value": "3072:zcP+wadgzyj+AmM2aTXOwszFibFl3yQRb6EPvqUYmcQY47aGgp:zD+AH2aTGibD3yrmqUYmcQY4+Ggp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788924224, "uuid": "b5d8c2d1-bdfe-479b-bf04-e03917a2ffd5", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788924224, "uuid": "edc3e163-1dbb-458a-95fd-b3782bff6173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924224, "uuid": "70ae287b-3e13-404a-bebe-e92273f70808", "value": "410fe1699749582a576c43d760128856be27a6cf04a80c0e3ad880ab41aa7c62.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc7c6f1-ac94-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788988863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988863, "uuid": "3302b44f-0077-46e9-8da0-f739aca4ec70", "comment": "Malware payload (Mirai)", "value": "20ba19abc8760375001f77510c9c1756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988863, "uuid": "899098e2-f09f-4fab-8b66-a7d7cdf832a7", "comment": "Malware payload (Mirai)", "value": "4140ab818a346c10283f42da5f77fe275178123300c739cc260bd6f294dee055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988863, "uuid": "792e25b5-ec99-4150-8c91-7a73d3ea2a8f", "comment": "Malware payload (Mirai)", "value": "3d315178404fd30fac6dbfef0c0a3fe01de51b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988863, "uuid": "ba86e29e-5571-4969-8d7c-d6ee56cdcc1e", "comment": "Malware payload (Mirai)", "value": "c2e77daf0d2453cf7f95c03c3f3ee3430234d7ca68a1bb9951cbf533cd89f9cc4e51911d015b77dc8cb607255b4dcb8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988863, "uuid": "93905b14-48c8-4666-b246-37e433e72846", "value": "T1BF262951FECB84BAD503193014ABE2AF27306D054F24EB83EA547F6AED7B6921D3614C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988863, "uuid": "a0a484b3-412c-41cb-98b1-72ced994b961", "value": "49152:OSwJhvL0fj6b3QqDOywjFSgOPndbBGUaDBz6yGosBjukRDxnBSOEe7DZievmfn0N:ORr7RqywTBz6yGiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788988863, "uuid": "50adafc9-dfac-4de5-a994-8a600725e0dc", "value": 4501504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788988863, "uuid": "14572872-3a47-4e65-8e6f-cbbea424e177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988863, "uuid": "e08672af-fc42-4d50-9182-b0239878a1b0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848a6de6-ac4d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788958436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958436, "uuid": "c755f548-08f4-4638-82c6-c4932d700d89", "comment": "Malware payload (Mirai)", "value": "4071124718e6f9afec422be27a7a21f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958436, "uuid": "a89455d5-88cb-4e74-8b38-b74959e6681f", "comment": "Malware payload (Mirai)", "value": "417ee3a3b38d2bd08d4c649bdd686f97a7125b3f2b3f6473befe8a5d258169f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958436, "uuid": "a1692868-6388-4f2d-9cab-70748882f4a8", "comment": "Malware payload (Mirai)", "value": "3a060cbd51d2cab5c89d83009e229ebde631cfb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958436, "uuid": "6c196c1e-c78f-4e7b-92bc-2ff3fca0f154", "comment": "Malware payload (Mirai)", "value": "81ca0529e215c82ad43a7983cb95b4f9de2f083fa1ea7a2649e55a72124ac0f223356d9a4269fdd72f589d9b91ad94de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958436, "uuid": "a0533102-157e-4ac0-946f-e2645b634e31", "value": "T1DA9312B023D5BC02CAA1A1BEC506C408373ED27E569A3F277117BAF3270E555EC6902E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958436, "uuid": "3b4e44da-11ad-4188-aa32-ba063595489e", "value": "1536:tzhlFzfWU8vKmnLQM1xYOlrstYjyZDapbIKBn4fv/5/dULzD7ZtqXeb5CrVTUuSu:Rh/zfWU8Xf1x/ytYjyHKBIB14b3Tbsuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958436, "uuid": "f3c8f316-dba7-4cf2-bd79-f48997d4450d", "value": 91308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958436, "uuid": "a4135a28-b041-4940-a9a3-b07e40ea2643", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958436, "uuid": "23342df4-d1f4-4570-b5d9-4f5ab614504f", "value": "417ee3a3b38d2bd08d4c649bdd686f97a7125b3f2b3f6473befe8a5d258169f0.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df461154-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938402, "uuid": "a326ab9a-72ba-46fc-9521-d343049e404b", "comment": "Malware payload (Mirai)", "value": "f52946e24027cce10f2593e55110bf59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938402, "uuid": "c12bc962-7d0f-428b-b01b-855815d9f8c4", "comment": "Malware payload (Mirai)", "value": "41bb43cc1e4ce0fc1692bd56c945134a7ed9a4e4ee4601130310416640e03351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938402, "uuid": "949b01ff-ec46-41c5-a4a3-03b63ee01476", "comment": "Malware payload (Mirai)", "value": "398f78e97b6820331d8518e76fad1fe63581c3a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938402, "uuid": "653d0b63-d81e-49ee-b5c3-8f1a64909559", "comment": "Malware payload (Mirai)", "value": "62094ba577760a99af4bd595e99dff448711aa32f7d341daa58fbf7748e3f376c5fa3bade3fe2bf6f9ce54418873ed2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938402, "uuid": "a2b0df50-733c-4c22-91d8-ae0e980043c4", "value": "T139A32B02A5518A53C4C60B7ABBAF865533236F64D7DB33029A14BFB42F4379E0F3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938402, "uuid": "f65b0610-46ff-47ec-bad5-9dfa0464241d", "value": "1536:mDnfWGYbwEE8Ef6b6grCaNtHnA3yMFiq+DkmC5RYdfSQIjAfbZUY4FzPreV+:JvH6grCaN4+DxCH2zfYFzPr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938402, "uuid": "e4fdba72-7f3d-4c4c-b7e4-380d69ebbb05", "value": 102139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938402, "uuid": "856d5c65-3362-4c31-9706-5f089d413316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938402, "uuid": "abe4b87a-98bf-4510-b4ab-40fd60cacf9e", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc05ae9d-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1788977453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977453, "uuid": "1f70db37-fbdb-4e48-a132-d35c12ce9954", "comment": "Malware payload (LxBaseRAT)", "value": "b3119ce1db9146ce9ae90c6bcbb7e68c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977453, "uuid": "3cea5c79-571b-4d50-83d1-b9bdcd3f6f56", "comment": "Malware payload (LxBaseRAT)", "value": "4236f6963a4544231b60ac02bf04f044df8e6ce84286df04d955978e8376ca2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977453, "uuid": "13fe0568-da4f-4ac8-b4bf-eed55d981996", "comment": "Malware payload (LxBaseRAT)", "value": "3ddb39e12cdcb34a00ec02b68502007f272070ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977453, "uuid": "d682b8dd-982a-40f7-9334-1e6c6266e83b", "comment": "Malware payload (LxBaseRAT)", "value": "045b3b2e649fa2c9fa5f19a3604b14a7389da0359e9ba8c5c81be4d4d1f2b55e40d6697808357fee8e17a5601eebe1bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977453, "uuid": "f2016e6d-566b-4497-88be-955f41a077ab", "value": "T1C62523324FA9276C06F89610247E4DCF57E92EC840DC969C52BAE813E5DE70112FB66F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977453, "uuid": "201c1d12-0b8a-436e-b0ce-1fbe0effec9f", "value": "24576:a1EhIvhApDPYK9CZVkzn8PEUSmtae0Z7bwi:S4u85Ui78P3S4ro7bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977453, "uuid": "03206646-440a-4d79-8290-b8c9630c6c2b", "value": 1013493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977453, "uuid": "5cab84f6-ee75-4ea0-9b2c-639d258d5e8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977453, "uuid": "520698ce-179e-41ce-84a1-0c01b9d60038", "value": "PO 1916326.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f183607-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946803, "uuid": "8495b53f-a8fe-4053-bc0a-b6c57cd905c4", "comment": "Malware payload (Mirai)", "value": "fec19e3907cdd383d74618fa484b3b34", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946803, "uuid": "69600f5a-dd9d-4496-b63e-0be3b4268555", "comment": "Malware payload (Mirai)", "value": "42cc531eff0e7c077f71e6cf3fa622c3260dfc713d638059d1f2d2bfe23856d1", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946803, "uuid": "dfd4e4cf-5b0c-4104-a5c4-3b02271c732c", "comment": "Malware payload (Mirai)", "value": "03fe902deee990815ecf08249af2180655d9dbfe", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946803, "uuid": "b0c2f679-cabb-46c7-8941-aa910b4cbcba", "comment": "Malware payload (Mirai)", "value": "207bb0826c2874cbb24947a6dca1324c0e61d2d5b37016a13d5b351c1bb60ea545174b78fcb860855e47b36a3c1e31ab", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946803, "uuid": "137fba42-4205-459d-8095-3cb475e46497", "value": "T1906312F0A7153C3DBAC746B1FA16334786E0C52B8D88EED8AF9E40904B49DD84687F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946803, "uuid": "ade08ef3-9409-48bd-b2ff-f853a8d4dafd", "value": "768:NuM5bXUc29Fa6apvNnMFNFaT11RhJz2fTygs2PjQKa1BB6ZoQih5EB27U3Q6Wpwx:Rl2sFn2aDJYc2rQp1BB+ihqWkcrP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946803, "uuid": "a0cad6a0-32cf-4ea7-93b0-389187599b0a", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946803, "uuid": "035bd484-5aff-420e-ac29-05c6cb236ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946803, "uuid": "5ce0eb01-f6c9-42b0-8f13-ac7e5fa353ed", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fed7e57-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788933141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933141, "uuid": "b274fb1c-117d-43c5-897b-98614219267a", "comment": "Malware payload (Formbook)", "value": "55ebe13879adc0e87ec509fadd3d3974", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933141, "uuid": "019eb473-d9cf-4392-ae89-e7d06b04c8bf", "comment": "Malware payload (Formbook)", "value": "42f7634c21ee16cc1e95a4fb7299b58fe87737776ef120bcf0a6a3fa74246e6f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933141, "uuid": "2f76741b-f0f9-4e99-9800-0eea5717da0a", "comment": "Malware payload (Formbook)", "value": "b6da1e9ac4d36eff1d72c4ca437f8e61baee54df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933141, "uuid": "6d295e89-6915-4560-bfeb-81e6e6d20fb0", "comment": "Malware payload (Formbook)", "value": "aed4827f3346716b67a08fe83c5d0137bc230b56207021ca2f6f36f4851d0d13646b09d1606897a594cee19650886d07", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933141, "uuid": "eca1c5af-d9c8-4664-814c-97549361dec0", "value": "T189B6B3581787D872A322676C4237E938950A650716C5EF263A7CD7183B78D87A38CFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933141, "uuid": "e250d858-8413-4028-badc-d6589bf7f6da", "value": "98304:hXZJN9uonf1WFVj+isi4FEfy2rTV1flExzqQFzXB9la/TxQVgDOtPH5muscw+hH:joFVqiaQ1flExBXe9VAPZmVbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933141, "uuid": "fab703f6-09ea-4a69-b0a8-be7a65a434c6", "value": 11456583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933141, "uuid": "a4da580a-76d6-4013-90f1-2f55b4bd09e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933141, "uuid": "0b7db52d-6b97-4643-93d3-05bba3d8a7a8", "value": "1247-60720-ARMAN.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627a0b86-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963532, "uuid": "c02b8536-847d-4b02-bfdf-9a9bdab59149", "comment": "Malware payload (Mirai)", "value": "2f560d08db55718bdf27ea3310900d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963532, "uuid": "31e529a5-4e91-4373-8984-b1ffe49e7c62", "comment": "Malware payload (Mirai)", "value": "43292b1afa0c4d13ce8d39c83ee946695995fbb153b5a801675d4d32b1a6290d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963532, "uuid": "098ea2d8-edcc-4561-98f8-bb9053a53061", "comment": "Malware payload (Mirai)", "value": "3c73fe5a6bd08ebfc32bfd66df765d77496a7c7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963532, "uuid": "a48e7a3e-8581-493e-9093-19244e5f4ca0", "comment": "Malware payload (Mirai)", "value": "f9ab342c705163bf76f888d63f755ce754170228c34b9ad353c96d44775dcea9902eee1b47bb73c6bb6e9e3d1b6a399a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963532, "uuid": "ff0fb107-8139-4892-b7c9-21ae2711eb7c", "value": "T133F34B83BF83DAF7E55300F141F79B221A31ED3A0422DA5AD7B47DB5A8516D0E60A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963532, "uuid": "631e85ae-a90c-4de8-a782-a19ae2a81d8c", "value": "3072:79gyPA+a9mf1tRaBqZxv3i7XE4FcBGsR:7JPA+a94lZ34UYcBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963532, "uuid": "16d5a762-eb74-4e7c-8c7e-848467e173d8", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963532, "uuid": "47d81718-4577-457e-9d8c-4b638d3f3597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963532, "uuid": "226e5d4a-ed63-4f1f-984e-b6d02893b871", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebb9184-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946856, "uuid": "40ac254a-eeb5-4c33-8ca2-c3adb8160d2c", "comment": "Malware payload (Mirai)", "value": "7830099fb0765d5b7a0be9d089114233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946856, "uuid": "7dd64687-a98f-4d73-b9de-91d9f60472e9", "comment": "Malware payload (Mirai)", "value": "438faf25b1d7c387ef14957012fd4fdfe193a4978fb71b5aa90081caa9d3cd9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946856, "uuid": "21a4cae6-8b96-4b1b-8944-b6de00bc1780", "comment": "Malware payload (Mirai)", "value": "1d2eaeb1750f4705e1f6917d0ff2d4e1281c688b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946856, "uuid": "447948af-b51a-4ed6-9c61-738ef06fa28b", "comment": "Malware payload (Mirai)", "value": "76e799fa85f7da14677cc69f0d1231c4611e40030a03c934710a28f211fd7a0c55908f047486db9706c81ae6bd03867c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946856, "uuid": "6a07a429-772a-425a-90d9-58d5cad4ad7d", "value": "T199C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946856, "uuid": "cb0aeae8-3aaa-4db7-962e-874cb25a7f94", "value": "3072:X6tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNiohw:1oRNjmj1VGc3rRiou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946856, "uuid": "e2710759-3a37-42cc-aea8-670ca7ff2260", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946856, "uuid": "3bfd25f3-efa0-49da-b819-d9a156597534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946856, "uuid": "de7a61db-a8a9-40c6-a858-1509dc60db7f", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b24f40-ac4d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788958431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958431, "uuid": "9cdd1e2a-fcf4-48a4-a10b-850e5377ce77", "comment": "Malware payload (Mirai)", "value": "17e1296380f39200c81c9dbb39b61c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958431, "uuid": "f905a833-adad-40aa-9205-a7cfa02bf979", "comment": "Malware payload (Mirai)", "value": "449155fa61f70f8b53873867339a66836cc455e77b20778f899dd14a2a8f6063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958431, "uuid": "f299e906-3b87-4e7b-a45c-af18c7ddc6f5", "comment": "Malware payload (Mirai)", "value": "4e66dae2da19954da83093f6abdfad5aa613b197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958431, "uuid": "47dae209-7426-4428-908c-3e1c32ae5253", "comment": "Malware payload (Mirai)", "value": "dde4d2282c9446e7c69ef63f6aade4d1799eb0383286624a3ffecb5211fba1ea4c553b6e35e51d86837182bc6f637f36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958431, "uuid": "14d5c149-63bf-47fc-b229-0e985f4e8644", "value": "T1E344D753E2408DA9D29508F2722E3290B647437FDBEB3287FE254A61BB9D54F013ADD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958431, "uuid": "419683bc-8162-4887-a9a1-56867e52ad9d", "value": "6144:cSXmF55gjI5oCDjQuawYmUww4AWoTSHLj5wh:cFjEI5oCPbUTRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958431, "uuid": "c7711a2f-af7d-4a3e-a6b4-588d90443741", "value": 267680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958431, "uuid": "2f329b9d-0c2e-44f6-bf8f-5f481a71ab75", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958431, "uuid": "697bbcbb-ae57-41c2-bfbc-ed8622dd38b2", "value": "449155fa61f70f8b53873867339a66836cc455e77b20778f899dd14a2a8f6063.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b661bf65-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959808, "uuid": "e4297444-f217-4ccb-a84c-468668b3f0c4", "comment": "Malware payload (Vidar)", "value": "da1de43dcedf61dfacc3e4f302dc8266", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959808, "uuid": "71133200-4b35-4ded-a788-88418169c85b", "comment": "Malware payload (Vidar)", "value": "4548c315abf0e20c36093a0271a2ca875b4716a0d279f8d171e8194eb8bdc3e7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959808, "uuid": "56d3724f-d035-4ae2-a121-d1907f106751", "comment": "Malware payload (Vidar)", "value": "33b54b6b8a3443bc516e9d5e309b9de653244857", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959808, "uuid": "5936e700-1217-4997-90d5-9975893cbe52", "comment": "Malware payload (Vidar)", "value": "31f828b5b20af793d98249aa730537f2ac4dee6f6564f7b2130c9b50b374f2846e6540281770bf94e96eaad46ccac31d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959808, "uuid": "3423f6bc-99f0-4d03-a98e-00314f0b55cf", "value": "T197E36C71A2C2A1B2CA4D33742A3E77FD9D709B222B04CDDBDBC4FC186E691D256B1416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959808, "uuid": "b47e75c6-8768-47bf-87c0-b3a7617114d5", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959808, "uuid": "aca642cd-0bbf-480c-b3b3-5e047cc839a7", "value": "3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyKzdEpx:A/rLVPW0nsP2Xy+TJfLzW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959808, "uuid": "d8a1dedd-a10f-4d28-8068-c7ac4923683f", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959808, "uuid": "183946f6-0aa6-435c-96c4-178997b5a3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959808, "uuid": "df1845ea-4da7-4a5a-8c08-603ed89dba04", "value": "4548c315abf0e20c36093a0271a2ca875b4716a0d279f8d171e8194eb8bdc3e7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0924f0a-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788943101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943101, "uuid": "7f11fde8-568e-45d7-9e27-3c76bca912dc", "comment": "Malware payload (PureLogsStealer)", "value": "7ea54019289429d8c7aaa18ea1d85fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943101, "uuid": "c647ce7f-cde2-465c-a4b2-624f674ef424", "comment": "Malware payload (PureLogsStealer)", "value": "46a2508f313035fddc84a9c18eeb8b6d20d8fa385d8f7d13b5072a8753301af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943101, "uuid": "16361c1f-448e-4715-9832-bd762de48df5", "comment": "Malware payload (PureLogsStealer)", "value": "d193ca2bd8dcf01c7debef57c887bf14bc50bcbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943101, "uuid": "6c54a199-af77-43bc-a657-a3f2302fb841", "comment": "Malware payload (PureLogsStealer)", "value": "4c9ab2a03d5e357234acbdf67328fe9daa13c8c9805826ffa09d148bed7383873e29fe1f905d40324470dab453f6c9d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943101, "uuid": "5c64ce6b-1308-4bcd-a9a9-ed0b07259f10", "value": "T1CF8512682617D807CA6547B40BF2E1B55A780FDAF402E3176FE82FEB7A35B594C84183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943101, "uuid": "eff49383-344a-4374-b3f3-ec42566d68d8", "value": "49152:8DEwD5omVBH148ptVq/VOfDapFZnrFj+mcfZo9:8DbVBHzXVDadrFj9AZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943101, "uuid": "0f05312a-fcd9-4347-a814-9e02c6a2eb00", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943101, "uuid": "360cd736-731d-4b37-83a9-b2df62a7c556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943101, "uuid": "0fed9068-c79d-417a-96a5-2cdafe1004db", "value": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0437\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670bcb03-ac46-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788955380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955380, "uuid": "d0b77d14-734d-4916-b233-e74b94ef835d", "comment": "Malware payload (AgentTesla)", "value": "a887843992a7c4b3f40b587555892dd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955380, "uuid": "1f622662-9ed1-474b-b409-750dd34823eb", "comment": "Malware payload (AgentTesla)", "value": "46ac3cfdf4352ec9399d4335d7a63f4914bd121356a4245c38edd5bcb7e5a284", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955380, "uuid": "d9739889-14b3-4dce-837c-a67da30c323f", "comment": "Malware payload (AgentTesla)", "value": "2b52f7843785f844cfbbafa2326cfb30ebd27d7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955380, "uuid": "43aa13cf-acf1-4273-9244-3f09114447ee", "comment": "Malware payload (AgentTesla)", "value": "03ee73dd88d79eb225f0a07e2b51b90c671c88b8d243a03a6fcb3e2651675a23b6b91df0f76bf37b4c867135df57e17e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955380, "uuid": "ec81593b-535f-43f3-8d4d-25d7c3723669", "value": "T1D8B64A0CD12A8963D0788D1E840D4AF9AB1B732BD958DE8F7AFC774D1F78A81B24C615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955380, "uuid": "7951bf73-4244-4061-b435-3bfb8344d878", "value": "98304:KGomcixgrGu+Gw8bRxxA7odDGTIhm0SPBAC/adyRcCA7e9PbVGaD7CeyQDhwu8:LoxiqTbR0EdDGTqBQQe9VDeght8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788955380, "uuid": "583bb0d5-0dfb-4c08-887f-7849c9263ea2", "value": 11410721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788955380, "uuid": "d60c5f6a-77b1-4dd5-af4a-f5ed693f2671", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955380, "uuid": "698d5ad5-7927-4bf9-9afc-dada11fb0edc", "value": "MT103 swift.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec2b7ad-ac6a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788970989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970989, "uuid": "e03d1011-e86a-4e89-a322-a52ce04b1356", "comment": "Malware payload (Mirai)", "value": "216d839890d0d10c43fd7b4ca6573768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970989, "uuid": "eb615e7e-2ac8-4995-b748-49dcee226f35", "comment": "Malware payload (Mirai)", "value": "4714c4c2a345cb6eac9d5be5bf7c9c633234a24bd2ba43f88de2526a5d1bc450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970989, "uuid": "907dced4-e8f8-4013-8907-425529dc7788", "comment": "Malware payload (Mirai)", "value": "9078807dee86599a6c047f32ee88abc2f14cfe29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970989, "uuid": "41b92366-c6a1-404a-a7b8-f08110887057", "comment": "Malware payload (Mirai)", "value": "eb98fac74998925be6309378510d9bc538f92a6f6e7f8acd8863b965fa210476bb2dc384a78faef6075bbcfc2d42bfb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970989, "uuid": "8043fb65-ebbe-4aa1-9318-abec651408f8", "value": "T18CB26CE18F3A1F94E26443B4642187385B53E41AB74F0EBE162FA3618453D8DF1967F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970989, "uuid": "f995d821-e5b9-4f5d-a100-e657bce38f72", "value": "384:KG1lMaIPgfe4QFlCgg+Xzf38FmfIfRXomENGNXevVLZhdr75zoZ/ynTqBg7xpO:KG1KaIWe4QbCT+emfI5XV2LDoJuvzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970989, "uuid": "fafb7051-da9a-49b4-aa9e-b9b8a3c38803", "value": 24544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970989, "uuid": "5cdca20b-60ab-4b81-8f02-724c8157737b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970989, "uuid": "628e094b-bb4e-4669-9ea1-2eef08202b43", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40351e9f-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788976789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976789, "uuid": "c91cece3-ebdd-40ac-84ce-af0c891ee5cc", "comment": "Malware payload (Formbook)", "value": "087a7a46298c0c25bd17d090e8b29a23", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976789, "uuid": "1185fe06-e2f9-4039-b687-920a00193100", "comment": "Malware payload (Formbook)", "value": "474cf22523a5ea64396191349c7d044831761b0702a4b84ee9264b45854e252d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976789, "uuid": "0cf2998c-08b0-4248-826f-32dd426ba88f", "comment": "Malware payload (Formbook)", "value": "f824e623580b43c73d75ed763e1a6589d99e0a7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976789, "uuid": "33e4307b-b2c1-42d6-9cb0-300a4c39e65e", "comment": "Malware payload (Formbook)", "value": "5c04d554d97efba210e51dc501ce2f98c9964bb65acd47eefdb707ad2d36e0e50f2f8a0f07f4bc6083626099dcd02a31", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976789, "uuid": "c4f352f6-da65-4878-8df5-24e397a0f0ba", "value": "T121E5C6A3376D660B6F083756946D59D50BADC0151AE3A9C0B4EE0CC89B1FD8F3980E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976789, "uuid": "9e4431df-f6c0-400d-b1be-5a1c132a9d8b", "value": "49152:arudgR82bMoxXUUhiaf/li8mP3P0gL5TTTV/87b/Y+hFwNNe:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976789, "uuid": "3e52417a-1c05-4d77-a442-9ea5ec770f10", "value": 3217110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976789, "uuid": "c73be973-3946-4fa4-b339-15fecee0fc69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976789, "uuid": "cce2e460-7f49-44b0-9d6c-485bc09025db", "value": "202609AL-0365.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea74aaa7-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788950446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950446, "uuid": "025214b1-bfbc-4564-b542-c5fe684d0e35", "comment": "Malware payload (MassLogger)", "value": "ab09e82912401b840a38ce109cab1c37", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950446, "uuid": "87f15527-6a90-4b04-a9f5-b679de9cb5b0", "comment": "Malware payload (MassLogger)", "value": "478887148d541ff6bc624ecdc1f141b7073499c99d998140018b635f70b673b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950446, "uuid": "0dad11e2-70d7-4f35-a325-c3283c5d7ae3", "comment": "Malware payload (MassLogger)", "value": "3c2df3466de95ef82863d641e25515bd7f9812cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950446, "uuid": "1f877855-8507-4057-a9ea-7249a8310f75", "comment": "Malware payload (MassLogger)", "value": "a2474d95c3a8711f77b07dfabfd054ebc903a6eca6618dbc63176fa7a0288b5ea319fcb444868565da21b16f8b4a47c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950446, "uuid": "373987f8-9873-45e8-983c-97ec7b1e4e2e", "value": "T13CB5D8F7618FA64B490C3B15E68CF8351F4FC4296B83F954B4CF1AD60046CAE35A4DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950446, "uuid": "1a3a3a56-58e7-4f6d-ab9a-6ef5bcea7e94", "value": "12288:v73Z8RYViQBk14+hPN+ZGqw8N/g/rz85RYJl1dV414gWyTS/d7XgUINqv10E3FZS:D3ZBZS1XhPN0GL8m/icXI4gWfXgUyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950446, "uuid": "07cb94d3-082b-4cee-acc0-1b49ef54efb7", "value": 2463684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950446, "uuid": "73fe91be-1bd1-4d13-bb04-d21bfd9731e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950446, "uuid": "9b75b8c3-e96e-4946-9fe8-adef845a4f63", "value": "AT-UE382 20260511.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e9fedb-ac5b-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788964431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964431, "uuid": "12a5f02b-3a45-4c39-b602-5d0247910fa0", "comment": "Malware payload", "value": "3b3e85be5e0c92c5c972f881a8fafa13", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964431, "uuid": "be3ffe0f-e817-4b5a-8a16-4cc572c0062a", "comment": "Malware payload", "value": "478c582b194638abe04b0ea024a4a47b303d1e248659a49f05556de3b8d14c13", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964431, "uuid": "4fefccac-46fc-4c90-819a-7b5db683660c", "comment": "Malware payload", "value": "f7070cb8d9fcf3855b45c4fa13a5dfb0f04cf5f6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964431, "uuid": "8d1a9410-9d60-4f03-b610-0e78401b8f33", "comment": "Malware payload", "value": "862ae853882a66c700715a776b226b88cabe937d2655085243bb1e4bf01cae17b02abb1f45e4be82ba88cf0f0aef9c55", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964431, "uuid": "7fae6081-abb5-42ae-a6b3-2dcf470aebba", "value": "T16542BF505E295262D2AB1B3318A0F6FE9E33FADBD722A36D10415E134D13140CECAF5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964431, "uuid": "6cb5c740-d262-41f1-98df-50366e0aebb3", "value": "192:8c81pQhi0ZLmN1i4KVrfZDLAfTnoTT2hOyCsmPiPxZCCPTm+pmctSVtrpaQqZBCx:VcWLS13ueKBwBPiemFVt72vAk9FF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788964431, "uuid": "701c9879-3ab2-412f-9c8f-b2e9ada17cd8", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788964431, "uuid": "edf7d83e-d07d-489f-9d30-3db0e26ca7b4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964431, "uuid": "57475986-8dff-4d74-a497-36f3f7d4fc5d", "value": "478c582b194638abe04b0ea024a4a47b303d1e248659a49f05556de3b8d14c13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419e6d91-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788976792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976792, "uuid": "2c53b490-562d-47c0-8762-02a98374144f", "comment": "Malware payload (VIPKeylogger)", "value": "a057cc312488fc6fad3a82c2a9827a8f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976792, "uuid": "43db7cd9-1901-4682-a1db-3551971e06ce", "comment": "Malware payload (VIPKeylogger)", "value": "47b5d32f42b94aa1be6d8788b68b616a0e8460ca06ff1ad165f19c4f03cf3146", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976792, "uuid": "3e0b9e05-382c-44bd-af2e-f45b64a4b06a", "comment": "Malware payload (VIPKeylogger)", "value": "a00f98e6737e5d4b7317e60de73975f059f1193c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976792, "uuid": "cd0bc83b-b116-4f1a-9835-0e4b884bdd8a", "comment": "Malware payload (VIPKeylogger)", "value": "c7a149a9b23f9b30986dec1240ae56e25a7b5335fe9fe7b0b797f65785d1d51e3cd38a7e16e1e1e994e81f33e03c004b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976792, "uuid": "b3901d03-f516-42fd-b685-fc412156c594", "value": "T10F65422DBA3DB1688CCD3126A12563B1C44A5EBF23775BCB2C10FF91A642C719CA6717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976792, "uuid": "e5a11625-dc7c-4cac-9384-fa1623b013bc", "value": "24576:fJ6RRuYRM/siotExGAYjJNH0au7rrGxFZX87AwtMqW:fJ6RRuYRM/siotExGAYjJNm78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976792, "uuid": "ddacd0cf-b401-4a82-a5a0-6ffd08a90891", "value": 1473519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976792, "uuid": "3d9a4435-2835-4e02-97b0-80a3b6ab6977", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976792, "uuid": "8fb513f6-f2c1-4988-a21d-07fdb14f0913", "value": "SGD098765467800.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854a8fe0-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938251, "uuid": "47f03fb8-873d-4e4d-9bad-90c8a70ae218", "comment": "Malware payload (Mirai)", "value": "47ef708e06bcb3ce80f29b36a862ff60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938251, "uuid": "71f9a98a-b96d-4d16-a682-c5b73070860a", "comment": "Malware payload (Mirai)", "value": "47d2264143af608bede8d54a8f1c2959f81e61cdc0467b4c461c9fb005ff8d20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938251, "uuid": "1c483259-5a5d-46eb-84d7-cdd4b65ff532", "comment": "Malware payload (Mirai)", "value": "856c4a8739cff0ccf614e3bf4ad73bddfca009ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938251, "uuid": "35e2ef0f-492f-44d4-b5ef-8a8cb2de8b11", "comment": "Malware payload (Mirai)", "value": "6c2a17e903b462dc8865edabd544ca64210b8c04e9d1eda74863e118d8b1152a1ddfdb646c3168e0699f7ed75ecefc9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938251, "uuid": "ac940505-6e89-46ea-9be9-292faae7759c", "value": "T176A4CF53F7B0ADC6C48747710C7EE230876AC5570743B291FA6D86242927B6EBDAA730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938251, "uuid": "dcca4755-c748-403e-9be4-7ab2c5a2150a", "value": "12288:KU9CuKHBJQfL5r27pGoViG4X9Vjp7UjnXFtkZrY:GusJQ9ifVmcXfkZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938251, "uuid": "1c09b27b-50df-418d-9fe5-bd13340b52dd", "value": 479256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938251, "uuid": "b32a44f1-4377-4010-b3a4-60c6caa610ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938251, "uuid": "5380e18f-0d28-436a-b1b4-7c570e649448", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dee812-abff-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788924825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924825, "uuid": "e47777db-0e56-474d-9625-52bba4c623b8", "comment": "Malware payload (Mirai)", "value": "ce3f178fc13438b4c45d84bf34b0a3b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924825, "uuid": "08141957-88f0-46d4-9584-1582dc710ec6", "comment": "Malware payload (Mirai)", "value": "481ab3406ddfd6b9cf4c9346b4cb815776fd0d89719344247d0d22c8a20e9e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924825, "uuid": "bed306fc-b0c6-4ccb-9b83-8bf45a2ab74e", "comment": "Malware payload (Mirai)", "value": "bc2153bd86aee7d6c93fbb56bf25f43a9d0a3339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924825, "uuid": "796494f0-f864-45ec-a758-ea56e6c58e5b", "comment": "Malware payload (Mirai)", "value": "5ab650c503325b7cf0d862ddfa2a3704a3d39db720bd767bf241475b4f7cb1989ccee53b92338feda390efe11e6b7531", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924825, "uuid": "6b55565b-0f52-446b-b1c9-3c76f1a6f101", "value": "T1EFA32C80FD458767C3C227B7F78E479D3B355A649BDB331165386EF42B81B982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924825, "uuid": "8359ad2b-031e-42f8-8a2f-8d9b28b3cc04", "value": "3072:U9d1uE0Ylk0t58SU8toJ2eM5RUyZB0BmQwiQmvvhMXWyA:6hU8CpSRUyj4mQwiQmv5MXWyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788924825, "uuid": "aaebacff-af69-4d4b-9c15-f22a2f4df174", "value": 103971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788924825, "uuid": "f8c73c4e-ff58-41b1-80a7-9c7098c3e161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924825, "uuid": "8200828c-fdf3-4a45-a56f-d40c57cd41e7", "value": "481ab3406ddfd6b9cf4c9346b4cb815776fd0d89719344247d0d22c8a20e9e57.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab17b5ff-ac69-11f1-ab4f-4201ac107002", "comment": "Malware payload (WannaCry)", "timestamp": 1788970526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970526, "uuid": "d9cde84b-e1c3-4e52-92b3-c0ed060eaa2f", "comment": "Malware payload (WannaCry)", "value": "e6edd6938bfb2bd127cb5a6b6c4ce4c6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970526, "uuid": "effe8160-8441-4675-bfd6-05b599048764", "comment": "Malware payload (WannaCry)", "value": "481ffa8763870c6a20ac349d00e234250f374f2b398338344374df0f2840a881", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970526, "uuid": "ebb072a8-fe80-4348-b3ff-9d0f38918e66", "comment": "Malware payload (WannaCry)", "value": "f0138cadaef5eac22147618d0a5c6a9329a025bc", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970526, "uuid": "2d33b268-4eb6-4aec-832a-3b8d73bd2d21", "comment": "Malware payload (WannaCry)", "value": "4249be4da685ebccfcc0891500b802921bbdc42e6126dcb9fed0545a823fb763deefcdfc465dfbb02dcc20f1db2da0c3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970526, "uuid": "0b2cd077-57a4-4a1f-a9df-d47c3af906f7", "value": "T1A336F144A5E88E78D7F60A7344A6CA3153713C5D87AB8F3F36E8909A3C62744BE71B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970526, "uuid": "46d492fc-caa1-41e5-8fa0-723989873c88", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970526, "uuid": "619776b0-182d-4291-9013-5bdcd5fedcad", "value": "49152:jnXnAQqMSPbcBVQedAINRx+TSqTdX1HkQo6SAA:DXDqPoBhdAaRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970526, "uuid": "0c442e7f-c2b8-409a-8968-9a958891f526", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970526, "uuid": "7d22f71e-4f54-4748-bcdf-396ffca83c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970526, "uuid": "92a3d66b-1317-4026-8487-b0ff3233519d", "value": "481ffa8763870c6a20ac349d00e234250f374f2b398338344374df0f2840a881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4206b4e-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959831, "uuid": "5697e623-6275-45c8-b181-8cbcd0feae40", "comment": "Malware payload (Vidar)", "value": "388005b291f40278c449ad0a79eb5cb1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959831, "uuid": "95e51e82-bdbe-494e-82f3-d522bf9cddaf", "comment": "Malware payload (Vidar)", "value": "484e8af8a322b4f17a30c91a0c239d1b401484f664b9397f319f3e6bb610804c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959831, "uuid": "f669b5a8-aca2-49d0-8da7-b86f2679a907", "comment": "Malware payload (Vidar)", "value": "dcf7d6857b1787f7d83dd1134f2e5181caac1676", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959831, "uuid": "16d71661-fa62-441b-8509-af05a0846ff7", "comment": "Malware payload (Vidar)", "value": "aa3b2022d25dbb6cd0fbc40941b18cd822bee1cfcb9850edf36a36fc8efcb3a8e4298d2a764d7f5d780c0352d8bb93f2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959831, "uuid": "361f8b54-9ed2-4ac7-bdb5-4342576dd014", "value": "T17EE36C71A2C2A1B2CA4D33742A3E77FD9D709B222B04CDDBDBC4FC186E691D256B1416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959831, "uuid": "90b3482a-f89b-467e-af60-c33feeb37353", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959831, "uuid": "27b1e441-961b-46be-82a2-78949f4ec265", "value": "3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyKzdEpx:A/rLVPW0nsP2Xy+TJfPzW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959831, "uuid": "0881a506-58a5-48e8-afab-3040b6cb870f", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959831, "uuid": "c665f404-4d02-4917-be47-f5f6f6bcdb90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959831, "uuid": "4af902c1-4257-4763-84dd-1586b6c5a16f", "value": "484e8af8a322b4f17a30c91a0c239d1b401484f664b9397f319f3e6bb610804c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f8324d-ac76-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788975883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975883, "uuid": "700af744-33ac-4f38-b239-36f2c0438f8b", "comment": "Malware payload", "value": "fb14d7084027659b27040c487967aa3b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975883, "uuid": "e1e2bbc0-2fd9-4560-85c5-37f2dcf934fa", "comment": "Malware payload", "value": "48963aed895dfa9b36b66487ef61b823432c07db1d6468cc43f64ec287cd660f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975883, "uuid": "7beb1c2c-3cff-4d34-84b2-da9f88dbf206", "comment": "Malware payload", "value": "52cb638fe7ebe29936afd34b9240f9924b06dc2b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975883, "uuid": "b6efcdd5-ee8c-4328-a6aa-336034836fdd", "comment": "Malware payload", "value": "d38ee67834a354a484858eff69126de3b5ecbef6b720393c3bd0629ea50de39be006dce17dc40d9cbc4c3890c34e42d3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975883, "uuid": "6e1665d6-73f7-459f-b463-9b55fea4d72b", "value": "T1AFE423CF03EB609ABB10303272C4238B9F9D14A455E9B51B69C1ED1D34C99ED6E27E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975883, "uuid": "44c13624-888a-42d1-9b9e-d822e16f213a", "value": "12288:2/GSDR686X248CqS3ZYFn8Ar99FVYhDxOXd9EOyLRjHPVd2t+OLUlnIV7WcRxMZ5:2/GpJuVSJmjqh109+N2N6c/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788975883, "uuid": "54dffebe-2009-48d3-8372-3490babddcdd", "value": 700577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788975883, "uuid": "9678b05b-9bd0-4f39-bf80-44e0061d8569", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975883, "uuid": "9d6224f7-7e18-4e41-9cea-dbfabd21acf8", "value": "RFQ_ApogeeEngineering_Specifications.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612f35a4-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963530, "uuid": "884c2021-115c-4bf0-8edc-897cbdd7ee56", "comment": "Malware payload (Mirai)", "value": "e87020abece6f17a4284acac0d56eda4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963530, "uuid": "e1511627-fe41-4e06-b980-921f0db8a191", "comment": "Malware payload (Mirai)", "value": "48d49c97a98916c05b8a0f1dc253ef0b6699215b1f3eb384bc33a576fad0f968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963530, "uuid": "0b1ed95a-a592-4f81-8a7f-ace39f4f8c2d", "comment": "Malware payload (Mirai)", "value": "d8227edf707ed80995a9c48c169325022aed048e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963530, "uuid": "88d0e731-8af3-4975-a837-8ec85811d411", "comment": "Malware payload (Mirai)", "value": "e6f306ecfca68b838550cd8873762a603645780ad19f3344ab5f73a1ea6dd254ab13bfb2ec4ec6f25c2ac0323361699f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963530, "uuid": "cc7b3f5b-5eb0-4ab9-8f76-c6dae392898f", "value": "T1D90429027B0D0B43E1531EF0277B07E183ABAD6629E6E584750ABECD93B1DB16506ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963530, "uuid": "8ad9c9de-5d48-493d-8a1c-515fb3ca5cb0", "value": "3072:/5WPEIMbEl3D26OxGv+mpeeWDe6jDSbrwH4K4uFD:g/AE5Ox9mpeeWDeODSnwHjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963530, "uuid": "f0c6b00c-fcbd-4d95-abea-bd2310fad8d6", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963530, "uuid": "90d6132f-3bb9-41f7-a982-349e1f152ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963530, "uuid": "a6f93c49-6193-404f-9c76-3485469bf22b", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd877f96-ac5d-11f1-ab4f-4201ac107002", "comment": "Malware payload (AMOS)", "timestamp": 1788965457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965457, "uuid": "11198cf7-5eed-463c-9def-f51beb2b995a", "comment": "Malware payload (AMOS)", "value": "c062704203b38a7c4d6e21cd44082d86", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965457, "uuid": "79c5db2a-63f3-4c8d-91cc-4b8bd321a9b0", "comment": "Malware payload (AMOS)", "value": "4903c40fbdb96cf39f35ed592a886a39d230564b26dd80aef3fa6c58bc501551", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965457, "uuid": "88ce3d58-32c4-4e1b-8a53-0be093ff6380", "comment": "Malware payload (AMOS)", "value": "5f71d4d68561a3703a76415c567c4daf783c4c2e", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965457, "uuid": "d4f4f108-9066-404d-accf-b7865903fffb", "comment": "Malware payload (AMOS)", "value": "77f3a78b25c7082c41b3e1d810b47b3252b05f9375f1c0642ad4f32dde53a9399b03bf477ed9931573e5cc9d698b6048", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965457, "uuid": "bc79395d-a42f-41ad-a160-6fe725aa5923", "value": "T1E264F151F73EA544C46CD3B83DCF8F532112B8710EA621B76B20EA9C2A165D2771EF1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965457, "uuid": "a770bc8a-2150-4ee3-b5ec-17d5941fc510", "value": "6144:vGJY87pyLobY1WLtxu47fbbgkQlyLIbYNWLtxui7:vGJY8AQfbbgkxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788965457, "uuid": "527384ab-67f9-4a6f-92b5-0f36063437fa", "value": 330592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788965457, "uuid": "37fe27c0-3777-4095-aadb-0e077f334b68", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965457, "uuid": "ac8ee01e-b40d-4121-8a94-0efc42d5146c", "value": "stage4_buildA.macho", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7601f2-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977298, "uuid": "66e0a2d8-bfe5-4546-8cb2-29eb192bab03", "comment": "Malware payload (RemcosRAT)", "value": "3a4343b85a768e372e547aa3545fc83f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977298, "uuid": "94953ad9-b7b8-4f31-b6a0-2526644b858f", "comment": "Malware payload (RemcosRAT)", "value": "4ace3c417433caf2edc3c3b21b38632f7d262fc5dd65ea737f20a3d6a02c7c5e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977298, "uuid": "e957380f-e855-4c44-9187-634041649433", "comment": "Malware payload (RemcosRAT)", "value": "237b8a394aaaec2960b84b654b56d738c3c6ec2a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977298, "uuid": "f347544b-0211-495f-b0f7-407a03f708db", "comment": "Malware payload (RemcosRAT)", "value": "5bb6d70d0c4c74bed587909b604d901e0bf41d7005fc43507e5bacba93a7e5d811a3ee25d493b010fb2b08e551d505ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977298, "uuid": "2fc9b499-0d99-4eb8-a771-5abab7fd4fa4", "value": "T19DA4BF4F9A0C85A41EA05555EE1BDB076243C3528133DB4AF8AC05C99FEA7DE8DB078F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977298, "uuid": "d7c40c23-4f65-431c-b8b6-74599f186d6f", "value": "768:fYiYpCuz+Bo3ABjMFwfPnZ67tnE6Mx+MR/S6gTitQg:fepTz+Bo3A9EMPnZ0nE60+MRBguD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977298, "uuid": "7c107a2b-0332-4105-a47b-bb2ca6b7b273", "value": 467534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977298, "uuid": "64e5a94f-1bcb-4bed-8a03-408aca430966", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977298, "uuid": "1a74a707-4437-430a-af22-fcbb78dca85e", "value": "Camera VD532326082016.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca6885d-ac7a-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788977562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977562, "uuid": "390f3729-26b7-4885-8f34-c07fc915db37", "comment": "Malware payload (MassLogger)", "value": "5aab6a0c4bd641570f9851ad9e3170b6", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977562, "uuid": "65f8464e-c44e-484e-b3c0-4a446a4d62dd", "comment": "Malware payload (MassLogger)", "value": "4aec2da75423bd7457ae135d3118e308339756fa89cffdd0e78fd85be00a97cf", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977562, "uuid": "52783216-ce43-47ea-a4ff-27e70a8ab06c", "comment": "Malware payload (MassLogger)", "value": "95233ee1ca7354f7f5c12cef2874ea6ef4dc775d", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977562, "uuid": "395464e1-e641-4da0-bf01-421bcb3ea7fa", "comment": "Malware payload (MassLogger)", "value": "946122156bca13e918dd110e671f55a8deed5a32f9724a8c3d0f277e869d03c384b004be59c3a03deaf9651756995984", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977562, "uuid": "8aed279d-b821-4968-80c0-9f07f58355e5", "value": "T1CD4464C0C6D245CC7320BEEBF2AAF86B3254EE59C1B8523E50D3D664624AFE44CCB559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977562, "uuid": "25f77e1b-d6c1-466a-a4dd-a410e06e928c", "value": "3072:yZVmr2P/yb4CISddwwPQxZVmr2P/ybTISddwwP8UbYKd0d1N9DISddwwPGJxv4vL:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977562, "uuid": "16f8d214-4a6c-42d0-ae61-1fd6f8a71712", "value": 278465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977562, "uuid": "b5b3a9bb-ef87-42f2-8138-d391cfedffe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977562, "uuid": "3b2b80c6-49e6-4967-94e7-ee7e8f031869", "value": "Dekont.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49d3d85-ac49-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788956771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956771, "uuid": "de3f22e3-2a7f-4277-b925-36ded4593ace", "comment": "Malware payload", "value": "e559a5a77d6dbb457919ce3f0379fb23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956771, "uuid": "482fafc9-0528-4a64-ba16-0d86990509b8", "comment": "Malware payload", "value": "4b3cbdb20bf94db320a23e0df68ad46086f60cee02b7bacf541a78e9787d807e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956771, "uuid": "bc305d3d-c099-42f6-949d-ee9f03e0a5d8", "comment": "Malware payload", "value": "86544a949ad39ff2f301866f7ce64644053e1938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956771, "uuid": "e1ce3832-49e1-40cc-a5c4-0959e00e47b5", "comment": "Malware payload", "value": "8e3ea7afc84b86c494d5c6e01800ed9e8294dce4ab34d030eebebbb57ec3a2ce9dce2ac586629026c761d86785382aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956771, "uuid": "0d2917ed-9e73-472e-bdd0-db6421421ea8", "value": "T1BD48F01663E111AAD577D138C7AB6603EB72B40713308BDB329C43652F73AE45E7AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956771, "uuid": "f7aa2f4d-2a8a-40a3-aa3e-29553bd1ac9e", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956771, "uuid": "7a2f7bd8-24c2-40c0-9553-681a792945e9", "value": "1572864:1Pp36F/iKRzlo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZ+:1PpIllheuXpX/z/5NivOcC7hlTrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788956771, "uuid": "d6b523c7-1dbb-4db9-bdcc-a71dea673799", "value": 116962727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788956771, "uuid": "b7ab9742-48bf-4bfb-9281-ccd6bccd437d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956771, "uuid": "7f8188f8-ab1b-48ea-9d8a-ead1fcc82104", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9343b8f7-ac5c-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788964903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964903, "uuid": "47a24a6c-a60f-4343-b4fd-a913a827e4e5", "comment": "Malware payload (Gafgyt)", "value": "631d2e877bd04555ffe85afc7ab8dc61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964903, "uuid": "47459100-3b6e-48be-8496-fd3107621241", "comment": "Malware payload (Gafgyt)", "value": "4bc118f6f176190859b82dbb718b3e4df3658ee3af44b36663e5977b38eb4302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964903, "uuid": "93a11e27-6933-4173-b4f0-4754cdac78fb", "comment": "Malware payload (Gafgyt)", "value": "2f05c28b3a9118a3e4189a2c0af9bc03c42f5a28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964903, "uuid": "aa690541-22be-4be8-b086-b7abe5040ab2", "comment": "Malware payload (Gafgyt)", "value": "c5e02eae3e3893c5fe7ef76af233d2e0bf7414c18e707dd83d762fc1698135b937c67c0bf0c22d29d1e994b77519c446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964903, "uuid": "4606a64f-fc8f-478a-8ff8-b63c10c49267", "value": "T10654863E7922AB7FF168837107F79E719B9521D32391D385E26CC7181E7124E284EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964903, "uuid": "4a2f9de7-8c90-4924-9441-9817d03773e6", "value": "6144:4mbAQYb3y8fQ5hQpKqmUoUGsBYNXbkJqh9Zn:ZMQeQ5hQYqmUoUGsBYNXbkJqh9Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788964903, "uuid": "1b0d238c-be78-4593-b2eb-e117672d73b9", "value": 304755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788964903, "uuid": "91093ab3-d66e-4d02-8555-9c14a762233e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964903, "uuid": "0f7c987c-7f65-4c28-acdd-0cebc9d99f4a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef21911b-ac05-11f1-ab4f-4201ac107002", "comment": "Malware payload (CoinMiner)", "timestamp": 1788927691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788927691, "uuid": "5c307782-d7e7-4214-91b0-7442e4142cb1", "comment": "Malware payload (CoinMiner)", "value": "ce2965e0dde84edcae60ed7dded6d9ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788927691, "uuid": "7dcba05f-6f22-4397-ab0d-4426cb6d0172", "comment": "Malware payload (CoinMiner)", "value": "4c4543b1963b22fb4bdd039558c6f8ea913ada5c61f1b36637318804dec9f322", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788927691, "uuid": "8055ba3d-d851-4373-97d6-c2d10860c85b", "comment": "Malware payload (CoinMiner)", "value": "34c828f172d67548569b2b00e5fa69dfe6c158c3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788927691, "uuid": "ad468fa6-f6e9-4fd3-9ab6-95eddd5e3bca", "comment": "Malware payload (CoinMiner)", "value": "840b60ce070e051e78f5d54978ed807cc00917135bfb3c14cdce6daf8bbf2f7a15a840ce914d50fea2c4d79ec704ae54", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788927691, "uuid": "b1e34e64-8979-4c9b-a935-5eb9f7477e0d", "value": "T12226AE17B6A254FDC0E6C830838BD573AD35B8555221397B7684AB302E76F305F2EBA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788927691, "uuid": "4b3094e5-1ec8-4289-aaab-3aa92b7f0bcb", "value": "98304:sgzgxMM+jACCVQJAQUb01vL9TWo16X22j8rRPR:jFZcZQJdPhTZ1trRPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788927691, "uuid": "fc954328-70e1-40ca-b269-a1b5fe4f9399", "value": 4506400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788927691, "uuid": "16c70dce-fe26-448a-b952-03ccab9b95d4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788927691, "uuid": "bd7bf223-d09b-4c95-bc99-7190c19dd14c", "value": ".X0-lock_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd20da49-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943122, "uuid": "4dd0160e-6935-4285-8b14-12a41fd5dbce", "comment": "Malware payload (Mirai)", "value": "1ca82229423241f4373f62803f7a89d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943122, "uuid": "9b2ae165-cec7-485c-9484-dbd53f62c768", "comment": "Malware payload (Mirai)", "value": "4c50e1ec129f04399455f16c965e4701d4d56c7f2d4cbeeae4f7f1392953caba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943122, "uuid": "346738d4-eb26-4451-8fd9-094de1f57801", "comment": "Malware payload (Mirai)", "value": "d0ec409ed179631de9a90f4517fb93b05bc14162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943122, "uuid": "711abc58-9351-4dd1-bca4-8adaa42e5e1d", "comment": "Malware payload (Mirai)", "value": "1c5a58682a7d0c1e8b8eab147700af6691c656dbdec8295dcaa1e400ac35a36e6782676b6b8227c922419a812508e2b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943122, "uuid": "a00813c1-8342-4a10-b033-5fa62696c44e", "value": "T16FE2F267D372E052DE786EF2F96D85CA67BD4B6CC17B30A3161516282D9B0435E3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943122, "uuid": "aa3b995a-f21d-4109-ae4e-9c1ccffbe2b5", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9XLb6B69q3UEL5If:uorm1vpALgUJ6dLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943122, "uuid": "a231d45c-1d33-4992-8749-cf871be001fc", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943122, "uuid": "c429cad3-6105-4429-9b1d-42f3a1157482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943122, "uuid": "8b1f46de-fa6c-4976-af42-ffaf86f96033", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc7b4c4-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946804, "uuid": "8ab3694a-73aa-4fb8-91a2-d0bb87466c05", "comment": "Malware payload (Mirai)", "value": "a124a363d5717b4a2c8fab0357e3d84d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946804, "uuid": "bab329e1-a04a-45e5-9be7-c059aac18823", "comment": "Malware payload (Mirai)", "value": "4d07792f8145ae375395d14f59fd0cb3541803b3d4c8be21b04acd0dc7a5a286", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946804, "uuid": "98c4db28-5e30-49c5-9e3d-a3fabc268b98", "comment": "Malware payload (Mirai)", "value": "70badf57fbbf9a962f67e22ca7337b382d271501", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946804, "uuid": "18752762-5e08-43bb-ac68-6ebf59dc2115", "comment": "Malware payload (Mirai)", "value": "93bc62c238d3b9a5379434a8d469ed39d256cdd346efe7afcb89045f417d39ee69c9c4710d92264ef7e81ba8e25d8734", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946804, "uuid": "2d8f3b6f-fea0-4d0c-85a7-c0f7b6e10f90", "value": "T15EC3F185FB636991D0A342FDA4C00AC387912E318BE217480699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946804, "uuid": "a96c9d46-ff5f-4bc8-bb32-5ff3258daec2", "value": "3072:QBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnn:sMQRtXU9kLCP8ifbxTnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946804, "uuid": "8a427dbb-7419-49c3-a6b0-43298c9bfacc", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946804, "uuid": "2bb64701-8f1b-441f-b7c1-323a0e47c136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946804, "uuid": "a87d09c8-f1dd-4e15-aea7-a3ad7a38e12d", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7435b59d-ac02-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788926196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926196, "uuid": "72df8f35-a718-4398-b5a2-2ec77390e1f2", "comment": "Malware payload (Formbook)", "value": "c8938b53f514780745b5729268815e93", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926196, "uuid": "a4155d06-3c6a-464a-aac2-1864219a2f9e", "comment": "Malware payload (Formbook)", "value": "4dafdbb610afca675acd37d4df766ebf84ab0b903ce270696218a9a9b56f2c13", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926196, "uuid": "dcdd0cbf-4e91-4187-a38f-c18bb28fa9f3", "comment": "Malware payload (Formbook)", "value": "7822e4d8e508fd8244b8985b628f580c8626cc2d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926196, "uuid": "8e6ac56d-e5bb-49e4-83d8-cdb279393b30", "comment": "Malware payload (Formbook)", "value": "bd174de443551b370f696e48c4a2345001bc291b96f34b5f6343c772124ca7966a514b8f55c3a5a3081a060392448086", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926196, "uuid": "9ee60d5b-b565-4486-ad86-57b385ee24d3", "value": "T1EDE50BF2738B4B062B15F377AA4E0C580F46E082D6879ED070DE4AD4175B94D3EE49AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926196, "uuid": "7857a219-fbe9-45ad-a6c0-7169d96046d4", "value": "24576:nIkJYApwCazH9XwmxMGlWqC5s02Tfr0obO0kqHku:IsYApXazNPxz/Clv0LHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788926196, "uuid": "5feb11aa-14b0-4292-a2a5-71d59adb416d", "value": 3206682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788926196, "uuid": "b8cf4c29-2134-44e4-9901-c0eea58e790f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926196, "uuid": "c0f625e7-93e9-4723-a697-858696e3bf22", "value": "EP-342152026_ORDER_QOUTATION_FORMS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd95a7a-ac5d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788965488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965488, "uuid": "458d6fab-d86b-46b6-b941-e2a43ba25ab7", "comment": "Malware payload (Mirai)", "value": "1bfc3da7a99e9e0116af534302dc4265", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965488, "uuid": "3fe2d9fb-e42f-46ac-b10e-705418a20fe0", "comment": "Malware payload (Mirai)", "value": "4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965488, "uuid": "46ab9ff3-e7a7-4753-9afc-f535fd89faf8", "comment": "Malware payload (Mirai)", "value": "7b1ad2d368fc458416a0db185160332877a880c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965488, "uuid": "0c5b4dff-7dbd-4da2-9011-3897e5c924f3", "comment": "Malware payload (Mirai)", "value": "427622c53f2aaaecf1af347ac7f418ea0756b606c065cc76a6243b031382c4d7b3223adc70e01fa557f23bcc0569757f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965488, "uuid": "5a86b82b-9129-4141-ba58-10be636c4b5c", "value": "T1C02162CD3068B137C194EB10B1A0CF48D105A7DEF6C9995DD94FA656E5496D0BC27730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965488, "uuid": "9859f433-f1c0-4569-b5d9-49cce63b2328", "value": "12:xLfIVT5VFGafIVlVFYfIVT5VFAVlvq/jVGlf6LCafUhUf6LjfUeslfTMflfT+fWg:9YLpYHMt6lUa6/U3tT4tTqWtMnpMZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788965488, "uuid": "629b6e9f-b133-4fad-99eb-077effa8577c", "value": 1195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788965488, "uuid": "4025f195-27d9-4c86-9098-4e1d112aefda", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965488, "uuid": "df0d8851-1a7a-41e0-bcc2-e49c6e6eae3b", "value": "4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1645b9-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977504, "uuid": "d5ac74ec-3034-4ebd-8f79-87611409a984", "comment": "Malware payload (RemcosRAT)", "value": "e90bf96fa87b826aa07c82708ab25338", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977504, "uuid": "8b0ab9fc-80b7-4d79-8280-77ee0e134ef5", "comment": "Malware payload (RemcosRAT)", "value": "4e0b6d046fee5e9a00860aa8575c5de748cc8830c96d8978318377f53bb72004", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977504, "uuid": "678ab3da-bc54-4173-8936-8fee81ac6bc4", "comment": "Malware payload (RemcosRAT)", "value": "1938a723f6e08e310a046379c273e0d8f3d80a2a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977504, "uuid": "4ceedf26-ecc1-4fea-90a9-c8d73617fbee", "comment": "Malware payload (RemcosRAT)", "value": "a996bc29c5d049e9f11cffa0a9939409439dd1ba29997e47777dd7abd743a47a1487c42748cafa6c74b66f14d394c992", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977504, "uuid": "da2302fd-25b9-4781-87ed-e13c16a5382e", "value": "T1CEB24AF0DA2A57958CCE1E92DED05D0594BC48641F630078BFF91F0EA6C489E63BE64E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977504, "uuid": "ae738179-21ef-482a-83e8-9aaca2b39afe", "value": "384:FLamJqSZRfM+RMP7CImoLZdUN+MnM0xckbquK36RpJj9Vb0fPuDTXtvLwb6q:FmmJqKRITmcWnTcIuKdj9VbUWDT9vLwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977504, "uuid": "2bf69c1a-f729-434a-ac1d-11957c6f57c8", "value": 23390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977504, "uuid": "c865981c-bc47-4218-9bae-8d7f713d4295", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977504, "uuid": "675689c5-9b7e-422b-a3be-e6653343aae0", "value": "Pendaftaran Lembur September 2026.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd3ed66-ac45-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemusStealer)", "timestamp": 1788955014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955014, "uuid": "a7c44cf1-5ea2-4817-9e67-4710160e6f49", "comment": "Malware payload (RemusStealer)", "value": "26656db0e80ac987410750f3a81b31cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955014, "uuid": "1529befb-ac21-42ef-91c3-c636b9ad10c5", "comment": "Malware payload (RemusStealer)", "value": "4eaedddd70557d9f54867d6552b78b395f65449c0e7a6d66c6822a88825d6d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955014, "uuid": "b8638b25-1f29-4c5a-ab6d-0e52d0537f64", "comment": "Malware payload (RemusStealer)", "value": "5f07e641ce0f8f944a9d9cdbf87dea91a8cbb335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955014, "uuid": "d66bffd3-270e-4223-98ed-6db1cac811b0", "comment": "Malware payload (RemusStealer)", "value": "d2a0fc9611a81675bad6a12bd12a0a85ee300caac9dbc6db35ddb1ec1b195efa16e3b0b524246a8ffd8afb44cc6dd4a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955014, "uuid": "ca7ff237-8a7b-46db-b84e-9cc3f15be9c2", "value": "T1742639037B9540E4D55AD638C97A62A3EA20FC8C9B3123D72F40B6702F657D1ACB6F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955014, "uuid": "d8be9239-fbeb-41c6-a078-dacb9efba823", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955014, "uuid": "bf0c8e28-99f3-436e-a963-185ad93f08e7", "value": "98304:9osGaN0GrY8BQOdGF7AH9I8SiSBpCBbdeWBbaLFUtf95KtbDkbSd9NnybwF9P70n:9wh/8Rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788955014, "uuid": "8ae6abc5-6c8b-4af3-be56-9f34d3aabc47", "value": 4852592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788955014, "uuid": "33d196b7-23c0-4e26-bdca-8e55e13f7370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955014, "uuid": "c96459c9-18f9-40d9-b756-dbee668757df", "value": "installer1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a552b8-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788977146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977146, "uuid": "bb58f124-bd75-4dcc-9c1c-bb0968541743", "comment": "Malware payload", "value": "07fb7877def87538715fddad8139118d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977146, "uuid": "4670b4bd-62aa-4d81-9947-b14699d8084f", "comment": "Malware payload", "value": "4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977146, "uuid": "2b45cc63-f04f-4c1e-931e-b613d485df64", "comment": "Malware payload", "value": "52f2fe34586bfa6a782fd871006cc88f52988c1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977146, "uuid": "9dbc3746-c47c-4d4a-9fa8-29c57c7e11ef", "comment": "Malware payload", "value": "20cd868c9309c6ba9b411c1dcd3ba187d89ace01d33e833c7ce1cb126d11febbb94a350206d17647588c6ea06c3852bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977146, "uuid": "91b8a697-1e02-4a24-834f-3716cfb71bb9", "value": "T153C6E89A230E8470A53E571CD0BA6561C6D93103559ABB1E33FC3308BBB7A2B674CDD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977146, "uuid": "85b5ff39-7936-4895-b9dc-5f5cf378ef1c", "value": "98304:KtlvKF85DrPTvU1s5Nv6mggPnGw8kSt6DA5l8M9tCN3WIhASObpNMGgVf9rllgRr:WZnW5KU43orjMGgVpgRGyf7RsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977146, "uuid": "067ed16c-3786-4bf6-8f6b-22f42be3d6ef", "value": 12596817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977146, "uuid": "33035a26-ea04-4d2e-b383-89ed532810e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977146, "uuid": "cc25f330-bf35-4b45-8774-ea05bb42c942", "value": "10124658.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0171985d-ac4b-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788957357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957357, "uuid": "0002185f-6072-4bba-9911-98d3761e5090", "comment": "Malware payload", "value": "c4e53f5149b220114a6c938c5c5034b0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957357, "uuid": "cad03dcb-153d-458d-892b-24484820863f", "comment": "Malware payload", "value": "4f4d546cc22645dac9153aad251f9a06577860edab84b3d29cc334f075ee3dc6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957357, "uuid": "045e888e-9fa5-4dbd-a6e8-7a5388519e52", "comment": "Malware payload", "value": "741918bbfdba2519c8ee056c5f417b606a60546b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788957357, "uuid": "11375bfd-e409-4aa6-893f-b3a9465bbcc3", "comment": "Malware payload", "value": "b13f67ac44480d1d537e74822614718e4343e478a47baa4833e0a75f558e65360d51bb220fa34025aba911027b6d3134", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788957357, "uuid": "75407677-613f-4581-900e-b82701ae2b2d", "value": "T10C37EF7DCEE8413EC2B7C929D9CA4A17F85A092B230CFD4A68D773A755271827CE211D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788957357, "uuid": "b842628b-09a2-41fe-94cb-8338e9f8b23c", "value": "3072:jPGjMnzBbDVmBYNi9lNB3jm9kmpm94SwQSYlwEugwGi+mC211J9m9Pm9+mJaaRS5:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788957357, "uuid": "ff17a52a-e2c9-4f4a-9ff9-3cbf3fcfb026", "value": 24071004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788957357, "uuid": "c8b6535b-ce34-45d2-9b26-29a9f17b8c63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788957357, "uuid": "143549c7-0cd3-4506-b7a7-f76038bd46a4", "value": "mazkc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf997f59-ac22-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788940066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940066, "uuid": "a1191708-5767-4296-84dc-67b96e888637", "comment": "Malware payload (JOMANGY)", "value": "74a6b647e316b2201e15aae6d15359fe", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940066, "uuid": "d62e1f15-5de2-4a5b-b476-0241cbeab508", "comment": "Malware payload (JOMANGY)", "value": "4fc8e91e1f10de64ba2e7567d9c074bff265ee8b0ef1a0bb12e1241b8c9a87cf", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940066, "uuid": "cfb20992-22b6-46ed-a189-5bac47fe6c6c", "comment": "Malware payload (JOMANGY)", "value": "1b301d98fc7d68508c212e5d62a27effffd70d4b", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940066, "uuid": "12e5039e-a08d-4625-84a8-c088579c0fad", "comment": "Malware payload (JOMANGY)", "value": "174f087620f3b97c1d1b2c1ef7577c467dceeb1f1deb4fe4d0d26cf7b31a3025c1c115a9a8795cad66ba9dfc5ed6626c", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940066, "uuid": "2ba457a6-7ee2-4cc7-8b92-936ae66a4299", "value": "T1E9C28D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940066, "uuid": "1075bc4a-1d83-48fc-887e-21585077be11", "value": "768:18vCB+25j6es8RV9FYpMSUpi+20qUpi+20YQX:18l25Jzd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788940066, "uuid": "81f957d5-3ae5-46ca-aaef-b2aeff2d0c8b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788940066, "uuid": "4008f180-3dec-4e03-bbe5-bef4e58a9571", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940066, "uuid": "db38fd79-aac9-4adf-8594-837f3bf4be31", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec9744-ac72-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788974341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974341, "uuid": "704c8980-2617-499f-b187-350b6c0682cb", "comment": "Malware payload (Gafgyt)", "value": "62a1b93149716a895583df834083dfe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974341, "uuid": "624a1c40-d728-4e5c-9990-895baf6dd565", "comment": "Malware payload (Gafgyt)", "value": "502a05d1c59b4a44a1b32fa98a1c42ac747419241aba959959c8f6a87fcb1465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974341, "uuid": "1cb7562e-d703-4e5e-a509-ce4e133d8a27", "comment": "Malware payload (Gafgyt)", "value": "361f975bc3f9811eb5d77a2ebdb2b9336d17ca36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974341, "uuid": "d0f945aa-ed61-4fbb-86ce-161dd50ce33b", "comment": "Malware payload (Gafgyt)", "value": "c235cb3fd51e28ee377fadde386895bfc606fc0bddb509bac46e2e15dac1d6cd0f4edee7405aca9d9ca94ed9a8a16ff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974341, "uuid": "b9664c16-b714-454a-922c-ed340af542b9", "value": "T157341901F8044B67C2D327F6A79E879E3F3257A653DB33029A38ADB02FC679D1929550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974341, "uuid": "7732614d-5443-4813-966f-b7eb413e6ecc", "value": "6144:rZxwd46EItp5/nY5hMwXLEWpmYzGmwFZ2agxWXlyWBy:rzO4op65hMyLmYzGmwF0agxWXlyWBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974341, "uuid": "6e3cd892-51a4-449b-a0f4-d6004bbd0d32", "value": 242328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974341, "uuid": "b2044fba-f30f-4470-9261-839e68a6dd4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974341, "uuid": "4eb68f34-bece-42ec-8ce9-8467d87fb7d1", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e052616d-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938403, "uuid": "b6bb7362-6171-42d1-be29-7ac1d0adbaf6", "comment": "Malware payload (Mirai)", "value": "5b9cad39a3cb8718351a4c47e8fe33cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938403, "uuid": "fe80c6ff-004b-49a5-b430-287fed64ab79", "comment": "Malware payload (Mirai)", "value": "50f3f828222f260f48f5dd119d1f561ab18f34b117f97e0100a15128f6799c32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938403, "uuid": "5ecf1879-c8ff-4576-aafb-4a4769adb58c", "comment": "Malware payload (Mirai)", "value": "2d75e838b07aae4e7b4fad9ab3d7aea9538f7683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938403, "uuid": "a94eccc5-4e1f-4b1e-bdce-045ea9cc55b1", "comment": "Malware payload (Mirai)", "value": "e68099aa171e5d87124e7e870423267a872cc6d787cd01c918d5132a3f6c6d7c2e24a4ddc2ce3331d568c831b1389faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938403, "uuid": "7e2e9439-f223-4e4b-8613-6d33212e1f89", "value": "T1EE734B02730D4A43C167ADF02AFB57F087B6F96119A2A244F52DBFC85236BF01956F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938403, "uuid": "9d4c0810-4af9-4d95-9b70-9835392797da", "value": "1536:ZhAOg77+0dWVNVaX6ylKvSfQfgt5sixyWV0vLR9oHFXfAEin:Z2Og7NdybyovGTx1V0vLR9olvAEin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938403, "uuid": "ec470df4-5903-4452-a581-7b506a3e0558", "value": 79298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938403, "uuid": "04f3669c-7bd7-47b1-9d54-a702cd8bc4f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938403, "uuid": "36b6c2b4-9a63-48b7-a355-c40859312109", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2714df3-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788933172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933172, "uuid": "38a3e169-da42-4955-b2e2-49bd09e77e88", "comment": "Malware payload (AgentTesla)", "value": "e91b6f447959cc3b628c4128e2310fc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933172, "uuid": "8e1cced3-b875-497a-a272-2719f1566a75", "comment": "Malware payload (AgentTesla)", "value": "5173d3ead814be118f3bf395afa2e5e9d975493678cb85e47eea1104a2231277", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933172, "uuid": "4fda83bd-fd49-4299-b3dd-52451646b8c5", "comment": "Malware payload (AgentTesla)", "value": "41874904d55a97d10de1c6f3c1c9318e30a2d6ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933172, "uuid": "78b1e92e-86e6-480d-9e82-a4256ef27c8a", "comment": "Malware payload (AgentTesla)", "value": "12334bac0cd707ce30e953b79f63202452ae1da3de95eea6e97d74bce3acdf0cb8ddc1c079edf5f34be620cb69712062", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933172, "uuid": "41f02dac-3e31-4d34-9fc4-0560abf26bd7", "value": "T1FEC6D51A4208A5F4B6FE573DDCA65971464C294B1188BF1E71BD2348BFB278F2B4C4A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933172, "uuid": "fddc5e49-0510-4f00-984c-ab7d582076fd", "value": "98304:OqLH+WlYXTm9kjWvPDdjfV75z5L/h0sPi7GRA1Ljcxe+DuIF7+:vCinDFf15z5L50AzRmLjcxPDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933172, "uuid": "7927deab-efa9-4df5-baa8-19f957745f1b", "value": 11495457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933172, "uuid": "48216d4f-9b04-44ff-87b8-1268c261fc74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933172, "uuid": "dd2d6833-06d6-47a0-a1b6-650d68c9224d", "value": "Shipping Documents.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc207ebc-ac16-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788934933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934933, "uuid": "2d564b7c-55c7-4971-8b58-978cc1abd9a7", "comment": "Malware payload", "value": "cdee1105f91edb10edf5e39aa12c3994", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934933, "uuid": "dcc64a8a-d39c-4569-a388-90fba9e67e08", "comment": "Malware payload", "value": "5194302cf12402a2bd9dc18cff51b19a5092ecbbd1b15d95aa56da357c2b9e94", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934933, "uuid": "d8c2b036-df22-4684-9158-4369d592442a", "comment": "Malware payload", "value": "1605aa1d4607a429b41b3e7c79007610480cf189", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934933, "uuid": "d0397f63-bbd6-4424-9995-7f863c264717", "comment": "Malware payload", "value": "3749b15c86e421d26928fe3a8740d3fa4ed53d41505c6d54a868559fbc4ecf35749d9376b9bcba5b14f805d8de31e316", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934933, "uuid": "cf83f37c-4c90-4069-9730-fc1c210c80ca", "value": "T1EE764B87FC6515E4C0AED33189A29653BB717C885B2123D32B50FA283F76BD0ADB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934933, "uuid": "331e3dd0-85f2-4eb2-919e-29e6af5d9edd", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934933, "uuid": "231132be-a3f8-4af3-9065-f091f73a3e31", "value": "49152:hK4vmw70k8LFKb/Rpo1Auls9cnRPVfvyRM1ImdQdrHqwcBS+VPQGIABkCOfS4Sx5:hKA5GeL5IPuRc9QGIKMknbEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788934933, "uuid": "fd7f2e3e-806e-4023-8049-d513585d16c5", "value": 7463424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788934933, "uuid": "1b5d2cf4-9f48-4530-8d05-01b6f72bf514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934933, "uuid": "b4e5f22a-30a7-45ba-9d55-ddbab891cd5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1739ffca-ac93-11f1-ab4f-4201ac107002", "comment": "Malware payload (SalatStealer)", "timestamp": 1788988317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988317, "uuid": "e0843b11-1b9f-4872-88ce-2c08a3e284eb", "comment": "Malware payload (SalatStealer)", "value": "c8b0067b28f8fa7e774b85e230b15991", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988317, "uuid": "a9e0e973-8857-49f8-b3f5-16903336d40c", "comment": "Malware payload (SalatStealer)", "value": "51da755fef7869159723b7022476e129db585ccc643e25cc96de070838b9f66b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988317, "uuid": "37c6e00a-c145-4632-a0f5-ccf1ecb9af43", "comment": "Malware payload (SalatStealer)", "value": "da3b30b8ca6eae9fcac8959f626d526e13a494e5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788988317, "uuid": "2980dd88-5484-435b-8b11-8dd565ef1d3b", "comment": "Malware payload (SalatStealer)", "value": "67d9aff3f557f684e3dbe67a66e03396205eb106fcfd888c11680e2776be4b521598719934ab05fcb6654b75fe60b6de", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988317, "uuid": "093a0340-3d80-4fc9-9a10-ef421fb4b166", "value": "T14416232BB39754FDC527C17586DA63B7A832F4201335EA6F0BA4CB726E50CA05B1DE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988317, "uuid": "ec2c3a1a-e526-4725-9c90-a2c21f931c41", "value": "7b3caf526ef8e64cce0bdfecef874fd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988317, "uuid": "10ad0e64-d50e-4098-95d0-24ff2b510bf9", "value": "98304:NYWdb/jKjlfb441C0JL2E/jVyuqbKN69BisxRYS9rmq3uzxy5yh:NYWdb/eb4SvKE/xyuqb0IBiYRYSsq3uD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788988317, "uuid": "e5848388-feed-4b18-bb0e-f24b12f4b8c3", "value": 4107264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788988317, "uuid": "d98ecabe-3a6a-42df-bb80-0481a861fde1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788988317, "uuid": "6193362d-a3ff-407d-a470-7e99af601d6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26701cbb-ac76-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788975887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975887, "uuid": "78680a84-7f05-402d-816a-7fa80c2d9852", "comment": "Malware payload", "value": "1e10e41882f9501c214e15be27723852", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975887, "uuid": "7746c879-4684-4241-ac9d-b4b0f566e896", "comment": "Malware payload", "value": "51f014c978c801fc35c77f026b03f110f1922c1ad3b2a5c9672ce81d8ae5ce28", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975887, "uuid": "7a9b340a-baa6-4af5-977f-44c112b1d271", "comment": "Malware payload", "value": "0f7e3494f7596bb8c26ea6002b3972d899443a7d", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975887, "uuid": "7925a43b-2688-44c3-8c41-f78a4c1d575f", "comment": "Malware payload", "value": "2c99a2ae757409b75519d144b3035dec8503e2677fede0c78b79d33dedfbc1c28355566c935e44c7b3936df7d63e292c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975887, "uuid": "2ea532fb-c01a-478a-95a2-5ae1616b39a0", "value": "T168C4235ADEA5694CC35B417CF711D9EB3D058E6541C0E7AE3005BA1C32E8AEB8BCA19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975887, "uuid": "a0fff56b-c9bb-4cc4-8d21-955e8649bb9f", "value": "12288:yywd3zfWX/p6MgVj6YCyJ4bbEqa4iSHapck7I4iOjG2HdjrMNND:yywZbWRkXH4U3Y6NU4pjG2HdjYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788975887, "uuid": "7085f774-205a-46e4-8a91-5b01a6371933", "value": 592563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788975887, "uuid": "b465cadd-cf52-4fa0-9c1e-7edb5b856996", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975887, "uuid": "e5dd5251-8154-4a27-ab2c-9e1cf96be885", "value": "Copy of P10_Return_Simplified.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0194e53-ac44-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788954724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954724, "uuid": "87a40a61-d10e-4b13-867e-496ef059af9c", "comment": "Malware payload", "value": "7dd5375558481f5fe5533a54f4444a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954724, "uuid": "a88f6196-23fc-4412-a9db-fd04889a42ab", "comment": "Malware payload", "value": "535736a33876d863533cae882bfda72ac29d6f24015ffca9a9c2faf5a16dcc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954724, "uuid": "754de5cf-c93b-46b4-a784-ca8ad6e0398e", "comment": "Malware payload", "value": "ca0796457ecefc0aa9f78023955d70fb15828d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954724, "uuid": "853ac524-3813-46dc-ad13-3520067e3bfa", "comment": "Malware payload", "value": "4bc51f0daef513e6d3e8eeb9825a72011c38080a13b6557bc38e7c24f0571deaa362b0d9df13186a05d3979efc63470b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954724, "uuid": "800d88ea-c0a4-4ab4-a131-bb62832e3f0b", "value": "T1101733A66C662C83CE61757B23030325AF314DB17B168B092E35F86D2DFE1E96B19347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954724, "uuid": "8564658b-9899-43a9-a618-f0b87ca921bd", "value": "393216:FZeO9tJPax+ZGflWrHzvA8ohjVm+Vn38MyDAX+mUAGv:H5dPHUyz45F7m7O+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788954724, "uuid": "e2061dad-5c9c-495d-a432-1c4c6d53acb9", "value": 19836928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788954724, "uuid": "0f3d56d0-3d36-4d59-a74c-5d2c5d8b20ae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954724, "uuid": "b90b96de-4270-45c2-8365-871e5c913e01", "value": "Loader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c426f4ab-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "a5e47b6f-c2ce-4627-b93a-e8446a907ac2", "comment": "Malware payload (Mirai)", "value": "3d6a47340a19ca993c7c9711daf9e13b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "33f948d6-16ea-41f2-ab51-fa61fbbdab6e", "comment": "Malware payload (Mirai)", "value": "538dca6263662f71a70ee9a2663e3f782ef75d6394b66aacd20cefd7df9b1253", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "f4509984-ce19-4ffe-9988-5f469265ce0f", "comment": "Malware payload (Mirai)", "value": "db42937476220893d008e6be8a3b7c2b48a8f5c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966273, "uuid": "c4be3e1c-4e81-43de-ae64-0eb91c06258b", "comment": "Malware payload (Mirai)", "value": "232f1eda343c4f42dfb26c1cf717054d533d4ef0e4396a938df2e4094b82698cd8b8f118e1970e2882cbf368d9173e5b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966273, "uuid": "666c80d8-9702-465c-9e41-d1492c6f07b6", "value": "T152519DD832564A30BFF19DDEB5F588247080E191EAC5AF15D9EC66FC864CF0827D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966273, "uuid": "184325e8-1794-4826-826b-436e14c4425b", "value": "48:vXS4SaSgSuSg7zES7SqSdSsS0SEuUfS7Sol:vXS4SaSgSuSkES7SqSdSsS0SEuUfS7Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966273, "uuid": "3f6209e5-5ec4-47fc-ace3-db1f9a4dc811", "value": 2849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966273, "uuid": "6af5f7f0-65f3-46b7-a1cb-615438af106d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966273, "uuid": "e4b06ec5-9a39-47ea-a649-6f25967bc83a", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3269e2d8-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "c75622bf-0891-4e95-a605-a9cfb785dfca", "comment": "Malware payload (Mirai)", "value": "d8d813b2a83b73071a8b5297813eef4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "b093899c-b138-4d4a-8bf4-3ea8a032e0b0", "comment": "Malware payload (Mirai)", "value": "53eae9792b8e31b1e81e2c7311ca06db055890ea0b941c906773b73d58ba1d69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "c0539eca-20da-45b4-a568-08927ffc723c", "comment": "Malware payload (Mirai)", "value": "d8ff2c70c891be99a3ecacd71b756f586ecc9c75", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "c27e35c4-9db7-4534-a8cd-669b02a5f03e", "comment": "Malware payload (Mirai)", "value": "034da877f8e080e5ed4350fec161babd3a977515b09f0bccfb273a870e810aecec8dbbeac1a040c58dc02019a3c280a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "5549db59-8732-4b0a-b7a7-43f4a8155d68", "value": "T1DB53F23DD03D45E1F16C93BB071F28972895D39CC28486FA7AC8586EE57B2953C8CE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "50611799-2709-4aee-bf1c-5a7ac6ef416c", "value": "1536:WeKpSFIsrfwECBtdq3p4YDVDrFOtMG5wkF5Dinouy8DMM:dF3Tw7BtUt5OB95D6outDMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963452, "uuid": "faf4267b-23ab-443b-be55-9c2cd715220e", "value": 61836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963452, "uuid": "d25b4b32-127c-48df-988e-42cebcf918f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "2826e441-0f5b-47aa-ac37-dc7762f4fab2", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ee02c7-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938381, "uuid": "9dcddaed-9ec6-4e71-afcd-ad4be9204b51", "comment": "Malware payload (Mirai)", "value": "4029ace09440f0b2323d824c2e5064ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938381, "uuid": "51991586-4376-411f-b95b-73269de2ec51", "comment": "Malware payload (Mirai)", "value": "543d383c5ef9f5a79e4ad9d55735b524d8dcfd2f65ced2909c9bcba007653653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938381, "uuid": "f08fdb99-f984-45fc-8da9-0a663576671a", "comment": "Malware payload (Mirai)", "value": "de648cd7eacd3f362f208138ebaa56a2f40645b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938381, "uuid": "a1465ac5-21e1-4f5d-a832-e20fae29a036", "comment": "Malware payload (Mirai)", "value": "a8e59a51968a1da544ed2b3304ffc1724408ed7b29b994e96bbe0f2ce119818ebd2794de0aa8980e39a3b933d97487a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938381, "uuid": "a3af899d-9195-4ce1-bd2f-c7ddec8fa1f6", "value": "T163F47C5DFE5F7D42D2C6E23ADF4A83E47127B0A9D213519331C5020CE68EDED8B6198A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938381, "uuid": "ec2eb81b-2092-483b-b0b6-b7a0ae7c4b2e", "value": "12288:RZQe4m8NAEyvyVGkr5HYxdI5w0AxbhTH2RBJFIz68B4:/g6ESywW2xj/rgJs68B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938381, "uuid": "7f692984-5d5d-4dd2-8a4a-e2ab70ac6df7", "value": 791480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938381, "uuid": "81c8d6d5-d3b1-43e2-a73d-97a8a265c0f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938381, "uuid": "302b0488-75ac-4671-87d8-4c849384174a", "value": "main.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ee9bb2-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966337, "uuid": "095b6c34-2246-4089-9bbb-25c77d412e44", "comment": "Malware payload (Mirai)", "value": "8e98fc6b0f9d919b0fdf56db0fffa2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966337, "uuid": "bea0a64b-5f39-436b-89d9-0674faf94fb5", "comment": "Malware payload (Mirai)", "value": "546a563633d9bed5215d3470edadd78744e20f8d046e5639e8841f9215db1d56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966337, "uuid": "6d89179d-4534-4534-b721-2b1f477c7f7f", "comment": "Malware payload (Mirai)", "value": "39fbb9b43c551f2368fff924dca08cc053c039cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966337, "uuid": "56142bde-8064-47dd-8114-ad92e6431dfa", "comment": "Malware payload (Mirai)", "value": "79543f25e19085e9f664b130c0eae01326d22a6e3a612dd0b6ea02cc377ed0ffb65271c0e1d66a2994869d4b3ab8f93f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966337, "uuid": "a247ed43-72e1-4145-a7a4-71e598d9357b", "value": "T18C6328827880AA26CBC0577BFA5F108E331457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966337, "uuid": "7e2814e0-b550-48da-9a25-038bb7db0055", "value": "1536:dRqCA7shu+z506mEu82prPw+70w4Y8jkMhW65g8Yn:dRqG0pjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966337, "uuid": "d49e2aa0-8715-4723-819c-a4fc2dd23807", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966337, "uuid": "59432bdb-f953-4f26-a1d0-76c8cbcd0a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966337, "uuid": "627bda8d-4f01-4da3-90f8-f0c20b6c01cf", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe484a2-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977480, "uuid": "08ee2945-68ed-413b-b039-526b348c74a9", "comment": "Malware payload (RemcosRAT)", "value": "8fec5c785e64bb857308238f99d4c700", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977480, "uuid": "17c5801d-b26a-4f71-a97e-7e3e23ac11c0", "comment": "Malware payload (RemcosRAT)", "value": "54b33d56ed1845466f825f2644e653120540638b2ae30c14353a1105e4d4c2ba", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977480, "uuid": "36d5226f-e798-4eef-bb66-892fef4a78ff", "comment": "Malware payload (RemcosRAT)", "value": "309042d0330411670c7a215c1e85bb05deb25a30", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977480, "uuid": "f33b6c8c-6795-4d2c-b73a-129aa7f1585e", "comment": "Malware payload (RemcosRAT)", "value": "4e095e92883a11be1237e44814d178f8213b013e4c55f388892e28a741ed072496c2b902dd999661eb29170acdf65cc0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977480, "uuid": "cc405f00-0c9f-4476-b289-d62b22cce174", "value": "T121A25DE1EE3916C24E9E2B5AAC935FC5C9B9800D021700B47EEB5749250A9DCB37D39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977480, "uuid": "df8301b9-0654-4e0c-950d-4d8bc64d7f1b", "value": "384:dRd6mJqSQlS+RMtrsDmNUmoXdQ4o+KU7HVqujDceTv6gJn64tb4RDvA8Lwb6q:dqmJqXlqZ/imyCUBqujDce2k64+RD48c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977480, "uuid": "78a84880-a6c5-4913-8af1-227493da81a5", "value": 22553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977480, "uuid": "c57b9f15-33e8-4ba4-83bd-e6e80f2fd573", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977480, "uuid": "26d4b6eb-248d-40f2-a120-7078ba5a92f7", "value": "shipping documents-Delivery Notice pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6763574-ac4f-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788959432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959432, "uuid": "68188d49-cdf5-4164-bf4b-11af04f4c2f1", "comment": "Malware payload", "value": "8ff87d296f33691d3d11b0b2aa859451", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959432, "uuid": "77951955-95a3-451c-b80e-c557312368bd", "comment": "Malware payload", "value": "5689bdc0a84f245fdd7c5f71e783e07e926afe705d4082569b2c349b74060390", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959432, "uuid": "44b5cd11-31f1-4250-88e6-b7a2ad497914", "comment": "Malware payload", "value": "0c49e3e4f41647af17d88f01f8ffe798e0dd6357", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959432, "uuid": "84deceba-401b-4777-b831-4ff90d2290c0", "comment": "Malware payload", "value": "c86fc2785226b6c2bfc4729a49b5d92f20d42e0ee5f368029b60694ec9afdfad514ae0b5953bbd6f0f9f21c9d53a7918", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959432, "uuid": "993905fa-26de-44c0-9789-fa758a7ad357", "value": "T1793127196BA95B14E3B38F3A54ADA7118572BC12F966CF5D018495CC2828600F831F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959432, "uuid": "f34ca8b2-c9cc-4f9e-b84a-355089c7a730", "value": "24:8fJ/ByUFy+/igf5emClCwawlJfj8ezjjrabZs:85YmUawzoOa9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959432, "uuid": "158924ea-1257-40c8-bff5-1d59a578deb9", "value": 1874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959432, "uuid": "e8e0d720-b1dd-4054-a625-365d84615f95", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959432, "uuid": "d9f0a14d-82f3-4bd1-92f9-7c574bbf7bec", "value": "5689bdc0a84f245fdd7c5f71e783e07e926afe705d4082569b2c349b74060390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4957221-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "22b772b0-5748-4a8e-9795-ba6372fe5263", "comment": "Malware payload (Mirai)", "value": "bae9c85a276ed199b95d92b5bd765665", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "183c2c50-bdcb-4417-b163-6a1a338459eb", "comment": "Malware payload (Mirai)", "value": "569755ec01742f3c064d6034b5da96fed01fb9a565051ea9d62723ca9c93381f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "d2fbcb8c-dcc9-4bad-a88c-df2094895e73", "comment": "Malware payload (Mirai)", "value": "e0df4d352280034e56fd1804bd19a66e6d0b5e11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "44ef568a-4047-4086-b6cf-b992bf6dae9f", "comment": "Malware payload (Mirai)", "value": "bec973d3f493f8a4c8400341d656ecbdb73b03af3174c150525d73c9cd52d631f5a42fd49bd7d653c752861673481dfc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966274, "uuid": "d3d0431d-5d05-4263-b42f-a9894aa2a07e", "value": "T1875192D432124A31BFF19D9EB6F559247480E091EAC5AF05D9FC7AFC864CF0826DC6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966274, "uuid": "15736901-f28b-455f-aef8-4f42cf17c980", "value": "48:vXc4cacgcucg7zEc7cqcdcsc0cEuUfc7cof:vXc4cacgcuckEc7cqcdcsc0cEuUfc7ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966274, "uuid": "587cf012-281d-4dc8-bb74-50620171feba", "value": 2821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966274, "uuid": "f3797b8c-9042-49b3-ae97-f315a6cb9cfb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966274, "uuid": "4ecfad0d-808c-4c68-8483-6c8f10943877", "value": "lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90a4a90-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938391, "uuid": "33249702-05bf-41d6-bfab-077590637dc4", "comment": "Malware payload (Mirai)", "value": "e6a6c8bafe3353e8cd544d35c7557f04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938391, "uuid": "b1c9e08f-06c9-4c61-8846-05273ddee6f0", "comment": "Malware payload (Mirai)", "value": "5739430e7a8b3458a9f80a0f37a9eea49d9114ac27082357dacb1185be4adfb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938391, "uuid": "66eca5dd-3cb0-4793-aeb0-5bc01185e395", "comment": "Malware payload (Mirai)", "value": "129e11de51af598c1e5fae26b8872221d5caf7ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938391, "uuid": "9c24da2c-2d84-4e9f-8fc6-b10ee32fa8f1", "comment": "Malware payload (Mirai)", "value": "2867039e00839c6f3137cd90a99699f65361c967cef2abef6d9340d78c91998b1c07458446f46538dd3bcae5fdde3af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938391, "uuid": "358f1b9f-29d8-41bf-806a-3c6b73fd3ccc", "value": "T187933B02B3184A43D1576DF029FB1BF183A6F9511AA3A244F91EFFC95232BF11946F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938391, "uuid": "1ff78bf5-25f3-4092-a639-a96bd1db9ad7", "value": "1536:HDzX2M8RQSLViOLxpxIenEEduwtcf6nNL5tNrE1avLRnoHcXiwEshn:HOM8Rr5zmenEcu69bK1avLRno8SwEshn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938391, "uuid": "0f435a4e-cedb-4508-bf22-2591be8686c4", "value": 89856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938391, "uuid": "14062f88-2745-4279-9c0b-b9eac5afbf39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938391, "uuid": "4611fcdc-f224-4c6d-bf24-6203b993c1d3", "value": "main.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7f1d06-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938372, "uuid": "356235f3-56f4-4912-9877-69f4dec3db7c", "comment": "Malware payload (Mirai)", "value": "7e4e059778fa5252d55f03fad3a3eba9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938372, "uuid": "7b236765-1c64-45e9-96f8-e8dad44a098c", "comment": "Malware payload (Mirai)", "value": "5824ff4ccc22e9e4f05de9f06eb85ccfd1d12d5387aeaf013d137d6222c4a002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938372, "uuid": "a872fdaa-deba-4579-b072-987d6bfa2305", "comment": "Malware payload (Mirai)", "value": "721e58b0fb8462dff509c607af63de340b289cc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938372, "uuid": "1c9e5dc9-e672-4c04-9a62-83f667e0741d", "comment": "Malware payload (Mirai)", "value": "2699df93a0a6ca4a1a01943f0563be500de1c28b3b0ffb66e38404adcbcbc3fee6f941bca002a04a4a4a7b600ef67cdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938372, "uuid": "6938473d-076d-4cf6-95c1-ab4e5153c9fa", "value": "T167831942B9418B13C1C21BBBBBDF86653B21A614D7D73302BA297FB41F4369D1F2A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938372, "uuid": "e6ae8f7e-2940-4114-afc6-dfaf756132a3", "value": "1536:fDQwfku65Ut6X6jj5acd9xev/OW9G4sgeyMm4pffg1/tOiecqgnS591UgdBKTQv0:7Qw8u6LqjFacd9YengNMqlOidqgS5ddY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938372, "uuid": "ed40092b-c51a-4622-bcec-6ecbec4972ee", "value": 85455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938372, "uuid": "c8796e1b-c0c9-4f1f-9bad-c2cec19f403e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938372, "uuid": "80634917-cbc8-46a8-ad42-d850a068d58f", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29e5a0c-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "2b6954e0-95e0-4b12-8b8e-fa5f030326a1", "comment": "Malware payload (Mirai)", "value": "e800a5e91c4bf99ebceda2ca35d4b121", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "0365886d-d067-44be-8dde-c178a6670753", "comment": "Malware payload (Mirai)", "value": "599ad6b0fb843853cda30b374bd9fa55aed341811568369e0f74aa0f68af06be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "b51898fe-06d2-413e-a4c8-93289327d643", "comment": "Malware payload (Mirai)", "value": "c0e79ad6415a73559e3021464bf7734df73e6b35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966271, "uuid": "dfb26b93-2bab-444a-bc41-d7976399f97d", "comment": "Malware payload (Mirai)", "value": "9aecfe4ca0ede46bceffa670bd9eb99b8cda0e3b163b683a457ca454e6dfe410a16324f1ec7faebe27c473e95f9f5100", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966271, "uuid": "3e9dfe89-5360-4ea2-babc-e0dda846a7e0", "value": "T18F51C4C432124A30BFF59E9EB9F6493474C0E195E6C5AF41D5EC66FC8A4CF0826D8692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966271, "uuid": "0b66e541-ec7c-4779-b626-5d3d32c27e94", "value": "48:vXHW4HWaHWgHWuHWg7zEHW7HWqHWdHWsHW0HWEuUfHW7HWoHZ:vX242a2g2u2kE272q2d2s202EuUf272c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966271, "uuid": "76cdbbab-33ef-4313-9355-f520ce32c5aa", "value": 2849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966271, "uuid": "db40397b-7703-4f09-a9e0-d343ab00f61e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966271, "uuid": "f7be32f2-5b90-4204-8642-df55ce88cef2", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595a90b3-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "a7c7286f-447b-453b-a2cb-e33797ad9592", "comment": "Malware payload (Mirai)", "value": "c0d9bab119f3a3dc074159980b03438f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "1738a86d-937a-4446-b68c-443da7f05374", "comment": "Malware payload (Mirai)", "value": "59a4e0dd443863cf01c5ac8233f490cf08d11a68a7c08eb394f4d9afb676e4a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "525aff88-597c-4a22-a5e2-1263d0c6baf7", "comment": "Malware payload (Mirai)", "value": "172a36e57120b079065385447f238ee35f8f883c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "b955f08a-b127-4d17-a3fd-ad601169582d", "comment": "Malware payload (Mirai)", "value": "f2a9b3da8eb18643eafe9ce0b61a20fcdf3419609d56898ca2f1715ed3440ceb6944347d79ddbc219ffd2f02bcb26d05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "278752af-10d6-465c-833a-c5aa435a1961", "value": "T135266DA9BC5C7452DAC87AB82B2541D4B335FD48DF8183277A18F7ADA9F2358CF11260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "c4cd0503-2454-414e-9284-6f84b1739c6d", "value": "49152:JaZJHhZCJRXwKDTjVjm2f5gFZgwfgPan5EA1VRUeLn:MZJHrCHwKDTjVjm2f5gFZjfgYEzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963947, "uuid": "c6ec132b-5007-437e-8ba0-936dd317f7f5", "value": 4653056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963947, "uuid": "b553ed67-c0b9-4633-bc02-af763ad959b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "58234a10-b5fd-4e56-ac32-5a7f0079906e", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314fd518-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "6fce3e18-6d9d-4006-9696-c5b90e94ab11", "comment": "Malware payload (Mirai)", "value": "8271b22412f868205518a009c9f50dc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "25502066-701b-4330-8b9d-d3e2aa1fe186", "comment": "Malware payload (Mirai)", "value": "5a4f07223827e3435b361446dd219407a5f92b55e31d7053efa58846b602c460", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "062e5433-6391-49e1-b0ce-2287ae14dc51", "comment": "Malware payload (Mirai)", "value": "9fec4df864cfef2c0a759af669f1d24d729fca36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "1a6f5c98-e7ad-498e-8664-a0503b6dca4d", "comment": "Malware payload (Mirai)", "value": "cbc3373f41d82be4a2cdeffc5577e53b92c25291e94b0855134e315b1234042dd0e794bd2a269d238c4e1335d776c6d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "5f2a079a-50e9-4736-a6a9-8d287c65f48c", "value": "T14B041946FA518F13C5C755F7FBAE02883B266B6AD3EB3003DD256F6427864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "458f1856-3202-4644-8ea0-729277bd28b5", "value": "3072:s7IMPTODsF8f6VBwPAQN4uBkqneIypBksgCRlqy:IVPTODWBopN4Okqn5ypHgCRlqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963450, "uuid": "cc4043ec-94eb-46a4-bf34-89baa86cf8aa", "value": 175996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963450, "uuid": "37460623-df2f-4197-8bed-d5f99cf00b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "86edae61-37d2-4948-b003-6cc4c1410767", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b831d489-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959811, "uuid": "f0cbc92e-ea51-425c-a190-e909bbc08648", "comment": "Malware payload (Vidar)", "value": "7c89b5536dee68bb84a9a780f4e75a1e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959811, "uuid": "cda3fb59-6e47-4cf1-898a-bc5505121c9c", "comment": "Malware payload (Vidar)", "value": "5acb5e67042c7f98e8141833a6f6fb057b7233c8b5491d255c8428952ad668e1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959811, "uuid": "239b713d-3a54-4b31-8c7e-1010599f2cab", "comment": "Malware payload (Vidar)", "value": "d0dab457b9dc2c59dcb8544959a636913ca6d68f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959811, "uuid": "033be20d-286d-4bcd-9af2-70276d489609", "comment": "Malware payload (Vidar)", "value": "c1ebc1b068d6e6004cbd325ca83c5b1d97d0fdf9cc688141cfed8f8f5fa74420e9368284ffb36738f58c4c771f45e3d7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959811, "uuid": "faeb851b-26e3-4739-b055-51a6650eccd2", "value": "T12D046C71A2C291B2CA492374293FB7ED9E709A222B04CDDBDBC4FC1C6E791D15771416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959811, "uuid": "196f31b1-92e6-4669-92e2-ee9c9f13023e", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959811, "uuid": "a3be94ff-fa75-41de-8586-4fc4b0a75670", "value": "3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyKzdEpxhovIKT:A/rLVPW0nsP2Xy+TJfLzW71KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959811, "uuid": "4d4c70de-2e93-4982-aed2-285b89869200", "value": 183856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959811, "uuid": "d491230d-4a07-4a25-8a8c-438e76b6ebc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959811, "uuid": "03c62524-d3a9-49d7-a7c9-2c03cb1c15cc", "value": "5acb5e67042c7f98e8141833a6f6fb057b7233c8b5491d255c8428952ad668e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00da435c-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788977113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977113, "uuid": "2995a605-cfea-4bf9-9a2e-3e6c9f9a6639", "comment": "Malware payload (PhantomStealer)", "value": "1f14b916f6da5f36ff84dd88693b5d45", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977113, "uuid": "a82567af-7a14-42c4-8578-a8035fcb0008", "comment": "Malware payload (PhantomStealer)", "value": "5ad59fde4f2e3533175681b8399b025500bf89e3185744df01f284cdd20638af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977113, "uuid": "5ba6b99c-22ab-4b77-9f6e-3df66fc60871", "comment": "Malware payload (PhantomStealer)", "value": "936f7eaa1ee0ffbf9efac2344fc33c3a06319493", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977113, "uuid": "ad8e118a-07dc-4695-a416-e7569d7e1dfc", "comment": "Malware payload (PhantomStealer)", "value": "336271a60af8b315c9490a983f8a7b3c38dffe67487d8138d2c5b380f3185619e65f7afa9e54fa33300abba6790e6c8c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977113, "uuid": "7d5669ea-346d-4b2b-994a-ef9ec98eaade", "value": "T13EF5231419255AAB09BCCB2E525B092C3BB2DFD4A2C8FDCBD58677D7016E200F6DF864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977113, "uuid": "462d8ecc-bd01-4c06-bd4f-068e70098867", "value": "49152:jh6S/oSd/663w5p/kixdu1NgzFPl+TTYa4bOM+TM+1:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977113, "uuid": "3ea4e96e-efda-4688-b103-ed849b22988c", "value": 3631443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977113, "uuid": "a7440e71-81ca-4156-b0be-80329d856759", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977113, "uuid": "5c12c2b8-4f51-408a-bc04-61c0071456c9", "value": "OFFICIAL CERTIFICATE_20200102151516 & BL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1649e50-ac30-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946136, "uuid": "989c37bd-0bcf-4a5d-8510-f498a19143d5", "comment": "Malware payload (Mirai)", "value": "fb964f127c0719209f95eec1a6f7b8fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946136, "uuid": "17c90c11-006a-45a2-9731-292039d81dcd", "comment": "Malware payload (Mirai)", "value": "5bdbd8b21e5785c571b2d7adc4959101a18803119bd1d589a5217d8d042e767c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946136, "uuid": "b28ed9af-3343-41d0-be8c-20904985a64f", "comment": "Malware payload (Mirai)", "value": "c1780f21a79343c2b06a1e8b09cf7ad320767067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946136, "uuid": "4c068314-684f-4bcb-9b12-260ac31674c3", "comment": "Malware payload (Mirai)", "value": "89edf1b0b5858bb0683a41aa5e5c62cd57a276492f95c8585efc7f3ca390da48d8a3a4280a704d4b2ccbb18f9075a28f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946136, "uuid": "5dd4e96e-94bc-4342-ba71-c73f25fcf565", "value": "T1F4B32A40FD50C767C3D227B7F78E469D3B355A64A7DB3311A9357EB42B81B882E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946136, "uuid": "08c6b998-1bd5-43c9-b29b-7c2a99d9f625", "value": "3072:ZCD5EEgYlkhbAWduac+GTuyKzGam7ZTQOh21JXwQA:+Wtcb6yKXm7ZTQOhMJXwQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946136, "uuid": "ca69a7a1-4f4f-476c-85f9-e695b2efd7ff", "value": 111325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946136, "uuid": "22214d13-aacd-4711-b200-1dab95ce7d15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946136, "uuid": "7acb00bf-e6e7-4e1e-a936-7001385cb38e", "value": "5bdbd8b21e5785c571b2d7adc4959101a18803119bd1d589a5217d8d042e767c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276325ea-ac71-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788973741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973741, "uuid": "a7259e35-2fd9-45ab-84f7-33dc608f19e4", "comment": "Malware payload (Gafgyt)", "value": "7b3a53122390c8963aff25d6a8e371c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973741, "uuid": "2a78df59-77a8-49de-9b16-94df3326eb01", "comment": "Malware payload (Gafgyt)", "value": "5c6a8428e59e0c60297785652d17ba701878f4a9890051b63bbcb25a32b58a7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973741, "uuid": "7d546ae4-f543-458b-8f22-86c62a01ff4b", "comment": "Malware payload (Gafgyt)", "value": "4b5e70e68fe4e9c665372bcecde5b28c729cd627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788973741, "uuid": "d19b08c1-d976-4d7f-a711-8748e8a6cb27", "comment": "Malware payload (Gafgyt)", "value": "a5a1d60b8933bf43dd1ee5bed747c0aa43f11f4fae1bd91e1e4920f8d1d5b2423aa9ac5f23fdcb165048e43951d243f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788973741, "uuid": "cbe73a1f-5353-4573-b6f8-5bd6f3763696", "value": "T176243C23760C0783C0971AF02E772BF24F6AA5E212D76185E71EEAD45B73B712414F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788973741, "uuid": "d97c5bde-df3f-44da-b9ee-1081856b9278", "value": "6144:lhUIa+vZxHNw30AazJ5hMG5FGdamOzvxV/lGRrS749Dby:Gg1zJ5hMYYamOzvxV/lGRrS749Dby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788973741, "uuid": "a0f49981-f116-48f5-ad64-1c2c0b243d6e", "value": 227149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788973741, "uuid": "a0d958c3-5bf4-44ea-80ed-8cd30c95d82d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788973741, "uuid": "d8f17cc9-c956-406b-93b0-425569aa4cd8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44942f1-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938410, "uuid": "8e798359-fe38-4913-b178-1a36d3b387cb", "comment": "Malware payload (Mirai)", "value": "b60880e36076698180e5c706938b432f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938410, "uuid": "108dfbc6-87e2-46ea-891b-238fb9233377", "comment": "Malware payload (Mirai)", "value": "5f73ce63d8fcbb1a91c784c8a34a901f09a545700297ee73da1404f836d9cb57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938410, "uuid": "e5d37248-d27d-466d-b272-6633d2252008", "comment": "Malware payload (Mirai)", "value": "6360e5b8eb10d1aa4e012c22a35262aa5d7abc35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938410, "uuid": "bf67717a-fd22-4025-8724-4a7b52b6c246", "comment": "Malware payload (Mirai)", "value": "1f540cbe70a4c5f62fae66330d6d266116c6d59c5daa9c804c787ee56127aa0ada0b1af0fb864551986f673cf8b8da85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938410, "uuid": "e7d9a27c-dda1-45eb-aa35-7368b034aa6e", "value": "T188C36CD5F643D4FADD5305B12037BB378F32D07A1129EB83E7785A22AC61A01D61AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938410, "uuid": "a87216c2-0eab-481a-9217-6be927349a0d", "value": "3072:qXmkYDpMgztjHQ8bigC939tcvNVw3w0Y83ESF4G0hAB1QV:0/YDmqVHPOgC9tteP0ZJ4GSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938410, "uuid": "edb79ac4-a671-461c-8d4e-6e452d409ead", "value": 123240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938410, "uuid": "cd7acb41-4a3e-4e3d-8bdb-42d352dfbe20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938410, "uuid": "2ade9f18-6ae0-41f9-b9ef-766d3f5311e5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db59ff78-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Akira)", "timestamp": 1788938395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938395, "uuid": "98d29445-1ed2-4ba5-813c-446d3ca4adf4", "comment": "Malware payload (Akira)", "value": "7a7d7c2ab8913ec96b577344ec918d96", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938395, "uuid": "e9c206a1-b84e-483a-8068-4ce989a72399", "comment": "Malware payload (Akira)", "value": "5f73fd2184ffc262f1bdac74b8f15c589f8d5cf986625ff687ecd32928241f80", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938395, "uuid": "a1cd78e2-6713-4ee9-a9c4-c2d6284103c9", "comment": "Malware payload (Akira)", "value": "66f6bdb22385fc5f7824babb6f9d7c22e705c6c3", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938395, "uuid": "8bcd0db7-16eb-4529-bcc1-42a0086c99aa", "comment": "Malware payload (Akira)", "value": "cb228f167732aee417fa6e32f26aef1322628e1f52e7a7ed812fe47aaafc2c0c846e4f62ced1a10aec7408a5899d00a2", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938395, "uuid": "8aef9cbf-0b85-4ace-926a-27ed565cd0df", "value": "T1BC753B17B6A258BEC29EC070878BD597AC30745402317A3B7A90DE351E67E349FB9B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938395, "uuid": "b0a15b83-5611-498c-92e0-09e692127c1c", "value": "49152:y5ZJD1inSoatohZHOSck67NuQ8XLwf5Elf5LX:UZK6hJuQ8I5E7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938395, "uuid": "d8584426-1118-4bb4-b78e-6f880919a439", "value": 1676946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938395, "uuid": "7c3fcd62-e308-499f-ac2b-d5fb3f5edc11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938395, "uuid": "18e43323-a21a-4b18-82c4-410214e77e1c", "value": "aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6bcaf6-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946797, "uuid": "4bfc993c-bdbe-441e-a8c8-9529ea5bee68", "comment": "Malware payload (Mirai)", "value": "690529edbc96fcb85a58a3ed45a389ef", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946797, "uuid": "dcd44688-58f6-4dfc-9db8-e0f42ca9d384", "comment": "Malware payload (Mirai)", "value": "5fa112f650a9a301faa4ea162d2650c6d76f511882ca3451a9e1aa20e2d02952", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946797, "uuid": "ed064c62-13e7-4152-b716-a4d4f97d4edb", "comment": "Malware payload (Mirai)", "value": "ea57f601cf462d0b61e140ab311424c28d131b10", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946797, "uuid": "eac68911-09bf-44b4-bd49-53d4ffda1f4f", "comment": "Malware payload (Mirai)", "value": "eeb175aa0e86405dbf99a36352266f8d0fcecaf81755b523b194c140f207bd9c0a9fb07c5c38ac9c7f8a40658985c9e6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946797, "uuid": "5acd63ea-9634-4357-8485-75f45060d5e0", "value": "T1A1D3C021E4006DD1EC2129F578BA96BC0350EE700BDE1586EFFDE95E747BD94386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946797, "uuid": "84d9b1c1-f11f-42f5-ab08-7f6096559d57", "value": "3072:PniBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xu:Pidny+hovsmzbisJfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946797, "uuid": "8f855d37-87cd-46be-9ad0-b08ca9ad46bc", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946797, "uuid": "52288337-0bda-4526-90db-c4551bc96c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946797, "uuid": "b5a5c512-4a8f-47c7-b372-8615e46be56f", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4afd51-ac46-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788955442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955442, "uuid": "3f6dec95-308c-43fd-b0ad-c429b9916660", "comment": "Malware payload (SilentNet)", "value": "406ae8d6dd86e5f0c4ebdc05ded16852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955442, "uuid": "5b068f9a-bc0b-4dcf-8a48-93dad4eadee7", "comment": "Malware payload (SilentNet)", "value": "5fb0d79180a94586728efefa7f2c5bfff3fbf8428febc0054829ed737db20f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955442, "uuid": "f094ed69-59ab-423d-852e-63e56fb89a20", "comment": "Malware payload (SilentNet)", "value": "d5daceeccf819cbdecf2fb4fb03cb082010639cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955442, "uuid": "ca812532-b9d0-4937-9862-76496241cc3e", "comment": "Malware payload (SilentNet)", "value": "3b65e04a5fc24a03e76edeaf587b39bef3fe27c1b4340b201cc14e887c948330fd1491dcdcdb0dde12507b42e36be234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955442, "uuid": "b311dfde-6521-401e-aeb8-6cbd00b6664a", "value": "T1B0357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955442, "uuid": "ef49433f-b285-43b2-9461-c6bf5871f441", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955442, "uuid": "9a7e82ab-aebc-453b-8d64-b4d5a20c3d31", "value": "12288:Sbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD6vfqItNqdg:SbOVE5ifGPRZwmvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788955442, "uuid": "991fce8b-fed9-482e-a889-14af0bea8e80", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788955442, "uuid": "e5243fb7-ba4a-41dc-9ae0-1c5df10ddab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955442, "uuid": "8d092658-88a2-483e-a07f-a5c35693640f", "value": "5fb0d79180a94586728efefa7f2c5bfff3fbf8428febc0054829ed737db20f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f518c1fc-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943163, "uuid": "4e50d8a4-e537-4c24-a4e5-37510eefadc7", "comment": "Malware payload (Mirai)", "value": "be8c014fc65d91e74c7595c33a3c5a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943163, "uuid": "e804f8bb-e3e8-4f1b-b935-c3ecef31c9d3", "comment": "Malware payload (Mirai)", "value": "600921639b20fd41ac3b03465579f6a867a92756c5064c7961a5fa7ec97a1bf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943163, "uuid": "db0b4dc7-2d7c-44b4-a94a-8063ff279d79", "comment": "Malware payload (Mirai)", "value": "c1d76d3f533aee11c660bf47aabc2b6bd350d1c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943163, "uuid": "b17519f0-4aa6-4732-9ed9-2f059d875f8d", "comment": "Malware payload (Mirai)", "value": "00d39d31ce16a4d2415c3f88ec64f83915579d6937aeddb934568822b97569746e17d608071f4bd26789bb551adbf679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943163, "uuid": "fbb45d33-1624-4db6-847a-7ae15d5a6144", "value": "T156535C0273A84E0BFAE61DF4253F1BD583AEED4021E5F185A94FD74A4235F33494AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943163, "uuid": "ffebf450-27d8-4099-999b-e0d32f98793e", "value": "1536:fp3/tcoPzVx57hown8n4SVsgEZJB4kv9IZT:ptcEVD1own21VXSJB39IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943163, "uuid": "bf98ce66-f2ba-4765-a429-ef186e485a2f", "value": 63736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943163, "uuid": "78946741-1d4f-4416-aaf7-85e0d9cc107d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943163, "uuid": "e238f44c-cd20-427a-bd6b-c350fa98edb8", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22a81d8-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938380, "uuid": "be3761e6-9f95-4360-816c-4a92fae417c1", "comment": "Malware payload (Mirai)", "value": "016d89da41ee0582630d66d5c809b4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938380, "uuid": "b1532ff9-f67e-4df1-b800-99c277e0b133", "comment": "Malware payload (Mirai)", "value": "614e7c4fdedfdbdbf39ec67860ec7bf0430b62cc71df86309cb1675c7826bfb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938380, "uuid": "d38f8789-68a0-49fa-9a54-c02d16e5db3c", "comment": "Malware payload (Mirai)", "value": "fc5dd3e74eff6abc8c9c91b6c2a57e669215adbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938380, "uuid": "2de670af-62ef-4b07-82ab-98a11003fc3a", "comment": "Malware payload (Mirai)", "value": "f750a67eb2edb4a9572c4b7fe7d099859697114632f4dcb68a734ace89bbb9fbda539c466f880aec20893c1d21e89e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938380, "uuid": "88fe5fe7-01f5-49e7-8734-74bb6dc0a47e", "value": "T1EFF47D5DFE5F7D43D2C6E23ADF4A83E57127B0A9D213519331C4020CE68D9ED8B6298A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938380, "uuid": "d0152a60-97f1-4e06-af85-08059b7d6057", "value": "12288:GzQvQ8C8xjExJxZWjDnS8ErCI5w0fXx/fsnFnzB7Bi:bdsJvGbjiXVfe9B7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938380, "uuid": "9ea1f6d8-1710-4a92-b180-0c3187b28ca1", "value": 790800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938380, "uuid": "b8583001-fb35-4534-93d1-575a52e2b677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938380, "uuid": "cbbda70f-e028-40c0-8d90-ee39d5c104a5", "value": "main_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0300d5-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946853, "uuid": "4d92e13d-8243-4711-9e38-3bcd6df8832c", "comment": "Malware payload (Mirai)", "value": "5efe5fb58eb6785952016f4d36024cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946853, "uuid": "cad67ab7-742b-4f9c-904b-bfa08fab7383", "comment": "Malware payload (Mirai)", "value": "6230f9d5b410a70db2dea3c04c9bdb49cc8b34f9c31e0ae0ab9fb25ee115dc83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946853, "uuid": "844f07cc-9e2a-4d8d-a59f-bea68b5caa03", "comment": "Malware payload (Mirai)", "value": "d5e1457a2c77d9b3c29e43904f84fe87f9ebe698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946853, "uuid": "3d6c0e00-9e62-4940-a145-8ebe79e4d7f1", "comment": "Malware payload (Mirai)", "value": "e9aedd3bed988833939f89f0780178abb11a633e9238b7b7fb4b1625d0be582b66b800e1600753651af51e4cc3139935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946853, "uuid": "b7bdc850-5e09-4fee-9208-6df5d2352219", "value": "T1FD144A11FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946853, "uuid": "8db321e7-0664-4dc3-9a4b-07fe6202f656", "value": "3072:Ey5+GoCEggi4NerYqltSwJpH6+cYstkfUat:n5H5BT48rYq1wjY2XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946853, "uuid": "ca4c4529-639b-4af6-8004-ab54332e8e03", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946853, "uuid": "92229769-45af-4ff9-9728-ea346163be92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946853, "uuid": "603460b3-8e62-4bae-abe0-87f90d791c7a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d6fc4e-ac5b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788964417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964417, "uuid": "7174f04f-a5d2-4afa-a2be-dcb05ce42e9e", "comment": "Malware payload (Mirai)", "value": "41f9c71bc3f8fb23d9a37de376f36724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964417, "uuid": "a4ab9b6f-c14c-4650-b8fb-dd7082a4a1b1", "comment": "Malware payload (Mirai)", "value": "626efbafaf083cfaa164085a3a3f3e691415ce94d37166a6f396d4713c23f61f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964417, "uuid": "c04ce612-b65a-4d35-964c-308961c7df56", "comment": "Malware payload (Mirai)", "value": "1ad1c45fbaa40db57e5a4b2387ea522163bd4f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788964417, "uuid": "c9299b2b-3df6-4e06-87f3-77d0aaa203be", "comment": "Malware payload (Mirai)", "value": "96a280ed380d5a14c3050c8659e5b67be055c2fd91ea9379523084d3c8e84388eca11facb83fabf557089f41b9a3e449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964417, "uuid": "e2076e2d-c51e-4c89-a190-41657404b50d", "value": "T1E7144AC3F900D9BEF80AE73784134905B130B7A254925B37B25779BBEC3A19A0577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964417, "uuid": "9cf456f0-2330-4f51-9623-a39b8fa616b0", "value": "3072:Ep75FWITcPy9/UrDubKcXh3XJd6MdfEL28mOV0jbidLsc8jDPyuEXClWS:s75FWIwP2Wuh3Xr6rq8mGLsJyuBWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788964417, "uuid": "6aa51d3a-4d1e-46ba-ab2a-de0ec7443063", "value": 190752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788964417, "uuid": "c2827bef-8eb0-4f4e-9258-b1a775f60acc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788964417, "uuid": "c65a6b41-44b9-4d65-b829-b2abf897abb9", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dfc59d-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938386, "uuid": "92df5c58-44f2-413c-9d8b-bf655da1623e", "comment": "Malware payload (Mirai)", "value": "7fe3e36620ad7c0558a27ff721a532d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938386, "uuid": "4ead7a2c-49f5-4e05-883a-1bfefe967f18", "comment": "Malware payload (Mirai)", "value": "6461c8f43468d6278e74ba5495adbed1f57991ee0d96452c7c7017dc6efcc0a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938386, "uuid": "45ad4e54-3530-4fff-9a81-3073dce3fec7", "comment": "Malware payload (Mirai)", "value": "5d1b56eac677d6a0424c34f5658fc1b2b90c6539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938386, "uuid": "9cf5e9da-e99d-4e6d-b356-fb3724d863c5", "comment": "Malware payload (Mirai)", "value": "21f15250e77c53eadc7222dfb215dbe52d357e223b2121d24827a4103f01dd5f44ef81e2a1aa9c3717f8824d0b698410", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938386, "uuid": "2fb1327f-4aad-448a-93d0-adc5dd019019", "value": "T145A30903FB51CFB7C44FDD770ABAC70024CEB45726A0672A7174EAAC7A1B58B09A3954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938386, "uuid": "609f5e66-36bd-4a53-b2fb-f9eabf3f1972", "value": "1536:l3LqcVZH4F+5cKq1I525hjHbLLTJkl6jMlYlu/Ng1qfE2bkCehfgF7liWWLiX9/t:ZPUYaPsne65iWGoYyvrPUX/DRqzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938386, "uuid": "aa042d4b-69d6-4ce5-b95c-7d5ef47ed292", "value": 106295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938386, "uuid": "b60a6ebb-7002-411e-bb4d-adc9d3bb2ee5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938386, "uuid": "dd2fe846-ad83-4d43-bf52-037db241567e", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd4274c-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946858, "uuid": "cc7bc25a-95f9-4ab2-b9ec-9e93f539ad4d", "comment": "Malware payload (Mirai)", "value": "96058891c87f5c91b879572850e48fa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946858, "uuid": "f18d9fc9-3bc6-4c4a-a2d6-8fb2748a44ca", "comment": "Malware payload (Mirai)", "value": "64a91054d1eb4b51f211862e7ee2b9a4a656b90f3d03908cac76ca0c36d206fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946858, "uuid": "0f1fd038-80c2-4cc6-a1b6-3be558fbe446", "comment": "Malware payload (Mirai)", "value": "cc080835bde7ac90d27557f211a9c85b6e40078e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946858, "uuid": "9b892c53-bb79-47f6-b5f5-e92c6a7dd807", "comment": "Malware payload (Mirai)", "value": "484cce1f12f7ed0b251a1d253704be3b32fba45c4b2dbf322025e248be97f6e3be3bb0ac1fc983270bff3ab512e87b61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946858, "uuid": "2686e86c-6651-4ac6-a173-3b6ee8e71ee0", "value": "T199D35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946858, "uuid": "e0933757-e607-4443-af55-66d5b84d6bf4", "value": "3072:lAF2sh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTe:yMsqf/3iPcgrerAl8fEtHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946858, "uuid": "bcc46f1a-1a46-4900-b2c8-26d061e3a01e", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946858, "uuid": "5c59412d-1b13-4e4b-81a7-85557de2e906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946858, "uuid": "b7efd7c1-70e4-401e-b880-d134b8c6eee5", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a268b06f-ac61-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788967076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967076, "uuid": "0081dc2f-22e6-4d0a-be0c-8d4626a26e24", "comment": "Malware payload (Gafgyt)", "value": "97122cd71482e9ffc3cb8e8264327604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967076, "uuid": "d25c64b2-0501-4695-ad96-43c1b8707441", "comment": "Malware payload (Gafgyt)", "value": "652f9eee319df03afbf2ec9a8ed7348d731748a7e6063940609c027501ede548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967076, "uuid": "a98b8833-f5e3-420f-8b91-e645134d89b3", "comment": "Malware payload (Gafgyt)", "value": "f2cbd5fdf181e95b57de9ef2d0b713d1f9efdb4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967076, "uuid": "89be4db7-e2b8-431e-a5b1-bbaa769a9736", "comment": "Malware payload (Gafgyt)", "value": "9e6430dee54253affabf86510cbdc73b0d5466fe2fb4ad2e177a7333248ebf9be042f6074068c3a78dfeae78c821b916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967076, "uuid": "1b419803-d05e-4e27-8abf-d24ddcaa0dd2", "value": "T144243C23760C0783C0871EF02AB72BF24F6AA5E211D76085F71AEE945B73B716515F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967076, "uuid": "caf17bbf-53b1-4748-acd9-d7144e3302b2", "value": "6144:S5VyKEtI2gx8VIEo5rycT5hxtJee7amOzvxV/lGRrS749Dby:PurBT5h/HamOzvxV/lGRrS749Dby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967076, "uuid": "e2a5ea7e-0b4d-4b07-bfb5-e3ef44540b5e", "value": 227149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967076, "uuid": "bb484c59-9eb8-4044-bd2c-c08e561ecd8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967076, "uuid": "4b40c469-4e32-48f4-b45e-abd1917c1611", "value": "ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed8e3d-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977121, "uuid": "6e160bfa-364a-409d-8a2d-5bcf0efe9e77", "comment": "Malware payload (AgentTesla)", "value": "55e171405122802f10f471db68eb3a36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977121, "uuid": "2c2dd3d6-5948-4680-9120-375354976f8d", "comment": "Malware payload (AgentTesla)", "value": "659613c262096f971fd7853932b1543bea7d2246b1972281010cc37ae75afbbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977121, "uuid": "1f640678-2807-4f69-b924-f0e68f9e54d5", "comment": "Malware payload (AgentTesla)", "value": "445ce6210d1a965a4f3fd42ab4d2e52de552d512", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977121, "uuid": "f31794d2-6b4f-4a0d-8b46-a04735c95a5b", "comment": "Malware payload (AgentTesla)", "value": "eba75d4750dd5cdbed4a32457ec732184289772d614782e753523e4dbccbe4939cced50cb8cdfef278e1c31586a2cd1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977121, "uuid": "2fca09d8-1d39-430e-815e-7bb900257dfe", "value": "T19CB6945CA609A871763E5B1CD236499049B922472085EF1F33FC67287BB1D7B276C8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977121, "uuid": "29ebfb39-c3ec-4562-89d6-2da76a596fde", "value": "98304:cQiQdMXB9FoJF0te4FEH5xpkEFWJRFGTkSY4aGpQjlD+cmQAnBc+UuyVroIr:nNCBIEAkyWJRoTkSvL2lD+cmguArou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977121, "uuid": "5cba5844-4bc5-4461-8478-686e28889ba7", "value": 11410721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977121, "uuid": "c904a29c-4cb0-4068-9b92-2ed413c0743a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977121, "uuid": "14d9c6d7-8c39-4e2e-a099-7b3816d5609d", "value": "SWIFT-103-27082026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b8fd36-abfa-11f1-ab4f-4201ac107002", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788922925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922925, "uuid": "04491596-f49a-40a4-947c-019d98e8567a", "comment": "Malware payload (ValleyRAT)", "value": "afb33bc91f6cdf5cd4dea233defdbf6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922925, "uuid": "76f5bc40-def5-4cd0-8000-23401efa2a28", "comment": "Malware payload (ValleyRAT)", "value": "66c9668d460f0d3f71fb0ed42b895d53f90f4415ea9493e1dd2695cb505be9a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922925, "uuid": "463c531f-8cc8-46ce-bcf9-04055250492b", "comment": "Malware payload (ValleyRAT)", "value": "104c7ee356b841084b3d6085babd2bb5879fd969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922925, "uuid": "45d68bc5-4905-4e82-854a-a6922e88cd24", "comment": "Malware payload (ValleyRAT)", "value": "024f3263e293314f0b432a49a6e75824d469161f0054f064533871ada375ce3fba2d0a9b79188dcee9cb2d409a12bfc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922925, "uuid": "04e05c43-4efb-454f-956f-59a86fdd0069", "value": "T1BE777012B7018DDFF066A234689B8F61E332D8B106B1937723B1675D1FEE38C4EA6564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922925, "uuid": "6c112a88-4612-42d0-b986-a36eaf12d053", "value": "ce08ab0a87007f1423c570fdfcd13219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922925, "uuid": "bf294e6d-07eb-46de-8c84-042bd96ab30d", "value": "98304:2+dP6pfrf0qBvdAmx6bc4a+4Z7eSv5GdCdAmQp:2Y6VsqIuH6S0dCdAme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788922925, "uuid": "433e94cc-4f6a-49ca-93ec-2ddc7c11efce", "value": 35473200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788922925, "uuid": "5b54e435-097c-4f4e-ae1d-fc92a954b320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922925, "uuid": "35d2e961-00b0-416d-8cc2-70b425824a5b", "value": "instell_s2.0.08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a415a32-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963948, "uuid": "83c46f4a-9b8a-4599-85f2-887970bec228", "comment": "Malware payload (Mirai)", "value": "b373a8b5ab0fac7e60d21d82c98bf8d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963948, "uuid": "a6322813-320d-490c-bc4c-6f6435ac341f", "comment": "Malware payload (Mirai)", "value": "67e470c905677bda1427385bb0395c58ad226ab29ead64e439a8d1c1e9d1172e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963948, "uuid": "8d49bd67-7549-4fc8-81e8-4c554d490296", "comment": "Malware payload (Mirai)", "value": "3d6f9aabe117b8e88c8f06f9b14cb9c07fbab4be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963948, "uuid": "77e6f1ba-8785-477a-8918-e3278646a78a", "comment": "Malware payload (Mirai)", "value": "bf4506b6ae3f897d265271707f4fd80164f9a5ffc1c673e4592294ee7a0ded5e2da44db9472062f559872a2795878883", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963948, "uuid": "b46665f9-0835-4dc7-97d3-16e3a628ff50", "value": "T1B046F805ADC42BE6C42C9B7484FACD5223742D144BF14A266665FFE8BCB62787F4389C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963948, "uuid": "8ce6a991-6777-4519-a8a6-60eb215992bd", "value": "24576:vq1rfU5APwpBD33rT1/ORBsd4pn0NX0vMJiaXNWYBu7lijI38XOG059EnNTQOWls:S4OMFx2Ob+G49kKqnO97Xeuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963948, "uuid": "6514b004-1aa1-42b0-96ab-f208d384aee2", "value": 5439488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963948, "uuid": "7e44dfa3-82ed-4b5f-ac4a-fb988e0c8eb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963948, "uuid": "32de0406-eedf-4966-b2d9-e26e5b4bb2e5", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af567d6-ac7b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788977989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977989, "uuid": "c6a3bb75-2918-4ba8-9cb8-f4c2a6c463f5", "comment": "Malware payload (Vidar)", "value": "adb0a3db727b4d5ec87ed6d4af4e16fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977989, "uuid": "08e0c934-7603-46b4-9ff7-d0ab5fd50de0", "comment": "Malware payload (Vidar)", "value": "6850a9d2b84bf20f741bf21af7476307220544cae9f6c0e67ce344d2784193e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977989, "uuid": "702bc4a8-3e53-4c82-acc4-41ab6355a155", "comment": "Malware payload (Vidar)", "value": "509a41b4922b627666dd371e78df2c969f46e61b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977989, "uuid": "89ed9f84-0a6d-41ec-b2ab-a19becde2e5a", "comment": "Malware payload (Vidar)", "value": "b15619fbf48809f08606ca142116666b7b386095e3da0af84c64d1744e74b4ac6e4f1e958c1ad013cd38d42084686c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977989, "uuid": "63b36d6c-427d-442b-a814-5ae56dd18982", "value": "T185D67B07A96546E5C485EE38C57B8352B678BC8D8B3173E36E50BA783F763D099B8340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977989, "uuid": "1bdd3e13-1446-464e-859c-e038c931a9b4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977989, "uuid": "76adfb56-1985-4584-a48b-c2234f1b316f", "value": "49152:xjInNwPAyQYyjiBz7Se69qt5r1cKn0eIfMCpFEC1rsBHOaak+ltR7MdTmsWmwBN:x+U+V+CNSHXaVT7ogB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977989, "uuid": "f5f4e0b1-e785-415e-8eb3-e51416d50a5a", "value": 13131776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977989, "uuid": "a75bb408-8cb7-4dc2-b0cb-b523a26c14a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977989, "uuid": "1c31ab24-b21d-4d60-8eb5-a8adf5d57088", "value": "6850a9d2b84bf20f741bf21af7476307220544cae9f6c0e67ce344d2784193e8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9634767e-ac17-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788935272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935272, "uuid": "dc8249f0-6bff-4f31-89bd-339dd9761cc9", "comment": "Malware payload (AgentTesla)", "value": "80ab4bf94122a0765b9c97f386adfdc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935272, "uuid": "ad269937-5918-4242-b67b-ebb35da64c9d", "comment": "Malware payload (AgentTesla)", "value": "6850e8af2ed66c527d5e7d6e40e62275529a97225dbcd80d11cc4ce56c44b0c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935272, "uuid": "a4e0c3fa-d955-42cd-acf4-c86fa1bfa067", "comment": "Malware payload (AgentTesla)", "value": "0d922242698313b69a3013f58c8ea885a85d6e4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935272, "uuid": "9eb5b1e8-66da-4c9d-adb6-639a21393049", "comment": "Malware payload (AgentTesla)", "value": "c510b928471dadef4d8118f3be64d928c9fbc889dc1f733eedf6bfaff6c8e37785a8b65a8d900d46b2b30837ddc158a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935272, "uuid": "5980c0b8-d99a-4bc4-9098-ceebdf808c55", "value": "T147A2F2B3447981400DB7CAE11825E05A2E4586FDDD4E02E70487DFBD2EE4DCBC679E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935272, "uuid": "d634fda5-9f56-44ac-8c3c-963244407c36", "value": "384:5SiraQMbwx8qZjmrEZSsr7Yc04f2DYmFNBvlS0kM06dLhw93p/OGDn7FOB0x5jkP:BxJjmgZh7Yc04iYmDJlSehwppx3FOB0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788935272, "uuid": "871a9e58-c0a9-484f-b146-285c9d1740b0", "value": 21787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788935272, "uuid": "4570a578-312a-40a4-a4d9-34f9ac4a6f86", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935272, "uuid": "398cbe85-60f2-41a3-b2b0-e3d325269298", "value": "POMDSI7336W.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c14ba3-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "be437570-a8c5-4d60-b123-bf19630a5d55", "comment": "Malware payload (Mirai)", "value": "0f7006dce1d42c32bb94e97582a600ac", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "a94bb474-81e7-4bfe-9739-acb1582517f3", "comment": "Malware payload (Mirai)", "value": "687cf34c468538cd82daadd824be3fe692eece454eaecda0e65bda233ff329cf", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "9b5e9e06-27d1-422f-9997-0bac1036656d", "comment": "Malware payload (Mirai)", "value": "cd5d7570b044a54e13d1dab8070d3d4218a01509", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "5cbd8a82-0c90-4be0-81ca-7633011816d6", "comment": "Malware payload (Mirai)", "value": "81e485497fe83f73278d54f006b0131499fbff7876fc01b2f0de6d06aaa165c634105b0b9c570595bf91bc10a602e0e7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "30b7fe87-afc9-47cf-94c6-07c5d53770c6", "value": "T169F33A63DA26AF56C112A0F4A1F18F751B22AD6A09530EFEA477DAF44183CCDB205774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "39397e0a-8e0c-4a8e-baca-e1f5824ec61b", "value": "3072:ZXMaZ5Hvx1VV68fu1A7g1K52sGWhuhjeTk:ZH1VV68fuWOuThuhyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963451, "uuid": "4ad091aa-cec8-42eb-9701-43d6636ed4e3", "value": 159644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963451, "uuid": "c25aeb07-2470-43b3-a492-2d2d736b4123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "8d1e12f7-0294-419d-86c1-d5e3a75bc978", "value": "wife.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8429208c-ac0a-11f1-ab4f-4201ac107002", "comment": "Malware payload (RevStealer)", "timestamp": 1788929659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929659, "uuid": "f5442f8e-a00c-405a-a97f-dbaed3aaff2f", "comment": "Malware payload (RevStealer)", "value": "97233bd638c3f83252b8f2bebcbf3bec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929659, "uuid": "32dd9855-e82b-4d19-80d5-0b76e2bee6bb", "comment": "Malware payload (RevStealer)", "value": "6906a1bdba988bc588d9bb4b6fb77d37f75d30587124ff46e704ae27a373ed31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929659, "uuid": "af65af82-a909-4cbf-95be-4074eb98ea01", "comment": "Malware payload (RevStealer)", "value": "d398bc64ef265185c060e56145f361f63cd94d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929659, "uuid": "37045732-59d8-40a3-832c-c9f83ecdab58", "comment": "Malware payload (RevStealer)", "value": "b05a0a78be3e509f27b46257182e385f22c59127b04bcbb13cd384f7fa09d7b712d43b2e46483423695c45db0c12f317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929659, "uuid": "4d82d573-3937-43ba-8ace-224751e12680", "value": "T14ED523A5BDF15574D83BC3B28DC2E6ADB22E37804B648E473ADC65048D53A94AC3633D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929659, "uuid": "066f8551-07e7-40bd-a828-e7a078a3b1f5", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929659, "uuid": "978f1bb2-628f-42c4-8708-e7b5c1839212", "value": "49152:2hzMoUM5zpVJA6hHpIE/ZSwN+Kh7VHWagq/CMVCUuETAJuU3Y5nMWaG4jPz6cIF8:2dHUy9o00iHBUqHMEsEUAMWOScI+BU+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788929659, "uuid": "fd12b7d8-e3d8-457a-9a37-c08ec3d35133", "value": 2979840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788929659, "uuid": "15548de8-c68c-4e7e-bd76-59b11bdaedbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929659, "uuid": "6707b97f-bd31-42b3-9bd5-6031f44cae19", "value": "6906a1bdba988bc588d9bb4b6fb77d37f75d30587124ff46e704ae27a373ed31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32320c9d-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "3d894f3f-bd1c-48fa-b53d-da5d23269fdb", "comment": "Malware payload (Mirai)", "value": "356ba4d5aa0f3ba3e55bc33e85707772", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "fc50a059-38a7-4a81-ab92-2ff3592af23a", "comment": "Malware payload (Mirai)", "value": "69dd3b30fa5f84cafef0e09719de25bacecae56820f03362b8da7e313313d27b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "cad45334-6ab2-4720-bb44-93aaca3cd334", "comment": "Malware payload (Mirai)", "value": "72fa44ae60c4eda3624fbc983636bc0f46f5ed7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "a12c5ad5-3cad-48de-a233-25db7539b63f", "comment": "Malware payload (Mirai)", "value": "40dd2e41179547959a2498962cb7bae8aa09439d19059ea48e22389d3bb7d00d7408130c6fddc8be53ded642d469a69e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "dd76eb37-d4e8-424b-acbb-d04dfe495c17", "value": "T1BA141883F901EE76F40BE37644A30806B630BFA359520AB671573CAFD97A0D5152BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "e800608d-b49e-4b9e-a866-8c0599012d16", "value": "3072:6+rx7qXd1Zo3UnhZXhBibyhekzGec7StBn73xmhOKRbV9jbiVL+WMx0eL2:Fx7qXHXxwyhzzGec7sBN2OKRyL3M0eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963451, "uuid": "201c725d-7bb1-4068-a727-8d4fd41976a0", "value": 202536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963451, "uuid": "532f88a2-9905-4a43-92e9-780c1066d539", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "09b7f649-bfff-4663-9731-2f0785c30f68", "value": "wife.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4de1ab0-ac4f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788959349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959349, "uuid": "1602ecbe-959b-4756-a4cb-5f213a950205", "comment": "Malware payload (Mirai)", "value": "5c70799bf7a49ffa2af31e79ca0c018f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959349, "uuid": "c9549c85-8ca6-4bd0-a2b9-177d4201b63c", "comment": "Malware payload (Mirai)", "value": "69e2b050ac6f37c17fac1f887a81e1374744ee7e7545e551ee8de009170dc03d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959349, "uuid": "31a09f3a-d8b2-49db-9550-54c8651af4fe", "comment": "Malware payload (Mirai)", "value": "500d3a2d0a6554af385f6d89b98b66ec731a26b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959349, "uuid": "13a0e1fa-093d-42ee-b309-678eca2b1314", "comment": "Malware payload (Mirai)", "value": "f41c7f0dfde1b2a7dd7b19f587fc0a5d980fbfe0f82a36c290ab9960ac2951f4259288ccf7ef4cd9bb9af4984978cd23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959349, "uuid": "b6f4777b-178b-4bab-8017-5b8b8ad5f7d8", "value": "T15C440813E342CCF9E13208F1312B77A09D66813B5D67E497FB510A61EDAB54E013AEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959349, "uuid": "c1f632a6-8400-4e36-93b1-395f5f2920b6", "value": "3072:JNJVriTVe1rM7QHSY4DnnvJdc5akZKlJ+4oG2TKg5YAqHLj5wo7z3R:ZVOTVe1rM7Z3gjf4Dg6HLj5w83R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959349, "uuid": "732dc99f-2030-4b30-873c-a88bd879fb7e", "value": 255372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959349, "uuid": "b3263b14-daac-430e-988f-fe447e94c6a8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959349, "uuid": "b8abbabd-9122-48c3-a411-28dd4f0a56b5", "value": "69e2b050ac6f37c17fac1f887a81e1374744ee7e7545e551ee8de009170dc03d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255f1051-abf4-11f1-ab4f-4201ac107002", "comment": "Malware payload (VShell)", "timestamp": 1788920051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788920051, "uuid": "d8d7a4c1-dff8-4498-aba0-2f85a9f8b33e", "comment": "Malware payload (VShell)", "value": "b227ef0695eef8e01bd58d697fdeb500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788920051, "uuid": "7dc8d8c1-c4f7-468c-9ae3-9acd23b3214b", "comment": "Malware payload (VShell)", "value": "6be8c092507dc1e7105e56f5c5aaae527be511884105b1b3895ba6ce1d869d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788920051, "uuid": "4ad3e3ad-4cd7-4ca1-af0a-245cd3d2d1a4", "comment": "Malware payload (VShell)", "value": "d056d36479d47b786bf92fedf1017f03d3c95219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788920051, "uuid": "f8f89cbc-7501-44f2-8b63-b23997eb7c91", "comment": "Malware payload (VShell)", "value": "bdcd172c066c8ebd8e0f624b566423ee8f994fcb12965278e72955504c6df2dd109681cf35fd30c0e453520895f0a367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788920051, "uuid": "083cf52f-50e6-4a54-9299-4032d093acb1", "value": "T12991A5C5F75BE6B2EC1C07F500A3B9A8C4682E14827C9B564FE16F0C3C111AA3C2DA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788920051, "uuid": "8c1e137f-a578-4804-be73-9037caeec038", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788920051, "uuid": "5ee48ca0-b780-46b3-a676-e2de664cd8ed", "value": "48:6I7lwe7qz08SLJdSR1Ig9TPe1YpV1ZsSZIXxhxhwcRaK:Pl1y091q1Ig9T2Enwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788920051, "uuid": "0b82c9b7-a0b8-4aea-89fa-6f32bfa149e0", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788920051, "uuid": "ea2b06ad-c89f-4524-b657-b33d9b0c852d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788920051, "uuid": "873f024e-a686-4566-ac38-f115470831b9", "value": "6be8c092507dc1e7105e56f5c5aaae527be511884105b1b3895ba6ce1d869d91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89338eda-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946847, "uuid": "1247deb4-2cd7-4cfe-be2a-2977b89115ee", "comment": "Malware payload (Mirai)", "value": "17be77cd36f6148af8a320df256ea0b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946847, "uuid": "213a3d31-9645-4158-b975-a7ad1e16b92a", "comment": "Malware payload (Mirai)", "value": "6c36aaf35baa312a513bfea1afc62293889b9d95937ae8401776383728d36468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946847, "uuid": "01481933-a67d-4d6d-ad99-2bfd235eb189", "comment": "Malware payload (Mirai)", "value": "406c0f2b58cd31984cf93c4364c8578cf0e960ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946847, "uuid": "eadd31c2-c655-41c0-8a78-a3b5cd9e5342", "comment": "Malware payload (Mirai)", "value": "db9d274cbcbe5de349205050eeac614dd99879cf0652ee16894374f9147f604a744962b1ed86a71397cfbcaed04b2c39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946847, "uuid": "03238230-5de3-480b-b4f6-8e4cbdbfdeea", "value": "T1F8148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946847, "uuid": "2ce4f1a3-fcd6-4b0f-9712-f69a33f0cdc9", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dq8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946847, "uuid": "0f4fce19-95d3-42d3-a4a0-09bd7b1c6b14", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946847, "uuid": "c86c51c2-2dcc-4f63-9352-88977619f930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946847, "uuid": "0c166bbc-1870-4e7e-90ef-ba66ece14691", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1082bbad-ac7a-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788977568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977568, "uuid": "d78f96f1-6e4a-46a4-b849-95eddf93a08a", "comment": "Malware payload (MassLogger)", "value": "0625ac509048f48f83467732346658bd", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977568, "uuid": "842405a6-cd33-49a3-a55c-2869bb613943", "comment": "Malware payload (MassLogger)", "value": "6cf62cdc0999720c82cd3ab225a00c52a1974110056b3e7f21f8719d7d32205d", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977568, "uuid": "4b8afb9f-a261-451c-b9a6-6878f41d1a0a", "comment": "Malware payload (MassLogger)", "value": "0edc10c135940a6a6de481dfbf09dc806d31c19d", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977568, "uuid": "8b8234ed-f92d-46c5-96fa-54e0a9fb8002", "comment": "Malware payload (MassLogger)", "value": "03872486a3c686f86aab0a9aa000914e3f42a5050760cb0e28f91716913599899942abaf7dbae97f9a5188b44d304027", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977568, "uuid": "ff0c6c1c-5c4c-4cbf-abd1-57b72fa7bd72", "value": "T1F1449812EF3615A4C20D5ABC52D394ECACF52674946CABC35CEDF1A15F3B204E0AE94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977568, "uuid": "aec1e910-8283-4606-ba12-10354e9d3c7d", "value": "192:bckldiiPo3LVcUpheYy9iaWIT1qYnRLV3kldiiPo3LVcUxy9iaWIT1qYnRLVTWHp:bENtZNqTqGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977568, "uuid": "8ce35e8e-d91b-46db-b718-4d269ce90f83", "value": 278465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977568, "uuid": "db5b976a-7bf0-4a80-a8ab-8942fba44c78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977568, "uuid": "6a095cf3-25c6-45a5-a922-a00f7ede4012", "value": "e-dekont.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c93678b-ac6e-11f1-ab4f-4201ac107002", "comment": "Malware payload (SalatStealer)", "timestamp": 1788972596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972596, "uuid": "96c84291-f997-4adc-b9e1-81bd95c80c2d", "comment": "Malware payload (SalatStealer)", "value": "d6dfa25d2c64147ab1188c4786ccbf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972596, "uuid": "628b5e6f-a354-4b79-8e84-170c90d72077", "comment": "Malware payload (SalatStealer)", "value": "6cfb4609e950b151d76ec4b0b7330e5a9fe557e47739b2eda9e6f0dd071bd0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972596, "uuid": "b985c394-1daf-4523-aad3-8fb797e55627", "comment": "Malware payload (SalatStealer)", "value": "f9546c643520688cc2717931c571e51b4cdb2260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972596, "uuid": "016a6280-7084-4ddc-9d95-1b8696a80b7d", "comment": "Malware payload (SalatStealer)", "value": "fe912a15154d1c1c14e52b3b0aa5f896886b0dae2e48f679c2f95c5463e3aadc51a7b9a41cfb729109692cefc4530c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972596, "uuid": "f2d3a7c4-0d84-42b3-87fd-6ca9b37776b7", "value": "T178F53302D4239B6BF132B77FDDF57D8C157A995E0A2E9BEBBC235B060460CE4A391118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972596, "uuid": "6abb1e81-8628-45be-b54a-529134878f37", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972596, "uuid": "0d35b82d-1195-46b2-9789-7f148e9c3bba", "value": "98304:cFsoSEz4YhxoSdOvuFW4oFe4lc8++geksRJ8Jw:8UIOvuFW4D4lDTk88O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972596, "uuid": "daa39532-e6a4-494b-9390-cfcf6cfcbeb0", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972596, "uuid": "ce0f3aa9-0605-4753-839f-9f3bedfa3efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972596, "uuid": "fc7acd05-f61a-4ea5-b640-156731ca21ec", "value": "RKNobhod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3a1c32-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788933192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933192, "uuid": "dd9fb266-60b1-4177-b9c0-4a4029eb26c7", "comment": "Malware payload (PhantomStealer)", "value": "cc57c7bbfcc69ef7bb24f719a0984d9a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933192, "uuid": "04f17d7d-674a-4ab3-b395-7b391033e7eb", "comment": "Malware payload (PhantomStealer)", "value": "6db6c2539b854f3008095dfe17053b2e8f2b8574c90f9fcbd0696f3548dedb34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933192, "uuid": "60df8c3d-7c81-458f-bb84-ea7f44657f97", "comment": "Malware payload (PhantomStealer)", "value": "738d7d6e2fdc5228909c45d93f7d42ff7c5e5ca7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933192, "uuid": "dd72e6e5-0988-47c4-acd4-81f5b733d310", "comment": "Malware payload (PhantomStealer)", "value": "63db2d38b58bf47a0458e04ac0669b2e49a617183d8b4f9935cf45b6b8c4d535436535275f3d52f3f0486cb18e8bbad4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933192, "uuid": "5e781f9f-0be0-46e6-809d-6b9ffc73b6a5", "value": "T1DED6F749136496323762ABAC4239CC21E9ABD60396C6CB55317CD3183BBCD1B6319BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933192, "uuid": "eb643961-a64d-4314-bdb3-34a204c6f155", "value": "196608:SBd4zNlBYaLXls339ifCS28o746Flx6BnisU/VOln7ye/yt3B176Xm9ib/ErDtor:OPor/y5B1e28/ErDtfYcph1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933192, "uuid": "7e60224f-cd65-43e6-95f9-ed556938045b", "value": 13205681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933192, "uuid": "b9567a30-76fd-4ff1-a5af-aa5f0b44c56c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933192, "uuid": "c1762a4a-59cd-4d50-a3dd-c9f50f9375be", "value": "Sales Contract.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46c4bcc-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938383, "uuid": "7f66baa9-e578-4b29-a27c-a352cbb007e3", "comment": "Malware payload (Mirai)", "value": "d05e29bd2df7cd1dee735f949c71d97f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938383, "uuid": "fcc32f6f-f46b-4b8b-aec8-9ec775871091", "comment": "Malware payload (Mirai)", "value": "6e08313bd0b1a42ea306201de99d1bc4d8634d7c75774d8744cb102fcca038a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938383, "uuid": "12db1682-3f66-461c-a9d3-18e62f4a64e9", "comment": "Malware payload (Mirai)", "value": "f73c9c2c2cebae905b3522e5942d84be4fd3c1c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938383, "uuid": "d9740649-ac1a-4516-803d-0a8f13ffcead", "comment": "Malware payload (Mirai)", "value": "b199d1a5cd829839210ec98dfaa838df9bb36887deb4f36a7eee83b5ea9d13dbcc75ffb992dffd2d23b6e137c17cfb8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938383, "uuid": "585bbb4b-8fdf-4703-885f-097129a5cd89", "value": "T105F31841F9404E27C6C712BBFBAE428D3B2613E9D3EA7103DD215F213B8A95B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938383, "uuid": "ff5fbba5-60ef-4f28-a67e-b09b78dff939", "value": "3072:ikDX5s4vbdUgZaLmO94TvFjxHPxAph7jV6hh1LZ:ik/U+ul947F1H5ADjEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938383, "uuid": "f15e74dd-2c54-423c-845c-d18b1704130e", "value": 158880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938383, "uuid": "cce68494-f495-4968-a0ea-19c392b8009b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938383, "uuid": "13b6746d-555f-4f83-94a0-c2927819de21", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b56529-ac6c-11f1-ab4f-4201ac107002", "comment": "Malware payload (Prometei)", "timestamp": 1788971703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971703, "uuid": "75cba835-1c2c-41b8-906f-04ce22ea5210", "comment": "Malware payload (Prometei)", "value": "a2e62be560a131d15896334778f820d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971703, "uuid": "3dd2a76b-8a53-4135-9538-b4b28d40b3d6", "comment": "Malware payload (Prometei)", "value": "6e631ff8fd90073f95bff79bf094d37ecf130f016c4a41cd01a904016b8b0c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971703, "uuid": "3b7e3b47-f4c8-4777-ade7-ce4e1e9802b5", "comment": "Malware payload (Prometei)", "value": "bb7dcac3fcf8fb4271efbd4ac2bc9b7dc8cee1bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788971703, "uuid": "36c64a36-bc37-410d-baaf-1956c71a5188", "comment": "Malware payload (Prometei)", "value": "d04b424ee96a3377aa8cc9f5ced1f6fe652111008b436bfa108dc9769a5b2a5c015331cff7c09982c30ed5a82ec4bf3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788971703, "uuid": "57f08a14-fa4c-4523-b46b-bffa74e5af73", "value": "T10FA423B4F9219E8F6DD769B91B24831DE182C172589D4C2313AE95E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788971703, "uuid": "281e9564-53db-4eab-a44d-c3855bb8c262", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdY:Fs6pyCC/Ya2hpi6T6N4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788971703, "uuid": "096cc9f9-8c95-469e-8719-b62350ae6d99", "value": 449085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788971703, "uuid": "ab2d3c09-246d-4816-8873-6cc64df3836b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788971703, "uuid": "25906452-3be9-43c5-adb6-926550711007", "value": "6e631ff8fd90073f95bff79bf094d37ecf130f016c4a41cd01a904016b8b0c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4da0d0d-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "446c66bf-99d7-40a6-a763-3fceb7ebe1b3", "comment": "Malware payload (Mirai)", "value": "0c84d1910572162eb89889bdf4a32f8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "e122aab5-f1de-4056-8fea-3eab1efb4e3d", "comment": "Malware payload (Mirai)", "value": "6eb00b2544c679e6d6664d150791b938bb62f096a02376dc911384d5bd058802", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "42a52386-34de-44fb-acb2-d8ca618933fc", "comment": "Malware payload (Mirai)", "value": "f4f7909bc59a95c2b4e17d8937a1d9f77f9fb927", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966274, "uuid": "f6de59e7-9762-4be8-a81a-c9fd994f85af", "comment": "Malware payload (Mirai)", "value": "0f95427d0258d76cacae7fe914e831060e7bc205c7d9fafda22507da40cb4b1951fe11cac6eeb9df80c1e1057216b7cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966274, "uuid": "73837f69-6888-4bdf-a357-a2009e849ecd", "value": "T1FA515FD433128A30BFE1999AB5F5482470C0F091E7C5AF05D9EC66FD864CF0C26D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966274, "uuid": "a146e667-5754-4a14-a348-2f6ecc081a26", "value": "48:vXKN4KNaKNgKNuKNg7zEKN7KNqKNdKNsKN0KNEuUfKN7KNoKa:vXKN4KNaKNgKNuKNkEKN7KNqKNdKNsKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966274, "uuid": "c7b1fc17-7444-4481-b07c-ecba7b8086d1", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966274, "uuid": "8c6a664f-16a3-4680-b8f3-db9b716c500a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966274, "uuid": "b1f64525-ce12-4195-8312-3fd8d77558fa", "value": "pulse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a36912-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "3dc8fe3f-a4fe-46c8-b676-d054c55403de", "comment": "Malware payload (Mirai)", "value": "cab61b14f4d3a56457a6f9bd56c01dc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "a1f2bbea-cddc-4299-bf7c-e06a3b5c5003", "comment": "Malware payload (Mirai)", "value": "6eb93071b960088e2c2a440519fe57f0e19c9c6504f9a5437a42e27aa23e5f57", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "2da4bc28-15b2-4f3f-99d2-b3c1819cc30d", "comment": "Malware payload (Mirai)", "value": "b1b425e28aef555cfcd5b64fe8c579ae7f373c58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "65c28a16-90a0-4732-a5ce-255bc200d1d6", "comment": "Malware payload (Mirai)", "value": "9c6694bb6ad3b02151bc507c10b575dc833232791004f54fa1bf6cf7154134a567624edf3cccda7c91d49563aa8c2fba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "e513e941-7363-4878-a23a-f3c529323817", "value": "T1E7462B632A5CD70EC329113419B2CEA857792C4A86DBA527B242F30DB9F21BC595FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "b6b2db20-0c8c-4217-8cf9-90af32a04fe6", "value": "49152:Q6lQycFuPL/htSdR4W0+tzlFGUrriDxDhqNGnV57faBX3u0HH:bRPhTnWk0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963947, "uuid": "302f12ca-fa9c-4697-9e10-37b6bdb0025f", "value": 5439488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963947, "uuid": "ada7279d-1586-4033-ad1b-c34901c091b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "5314234d-749a-412d-b354-75e43e64a2af", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd4bd76-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788948033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948033, "uuid": "4ebc0156-82dc-4dc2-8dd2-22dd687698ec", "comment": "Malware payload", "value": "23ab78a797d2aeb06a28ecbd2e5adab3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948033, "uuid": "cbccba64-d914-4479-9038-072f4e43baef", "comment": "Malware payload", "value": "6f3c6bd0932d5f5cd3edeed20c4ad3f52aa24b245601c08689109292a1cee586", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948033, "uuid": "afdeaec5-7371-45b9-888d-d90a67bce081", "comment": "Malware payload", "value": "24de22f8c7775938d184263839e5f65bc2d7ba1e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948033, "uuid": "1603805d-1475-4490-8bff-f743b39eff5f", "comment": "Malware payload", "value": "518ea0f0332b247f03bad24228aa0eab44d4eccc8bd768a378e1d7d7c7b6d331fc3d657a2124ccb72a4c5933fef523b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948033, "uuid": "ab87f078-baef-4887-a0b0-00174b99c107", "value": "T199F29791FDB5C9313EBC413C249A50259686891B42FDF814F16EB89CAF2C63470B97BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948033, "uuid": "b44e8127-f4b6-4d5e-bbb2-cb2eb5c1d657", "value": "768:A9vZ3PnrfPSohu63fPbCjBkVbBkcY90KN5LqbvHCSbPI4s17:O3PnrfPSoU63fPejBkBBkcY90KN5LqbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948033, "uuid": "d197bcfa-cf2a-4e1b-95cc-72503705f910", "value": 37326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948033, "uuid": "c5a94712-4cbb-4924-9ef7-d21692cf865b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948033, "uuid": "d4283601-6c0a-46df-8266-6d977b2ca968", "value": "6f3c6bd0932d5f5cd3edeed20c4ad3f52aa24b245601c08689109292a1cee586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4e6335-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788966024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966024, "uuid": "2f7cc448-ec6a-45a3-848e-d97126e77b72", "comment": "Malware payload (Vidar)", "value": "006deb51f346e570c121c9d7c047386e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966024, "uuid": "092d0bc7-8482-4779-9a80-958a76280852", "comment": "Malware payload (Vidar)", "value": "70077e5e31e5ecf2a983448f2cf7e9e64a19a621e4344d183a271c2e10f69118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966024, "uuid": "3ae99568-d179-41ac-82dd-d186c647e36d", "comment": "Malware payload (Vidar)", "value": "f133b4de3d2b6e9097e86e186b635fd1754ba3f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966024, "uuid": "36e1d119-a071-409c-8f95-c8c708aa73f4", "comment": "Malware payload (Vidar)", "value": "97ec26f7ea164ab3ce8d2a0e40bd6ed014549c8d146edf70d5fd721408f72c51a23e83e88e7750a9fff69d2ee76d3f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966024, "uuid": "2d521c1c-739d-4a22-86ec-87a891c34572", "value": "T1FC366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966024, "uuid": "3783ef9f-8b31-41a5-b3fb-9a8ded786e1d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966024, "uuid": "6fdab69c-bb59-49a5-8293-ad4f9ab9f6f3", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaal:uc3XND1aJrCOkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966024, "uuid": "f989cc68-370a-48c1-9b2d-66c1664036f9", "value": 5001977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966024, "uuid": "9844a4ba-93bc-4674-9e10-535f776f122e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966024, "uuid": "a8b40348-357d-4f5f-be9e-623f5b7c8fb4", "value": "70077e5e31e5ecf2a983448f2cf7e9e64a19a621e4344d183a271c2e10f69118.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50455818-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788977246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977246, "uuid": "c9d1b4d8-7c83-45f2-8b28-9db32e90abbc", "comment": "Malware payload (XWorm)", "value": "785efa57e62b927c41512cac4155c2a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977246, "uuid": "0a7e1558-d4dd-41ae-8187-b18b0a1a2630", "comment": "Malware payload (XWorm)", "value": "70255ee15ce8ad819d5b36616a72822cb1a1e4e6d0f4a45ac372cff823f0214b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977246, "uuid": "09daf267-24b6-4517-8360-71c29eae9bca", "comment": "Malware payload (XWorm)", "value": "d4ee3b61daa3296255b3ffee2eb5663910b9c853", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977246, "uuid": "0521d450-2a67-4b54-bc18-805a62b835d1", "comment": "Malware payload (XWorm)", "value": "5377f0ea99148a0febdbee76ab3398d464a41f787dfffee21467a1b6b45658ad1215419b62f1517a9c91763a749a48cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977246, "uuid": "9ba02436-ab51-464c-80fe-f7c4746e7659", "value": "T12FB694489F04A631A53DD72CCAB969309686320390E4EB5E797C232DFBB5717135CEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977246, "uuid": "ff38d3b6-d736-4acc-a1be-7f5f4632ff9f", "value": "49152:zhI3qsJPwWbfW7X25uKOvrLwLnw9y6eyQuPPpggLt0sDsiFB5KuD:eqwPwWbfW7Xau3vPwE9y6ey4gLtVDF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977246, "uuid": "f1ce9ed3-4f8f-4767-b1b5-38b520db78d0", "value": 10655241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977246, "uuid": "cdb981bf-b83a-4157-9acc-969d2fef8e9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977246, "uuid": "763e9c28-9e73-41a0-a970-fabfc709cac5", "value": "RFQ MT-RM38387.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bc1449-ac73-11f1-ab4f-4201ac107002", "comment": "Malware payload (BTWStealer)", "timestamp": 1788974846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974846, "uuid": "5300817e-23d6-4c08-a2d7-05a8a9fa9a51", "comment": "Malware payload (BTWStealer)", "value": "4ee07e6c1f3212b798b1323f4f7ff15e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "Csharp", "colour": "#11E580", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974846, "uuid": "c231a3ba-a082-48b6-ae1c-b7328014d27d", "comment": "Malware payload (BTWStealer)", "value": "70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "Csharp", "colour": "#11E580", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974846, "uuid": "0b20b469-7839-4bf7-a568-afe39addd904", "comment": "Malware payload (BTWStealer)", "value": "468fad5fb87ed3a2716dc0cf3feec495bf18b6dd", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "Csharp", "colour": "#11E580", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974846, "uuid": "5b1b2a1f-18d2-4280-bdc4-7334e1647336", "comment": "Malware payload (BTWStealer)", "value": "72c52e30339f93f28214008614721bd685839fff761726818d78ad7d3fa32999cdccaff3c36c664ada037445b0e17dc4", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "Csharp", "colour": "#11E580", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974846, "uuid": "b0e13392-563e-4d0a-8f1b-07ed720e5215", "value": "T182082212E3FD41E9E1BBC17889265627E7B278551720D7EF21608AA81F33BD06E3D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974846, "uuid": "989ec919-ae3d-48ee-8a77-6e2ab5dabd60", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974846, "uuid": "8ca0378b-ffe8-4c3d-b1b9-8d899da4e069", "value": "1572864:Xb8i/YOYZX95YsrNy/6e8wLX+JgG1K1OwsSO1YLL8RcD1qYxEpV:Xb8i/YjnYA4ytJgwqnmqACEpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974846, "uuid": "58a23897-710c-4379-a94a-becf357ac956", "value": 80577147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974846, "uuid": "c4679d4c-b37d-48cb-9f36-5b1e893169ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974846, "uuid": "83de2fb7-c5b4-4a5c-be74-a7b6986a0351", "value": "ChilloutVRMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22ff44a-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788977437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977437, "uuid": "301636a0-d0d0-4e9a-9cd1-d6abd512aa23", "comment": "Malware payload (VIPKeylogger)", "value": "d2915245c0afe7b3e00d1a0875ffaff1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977437, "uuid": "5bfbaf30-660c-497f-b756-419c1b9d31e1", "comment": "Malware payload (VIPKeylogger)", "value": "70a77be0f5f52c00b9aff3b0fc9a5ae982d7f857d01b94a6def8ff67b7071c43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977437, "uuid": "0807cab0-3d84-4109-b01a-6b38332c90df", "comment": "Malware payload (VIPKeylogger)", "value": "bde64a36832bd60f97a8a9a834ac19903c56be33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977437, "uuid": "19144507-27b9-4295-a664-a5e78819aa4d", "comment": "Malware payload (VIPKeylogger)", "value": "45d8b8ada082ec2700b035f7eca8ee46a182770a5a59e959c41894c23abf20f71293814e1bb6144e3cf2747965f5a810", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977437, "uuid": "e35408d3-1c85-4332-9d1d-bf8bae629c69", "value": "T12665432EB93DB0588CCD7126A22563B1C44A5EBF23775BCB2C10FF91A642C719CA6717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977437, "uuid": "8535ba5c-3444-4646-9ee4-70803f9e9980", "value": "24576:vJ6RRuYRM/siotExGAYjJNHq+gwFj2gDOcUa9f+nlF:vJ6RRuYRM/siotExGAYjJNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977437, "uuid": "baa5b26a-0f46-44eb-97e3-cebd61618842", "value": 1471814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977437, "uuid": "a67d3520-46ba-4dd2-a9af-2a08828b2190", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977437, "uuid": "2c8a80b1-a947-4a62-a0f4-6326ce7b5b78", "value": "FAXGD0987655678909YADE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58929872-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "15940c6c-2101-4aae-b2dd-15f8f8c0d651", "comment": "Malware payload (Mirai)", "value": "2e4766b77ff931c8d21595ea06ee24b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "c06a59e8-4893-4ef2-bf06-c5bc35cff8c7", "comment": "Malware payload (Mirai)", "value": "72b15af6689fe693027280854bc9a70f0000d8d63a7c6ab9865697e462e9e8ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "18f713ed-c5a2-4c08-b4ea-0ca01ddfc552", "comment": "Malware payload (Mirai)", "value": "1934aa4a7a57f0900fe88c9456faf9ccf76769ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "c01c93aa-b06d-405c-bc79-3fd07d0f1478", "comment": "Malware payload (Mirai)", "value": "6b8745813be151c64ac5b77a4b296e554dd9ba48476bd6266ebf60fdb2b64e1473d86ba958ecb8aeb7ca4e4cb4bc5b11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963945, "uuid": "815bea4a-bc92-4c6e-bab6-ccb5b3620fe7", "value": "T1D7364A9DFC2EE452DD88AAB46B614197B734BC099F41C7222714B7ADB8F33D49F12260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963945, "uuid": "0afd070f-0c3d-49a8-94b9-98cdde57b9dd", "value": "49152:kGwZOoiqAdsf4JZK8JI8OH5EU9/Pcs7et:qZO/qAdsf4JZKKI8qEKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963945, "uuid": "4be4ab6e-b085-4f64-bbdf-976c10c40b9e", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963945, "uuid": "aa6d3d64-a414-48bc-9f2e-2162209f6b4e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963945, "uuid": "fb6290d2-d31c-4644-93fe-527d934f4225", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2325e866-ac1f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938515, "uuid": "f6317d55-2575-416d-9c06-54056da0f663", "comment": "Malware payload (Mirai)", "value": "4fdeb9f655863d888f8c39ea2cb57d35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938515, "uuid": "612b0060-deda-4833-806e-5e3d5f71a478", "comment": "Malware payload (Mirai)", "value": "72e8bef36dab789468552a3c55c40a6d836cf152fc292e125b6a5018b823af25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938515, "uuid": "f357f88b-0192-4f64-a067-2ae5003ba289", "comment": "Malware payload (Mirai)", "value": "4e59f0b1270b3a83bfe760959a7945cef4334dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938515, "uuid": "e44d158d-bf5f-4732-9ffd-b4b20dc0272a", "comment": "Malware payload (Mirai)", "value": "d45f8e1e3825b5e8a7e8526233615b3815241004e5972d11f44716487f5d8c1dfb0ea1c26ebd7f5ed2c3910a95e09195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938515, "uuid": "5fe378ee-f1b7-48c7-a587-c26d66399af8", "value": "T16CF32B52F8814F16C1D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938515, "uuid": "fd1a78e8-ea5a-4c3d-9c8e-768c89654cb4", "value": "3072:Q4tT6DbYLmXf3q6EQdIo3XTa5mQ/OkJ/GiJF2UGP6hh1va:BtwbYLmXf3qXuFXTaYQ/xJF2UGKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938515, "uuid": "2825383a-0c78-43be-a1bd-8c529cf4c151", "value": 170972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938515, "uuid": "209bc25e-edb0-4a73-9678-4f28479aa1ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938515, "uuid": "d88d44b3-30eb-40bc-8bc3-31b417345601", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b5d7d1-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938248, "uuid": "8c81f089-4423-4936-b25b-13e66126e160", "comment": "Malware payload (Mirai)", "value": "d0a15850c38fc04e6ad40da7ae1fcb34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938248, "uuid": "ae0552db-b0ac-45b5-8190-8efd4666d3e1", "comment": "Malware payload (Mirai)", "value": "735380b6c067135575422956c45d65422e1286da78ad800b47e5ad4204512033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938248, "uuid": "f8ec496a-6ed4-445a-96e6-3fbbfab1720a", "comment": "Malware payload (Mirai)", "value": "2256f5d18a982141825b714ad944f6edf80e1969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938248, "uuid": "bb7edece-db81-4b7e-9401-fbff9c91b3e2", "comment": "Malware payload (Mirai)", "value": "aa0edb2c199a6b909587191893653300f3ba7862cc8eccc9462076cf1d1e423491b4680bde0ea4936527ec73350ae9d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938248, "uuid": "07113171-8828-4918-8304-10b76f845af4", "value": "T1E0A4BF53F7B0ADD6C087473118BEE2308766C59A0383B351F66DC6102967B6EBE9A734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938248, "uuid": "91b07973-7092-4033-8c86-6204dbd8483c", "value": "12288:A9WbY+rZAUFh7GBl6qtQ13jAjphxo0FtcIrq:M+rZzh/q1BfcIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938248, "uuid": "37a94fee-8bf5-4c2e-b211-d45f6c01f609", "value": 487852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938248, "uuid": "ce78edab-358c-4655-9bba-c9d271811cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938248, "uuid": "53be6325-6828-474e-a140-e40c9eb6fbec", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d208337-ac61-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966986, "uuid": "a016afa2-9864-4d87-9692-1f99caf2aa1c", "comment": "Malware payload (Mirai)", "value": "b0a547d9da2bab40f70fc3d5af66d9bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966986, "uuid": "24be3107-9ad9-4135-9a22-6b02211d11ca", "comment": "Malware payload (Mirai)", "value": "7399a143e02055d2757f8d4e0aaf1372ed0a38b0b75709fcf2880ccb7036f0bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966986, "uuid": "d26a1c58-0119-4b7f-9172-fa73e8a045e9", "comment": "Malware payload (Mirai)", "value": "d1b1e046c604341cbef55801935eb53758c3d18d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966986, "uuid": "38954c9d-ed01-44c9-a40c-4ad36fe8c4f0", "comment": "Malware payload (Mirai)", "value": "f86197c2c4753229112dac6f43051cfe10d0dd2a86f7941d7733de128d85f4f112a1d30647482305f4be215f6b14b7fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966986, "uuid": "2a6ab386-1503-4702-a272-bc3c3bce1a23", "value": "T11F640863E3918F95D224C8F012B767B1B9AB017B55E756C2F62DC940BE5828D213FEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966986, "uuid": "b9d0357a-e48a-4651-81c0-e6b778c8b5ca", "value": "3072:tUvxdioZKD1N24GVWOeEuyPBF12leOeB63y3XuBhlmNBX7dO9mUCSnnB/jxZShp3:tUuCVn12ZDAuz69RfSn5jxZ+/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966986, "uuid": "646e2540-c2cf-4750-a1b7-92ece8123e4e", "value": 336928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966986, "uuid": "a76c0e3f-23d7-4249-97a9-6fde598d6f31", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966986, "uuid": "953a60f8-188d-4ea9-bec2-40dbd0d2a5cd", "value": "wj0s.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c5bf4d-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938392, "uuid": "feb01ce5-9708-4b6d-a2cf-d7bf6b4e37c8", "comment": "Malware payload (Mirai)", "value": "30b4663dc6af84bc888e64a67509784b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938392, "uuid": "6fccbd44-690b-4b89-8992-5ac283ed9f78", "comment": "Malware payload (Mirai)", "value": "73a09c0756624ef804228c1b93480be57488ffd7bab7c2e2598ea92cc81cea1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938392, "uuid": "d43fe853-5596-4d12-a1ef-7a4495554206", "comment": "Malware payload (Mirai)", "value": "aa4e34396550310e011012beb2cc984d7f67e810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938392, "uuid": "f597e867-e4da-4220-af6f-3b5fe33267bf", "comment": "Malware payload (Mirai)", "value": "9907e6b260b8c9997a1d0f206842606d6e2f18642c1590a5b90677a74fca3f21fb66d95cfe8619bea195e3d9854e64d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938392, "uuid": "cf83053a-2f27-47a8-b59d-0396b418602a", "value": "T183F33C466C91DA33C6C227BBBAAF108D33356798D3DB33429D182F7426C665E1E3B245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938392, "uuid": "70aeafde-f44f-477b-a70e-0892afe87d7c", "value": "3072:iy4O7FOln9dWBgeA7n0VBNuYBceXpA5v8ZaV9PzUdJs/:sO7Fen9V0pu79PiJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938392, "uuid": "26b13abc-eac0-4cb0-8b9e-63ee46ec811c", "value": 158209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938392, "uuid": "ff64fcc7-e75c-45bb-90f7-8a6584778d1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938392, "uuid": "54ad531f-197a-4d00-846e-bfe8c863f03a", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074fa509-ac7b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788977982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977982, "uuid": "25531d50-986d-46cd-a556-c825f25e38ac", "comment": "Malware payload (Vidar)", "value": "a5fc847c747a3054529e361a4158d3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977982, "uuid": "faaaf803-97a8-47e7-a3a4-7e9af52b958d", "comment": "Malware payload (Vidar)", "value": "74def0e4ad75c75aab47de583d29deaabdf7e02491e78945afeed9a4788b599a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977982, "uuid": "c933a965-1ee3-440c-9101-d0f37624073a", "comment": "Malware payload (Vidar)", "value": "f41e24ea6b5387aa848d0ecadd5c8e735b54804b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977982, "uuid": "6ad01018-6616-47da-b725-15791656d767", "comment": "Malware payload (Vidar)", "value": "c287381b0b459c12d062ca490004ff2869a6774633ce1b0b32f0dce5688d2349ee8c688b14565d9d2013aff7adaba848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977982, "uuid": "088e06ec-5fe5-433d-a3c2-a417077d7033", "value": "T1B4666A07BDA105A9C09A9730C8A742567B357C8D8F3137E72E94B7382F7A7D0A97A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977982, "uuid": "36481df3-c3ea-4b58-8772-6b86eada665a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977982, "uuid": "d62312e6-c775-4104-9ad5-b56a55e4db0d", "value": "49152:p//H9suDh0Eb+kq6I6l2yy0i6XaYNbHkkCOnFVFt+SR0oljEz5uiHUWUDmq:pTwt0NblF/trR0oljEzQiHv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977982, "uuid": "a74c5e4b-cdeb-4b1e-8fbf-14deb2bfd31e", "value": 7045120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977982, "uuid": "bfcce04f-c550-4e53-9c4b-eb7b4e810d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977982, "uuid": "1b252dc9-3d85-4f54-8057-b99049914780", "value": "74def0e4ad75c75aab47de583d29deaabdf7e02491e78945afeed9a4788b599a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f89973-ac51-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788960230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960230, "uuid": "f1b2f10d-6458-4b2d-9937-48bfe451c7c2", "comment": "Malware payload", "value": "242b9e285b2165d2a8d6beaa3cb14773", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960230, "uuid": "a2623668-e6e1-4012-bb24-0d2085c0ff95", "comment": "Malware payload", "value": "7553a8f2b37d9c0e72e2ecbdf1c874136fb8d7ef37389f5f6df88057fb01d8d4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960230, "uuid": "fed5933c-d149-4227-82e6-992f77261c9c", "comment": "Malware payload", "value": "21eaedd37018c1da95c34523c7d9b3cc9b719f34", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960230, "uuid": "856bb4c0-0504-4783-b154-f57072339db8", "comment": "Malware payload", "value": "da1c94cdd42c33563fd34c8a1d5b8e2e3404c3316bb4cf956eaee51696d8e843973d7de5b41fa657ecd6a606db865beb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960230, "uuid": "d1774e33-430b-4d29-8137-3005a2c9d06d", "value": "T1E14375A4D270ECFFE1BA2238E457A236517871A507DF977946F0A871FC516938220BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960230, "uuid": "ccfec4af-6938-452e-abab-e1568c85772f", "value": "50d0d1884889bb77dc39b3f77d667512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960230, "uuid": "10440e80-55cb-462f-9db6-8d77c2f482cc", "value": "768:0lnF0sygbUbGFZJ83mhxPK7Ewl9Zk/U2475htj34v1x/nS:CZygb9r+vl9Zk/U2454dx/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788960230, "uuid": "aa89d082-e741-4ecd-9dee-ee1c2febe2b2", "value": 58432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788960230, "uuid": "7c7c1c24-da90-4e63-8109-395bdf588ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960230, "uuid": "2e841807-d3ef-4725-92ad-8b860220314c", "value": "duser.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31530ca8-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "7f4f0062-8fd3-44a2-82a4-799750acbc83", "comment": "Malware payload (Mirai)", "value": "a634ad632370f65ca5d000c1fb6041c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "af64dff9-6548-491e-ac13-9b51c731b3c8", "comment": "Malware payload (Mirai)", "value": "75a19cca128ed3175631efe8b5dd5e344534de9b945a6f47175afd71d6b65ffc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "1375511b-8b77-453b-b00c-285b93c6f0ca", "comment": "Malware payload (Mirai)", "value": "59676ed11f83b9a62d6c7e585a66e0158605bd34", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "9a0db9dc-397b-48a0-a5ab-96df17a1bf7a", "comment": "Malware payload (Mirai)", "value": "72278333baddec221d95bdf1bcad574da6ff64ab6a02835b564e162188c41667d7d55cfb7ebf84063b531a7b4b1bb518", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "a9835d69-f29f-47ee-bf63-107c8385e74d", "value": "T193042B46F9518F13C5C751F7FBAE42883B266B7ED3EA3102DD256F6423864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "848061ee-99e9-4758-8c5f-08ff0e5e9d69", "value": "3072:oYMrCciiXL00KRViJ5KslFqY4Eny2hwJEkeLBxPky:oYiCciiXL0fwvKm4Y4Ey2haE3BxPky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963450, "uuid": "b81400a8-8f66-44f8-b94e-c19c86dd3636", "value": 180092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963450, "uuid": "e44ed1ee-0c55-490e-8b31-1603b4713439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "24c82bc9-2ff3-4c6f-9955-01bec690f2f5", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f2be93-ac04-11f1-ab4f-4201ac107002", "comment": "Malware payload (VShell)", "timestamp": 1788926922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926922, "uuid": "9aec4e80-dfbf-41fd-a5a5-9552021cfaaf", "comment": "Malware payload (VShell)", "value": "8a8839a22124ec0ac5dd1a58c2272a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926922, "uuid": "451035c6-4a50-44ca-b249-dee112ab02eb", "comment": "Malware payload (VShell)", "value": "7627323dc2af3b1edcb2081f3b91570b61008b539d038a45085342227933026a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926922, "uuid": "67fa7f4e-384a-4704-a575-4a024ec76d13", "comment": "Malware payload (VShell)", "value": "2129ce92b58a268553970920f268da5414ee44bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788926922, "uuid": "a10a0509-7b4a-428e-976d-d1da3b9ecdd8", "comment": "Malware payload (VShell)", "value": "ba5476f132f7227dae37d1fa25a6eb1aed8a364ac676d7be0799bd0096072074993ce754f0fb9524c820c162d37d9152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926922, "uuid": "35abfd45-bffd-40e9-afac-a35f38d74ce8", "value": "T1C471B541A0545AF2D94CE37F8487B895FD4FB248A2C80B0F0398981A2F710BBB0DDA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926922, "uuid": "c52765a2-7673-4616-a530-635378f862bd", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926922, "uuid": "2f07cd3f-32ba-413b-81ab-0c6f563c51ac", "value": "48:6IZUBQYxZul2EywS6De3njk7QLzgzIzQz4zAzo157D9N9XM/geu3ahr0/x:2BQMZ7EywS6De3j++D9vXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788926922, "uuid": "d6a2cbb8-fc25-40dc-845f-5fd7b4724471", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788926922, "uuid": "0b8e3140-a329-4894-a24b-003a53c4a64a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788926922, "uuid": "38de52ce-510b-49e3-9d18-6493894f716b", "value": "7627323dc2af3b1edcb2081f3b91570b61008b539d038a45085342227933026a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b558c261-ac66-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788969255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969255, "uuid": "342ef176-30e6-45c1-af02-83619383fc3f", "comment": "Malware payload (Gafgyt)", "value": "e7063eb1cdbb208ebe9e2eb7a3fb3b45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969255, "uuid": "b4b5ea2e-56df-447d-aa22-bee99a8a7f2a", "comment": "Malware payload (Gafgyt)", "value": "762b709a8230032e93d73ce43761d71d24c6d3dbc35763dfd342d07cb4ee90c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969255, "uuid": "90bdbe70-f5da-455f-8fc1-3960fb0f7595", "comment": "Malware payload (Gafgyt)", "value": "d4d1ce936e183405d2d326895ce5383c135fe3fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969255, "uuid": "03adad24-1261-4164-aa5e-97f5c2684f16", "comment": "Malware payload (Gafgyt)", "value": "6e255d50727d019cb10ab049e7f830c21f8a8396e4ae16869a9cb900668b0877b8de6bbf2e6021652958a6a549dac3dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969255, "uuid": "89ba9f0d-b2ef-43ae-aed6-b7c061728cdc", "value": "T138144C25F303C6F3C4830BF1229B9A670E22B5B7176F9655F36D6CB08E664C97509E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969255, "uuid": "2aef00eb-e858-4b34-9c11-a22bdbac9511", "value": "6144:2hHOFlDgAdYKwvRxG5hCA+gdQAmPxGHI/VShyv7f9/X8:2pOFlU5Kca5hCVeQAmPxGHI/VShyv7fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969255, "uuid": "ad57751a-b19f-4df1-bf46-3eea4f5ed05b", "value": 203233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969255, "uuid": "b3509fcb-9e27-4a9f-ab33-14b9d0336330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969255, "uuid": "02fdb438-3312-43a2-82ea-f94f216e1b93", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620d082d-abfe-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788924448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924448, "uuid": "ab1b6f50-6e56-42ef-8c59-d118dede16aa", "comment": "Malware payload (JOMANGY)", "value": "22816350d9e0b7ea15e3c204b49d100c", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924448, "uuid": "8c9a3498-c792-4e88-9832-3d5e20cfa569", "comment": "Malware payload (JOMANGY)", "value": "76361341b7f86862fae2235d1f67de4c0d3f9ec2ba108328d40b18f7800bc591", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924448, "uuid": "b0b8a47f-1540-4cdd-ac5f-5ed8e1f36ff7", "comment": "Malware payload (JOMANGY)", "value": "d1bad1c53cf6af583eb460bbdc7274cdde9561ff", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924448, "uuid": "99397604-3c1c-4a2b-bbc0-ac3f9558e566", "comment": "Malware payload (JOMANGY)", "value": "07b874beb3473f8783abb9b5681901f5db50266c8212ee661502411fd27aae155c759eee07bdcb5c83fd694258e29c5e", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924448, "uuid": "836420e2-aecf-4e4c-bcd3-aea5a906bd8f", "value": "T112C27C966A867C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924448, "uuid": "78678426-b2d3-4722-b25b-829db7c9a15d", "value": "768:YXc8vCB+25j6es8RPK9FYpMSUpi+20qUpi+20YQX:wc8l25JP8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788924448, "uuid": "20605b09-56da-444f-94e3-d9f83d6146d3", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788924448, "uuid": "3e67419d-57aa-448d-8176-558b28f4e3ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924448, "uuid": "aa1b59df-6e9e-405a-a825-237f10478ff8", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2385f2-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977316, "uuid": "c2d6fae0-1d80-4975-a065-5bd2e4a9ec7a", "comment": "Malware payload (RemcosRAT)", "value": "070b1628e702ec96791d0adb69290328", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977316, "uuid": "86c05f34-3ca3-44ea-a8c3-3bed475d150c", "comment": "Malware payload (RemcosRAT)", "value": "76572aef0acb98b0de60aba5bfb53cb3630a6d5c302c5e846f1d0ee212a67502", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977316, "uuid": "1e9459ac-6073-4195-8252-abbc97f771bc", "comment": "Malware payload (RemcosRAT)", "value": "c6f29081f69128039db5e66a2f7fef33c3f0906e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977316, "uuid": "cddde4f6-5a52-4d16-b36c-1003488052bb", "comment": "Malware payload (RemcosRAT)", "value": "cfc353f7575725d4353dea603cb993b10217adf8aefa096039e7127fb4dfdba957bb4ba5ac90ed9225ff38a39063cde8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977316, "uuid": "23de3fb8-5a80-414f-a7d6-48f9dfcdcee4", "value": "T11BA4D13011DB7A32759EED7422E834297A33954D9284BADA305C2A754FE6BEFC04C97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977316, "uuid": "8e55d61a-1004-4efa-a478-b13736fdb911", "value": "1536:ZqLOIbIDQrCojbfh9BUJ3FQNC6uc7Izuq+wZrsLXPNnVrGrBElkUM1CS:ZCjIIR4BEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977316, "uuid": "25c2c7b5-1c31-4f41-9851-849fcc91e290", "value": 484981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977316, "uuid": "ef08b873-a654-4181-a987-9a54a9f51ab8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977316, "uuid": "dea4d8fc-49ba-498b-ab8e-b6ef5f76cc82", "value": "VD532326082016.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09bb8e3-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938377, "uuid": "a19fcfe5-63bf-4b3c-84b0-89cce90c75a8", "comment": "Malware payload (Mirai)", "value": "91d5ad43416ee56a7e9165637d153da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938377, "uuid": "2a7aa9a7-86ab-4a74-a63d-9b7533aa1771", "comment": "Malware payload (Mirai)", "value": "772e4595a8d337304e50d76f2defab63dae2810a9f232301117a02975ca0d8b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938377, "uuid": "55ad0ab5-80cb-42f1-babc-c9a8d0202033", "comment": "Malware payload (Mirai)", "value": "46ec9dae2f3bf232f358df0cfc5e830cec8b7772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938377, "uuid": "9dc4212f-0ad8-4700-8178-49158ef813a2", "comment": "Malware payload (Mirai)", "value": "bc0bab6af8f3c39f729ae0e5098ceff05d95f1b6dcd7ac08ef77eb3585718c09aeb8de9a5f97f4994dfc693e783e2c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938377, "uuid": "d9f53865-71e7-4599-826e-b004087436b0", "value": "T18EE3F749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938377, "uuid": "6de8a477-c22d-4965-8930-6d30e8c9528e", "value": "3072:6nZpD+/4jM0P+GBCvO/bPevbfQpgMSaJosnkQc0rVj02amOU/XJWc58Q:6nZpD+/4jM0PzYvOazfQvSaJnnkQc0rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938377, "uuid": "723abfe9-d7a7-4936-b817-6f85fa285c21", "value": 146264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938377, "uuid": "fab19e74-89ea-4fa8-b6f3-760790523a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938377, "uuid": "fe3ee444-fa8b-42da-a09c-d33b62d83464", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c254952e-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959828, "uuid": "4fc993e3-0c14-4386-804e-fcfdab7ab486", "comment": "Malware payload (Vidar)", "value": "78656a9b1ffae68fa53e8bbcb00bf586", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959828, "uuid": "f8e3cad3-699e-4b51-83f9-77ff96be4aee", "comment": "Malware payload (Vidar)", "value": "78073e3c5b53cdf1c1157ab200b0a3685b9f1b50bffe36c91d6cba1ce22e5c50", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959828, "uuid": "7c310dd7-6c31-4a57-b917-ae401c301b77", "comment": "Malware payload (Vidar)", "value": "033b0bd0c08167eb5c785a098d36ba55c05fc468", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959828, "uuid": "765f6c9e-3566-4f04-a414-9aefe9c5fa4d", "comment": "Malware payload (Vidar)", "value": "86b8cee427ce3eb522ec51d323f2dd9f80f91521fa83b47024f12bc2af7ae5e50f42579230ae213905ce0e063a1e0f67", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959828, "uuid": "d67558aa-0abf-440d-a9a8-a48a4167d1c5", "value": "T107545931E282C0B1C90D2335196FB3BE5E759E311B018ADFD782B91C7DB92C16EA85D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959828, "uuid": "c6131a74-b1a1-4e5f-98c4-4c37b07deb4a", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959828, "uuid": "439a2594-6cd3-4595-bb91-6c60677c9f04", "value": "3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyyzdEpxSJ+LcEZbeD:A/rLVPW0nsP2Xy+TJfzzW7m0qW8VJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959828, "uuid": "d9a5c2b6-861c-4b60-8050-acf90e043e2e", "value": 286680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959828, "uuid": "5438d217-b42a-438f-a303-762ef6942909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959828, "uuid": "8a9bfd87-9ff2-40af-97bf-722a6620b639", "value": "78073e3c5b53cdf1c1157ab200b0a3685b9f1b50bffe36c91d6cba1ce22e5c50.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74410ba-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977499, "uuid": "a2812954-d235-4262-807d-cd02cf7814c2", "comment": "Malware payload (RemcosRAT)", "value": "1f11154ed364a0ccdc318d85e21ee893", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977499, "uuid": "0080d320-97a4-43d3-bbe7-6eaafd643686", "comment": "Malware payload (RemcosRAT)", "value": "781a90261c1d55c798832a2dac722d5791865731efcf96ef4791e9a2d942cfe2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977499, "uuid": "a4a11c75-ccb8-44a7-ae7f-4860d15326ff", "comment": "Malware payload (RemcosRAT)", "value": "38011217ecf2800e0478ae25bb2c5e626073fba6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977499, "uuid": "0a7b9852-92e9-498f-ba6e-c7248e54931b", "comment": "Malware payload (RemcosRAT)", "value": "fbcff0a739bfe3fa2ac0b46668ed833ea4119c7f264003fef7ddda22a16f3e2ea5e5e613e842f57caf76321be34e4f1c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977499, "uuid": "9100f55a-bc59-423a-a799-c3254f7ce760", "value": "T134C25CB8FF611101094F3AFBD86D0869C6E8016A29620074BFBAF29A19057DCF77D25F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977499, "uuid": "f4b5dda6-0994-43a0-9ecb-02f8ea341475", "value": "768:n8VmJqIG6mMEFnIoc1Yk7f3sjhDIYPLw205ZLd:8Vmof6mtODZ3IhD/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977499, "uuid": "2db69b5c-80e9-46c2-b043-22316c7a6eaf", "value": 26805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977499, "uuid": "46c58850-dc8a-4d3f-adf8-58135f96ea34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977499, "uuid": "2abd7a59-0298-4e9f-a0e2-dc63f84f73fe", "value": "Patriotical.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de61c35d-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938400, "uuid": "33d843c1-d6b3-4ad9-8088-ff2031331a18", "comment": "Malware payload (Mirai)", "value": "317cdda073096858ebcc9c295c1091b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938400, "uuid": "880fa0ff-ebab-4169-ac3d-bc856b59fd68", "comment": "Malware payload (Mirai)", "value": "7855ec1b0cec3287a126affeb8eb27626e86fb096e354c4d5acca28bae5ea412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938400, "uuid": "4b078fc4-cc01-402d-9665-32fa148e393a", "comment": "Malware payload (Mirai)", "value": "87345e79625d74bf7dc95d2f81461ccd0939707d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938400, "uuid": "c5fbdea6-bd1f-4bc9-8c2b-b66bacfe9126", "comment": "Malware payload (Mirai)", "value": "9e0e5982962f03303ace3b0f89cae9de34a8685dcb376e3b4ea24776f8cfe888bd015838c68118e8784b5de4463e18eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938400, "uuid": "c38cf532-1255-49bb-a5a5-7a9fe72b9ba7", "value": "T1EEF33802B31C0A47D2632DF02E3F2BD087EFDA9221E4F641655F9B8A9672D361585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938400, "uuid": "5f17421d-4b4e-47e6-b76d-89f92bf19e5b", "value": "3072:7wA/bPD3rHxg8G7gQFG0kU73HI36hh1wtQKp:7ZD/Hxg8G7gQFG0FzoGKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938400, "uuid": "daddc3e2-dce2-41e2-88d2-4957f8dde4ef", "value": 158776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938400, "uuid": "8fddec9b-cfb6-4b9d-8f59-5df06ce26d83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938400, "uuid": "bff27d04-6992-4cc9-8705-0c51eae3f51c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4907993b-ac58-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788963060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963060, "uuid": "d05bb44b-aeb3-4802-b6ac-772cde006805", "comment": "Malware payload", "value": "29c70803a5c63b5f8807d1f64503c474", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963060, "uuid": "c7cebbe5-5724-46ba-8b91-32a860ec6c6c", "comment": "Malware payload", "value": "78aba74a86285dfaa346eb470028b3af5cd5ad04de138e008a7d51b98927f0ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963060, "uuid": "13600d29-b764-4fd7-9071-53a0a3b98440", "comment": "Malware payload", "value": "b3abe63b122171a4512d2177741ac44dc3e7aaed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963060, "uuid": "e2b4079f-fd1e-4971-a209-161539da08a5", "comment": "Malware payload", "value": "b4ffe9691e1604288cbe3ef6f81082ab8c6c3c0c1e83357962d7a403932c53eaee2b9a0ba3f91b48dd1eb57b7b580152", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963060, "uuid": "719d0758-21c7-4f02-9eee-f7298aa92022", "value": "T1BFE0C240E6A13E142675EE0E83D4930E523057F0F95C7A7D99DAC7F60A644C3348EF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963060, "uuid": "64c6690e-57d5-4364-b6f0-ea392bb391aa", "value": "6:UqLqhR47DcKULt1cK8MNIzuLIUSICMNIcK8MNQkYcK8MN25FTEX3:UquhRADEt1VBILIQVIVsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963060, "uuid": "b6d7cd77-f448-4789-868d-4e623cb08fd6", "value": 293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963060, "uuid": "915c406c-3a3e-4537-98f1-422b92fafea8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963060, "uuid": "b6a4d797-1cc5-4712-8654-bd255ef1af1d", "value": "78aba74a86285dfaa346eb470028b3af5cd5ad04de138e008a7d51b98927f0ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86caad5a-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938253, "uuid": "80dc0f5c-0724-4f55-bea5-f7d7d2ecea70", "comment": "Malware payload (Mirai)", "value": "f8894af90177d034fd784b7ca5d783fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938253, "uuid": "ca828af9-9313-439f-9613-d23d96b862f0", "comment": "Malware payload (Mirai)", "value": "79cea37456aa1276e5119f215ef82c53a9dca7d71e9d814164a636612504ab01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938253, "uuid": "6ecf6f5d-a731-4b15-987f-76fa8b2f2101", "comment": "Malware payload (Mirai)", "value": "f0677a2eefd2e1047563af4bbd1df7905fb94525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938253, "uuid": "8481f281-480b-4b5f-96c3-d563dcada69d", "comment": "Malware payload (Mirai)", "value": "d1c5c76de899ee59629538d097159a41ce06698ed166e7affbbf872d47c51a73a1bb22dd4e96d4b2cef11c119064e438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938253, "uuid": "b7ce198c-2909-4f1e-88db-934263d83130", "value": "T1E4C44A46F881AF52C5C135BAFB5F8249732717A9C3EA71069D185B383BCB95E0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938253, "uuid": "79929fb9-244d-4d10-9f81-7ee32171cb44", "value": "12288:pMiJP/lWwk35qAX9j10PqOej8BYCMNrjpJWXdJ9JI0Ed4R:1Wwk35zC0vkJ9JbEd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938253, "uuid": "8a771a80-4dc3-4b6f-9bc2-130d166fa64d", "value": 544116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938253, "uuid": "0b63adbf-e319-4f6d-abb2-da46632666e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938253, "uuid": "5bd015fb-f1a0-4cf6-94cb-632d1679a1d2", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e52e5f2-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788948064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948064, "uuid": "c964a3c2-cd87-42b7-8b85-1155c870c770", "comment": "Malware payload", "value": "b7fa16ddd66de8711f5c2886b68bcae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948064, "uuid": "f19e133a-2d39-4e22-a586-5bd354ea8762", "comment": "Malware payload", "value": "7a4c87677d7892b66c30c82ea72893bd29cfe793fade45222b4cf853b877d300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948064, "uuid": "d7af0806-81f6-4179-925c-a7b10880b6e5", "comment": "Malware payload", "value": "dd24e9ab163d25d4de4ffd262c5c48cb24b37c64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948064, "uuid": "b2a2dd25-4034-4ab9-9dcd-33d381716619", "comment": "Malware payload", "value": "f0ecd40bed9546a849d58219fe13808160df0d29288070b704f9ae65ddc215a0339ca064b171f1ddf70e7decd351bfec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948064, "uuid": "d09195e7-5abb-402c-8be2-eac686845482", "value": "T129833B02B59180FDD0DAC1748B9FC627EA32F89523217A6F37947A722F36E612B0D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948064, "uuid": "a718a216-6019-4ca1-b396-0c7d4620a248", "value": "1536:8SCeQLe/bvVk/7BKWAOOjfT4ANuYfetPJO/CWbOdndbS2/6LAor1x:8SZQ6DANLOj77feVJVDddbWL5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948064, "uuid": "21011733-5442-4b76-ab9b-a86559ba10c7", "value": 87912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948064, "uuid": "6c24fba5-a3ce-4656-844d-c15c683d5ffd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948064, "uuid": "15d936a2-cde2-4b1c-bb74-90faa1ca32bd", "value": "7a4c87677d7892b66c30c82ea72893bd29cfe793fade45222b4cf853b877d300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a179727c-ac15-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788934432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934432, "uuid": "b45164c4-34a7-474d-93a9-0df257b2ba80", "comment": "Malware payload (Vidar)", "value": "586b4792e93bc6ac1578f2fc1ce06dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934432, "uuid": "06666930-0db3-40f8-91ce-6599909852ef", "comment": "Malware payload (Vidar)", "value": "7c8ed10f74e02899d7f2bbf4324e396e46830e8d2265282726a3d4841746f9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934432, "uuid": "e19f5612-9589-4398-865d-f08bc162653f", "comment": "Malware payload (Vidar)", "value": "56eca02d9e038571745914c0adc4d8f9cbf449db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788934432, "uuid": "94ddd110-f4e0-4667-8689-6600d2eb8ecb", "comment": "Malware payload (Vidar)", "value": "7b5fe08d78cd7447dfb7a2b4ee8e8a5b7c36c8e9763ca351fb76c3cd3ebb7b1ace3470960e1362dd6170b7644d375b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934432, "uuid": "87a2e54a-9f40-4d03-9bc1-4ad15f57fd6d", "value": "T18174227B2077988EE4ECC5BA47CC45AD78EDB73D32A8E71ED25CE04D67548352E920A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934432, "uuid": "c010d68a-f719-4d76-82f3-77f74824e177", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934432, "uuid": "4cf77f3e-fa52-4851-91b5-aa2f3c6ea698", "value": "6144:vBedGEctfslW269SYMo359aWTNRcewuFbELDMdbflfpB3cZrJB:JtslxYMo3PxNWvuFwLDMtPB2rJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788934432, "uuid": "dcf295e5-12a0-4ae3-abbf-8d622a70b3af", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788934432, "uuid": "c5444c42-743b-40ab-9e4b-9f38e6ca76d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788934432, "uuid": "a4a8ad8a-38c0-432f-9762-05aaa207a165", "value": "7c8ed10f74e02899d7f2bbf4324e396e46830e8d2265282726a3d4841746f9f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a446bad-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950258, "uuid": "68e63e8a-48c2-4eb5-a6d2-d9cc3ee9f4f4", "comment": "Malware payload", "value": "1bbd9d51ec9a01892ad0966d04b6d3ed", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950258, "uuid": "3d0bf6b7-72b3-4d33-a9e8-d4097f42bb16", "comment": "Malware payload", "value": "7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950258, "uuid": "ddc37a1d-daef-43ad-a4a6-204683541e8c", "comment": "Malware payload", "value": "a470ca129fd5ea1de842d82ac90b52227e15dcd3", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950258, "uuid": "5f2254d0-f8c0-42df-a91a-2b46205b6dcc", "comment": "Malware payload", "value": "dffe889f4fa011f2106062dd0babea864a182e0371f7fe7568362a216f82830a9400a32f6e3cdee3cea8ba7a8115d3e1", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950258, "uuid": "d0d577a9-2b41-4bfe-b51d-5fa3b20f1767", "value": "T1C1554A57E26344F8C52FC174C6579772BA70B8590238BE6F1A94D7322F21F609B6EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950258, "uuid": "dd6c50ad-ae20-4b7d-9025-bc4ae98deb1b", "value": "a510771dd4fef4f6158e9a679191a217", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950258, "uuid": "50a556d8-ae0d-4766-94c4-459a2ba05593", "value": "24576:qYJUODYrUgSiNKxynJHlcxBlwVzDxlqYnhSMXlrI+Vk:qYJUO8UZuduPlwVzyYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950258, "uuid": "63c65a80-5b30-48b5-b133-b9ba7672260e", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950258, "uuid": "10109ed1-0b39-4ef3-90a2-ac87092c719b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950258, "uuid": "0875fafe-8f0f-4b59-938b-9d42ced185d5", "value": "ChromeUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922737df-ac4d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788958458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958458, "uuid": "a98dbec4-5b3d-4647-8abb-b34ee7eb4a01", "comment": "Malware payload (Mirai)", "value": "2b2a2dfa6aa337d6848c80ed091d85cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958458, "uuid": "b678b7c4-8c53-4a80-a139-103bc6fa0cfc", "comment": "Malware payload (Mirai)", "value": "7e0365b85d5b4df17663564c999b795b71c27b131b4567e2aa0e94bfee043afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958458, "uuid": "1e71f24d-29e0-4a23-9a8b-6a95939f0a85", "comment": "Malware payload (Mirai)", "value": "7144bc8dd9b4fd1c45d9e58c9ebef5b4c9b59b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958458, "uuid": "93879455-84e9-43aa-bb8b-857b0a5c0a8b", "comment": "Malware payload (Mirai)", "value": "576e0ed15c5b601bcd381279587df8c2081eb805a548adcc77c9adc3ef091f574688792135be4183618a6a7b88dbb9a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958458, "uuid": "364ca858-a4ea-4369-b13f-d42d539bfa09", "value": "T1CF54285BEB09CC89ED5088F1213A37A2B46751FF8A62E0E3F9190129F99F9DE0075DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958458, "uuid": "79d2fe70-e4b9-459f-bb77-a9a614f4f71b", "value": "3072:YZg6IwWrX9jVvnlfGhEs8Y4jUTbrNcF5Uu73xTSxG/KhREvqHLj5wl7rj3:2gjwyNfGEH9UTbra7hTgG/KhHLj5wlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958458, "uuid": "125e4f11-0870-4f5c-acac-6c7f415e39bc", "value": 296864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958458, "uuid": "ea7c416c-0dd9-482e-adb8-f59881fca873", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958458, "uuid": "58b21617-1d13-4e37-aa0d-592f43e37007", "value": "417ee3a3b38d2bd08d4c649bdd686f97a7125b3f2b3f6473befe8a5d258169f0.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f8a09d-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977254, "uuid": "2505b112-6920-4ef0-82c3-f4d6075e99f7", "comment": "Malware payload (AgentTesla)", "value": "8814fbe0c2d2cf99e6cb56c6dbf14ddd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977254, "uuid": "bc63a41c-0d13-4ed4-915c-6fb99c5ab137", "comment": "Malware payload (AgentTesla)", "value": "7f0fa06ff5aad8733f8505940fd74d8ccede3b0fcc14d3dc220097fa842c098f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977254, "uuid": "70e393f0-b26e-48e1-b7dd-efca104440d1", "comment": "Malware payload (AgentTesla)", "value": "26fc0aef643e8308b2cd4f1a75ce7670dbfcde1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977254, "uuid": "16e8fbf3-045b-4c13-afb8-ddb26ed33a15", "comment": "Malware payload (AgentTesla)", "value": "dd501c6a0d23442f7afc8adf7454b92d16792441e4edde07fef97c278d976edf8d12b93a7a4a2758963bc70282a00167", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977254, "uuid": "0b75d6a8-2cbe-4dea-bde0-8905f792d262", "value": "T103C6070C5B2B5930A53EAB2CD935999085A9751340C8EF1E317D530ABBF2A57338EDE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977254, "uuid": "40fa18bd-ed80-46d7-811a-91a7a15f7e82", "value": "98304:K+9qiLNt7G+vDNfw3xane3xod3vInVgv+njDStMOrmV94aXACyygD2t2zMn03FMJ:5N7AFxod3FC+tMOrmmHhK5aVJZDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977254, "uuid": "c0d490df-4e7a-4b22-9590-20a6da7440bf", "value": 11495457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977254, "uuid": "ebda5d81-a438-4891-8ea3-989e469c5e33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977254, "uuid": "07897aa4-e480-41b9-a7b1-5b1c435a8ec9", "value": "Payment Receipt S00028207C.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff360b77-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788977110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977110, "uuid": "9e2a5ea1-5dfe-468d-8c82-d35d8b95b913", "comment": "Malware payload (PhantomStealer)", "value": "5c6907271e784576515a0bfa24d9c2b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977110, "uuid": "52f45f29-19f3-4b9f-b315-4291b06f8835", "comment": "Malware payload (PhantomStealer)", "value": "805e1082483911a4363cffa8df6bd19a0b91120773a83f419dd0d9c3ff9bf6ec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977110, "uuid": "fcb68a73-2e0b-4695-8d50-29969fad6c80", "comment": "Malware payload (PhantomStealer)", "value": "3b7d298f1db2935be3ccf6426d4d531c09f00205", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977110, "uuid": "11669293-63c3-4eb5-aec2-eec4be1b596e", "comment": "Malware payload (PhantomStealer)", "value": "6bf78a66b118081cce676adda9e88ed4ce589bc1bee62648d24d5b4ae4b9a65d861c0751f06e5c822b2a0c68569185e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977110, "uuid": "df0f6922-b503-4424-b830-0a44918fa9d4", "value": "T1FFC61A8A0208D4B0963E571DD1B65EA0C65E260311CDBF1E39BC6BC57BF962B274D8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977110, "uuid": "ac9e426f-0c34-4f43-8963-83ad216040b7", "value": "196608:i1xanW+JdcqPELI+9B6Fg+3wv6eIo5Fn4:aanPH1+nsg+3Un5F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977110, "uuid": "f7d3295f-1693-4a9b-b82e-78d9605f2d7a", "value": 12596817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977110, "uuid": "3446e31a-7470-43cd-a0bf-9fe180d04d2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977110, "uuid": "84725f2e-89a8-403b-8347-9ece2739d8ed", "value": "PO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7950ddd-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788933208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933208, "uuid": "8e899ad4-c2c9-4f95-9d45-3ce90cd425de", "comment": "Malware payload (RemcosRAT)", "value": "eba61a8df8db080d41d1cdbfe7d9f586", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933208, "uuid": "6cba5529-9793-4d40-a461-65b0476614d6", "comment": "Malware payload (RemcosRAT)", "value": "81946c5aa79705e1c2d1afa61411558505b12e7943c94cf45c7b81ae5657b546", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933208, "uuid": "7fdb197a-d3b8-4501-bffc-6adf23a50b36", "comment": "Malware payload (RemcosRAT)", "value": "212befce72fe29e037cf03987a72924b46d66509", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933208, "uuid": "f56d05a0-d652-4c00-90e8-3a9317eb471e", "comment": "Malware payload (RemcosRAT)", "value": "0d230aca804ac1eceb53ccdaa2e071c5d5bd547cfbe67e2a770dd7e72d270d9d4824289e936db03ea1ee60738b92c7da", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933208, "uuid": "e9a18df5-860d-4f38-ad9a-feb0ed92c38f", "value": "T1C251234BBD07C27595328EB34C6BB41DECE05A9312160C20BA4C89825F313BDFAD54AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933208, "uuid": "e6a6b70c-caad-4f72-ba83-d1d7291ca9df", "value": "48:Xkg42+Sy0fY0XQJ/aQUBn/lT4ML/ebn/pQFi+IFSy:r4dX6AJsV/d4ML/I/p+1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933208, "uuid": "90716490-e5f3-46e4-9c05-43610053fa32", "value": 2481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933208, "uuid": "598041a2-96ed-44d2-8cae-1873a96d94ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933208, "uuid": "a24fd1e9-16e2-4d71-8507-aa61e5e4b3db", "value": "PK-878893545.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78753c3-ac99-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788991136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991136, "uuid": "3c999072-456e-4ffe-9fc7-0cd91fbba386", "comment": "Malware payload (Mirai)", "value": "677b8af483f78ce618bda57d17faa848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991136, "uuid": "12ecd000-dbdc-4412-be03-3e2165fa9c15", "comment": "Malware payload (Mirai)", "value": "81b2824d381d3537679f470125dbdf474143ea01f00c06446d8438993b1ae643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991136, "uuid": "da4563e4-7642-4d27-97a3-5a1debb4a927", "comment": "Malware payload (Mirai)", "value": "b95c4820a911dbc67fed03ebbc22e39cfc3209ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991136, "uuid": "a7397bd9-3564-4838-9228-053b05c0aa9c", "comment": "Malware payload (Mirai)", "value": "704daaae7762726514b5b34c8545c1dd29e3442cac2f126ca26caa92d7bd9c0e48c0eacabd850c72bb40b52f6ef3e5db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991136, "uuid": "23b153d5-b3bf-4012-8610-760d631a4d67", "value": "T1BB261A57B8918A43C4E4267ABCBDC1C433672EB99B9722576D00FE3D3ABE1990E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991136, "uuid": "8fb379a7-8f22-4ba4-a0bf-28eb142bb12a", "value": "49152:ADPmrqixkgJutCxp3bWHfyIUMw6mx2kU1F1:MPmPxkyutc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788991136, "uuid": "37d024dd-0e52-4dfb-95bb-8f04d41a9490", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788991136, "uuid": "57aa3e66-7a5c-408f-94bf-000fad656e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991136, "uuid": "bc4cb96d-5d10-4bc3-8b29-86912747de7c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e7b377-ac1f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938517, "uuid": "2d8b920e-e463-4c35-b42e-978978b66d40", "comment": "Malware payload (Mirai)", "value": "5ed28eb18980821396079242b6ec89df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938517, "uuid": "9255d988-d7b3-4d54-be0b-d2e6456be3c1", "comment": "Malware payload (Mirai)", "value": "83339d96f6686f582d206d7b8e0e928abde2551e327c20eba693a4d1fbf44178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938517, "uuid": "cf419fe5-d82d-4b40-8473-374fc6ea589e", "comment": "Malware payload (Mirai)", "value": "1341b250e85a98936a8b83e032e96f4dba3dbe41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938517, "uuid": "548a2364-d127-46fc-bd42-96f035f25f8b", "comment": "Malware payload (Mirai)", "value": "43cc97d32719884d8eed0e59518b61c8a5ecb4a9855b99b98820dc7ed056fcf98b9aaac1ee0cb187e4afc08ec3250502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938517, "uuid": "b1863f53-fbde-44a7-b39a-3258d18e55e3", "value": "T11224E80AAF510EBBDCABCD3702EA1B0128CC541721A57B767274D518F54BA4F1AE3DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938517, "uuid": "e5570fd7-2cc5-4c50-ad98-5edf1d0267da", "value": "3072:h2JZLxaR4kaDFhnOllYSUPzVqLezyH6hh1P/U:h2JZLoR4kWFeYSUwLg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938517, "uuid": "2877d9c6-eb14-4b9f-9430-15747128cd1f", "value": 211956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938517, "uuid": "72d1f389-853b-445c-bcbd-4391899c5ef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938517, "uuid": "7b0c114a-3aa8-4587-8770-77fb14da5dad", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf38d48-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788977452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977452, "uuid": "7261dbd9-aad5-485d-acd2-be233bb3e962", "comment": "Malware payload (AsyncRAT)", "value": "77b5dba81e105b3d92d9d843de8f0430", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977452, "uuid": "e3522f63-0d42-4051-aec9-3bbaa84ae145", "comment": "Malware payload (AsyncRAT)", "value": "83492f9e63c4100d097668c3024ecb78b39d710fdab8bb04daaf864561a859f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977452, "uuid": "37b5d28e-3fa3-4b55-b7d7-e6904ac8da3f", "comment": "Malware payload (AsyncRAT)", "value": "ffb24920b71a53cb4aa957bd1be1f1fddfa555d0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977452, "uuid": "a60114c9-44d4-4ee4-b1c8-5809151c93f0", "comment": "Malware payload (AsyncRAT)", "value": "d3374c37a6c25179b3d1c2b1c0621fbc570dc939ef84dc45a90444aef1f83588eb5c3c33dff02a15f6f43150b9eccca7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977452, "uuid": "dae8e76a-68f1-4d25-85d7-4ac1645371c0", "value": "T15234D05CBD4A60B658260E6D500F580E16E84FF5ADC6D54A1A85FEED29AFFCFC027C08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977452, "uuid": "b6b2e913-a2d2-45e8-b201-427b2f18b442", "value": "6144:9vYQ/Hk1Af3q+yb3uAsOueHEcI2N0U8hosy:ZYAuhboHKN38ysy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977452, "uuid": "1bb88ffd-f89e-4004-8eff-ab0903680291", "value": 234999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977452, "uuid": "21993092-2b08-45dc-91ec-de73afdc5f45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977452, "uuid": "e24c787e-93e3-4836-8e7a-aae45ac2f4d0", "value": "Orden de Compra PO-031_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afd8277-ac73-11f1-ab4f-4201ac107002", "comment": "Malware payload (VexxStealer)", "timestamp": 1788974794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974794, "uuid": "6be0b626-40dd-415a-9d8b-ac1a120a5664", "comment": "Malware payload (VexxStealer)", "value": "a8b84e0ed4d4f21adad8906dcf6453e1", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974794, "uuid": "ed1418b6-ebea-4520-8709-f7a1dd317b2d", "comment": "Malware payload (VexxStealer)", "value": "837e0a4ca0c41081106693ce89b2b41d9973b35b062c6453f5d5309ff555501f", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974794, "uuid": "eb2d8765-21a3-4539-bbd6-abfbaea6afd2", "comment": "Malware payload (VexxStealer)", "value": "8beed83b7674b124daba27fa9c043cf4104e537c", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974794, "uuid": "9fc90eae-5866-4678-9742-fbf47cfda417", "comment": "Malware payload (VexxStealer)", "value": "3f053c6653e5a90f7c2e89c904c8d75520fa72dcd2232804dc3f15e19b787c9ea7e65c1885e51aa025c9bd1348d3b81f", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974794, "uuid": "fb5b5eac-4733-4b4c-b4aa-0e6f2758bb17", "value": "T10F183318E9BC844EC05F24FFE3F93BB369A635522F94739F6765886E56C0F249138224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974794, "uuid": "09d8f399-d93d-4f3b-a996-f3b3cd70887f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974794, "uuid": "fb5f4d74-9a28-475a-b499-d8b1bb47957c", "value": "1572864:je+BWMFDe45k4HYW0veBI3F6hDRR71VQmi1dBWHyS8IOtj/AWsOcL4IjaM3C27LU:jvBFle45/+v+hDRR7w9dWHysOtzgLPYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974794, "uuid": "538fd1e9-1c16-4a8b-9c20-dcdd3aa54565", "value": 90234783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974794, "uuid": "7dff591c-81c1-420c-a11d-8a92ce75a152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974794, "uuid": "b7e91b6d-6eee-43f4-9149-9e28dd486580", "value": "installer Setup 1.0.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09001ceb-ac7b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788977985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977985, "uuid": "0e59d2e7-9523-45f0-8a0f-ddcef69512e6", "comment": "Malware payload (Vidar)", "value": "ad53c46cb197015beca178721863fd8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977985, "uuid": "1b00d3e7-a01b-4830-b1b6-18d0ab9b1be7", "comment": "Malware payload (Vidar)", "value": "8398bb1657184bf9b9cb3da1ec43eb4db939066317920514c659e59c3af7fda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977985, "uuid": "cbac28dd-36e3-4af3-9895-99905529efc2", "comment": "Malware payload (Vidar)", "value": "8233eefc8c5655a7bed32a1ecfb2e37c94529731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977985, "uuid": "23143438-8e68-4b9b-9e6d-b4f749e2e090", "comment": "Malware payload (Vidar)", "value": "504bf19d0f25272513dffaede635db0998f04962cdaa9f620cced850d9e4be68c6cf888a401e29878ca34a4036ee6861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977985, "uuid": "cae6fceb-d940-4442-a2ef-3a9dcd727cbd", "value": "T1EB965A03BA5442B4D495DE39C47B8242BB747C8C8B32B7E76E14BA386F757C0697AB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977985, "uuid": "4535ad43-4e5c-4735-91d5-a8e1c9ace7e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977985, "uuid": "77d980cf-1888-4129-adf9-dfe4236a8c56", "value": "49152:NQwLC9g5DsgX2OptKpe3VtaVCpiAo01qKSUQP7wC0PgM5Kvzx/FVAI/cGYqn1msc:NN54BMFzLmDhMvHqYlgR1tq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977985, "uuid": "6d6cbd08-3d1c-4913-aaf0-bc50766cc779", "value": 9445272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977985, "uuid": "f3580d57-10f3-43dc-9290-72a44e496be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977985, "uuid": "447c7aa7-1cd1-46fe-9dcb-4d5c12253084", "value": "8398bb1657184bf9b9cb3da1ec43eb4db939066317920514c659e59c3af7fda1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5676107-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938412, "uuid": "9266bdc0-52b5-406b-acc3-fe3c23d49606", "comment": "Malware payload (Mirai)", "value": "a236dad4d4366a9e8c713c1db60be3e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938412, "uuid": "0246a820-2af1-478f-890f-cf7169df5a57", "comment": "Malware payload (Mirai)", "value": "83a46b66b31f169e1b25d340330d9191263660b04ef32d337a84977274881503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938412, "uuid": "f2a1c3d6-ed3b-4853-8a42-3e2d0548906e", "comment": "Malware payload (Mirai)", "value": "d4c9b6bf3bad66b0b6b60aa04a48cc1d0d485422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938412, "uuid": "5ecbd319-c43d-4705-9c74-1c30613aef9a", "comment": "Malware payload (Mirai)", "value": "c2fe16c470542efcbb79f78695ffba0cb601c9652a80c154be22d01b61b72152132813c2fd627a65f7efc40a2cd7ca1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938412, "uuid": "8c73e5cb-0983-46fb-a5d4-0ebfeddb0693", "value": "T172D37C73D8256E98C621C5B4B0648F782F43D1A881436FBE69B7C2B05497D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938412, "uuid": "9b8ea3a7-fb5c-4561-aa4f-614e73e8821f", "value": "3072:YOuckx3S9jjjNfPaDcvd7WoN1dK6hh1LKb6:YOuclljNfSYdqozddKb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938412, "uuid": "9b17801f-713a-4a90-9889-c365d393e75d", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938412, "uuid": "79540525-f6ac-48f7-82ff-cd33b77af3f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938412, "uuid": "6bf62c38-25f0-483d-9e33-e51a01f52d84", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87910b9b-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938254, "uuid": "c0ff3f06-37d9-4c30-b186-cd6e2d9a0640", "comment": "Malware payload (Mirai)", "value": "f2c2b55bfff1a99be189ac717aa2ab41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938254, "uuid": "1c171044-eba2-4531-b822-ac01fdb4059d", "comment": "Malware payload (Mirai)", "value": "845b6b4b46dc586292ada4e70506e9356bd69589af58e17473fcb10c05498d9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938254, "uuid": "f84d4aac-074a-48e1-a87b-48de7385b3f3", "comment": "Malware payload (Mirai)", "value": "53641248177446c106af07a41d66cd00b19f1c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938254, "uuid": "3d904d1d-a126-44a3-939d-8cf91045bdeb", "comment": "Malware payload (Mirai)", "value": "2822d700efa2518cd2447968f6e6ab8201bebae3212f189bc2572dc44468f72266f9715cea97b52c84fe777ea4139d58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938254, "uuid": "7320e768-83b6-4db1-b148-db528a0a96ac", "value": "T123D48C2377628FA0D365D2B202F3875186E511920BE31586933CD738BA51A7C6D2FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938254, "uuid": "e11e6304-f80b-4362-969e-4722f4bc1540", "value": "12288:RpU/4uHDs0uuFdrkp+6sWC0NJC8Gggq1iexrU+V+jp6sFjf+gqq94GS6KK:Y/4uw8rkp+6sWCyJC8G4BxIMquGS6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938254, "uuid": "3ac26083-e664-4a13-b2b0-316096d3d6da", "value": 611128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938254, "uuid": "5ad4aca1-395a-4845-8c69-61aae24e8904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938254, "uuid": "6c584c9f-2fe1-402e-bba8-d59ff08572c2", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de24dd96-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943124, "uuid": "f6196c97-9707-4e55-bfac-cdaad5f636ce", "comment": "Malware payload (Mirai)", "value": "3ed6e6884ae0507fc5a642bacea65321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943124, "uuid": "bcc02ca4-f645-4dca-a8ef-9c566aee7a8b", "comment": "Malware payload (Mirai)", "value": "8477a207642a2b276b386dea6651f6a140302853e76b2c8497d120465d0f28e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943124, "uuid": "6f3927cd-08e4-4c22-af62-d02a4bab4a27", "comment": "Malware payload (Mirai)", "value": "8aa7cacde691aba9fe976ba9605d3fcc804fc151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943124, "uuid": "e3f84bd8-4f01-4b91-b9f1-f7b30ed3ef96", "comment": "Malware payload (Mirai)", "value": "e29f72cc6f3b5f57790c287ff2208ced201317710e489218c9054227ea359acc4f0bddb34a9290e79a92866623205ac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943124, "uuid": "59a0de8c-d68e-4f0a-801f-fef62e421dde", "value": "T1EEC2D084F0419E41DFEA29F13E44CADABBD02F1FA9628E8036A053D25B5D2B35306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943124, "uuid": "77dbf2bf-1d8c-4f53-947f-9542cc01544f", "value": "768:vVdafO76jpmNJJKehmA7trpfIX9KeA7Ped4uVcqgw09a:bam+AnKehPRa9amd4u+qgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943124, "uuid": "92994157-07c6-4b28-aab1-7ae88f6910e8", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943124, "uuid": "fea90075-07a0-4813-8816-7a07d44f7076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943124, "uuid": "36dd58ed-a408-474f-8635-95b19d02cacd", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501425a0-ac63-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967797, "uuid": "2ceca61e-df12-466e-86eb-219a0841dbd3", "comment": "Malware payload (Mirai)", "value": "810fd097c97836a684e03f8dc09dddec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967797, "uuid": "11628e2a-ee55-428b-94a8-2b94315285bc", "comment": "Malware payload (Mirai)", "value": "85afddfcc394f54d51d562c51959ade8f7a53d09cf3539300ae0ec2b444d7c54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967797, "uuid": "e1b1f72d-73fb-4bf4-a2b5-e334785d73c0", "comment": "Malware payload (Mirai)", "value": "af6d58463a6b45980f42ba09f377902211290625", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967797, "uuid": "59df4da5-b6fa-46e8-8daa-42dc0cd78e3e", "comment": "Malware payload (Mirai)", "value": "cf47ef32896b3b746ce25714bf310bee6173fe7286c9777ddfbe5a52a6f11d981a1e0255f026f48b0e19e1ff542b9f69", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967797, "uuid": "ad36adea-fb89-4f9c-8a2c-1228b4599663", "value": "T1585194C502A290716DBE9AD631E58214F1A25192ACD77F4E9CDF78EC8C8DF0EA061753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967797, "uuid": "b08ed245-fe1e-4aa1-85af-2dbfd61d9668", "value": "48:ip+O+yp+8++p+yW+yltp+R+Op+D+yp+p+Wp+rO+Yp+Q+6p+t+Gp+U+op+D+Gp+vW:itHU8qoN7sv6MIND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967797, "uuid": "79b24459-66a8-468c-9a29-88d18dd434fd", "value": 2839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967797, "uuid": "5a845af8-86a3-4f43-8d86-d869071e691a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967797, "uuid": "60fa652f-9374-4779-a202-391d44a46312", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6224be0-ac61-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967109, "uuid": "985b4c15-8037-40ea-b02b-85acf63fcb61", "comment": "Malware payload (Mirai)", "value": "d540304ab251eef6d8ba6aee49a7f540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967109, "uuid": "506fb5a1-647b-4c4f-8850-64fa388b5a3d", "comment": "Malware payload (Mirai)", "value": "85c3e92be13ccf5b08f2387dbe25b892cf8e31081da2e4b5269104bf796ddbf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967109, "uuid": "5e8c777e-0487-4ba6-899e-db6a1c0ea116", "comment": "Malware payload (Mirai)", "value": "cec9f5b2f153d90bee89e65022da97d2c11cd077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967109, "uuid": "b97b5fef-bc11-44cf-a138-655f2b27bed8", "comment": "Malware payload (Mirai)", "value": "b7d2cf366e9c4b28f811fb5f78398172fa595910d4167602a983929f29dfab48944ed121ed280e1c55512b010b63af47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967109, "uuid": "ce17ade8-86a5-47da-a954-faa7527e3b04", "value": "T19364E487EB510DDEC56ACCF0133A635259DE413F95A623A7FA388994B98D18E02F3CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967109, "uuid": "1764cd9e-2f97-4d77-ba7c-4083973ddfed", "value": "6144:+ddPASgYSebgwYPU7w9/9J4jzjiTRMjxZ7:ilMebOtkvjiTRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967109, "uuid": "06d640b7-e115-46a5-8ddb-eb40031b0a36", "value": 336928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967109, "uuid": "d5598b00-13d8-496d-b888-de35dbf67c10", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967109, "uuid": "59cfd0d1-8ccd-4265-8d5d-ba039d52831c", "value": "wj0s.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89efa0e3-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938258, "uuid": "ee5b2943-ad4a-4d16-b860-fbf324adb083", "comment": "Malware payload (Mirai)", "value": "45655f5a8b34237a55ce1f57c1017ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938258, "uuid": "5c3713ac-a91c-47bc-8136-0c13435686f8", "comment": "Malware payload (Mirai)", "value": "85e0eca4446da6ef8c646f490f60769b37a0f9402d87f2b6564b7bdfb5c4e432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938258, "uuid": "88213c85-eea8-4249-8025-a1eb1f2ae08d", "comment": "Malware payload (Mirai)", "value": "a50b01b1e4b38ad8265c151b50be39534879c81a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938258, "uuid": "96c11e6c-bbb5-4e78-a77b-85d5113edc2e", "comment": "Malware payload (Mirai)", "value": "a194f0f786475a2ddb4e85ac87a6306fd425119f69081c8fc1d4e40305f77c3bb702c9e52144515507be9253984c32bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938258, "uuid": "38b33f99-014d-4baa-9eb2-0ad230f973c3", "value": "T1A1C43949F881AF52C5C1367AF75F8248736757A8C3EA71069D185B383BCB99E0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938258, "uuid": "0a62fcca-cd3f-4ba0-8cd5-f7b562f3a222", "value": "12288:fXdP2IWsb81Aaumj24l/WwZxZxKyNpjpPA1PJI0Ed4R:fWsb81PK2XyJbEd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938258, "uuid": "aa00d50f-1f74-4ad9-8cd2-e8af1b0229ca", "value": 544100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938258, "uuid": "c63eb60f-674a-4e1b-aed2-dd27db8e0102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938258, "uuid": "6971ffcd-4423-4256-a306-63018ae26e87", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1103c9c7-ac9b-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788991743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991743, "uuid": "b3fe1885-d462-4f21-91e5-0357d301ef86", "comment": "Malware payload", "value": "787fc1e6e741a36cfd41e0827f6c60a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991743, "uuid": "5d125ae1-07ba-41b0-98bb-2544b239ab9f", "comment": "Malware payload", "value": "87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991743, "uuid": "b71886fd-b733-47f9-a976-2ab034581c11", "comment": "Malware payload", "value": "c9d43948197d0ea6eb66e429886add687b37c9d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991743, "uuid": "54783c33-c0d3-42e9-a3c1-e074885ff9c4", "comment": "Malware payload", "value": "a65ec9a77f75dd0537533931d1b538868b9e2b9f067c8a47a0294c4ee6803ff404fcb632102962257ad947d6dac6c4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991743, "uuid": "4aa3b7d6-5037-4ed9-8975-5a3aace61f05", "value": "T108C48E4BE6AB31BDD51BD534860344B6B611B8A70720AFDF0394D5722D36BE0863CB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991743, "uuid": "74ad152a-e42c-4221-8a1a-5f49691ef61b", "value": "7d8b60128e7e3056a8ab022b0c2cd8d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991743, "uuid": "7702d2f1-f8d5-4350-84d0-8ae07ec63a60", "value": "12288:Zwy0Md3Tv0IrWhVynCmJfHoPC0OfKX/I17/fNMAO4M:ZJ0Md3Tv0IrWhVynRJYiI/wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788991743, "uuid": "2b9f494c-2890-4eca-a06d-0977610259cb", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788991743, "uuid": "1d20212d-72d1-4aa4-801b-46277cfd6f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991743, "uuid": "a572c6ce-e083-4ae6-98e5-d9413daa86b2", "value": "87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68799b32-ac66-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788969126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969126, "uuid": "e388d426-98a7-4d2e-b279-0a4b315850df", "comment": "Malware payload", "value": "780a756241ff8c370a2a8b6336bed3e4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969126, "uuid": "9c252583-1f40-4a7a-98ac-06367f42dfb8", "comment": "Malware payload", "value": "87eac864eda1676ddfb138a01d0256e8a24f0d577ed7f64e072737d5137c49c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969126, "uuid": "46e1250e-0421-4961-bd29-ae9d5d787e92", "comment": "Malware payload", "value": "52a16b4a4df0c429be233f9f8dbabed94bd4da64", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969126, "uuid": "623d29ee-f62a-4810-af4c-6be41701da24", "comment": "Malware payload", "value": "c917e675df13788df96d7930006e9b3d18cff2e1f15fca7bcd971b7f05dd84a2185ff5c01e43fbb8853d59b35a26210f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969126, "uuid": "2b9a752f-4b12-4afc-9378-a13404524197", "value": "T1ADF523D5E9C62875D01BF3B4F18A76BEF02B378588B14D1B37AD2E205F621242277785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969126, "uuid": "eeb21abc-d755-4150-ae81-59e16ec4fa41", "value": "1daa969bf463ca15e619d46b8f6884a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969126, "uuid": "7ed0a50a-7dab-485e-8732-885aaa860f0e", "value": "98304:WWFpOBKFix/1BE3ctS9s3FmwIU+J685sh:ABKFyQcsqAek6Esh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969126, "uuid": "b8de309c-dddd-42dc-9d8c-57b3599c95fe", "value": 3398184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969126, "uuid": "2071a4d7-252c-4363-a69f-57bf45d3f46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969126, "uuid": "a7e25540-465c-42ef-8cdd-f8231c71721b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad0b1db-aca9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788997799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997799, "uuid": "db888d33-27ea-4664-85b1-9b693d52c706", "comment": "Malware payload (Vidar)", "value": "5e7afbc2588e40d0b30a8f45577ed6ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997799, "uuid": "91c2a4e0-07d2-4925-9250-ca75865e64f6", "comment": "Malware payload (Vidar)", "value": "88a9d97e1a5c132b1018c8a7f92f0c146cd86b8d85b438c220c760a9f2dc3706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997799, "uuid": "8d4d4637-4bf6-43b2-83a5-494f91da3e9d", "comment": "Malware payload (Vidar)", "value": "e6fedf604883b4f166d60e329dd07abb994d8bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788997799, "uuid": "50ecc967-3104-4f90-a080-e3a6a269b9cb", "comment": "Malware payload (Vidar)", "value": "a898baf723cc5d85044a0f56332bc779e783b9a3b3823435d072ccdb3d60029bbcbb6dd0e9b1e9bc7b151f1a6a022d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997799, "uuid": "7ed5035e-fb5d-4a7a-81a0-b51ecc0c3629", "value": "T133568E077B8281B0D455EA7A84B7429477B03C5C833533AB2EA9E9303F663D1B67AF54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997799, "uuid": "e2dd1ae6-0d44-45b8-addd-5fa03bf8a643", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997799, "uuid": "de6e6b91-6380-4825-8665-fd546fb9c74c", "value": "49152:f5SExxGrhzt5HXIxtSMaoyP4E9C3wSh+2lRLJH1QCD+iX6KUqj9gx5fBlVgwu9wX:fvukxtcl45hrfCUjkQqEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788997799, "uuid": "3625addf-ff16-42a8-816e-dc58bde84d8b", "value": 6303744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788997799, "uuid": "17649ba6-9267-44a9-9859-878c0cff169b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788997799, "uuid": "cefef0bc-9feb-4d45-a2d8-895b1917221c", "value": "88a9d97e1a5c132b1018c8a7f92f0c146cd86b8d85b438c220c760a9f2dc3706.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccac3d0-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "4582bee1-41a7-4976-9523-12b73bdd8f0f", "comment": "Malware payload (Mirai)", "value": "1169db8281f34b505984e804ec379647", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "bba80fb8-3e2a-4c59-abeb-bc5794cbb99a", "comment": "Malware payload (Mirai)", "value": "88c0fa85a381a59bd5f72bf07443fdcf0763589c489f8b021c12be6ed312fdf6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "185ea8b7-587b-40d7-b854-3d48ee71280a", "comment": "Malware payload (Mirai)", "value": "2904786a4eec96196597a65ded5237302edfe182", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966261, "uuid": "64d27374-26cd-405f-a8ca-601a54a38848", "comment": "Malware payload (Mirai)", "value": "45df8b73e9ce4ad2b4ff597f127ce6ee0486e9c9e9508c4f168faa61ef30ec3319768c67970ff7afacb66215d86154ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966261, "uuid": "4e0e237f-c858-4d5e-b735-6547027c1885", "value": "T171516DD972124A30BFF19DDEB5F5886470C0E091EAC5AF05D9EC66FD864CF0836D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966261, "uuid": "5a73657e-249e-41a2-9ba8-876ebb897977", "value": "48:vXa4aaagauag7zEa7aqadasa0aEuUfa7aod:vXa4aaagauakEa7aqadasa0aEuUfa7aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966261, "uuid": "06427c6e-0a9a-450d-a5a3-e60157d98e4e", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966261, "uuid": "853630b5-0477-4246-9a30-d9ad4f301fd5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966261, "uuid": "e8ad83ec-741b-454a-8f0f-2e110163e897", "value": "aws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8149f5b-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938389, "uuid": "6157767b-a093-4b18-8bfb-34892ef7d708", "comment": "Malware payload (Mirai)", "value": "94fc29e7b170b7e3ea6302b5f32790f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938389, "uuid": "3cf2e58b-96a8-4a13-80c8-dae7d77603ae", "comment": "Malware payload (Mirai)", "value": "897bcc1eb8b34a664cfa695d1da43311ad44f38bf9fdf598a74548601b59aeb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938389, "uuid": "eb940d0b-c665-4181-9db8-b5535ff4abe8", "comment": "Malware payload (Mirai)", "value": "fe61c37ae35b420be61b23616a58e23084f9e1c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938389, "uuid": "af77efa1-8a3f-453a-9d54-3b4f3a4ddba4", "comment": "Malware payload (Mirai)", "value": "b50dc8accbbf385d3e4c536fa969d17c62855e5c9208e930e1977372582e7b890639a90648bdeea3afc937811a366f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938389, "uuid": "9e21ec0c-1419-40c8-9924-f3fefa1432ea", "value": "T114731BC25A42CAB3D4931BF901E7AB350632EC2A1B1EDF56F32DBCB85E025C87156358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938389, "uuid": "68b0e5d6-ea12-4f7a-bbc1-0d76069a5581", "value": "1536:/kDxTtJ6gPyPW0ZOHEPS0fglg5JM8iIvXKdGo4XFLEZV:/YbcgPAWWs/lqJliIv6dGo4VLEZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938389, "uuid": "4814ab79-a237-4bd9-b18a-4910af017081", "value": 73645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938389, "uuid": "18501772-56b2-412b-b69f-92bf2a2a1999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938389, "uuid": "b8858154-cb52-427b-acac-2645ad7497bb", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62d2cf3-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966277, "uuid": "67c50dad-582c-4f36-93d0-e759c424c95e", "comment": "Malware payload (Mirai)", "value": "c6a73aade34fe97642ae68178c0a0140", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966277, "uuid": "51cd4008-2420-4251-afbd-e5414dea2f87", "comment": "Malware payload (Mirai)", "value": "8a32bdd901356d77f539e71615b7c4198dea21adf0d05119ee9bcd86f01579b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966277, "uuid": "73f93763-1f7e-4abf-a818-956f5ef5357c", "comment": "Malware payload (Mirai)", "value": "c90ab62359475f185790ceb62b5c116eb2929c05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966277, "uuid": "07d95a9d-3961-402b-98f5-f4613e20c8fd", "comment": "Malware payload (Mirai)", "value": "8c41463ba27ce024a5c18c68bb23af92c3d1610f0a3efb15151258b7a53be1a8ab71ad02b8e949984ed09940e4bb9d14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966277, "uuid": "421a4d8c-3ed5-44bb-9538-eb2af6642e84", "value": "T19A51C0C832169A70BFF18D9EB5F5882474C0E091E6C5AF45D9EC66FD864CF0826D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966277, "uuid": "2ae83d69-ee57-4122-b973-7c30ab02ab62", "value": "48:vXUo4UoaUogUouUog7zEUo7UoqUodUosUo0UoEuUfUo7UooUL:vXt4tatgtutkEt7tqtdtst0tEuUft7td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966277, "uuid": "848635fd-47fe-4958-a3b3-b6ab6ba9020b", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966277, "uuid": "a5c9e87f-fa31-4427-8947-d13cafcfb7db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966277, "uuid": "0f1f3245-2302-4e1c-b4ca-f873af9af118", "value": "zyxel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6aa5b60-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938387, "uuid": "ebf28ab4-b7fd-49c3-9d3c-f57be1b6f93f", "comment": "Malware payload (Mirai)", "value": "b9c600c7fe177587086b988b23ca08cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938387, "uuid": "7167c6d9-c3b5-42b2-afcb-7c24607e057e", "comment": "Malware payload (Mirai)", "value": "8b3bd049094bca01aa6519d70757e9880d9cb73bf17a0ee7021ee3a7b621c861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938387, "uuid": "4c2a08d8-5d3b-4f16-afbb-a924c8935c5e", "comment": "Malware payload (Mirai)", "value": "88a9ff57748a2c9feb9d87610dd1c476e6012b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938387, "uuid": "4b863e8e-abed-4343-8a61-3504b63cc2e9", "comment": "Malware payload (Mirai)", "value": "87d1c0e00175c2601b624226875e72721d51c5ffc6970050bbef85aab89dffb16a5ee78d03fa48da6564bcb2f1d0de78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938387, "uuid": "5b633763-a12c-43bb-914e-eaf7be8248b5", "value": "T127E31941FC404E27C6D712B7FBAE428D3B2A13A9E3EA7103DD255F20378695B0D7AA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938387, "uuid": "66f9770e-7f06-41ea-ab9d-f9b2685bd7cc", "value": "3072:pEkLQVEHefdPycreDeBfl43OhRebnWk5bq6hh19xLc:pEk9HwKk6mt4ehcjJN7xLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938387, "uuid": "8f837d38-7af7-4acb-b100-6cc244664df2", "value": 155904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938387, "uuid": "7a0dafc7-8a4c-4e6c-8e8c-c228aa44482d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938387, "uuid": "47307017-3c03-4d02-89e1-5324cdfa7556", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4d1aeb-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977266, "uuid": "57b5cedc-e8f7-4b9d-b220-419aaacb3e13", "comment": "Malware payload (Formbook)", "value": "2fdf8d62fd910f0d25b3d78bc4e2afc2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977266, "uuid": "b907737b-02cb-4314-82bd-9b2e35f3926e", "comment": "Malware payload (Formbook)", "value": "8b64d3a963240b6da072d0f92bae30e8e72841b48671a346706539996d424728", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977266, "uuid": "393293c8-0ab6-4f7d-8a8d-0e2b257de58b", "comment": "Malware payload (Formbook)", "value": "9525fafd87a2d7ef310190ed61bf7806e18fa100", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977266, "uuid": "f61771b2-5427-436a-b2d6-77c6930d2006", "comment": "Malware payload (Formbook)", "value": "e047f990beeb1cd37beea4d33e2a4521640076f5b2618c5147d69c56bdaca06e7f3014fe81c108904911dd2f6333b795", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977266, "uuid": "5f4173dd-d093-4bf8-952e-2572d3ba8e89", "value": "T1F6C4122217E086244BB82BD9D05DAF0F09C50BE1548CED8E2B4EDCDE54F6B95A1FC92D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977266, "uuid": "6177450d-e45b-4aed-b51e-541db9f643db", "value": "12288:ZRctV6ATSvOhVgPlhkx2WBaVsIwO3a00bqxnGgMU:AV6MdrslOWe00epGg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977266, "uuid": "d3f5d91b-7ecf-40d7-9275-6c41e4cb9cf1", "value": 575202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977266, "uuid": "acbe6dc3-4131-4e24-9ab3-88f539ef216f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977266, "uuid": "99e1211c-6ab6-41f1-bd86-01a3553a297e", "value": "SW_605782.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb3dd59-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788959877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959877, "uuid": "2e8ba7a3-c85d-43c5-86fe-5033e280f7e4", "comment": "Malware payload", "value": "83953ecbd48bdba53de027689a15e717", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959877, "uuid": "2232d9ff-69e0-4424-b778-9a1414c29274", "comment": "Malware payload", "value": "8bc0da091e92bae0b0e5fb57c63c7356751ef9b90e7f6a143776960072153149", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959877, "uuid": "3b126e25-5643-4d5b-b215-be37373e9736", "comment": "Malware payload", "value": "8312ac2a3331408eccc8c2df518f4178ea998f47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959877, "uuid": "8d4f8258-8326-45d6-a436-daa931abf99a", "comment": "Malware payload", "value": "8ce95b7679efa94003c8e408fc4a945060dfe7fa721c98a9f151a9a64c37a618249aed5e443866e63b67a9ac67fa587b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959877, "uuid": "67f95e89-d513-4ab8-a02a-75d0b80e4b44", "value": "T1FED4A556EA4822AB4BC9C9E78944F5CF4CF4232F5926F6D458D209BFC3A56B5C2900F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959877, "uuid": "0cf903d9-b818-4500-97a3-e708cf42bb0e", "value": "1536:4oUoPoUoCoUoDZfP47qoUoKoUoQYoUokKaa:jPwPpPNfP47xPRPQDPkFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959877, "uuid": "fbfea9b4-3318-4849-a1af-9a7f7fff1dce", "value": 647755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959877, "uuid": "61d8985a-d282-4575-aa4d-9cbfd57aa6f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959877, "uuid": "d3887f92-eeb1-45e7-b568-b2f68370149c", "value": "L08U08Z2I4491.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b62a3f1-abf1-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788918826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918826, "uuid": "cf59829c-2bce-4aa1-b001-16b6a99cf5be", "comment": "Malware payload (Vidar)", "value": "3fb89d6f4b9d8664340bf6250e85d7a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918826, "uuid": "511672a0-e7f5-4c6b-804a-9e5c36289ac4", "comment": "Malware payload (Vidar)", "value": "8c6b26ab06165ec54247dcd7b4c2b30b23c9ffcf7c08f17947b86e3324d4e01b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918826, "uuid": "6ca822bd-e49a-410f-bfa5-79a2c387399e", "comment": "Malware payload (Vidar)", "value": "41bc3c393e1a546bf51db11aa0f5e19577808fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918826, "uuid": "69ce7169-0d12-4c42-8fd7-13bf290e417c", "comment": "Malware payload (Vidar)", "value": "a243034d14cac0f8b40ab407d80407b155a5dff78770d673eb14412667a0fc522b9a852973cb6e630a71b9ff0c433ed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918826, "uuid": "a9ab4eff-f3ab-4ff1-ba7d-2711e0924790", "value": "T1CE366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918826, "uuid": "e919b8d1-2321-4c0a-a248-4f99a32bb6b0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918826, "uuid": "c1cf3cca-2e20-436c-abca-5b7615ece9ee", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaW:uc3XND1aJrCOkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788918826, "uuid": "09b88d45-a5ea-40c2-83df-6ae9be425840", "value": 5003113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788918826, "uuid": "799d01b2-84de-40e8-b6d2-c972a19cf26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918826, "uuid": "25af593b-e873-431b-8446-98a54331ff31", "value": "8c6b26ab06165ec54247dcd7b4c2b30b23c9ffcf7c08f17947b86e3324d4e01b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ec367d-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788938247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938247, "uuid": "3b307e92-bf71-4e01-90c0-c9c2c217afb1", "comment": "Malware payload", "value": "172b6f0eb25d4ef36077407ae8d2d2fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938247, "uuid": "b9669239-c8db-498a-9de7-305a7936f9e5", "comment": "Malware payload", "value": "8c6d48c5d52ecb2b0b000b4433092de74dfcf8706123bacdc020f489d5bf821b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938247, "uuid": "dea25182-7251-44f6-a364-eb88c13d5b13", "comment": "Malware payload", "value": "041b45ed1a630434b11fe44e9035c203cfbec935", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938247, "uuid": "5f4b92da-b721-4e24-bb0a-67f86a484421", "comment": "Malware payload", "value": "cd69a26c0280cc7cc2dadbfdfe0779bbf74ba7281cf01285d7e7fa2fe3e62966a923efd22232f6f4cf07335cc0f8de44", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938247, "uuid": "09e38643-8463-4fc0-95a2-837a8cf6bb0d", "value": "T16D8274EE4F60FEE85A19161F24F20E443650C0B7A3AC16BFE58FB2260F5D5386E5D816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938247, "uuid": "a7351395-630a-4246-86b9-eb060e3d505e", "value": "96:8DTYLoDlZOyz1r2MPy2swGG49lK6i0lzXi5jF32m2J9pSI2fjnKDsWhC1b04suBd:8fYULzzwz4ieGkMpk6kpVWSO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938247, "uuid": "154b940b-d56d-4b09-8faa-5a1743a3cce4", "value": 18645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938247, "uuid": "4f9a161b-0307-4627-b8bc-cd633a15749c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938247, "uuid": "0e81101c-a433-4235-b9af-23932c5ababb", "value": "update.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18c73e8-ac68-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788970108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970108, "uuid": "59239aca-4641-46de-a6af-b792a5aeef65", "comment": "Malware payload (Gafgyt)", "value": "fa3432060842b47745c09e487b07b504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970108, "uuid": "2856fd58-0d15-496b-ad2c-56322a93ff13", "comment": "Malware payload (Gafgyt)", "value": "8c86700dd5e9c47a2aeaa835015db85b210b6ca4c5d7341179d48f33ef215477", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970108, "uuid": "827b27b7-788b-4b05-a0a3-bdc65db4b791", "comment": "Malware payload (Gafgyt)", "value": "ee60dd10ad481ea26a9a82f70cce08ad3ddba7a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970108, "uuid": "fa8c0d75-de1a-43b5-915e-b384538f969c", "comment": "Malware payload (Gafgyt)", "value": "c123ac731193321fe004c4b0d452ad4155626a3dee747256b3fcdf23a62f43d2ea9c3e18aaaecb6cf8b87c4e44f43628", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970108, "uuid": "246ae491-92f3-4c91-a535-d84bba2e292b", "value": "T1CE341905F8044B67C2D327FAA78E829D3F3617A653DB3301AB389DB42FC6B991D29550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970108, "uuid": "f2569e86-3a9f-4522-adf9-801a8b00c1bb", "value": "6144:gtKXrV4oYdy94kD5h8zXT2amLzGaVoZGaHL/Xcf/Gy:yQ54jyx5h83mLzGaVo4aHL/Xcf/Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970108, "uuid": "d62e5b66-73b2-4699-ae23-02c68756cb2e", "value": 235774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970108, "uuid": "061a6b7e-2ad7-44aa-aa33-14e614fd32b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970108, "uuid": "9fb424c0-9b94-426e-83ec-fcc90f3183a2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75c7520-ac2e-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788945260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945260, "uuid": "242fe6c8-c361-49ab-82a4-a6beadd19f18", "comment": "Malware payload (RemcosRAT)", "value": "980890035a019f64159e4e699e77a0f4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945260, "uuid": "aa6ae4cd-4a51-477a-b02a-8c559486418a", "comment": "Malware payload (RemcosRAT)", "value": "8cc0fb3f7a6e846a20378467c640553f45e0671d5de2580987ff60139cc82922", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945260, "uuid": "d76956c9-90d6-4a19-a8d2-0ec7eb936e89", "comment": "Malware payload (RemcosRAT)", "value": "d9677131eb695407c02a332264219f1c314b39c3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945260, "uuid": "11e75817-a583-4856-bb90-795e6ab2b510", "comment": "Malware payload (RemcosRAT)", "value": "fe6190e46b1afc3424fab6a77bc6f1304fc9df32aac37621798f35fa641bc0a1ffa9a5c516e2f2208e18878c988110b7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945260, "uuid": "8026f546-7937-4801-a4a4-0b370b95f5ed", "value": "T19ED4231EB6D0EE03E7236439839A82DB2646BD7A6F82D4177B60731DF8797C0B246941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945260, "uuid": "eb4bab31-bc28-40fa-8487-fe0eb634c5df", "value": "12288:nafDRsJ47/r7ytIOlIlSMgDKDtri711OS+IINrwzQuNVBLy:afDRY4nYpmIW1i711OS/Ss0u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788945260, "uuid": "09386d5f-32c2-4580-ba27-050f71b6d137", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788945260, "uuid": "19c1a463-9cc3-4dcd-9f4d-508dd0e87a9f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945260, "uuid": "fdb4d119-beb7-4bd8-8f09-21e843204f9a", "value": "HusseinXAtieh-RequestXForXQuotation-97865400.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a21613-abf1-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788918823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918823, "uuid": "d36bfed6-a783-425b-b7fd-abcbca1007ad", "comment": "Malware payload (Vidar)", "value": "25d51cffd2ef204a9e6564e5c62dcae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918823, "uuid": "75dc0131-6f80-48be-af4f-1f1d74acc377", "comment": "Malware payload (Vidar)", "value": "8e8321260017a015165b1c3f6cbc2ed83324f2da95a8d39d71ff1877c00b4fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918823, "uuid": "5260a13a-5cbb-4df6-b4bd-3f7984b1e120", "comment": "Malware payload (Vidar)", "value": "aa0799fda9a9e9853e4ec57fecc4ec5d3beec44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788918823, "uuid": "3f444787-a0e6-4051-9a41-6916e0117ba8", "comment": "Malware payload (Vidar)", "value": "b562199099f4a65c59f85dcf7a74d6c9b3a2cf6fcac6b483e11f07ddfccd568929c837265e98bbd492be3c7db741af50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918823, "uuid": "8428bf57-f4e7-481a-941c-1b7b3966d4a9", "value": "T124366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918823, "uuid": "2403d112-546a-41a7-bc88-ae7d7bbe1dba", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918823, "uuid": "9b67f4e4-c5bf-44f0-a03b-7f0912b1c8b7", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaag:uc3XND1aJrCOkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788918823, "uuid": "ed244071-f101-478c-a834-257eea0eea8f", "value": 5002801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788918823, "uuid": "ca797748-8602-43ff-b3c6-f275e9beaad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788918823, "uuid": "aeb41402-ad32-4b51-bd8f-066864bc76a6", "value": "8e8321260017a015165b1c3f6cbc2ed83324f2da95a8d39d71ff1877c00b4fa8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e877b483-ac5d-11f1-ab4f-4201ac107002", "comment": "Malware payload (AMOS)", "timestamp": 1788965475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965475, "uuid": "974605f3-1d66-47df-a5c6-0a0b68b645ff", "comment": "Malware payload (AMOS)", "value": "87ba5c4edaf7ee19cf001db127c7fe07", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965475, "uuid": "53c813a1-b9b2-4dcc-8ca3-e20976901a03", "comment": "Malware payload (AMOS)", "value": "8f12396cfb1ac4d52b3c0fad997b2cf83839bc464cfa43e43959239a3016d287", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965475, "uuid": "1aba9c76-2ee9-4077-8f13-007280cb5000", "comment": "Malware payload (AMOS)", "value": "c0a3884d81533b40d6af34c96e9d93ff247c8b2c", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965475, "uuid": "37216dc6-1cfb-476c-8584-6c6ecbd3682e", "comment": "Malware payload (AMOS)", "value": "54442ef307d87ace206539714e6cfae0aeca19d8c186303f567baed67f42b89eb8ddccc3c21bb54b39baa90ddbd1a392", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "scpt", "colour": "#7EA46D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965475, "uuid": "125a5465-0f47-492e-8ff9-5cfda06ea89a", "value": "T1D7833E12B2FA128DFAF39A397DF557D88E7EBC30E972951C4168110A4E61F828D54B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965475, "uuid": "b498334e-92c4-43cb-94b5-7009bbb9c6e9", "value": "1536:1Gqs+NJJDyJcegCDI2+/h9Zaohl+4XQ+9Fq:1GqxZ2cegCDIl/XZaohl+4XQGFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788965475, "uuid": "4afe2cc1-8ae1-4435-bb38-0a5ff8c8478a", "value": 83526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788965475, "uuid": "22dbf9bc-fa9e-4eeb-96a5-87206e1d866c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965475, "uuid": "f7ff12a1-ccbc-4983-aa46-d3802b49eed7", "value": "stage5_applescript.scpt.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ee641b-aca0-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788993893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993893, "uuid": "6e8c34cc-f3be-4a2c-8365-56b2b339d85d", "comment": "Malware payload (Mirai)", "value": "75d7f3382415ae7c957d3a66d4b5489d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993893, "uuid": "f42bf8dc-94a7-49ab-ae73-e86b692f4f9f", "comment": "Malware payload (Mirai)", "value": "905d1ddb63e317d4427b419159976711c9591b10f78c10ccdb9b8aefeaf681f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993893, "uuid": "e5be1b19-4eae-4af2-a5ad-675a857d54b9", "comment": "Malware payload (Mirai)", "value": "08259b4a1851c10aa1235e4169222e761fd1ee27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993893, "uuid": "f9694dfd-76ba-453b-9cc4-ed388b875240", "comment": "Malware payload (Mirai)", "value": "1793f91dceb3e0140b2748b8c80af1c112f5fe3503abb7f19aebefd5739bc03fc0ebf10cadaccebca6cf2a657201f5bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993893, "uuid": "2df80847-fa47-4d2f-b9c9-18a1fc719dac", "value": "T17B145856F1539D81F14206F4256DC7F03F11A5E323372CA5F9BB82F98B438AABC05A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993893, "uuid": "8df6df5d-fb18-41ea-9215-62f852469caa", "value": "3072:gHF1/P4g1oAkRy2ZmSyGHVM+SF853dJUqEF:i1H4g1oRykmnuVM+a8HJUqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788993893, "uuid": "f81e201b-c558-4d73-9945-404f20f8ec3d", "value": 198468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788993893, "uuid": "e9d81bc3-365f-495f-ace1-9cb0e1ff7e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993893, "uuid": "b0fab733-eae4-4939-ae27-f300f8ccce97", "value": "titan.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f586b5-ac18-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788935863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935863, "uuid": "79968ef3-735f-4a9d-8e2f-e4671143462d", "comment": "Malware payload", "value": "8dc163f35f85ba7e06689883a694fa9c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935863, "uuid": "dc17e8b2-8d7a-4589-98e5-54c2ed317e29", "comment": "Malware payload", "value": "907a80126884961f597f4cd64e02d3f0c168dc9591c1b96027a0835ab439660f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935863, "uuid": "13b2629f-0bd6-4d05-8aaf-d0f9ba330692", "comment": "Malware payload", "value": "f3e596fe2c65c695bb68be6bee5202aa253faebb", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788935863, "uuid": "61c94ba4-bc89-4faf-8277-6e28fb608341", "comment": "Malware payload", "value": "d7f3aa11f00910df26c38dff1e5299851e1f165b206e6b7e9bbdf06d7f18cd91c01493da8d89587d6f2107d0c774809e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935863, "uuid": "c19acc8b-9329-46cf-8802-2199571664b3", "value": "T1A8C7AD1663A111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7BB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935863, "uuid": "3ba90bf9-80b0-4cb9-bc5c-537ec0760a50", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935863, "uuid": "bda6d832-29b4-4e08-a5ba-21de523b9474", "value": "393216:Y2PB+xzPvG3TnPgUKD2OVwWOHectHHWLJoTG4Q42WA26Xz6hg1V24kfpslIDomYS:1PpvHWa6F/i2zSfgpe1k4mPddGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788935863, "uuid": "7fc7c428-d9da-4ca8-b1d2-33599a0051ba", "value": 57440768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788935863, "uuid": "ceb0ab64-e3a9-402d-a9a2-117a0feaa8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788935863, "uuid": "e929e86f-092c-4d8e-a75c-8c1232c11ecb", "value": "Simple Cheats Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b02263c-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977156, "uuid": "5a39ccf6-6a1c-4656-b8dc-e52cdc12ecc5", "comment": "Malware payload (Formbook)", "value": "f683d39a280f70aee166f6672119acd0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977156, "uuid": "8be26e1f-db93-4b1b-8bfb-022f9938403d", "comment": "Malware payload (Formbook)", "value": "90c7e11aa2f0f1b4ed3f3d7b394a2be3f6079e929a94191b7565c7b830685c53", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977156, "uuid": "bad03d95-5389-42fa-917d-984dcdb4f164", "comment": "Malware payload (Formbook)", "value": "21fc49ae3a2e56a5e93e7eef7efc09e5ef878ece", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977156, "uuid": "1d60c8cc-2e9d-4cf8-a411-4d09d1284c93", "comment": "Malware payload (Formbook)", "value": "4bf58c41472539f238369e2f6c0547b32a9b7744ab49d9870fe82729576405ef29e92b119cb2ab9e9f8506e4a5932540", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977156, "uuid": "9c0d1e39-9221-4b1f-8803-580229e8b776", "value": "T161E508A126EF7C0B1A283656E85D18458B0FC1385D43B4D0F0DF0BC9AF5FA6669D0DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977156, "uuid": "4106cf70-c485-4196-ae44-32d7bb320bcd", "value": "12288:OdX9UQgOGOSJ3i3+eWnBAXuHkMSKDvFFZN+E7Dsu8LM05EDWbgy8mMqFtaixwKqS:6GOSfezXnMKbkg57+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977156, "uuid": "22e1b9cd-7d53-4030-ad5c-097f9fc077d6", "value": 3216262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977156, "uuid": "3b9970c1-c0b9-4566-9797-01ef195e34a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977156, "uuid": "1f584725-08aa-4870-85c1-083cb225f5be", "value": "RFQ \u2013 V-12253REVA.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3cfec4-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938373, "uuid": "ef057e44-8564-4854-be73-72847c2ea9d8", "comment": "Malware payload (Mirai)", "value": "42470c611385ce92a545b5c9689c85a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938373, "uuid": "5f25ef92-b5d8-45be-a87b-3e73850e6065", "comment": "Malware payload (Mirai)", "value": "916a849ed00c62ad83b04d731a23218f4ddfc6813a83da787680e89f791a2f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938373, "uuid": "4ad9825b-3268-458a-b6dd-10f971d0591a", "comment": "Malware payload (Mirai)", "value": "a241873f1c80c4f941043987ae3420f2ca1f301c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938373, "uuid": "729428d4-d883-4d91-80db-d2b73c5af1a1", "comment": "Malware payload (Mirai)", "value": "391a43a97cc3987ecbca6cffe95e802f21fa69dc39089cb4211319e65afd88e21cbdcb4cddccba080f4a854918031802", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938373, "uuid": "3756f3e3-6fec-4e78-b6e8-52717d5f6426", "value": "T1ABD32A1AEB408B53C0D61B75BA9B82453323DB54E7E763069928BFB43F8379D0E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938373, "uuid": "0227047f-1d8c-4848-870e-eceb36b5fa93", "value": "3072:sy94HJaz8WbdGu8IM8ttkWJUzSUs26M/9nmlD2u:6HJaz8WbdGuJMFbzSUs7M/9mlD2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938373, "uuid": "83ee49dd-f0ac-4282-b445-391913a8563d", "value": 139774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938373, "uuid": "00b13d2d-428b-45fe-bf44-4413daba2edd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938373, "uuid": "ca3f5813-676f-4cc7-82a5-83003c2f1cfb", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662bf7a5-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977283, "uuid": "69efd466-6660-4a34-8107-5116d59b51ee", "comment": "Malware payload (Formbook)", "value": "335ba9a640e396a50ae4256a0d4ff7f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977283, "uuid": "f879e44b-e7a9-427c-911f-d7b82a51cc79", "comment": "Malware payload (Formbook)", "value": "91d432b1184d1684496d00e63364f879a229faba21817e7db5de900a3a5c7939", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977283, "uuid": "9011977d-b539-4545-ab45-46b288286759", "comment": "Malware payload (Formbook)", "value": "2a28c6edd72d4d1c67197dd4dfb5749d13e05bec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977283, "uuid": "17b44394-fd26-4fb2-9e6b-17b88d5224eb", "comment": "Malware payload (Formbook)", "value": "6799e996221a9082ae7352d911c788ac2c3fd8311bf9d9a0f803e2200e00bd64dd9ddd56355716c376670b4961ce8c73", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977283, "uuid": "4ffe1261-d743-46ba-9505-f7eb90ad38f2", "value": "T1C4E5C9E1A2ED9107570E339B508D888C4B8B45617E53EAD4A4F78ED420DE89A6FC0DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977283, "uuid": "dbc9c4e8-bb0b-4ecd-a354-f85534a61414", "value": "12288:hAWGFRDpKAQSkJiacOcXJli2JdlNRVVHZLCGIXq/ArOBbCQGJMGJd8WeokeCv7HT:hqciaUJdj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977283, "uuid": "70bb4938-8697-4328-8c94-bd27dfbbc22e", "value": 3105504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977283, "uuid": "eb2bef0c-747c-4612-982c-f74640741c1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977283, "uuid": "24678ad0-7b27-497c-83cb-627a6942b3da", "value": "JD261393 OVPB26Q001011.xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca13ba7-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788977347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977347, "uuid": "377ed403-8707-4036-8a75-3f979632d1d2", "comment": "Malware payload (VIPKeylogger)", "value": "34371a82989be02570f2edda62bc0527", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977347, "uuid": "94f6577e-0adb-41a0-a13b-b9073e238c38", "comment": "Malware payload (VIPKeylogger)", "value": "91f7c6f6d254a879acd10c55b5370ea8a7bac09c30df19a1f0ed694ea72675c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977347, "uuid": "b66c1076-df7f-4d0a-84ec-493100b0b0b2", "comment": "Malware payload (VIPKeylogger)", "value": "845eee717b2db207999bc484b75d0fe2f7d90300", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977347, "uuid": "8f9d2a39-ea39-414e-b27b-48469ef76a82", "comment": "Malware payload (VIPKeylogger)", "value": "7863df30c539fa18565974293f00211ceb231ad66627265b479fe953a4050ce794a4c3981507dbf14569d01c08e99f27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977347, "uuid": "50410e67-ed16-49a4-9f90-60d000ef0c46", "value": "T151C6A4E817409473B325976C833789218549A90324CDEB4D397EE3593BBDA276368FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977347, "uuid": "9fab917e-be6b-4ac6-bf71-cec3aca84c55", "value": "98304:Ae6m0zCeUPPAqQ6Wt66VfbaRtB29OfQb9GFDd2a14Eba:AjVCe0PAl6g6xo9y/VoaOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977347, "uuid": "6cb82aa4-baf2-459e-a14f-cd7863eec9c9", "value": 11523593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977347, "uuid": "4f01012a-d461-489a-8c66-74a4df7fd6bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977347, "uuid": "6492dbff-2113-4756-a4f6-e223c0af9260", "value": "PAYMENTS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1738e6-ac33-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788947307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788947307, "uuid": "15adf7e0-d04f-4c34-b091-7eb8b9c4468a", "comment": "Malware payload (JOMANGY)", "value": "2410006d6300fac1ff7673be53e66710", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788947307, "uuid": "5bb6198d-e601-4107-b0b9-ec7d2f3fe3e8", "comment": "Malware payload (JOMANGY)", "value": "922007fe7b2724c3d992430ecfd581ed0f9be8bb44da73e32e543c00f1d9651b", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788947307, "uuid": "a2a0c5b2-2822-4582-a7a1-a55c69051487", "comment": "Malware payload (JOMANGY)", "value": "3b45c919c6f868b58e9295d07214322a7f4606f7", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788947307, "uuid": "23d77423-d524-46fd-89ab-79d8a6fe51fc", "comment": "Malware payload (JOMANGY)", "value": "09cdfe0403571d976d842c19208b0ea74e3f1125d25b38e9da5e461bdbd0052533296d668687a57a3dc2e687dff44e0f", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788947307, "uuid": "b6d15dcf-232b-45c4-ac29-95d5c89ae0bc", "value": "T11DC28D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788947307, "uuid": "d238cfd4-d067-4c23-ba88-32b2d362dc01", "value": "768:t8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:t8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788947307, "uuid": "c3cd6623-e142-4d01-b2b2-9339e59ca87e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788947307, "uuid": "a4c69a68-617a-478b-8ef5-565b864c2c75", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788947307, "uuid": "8af5a939-ceb3-4c21-9023-53e515ab4896", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07924f8e-ac7a-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977553, "uuid": "2016e495-2dc8-46ce-81ba-f0c33f7e26b5", "comment": "Malware payload (RemcosRAT)", "value": "1a3b7bd3e32b299a1773f1ab40915642", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977553, "uuid": "c2b9c5ae-5a3c-430b-aa97-19179d4241a8", "comment": "Malware payload (RemcosRAT)", "value": "922af002b5e85b3bf5ab19ac4f4d5cf86f9c989a4d1d97ac8b44adefe1a02d05", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977553, "uuid": "d091baad-44a5-4765-9fc7-7139e6445a3b", "comment": "Malware payload (RemcosRAT)", "value": "6b5a2325ff93ea7e360969345e11bf017de726d5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977553, "uuid": "2a8a651d-9da6-4bf6-a397-6d3d2b6f0683", "comment": "Malware payload (RemcosRAT)", "value": "0be3a38b8737e81011bdb57bfcaefc6debe5bf498cb15a1ffbabc53f3b7af47dfe542b1aa807fa703a4bccc30938400b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977553, "uuid": "68f9e4bd-a236-4a08-a487-a6a41499d46b", "value": "T19251124B7D0AC139883A8F635EABF41DD9F0154B51099C21B89C88422F323ECFBD21A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977553, "uuid": "a4217880-4b63-4ae9-a705-e9170f2d9300", "value": "48:X8aSoA6MP0U9iOShs+81UbHLwfn/21G4i/e1n/ua3BU2CpKgb:XE6MP0U9iOKs+81mLwf/21G4i/E/u++F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977553, "uuid": "0766f47b-f16e-418d-862f-4c2e942f7730", "value": 2830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977553, "uuid": "c376a632-a2db-497c-8983-3a5d8d31a5de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977553, "uuid": "f4d9816c-6c1b-4aa6-9bfc-12f01608fec8", "value": "PV-7467385_PDF.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9693bdd2-ac22-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788939998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788939998, "uuid": "293635bd-cf56-48b6-8b34-b9671d986d64", "comment": "Malware payload (Vidar)", "value": "19ac024b149cf71f5d74a21a0dbe193f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788939998, "uuid": "7cc6b7aa-e2ca-41ad-9538-8df46d437717", "comment": "Malware payload (Vidar)", "value": "92386d22b386d57534a7c069dce6c5b5034765f7bba78d9f4f87d94920c01d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788939998, "uuid": "a512d6b1-a19f-445a-8b1d-9f8831b924ee", "comment": "Malware payload (Vidar)", "value": "d69a81091f194b6775cff3aafd8b9038c1207fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788939998, "uuid": "d29c8791-3eec-4ab4-b7e4-636f80eaef73", "comment": "Malware payload (Vidar)", "value": "697b235969bac60d8cd7e73e5773b7809ca274ac4a4ec57b28bdfbf3b2cb8ae06c456f5c7b40e156610e4b0157fcb994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788939998, "uuid": "c292a8b7-8c8c-443b-a144-61100f25b6ff", "value": "T1E3366B03BD9125B9C09A973689B78252B774BC2C4B3133E32E50BA782F767D05A36F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788939998, "uuid": "c36342a1-75a4-4ab7-93b6-cf47198abff5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788939998, "uuid": "3d105df2-918d-4944-8229-ce6e481b8ae5", "value": "49152:CKnLG56cO0iAdicM2h/W3vCUkEkaerfNSpQRbsqBzu7Iorp1JtncT:Cf/9luvdkEkZNSpcbBzgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788939998, "uuid": "2db1bb9a-e16d-4420-9692-169eb43a6c51", "value": 4923392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788939998, "uuid": "be7e7f25-cddf-4e2a-a510-e362c28af9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788939998, "uuid": "fa45913a-014a-46b9-a716-3bcb4fffe469", "value": "92386d22b386d57534a7c069dce6c5b5034765f7bba78d9f4f87d94920c01d84.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583382ff-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "bebe1f3d-296a-405c-b783-4190698dc382", "comment": "Malware payload (Mirai)", "value": "9ff2d3f743cace6c3b1191272973f760", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "268c9cff-9a3f-4920-92b1-aa15c7d3d8dd", "comment": "Malware payload (Mirai)", "value": "9248f7195a811960f7b7962ea8c96e9c4e59a8ad1ed4632fdca169b334de481a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "31e57deb-120e-41b8-af77-c29e1aeea922", "comment": "Malware payload (Mirai)", "value": "5de98b12000ffe68fa3dbe244ce56ec328ea6b5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963945, "uuid": "b2db3716-a1f4-4c7e-a82d-32d6703bff03", "comment": "Malware payload (Mirai)", "value": "2b4461d93c83b92d3ea2fb90267e2b31548e650cec5145a7cc36530f3d72b030aeb42708cdf97e607c40babf6c778af0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963945, "uuid": "aca29077-13a5-4a0f-a93a-abfcce4b7750", "value": "T139261A97B8924983C4E42676B8BE80C433635EFA9B9B53576D04FE3C3ABE1990D35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963945, "uuid": "53f9d5da-5475-4087-891c-2d04051d701e", "value": "24576:6RTKdzf1DJUdVSYeBBF3kwmfaVtl6TFq3U+LzYnLVYC+a+Fb1esSUzr9prsuuk5+:6WtO+7bdr6VUQlV4HW9NkaZJgRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963945, "uuid": "f514da18-3d43-4aa4-900e-394500b27df2", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963945, "uuid": "b14ce1e4-0c16-4bf8-a4ec-f56a87407819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963945, "uuid": "56ed0f4b-79ea-435a-a538-8f56d590de85", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c99e01-ac58-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963268, "uuid": "b399418d-801b-47cb-9219-a44b66d04057", "comment": "Malware payload (Mirai)", "value": "6481808b9d76ed00cfc720992414fd2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963268, "uuid": "22745024-b0b9-42ce-aa61-57713048dd33", "comment": "Malware payload (Mirai)", "value": "945e374f543cae73a63c5faa6674bd3a8f2b2fe616127a49fe7418cc29cbfbae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963268, "uuid": "d418b858-7866-4b27-a685-19a63f514135", "comment": "Malware payload (Mirai)", "value": "62e7199be27898086e56c0a70cb6cf5c6a9838a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963268, "uuid": "1f36c4d2-0a6d-47a2-9676-bee25652cc17", "comment": "Malware payload (Mirai)", "value": "1d4c74c82d9aa8ec17600f9e0c3393085ba838aaa06d8ba97a20561818ff6bac25dc856523c74e8001e7896639c6a650", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963268, "uuid": "2fbe2f66-f0c6-4ba7-ac74-f119fafa93bf", "value": "T1F9742A8CA2F1E3CEE158EE745321BC1A5D72463B3193728A219EB97313BB19449F9D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963268, "uuid": "94f8cd27-8470-41f1-b7f0-cc0ff03ac83f", "value": "6144:HKXPLVK2u4Ad7Ls4y6xgUbPvGPPLoOq3a9nG:qRl12SrUbXGPTea9nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963268, "uuid": "f18eaa0e-3610-4608-8118-a7aa451fe5cc", "value": 348052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963268, "uuid": "2c3fd860-2106-4fb3-9b82-72979991c48d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963268, "uuid": "a687b376-9a54-467b-abe2-5cd3d65a5699", "value": "riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a26490-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977194, "uuid": "b89b508b-26af-4da5-9549-da1bf1cfdaa8", "comment": "Malware payload (AgentTesla)", "value": "f2ad39271aa6efbc37e8959c024b58f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977194, "uuid": "6e42169a-0bcc-418e-bc85-872bd1f484d3", "comment": "Malware payload (AgentTesla)", "value": "954f2baff42164d92d9d8ad85f42248a5d92d47fb72da542afad609787b91aeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977194, "uuid": "87fb3628-5e0d-4d53-8091-964ba47c5de3", "comment": "Malware payload (AgentTesla)", "value": "20ba5da4db06a9cee1aa129965bb18bf1b883b7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977194, "uuid": "0bba2b2a-dd48-4912-afa7-ad82bc5d1d4b", "comment": "Malware payload (AgentTesla)", "value": "01047ac50a16100fec048c9dd6cff52cb36ddd134d1e6c29a3ccc122da2d15e769ddfb26b64bf78c3f7c2e31505aaa7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977194, "uuid": "a06307d3-2f47-4a1b-b556-5d8f932bda35", "value": "T12EC6C548432C9630AA2E9B1CC5B5D920859F218314E5EF5E317D9359BFFAE07738C9E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977194, "uuid": "cf4237c9-8d74-4ef0-9506-f37eb38da68b", "value": "196608:VezvagYza7V1UIX+Wyj9uzOuYsngM+g4O6eXVR:MXr8uTYEF4XeFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977194, "uuid": "0bdf457f-f3c9-403b-9b13-10b35170187e", "value": 11495457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977194, "uuid": "17e55938-a74f-432f-a2d0-82c5181befba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977194, "uuid": "00c14eed-9050-4c73-8795-912d62a9f2a5", "value": "LiT6543AiT.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c76f1c2-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977293, "uuid": "4c2e2c13-8244-4514-9849-8e095c76578b", "comment": "Malware payload (AgentTesla)", "value": "500afcce64a74a419dec577aa237d08c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977293, "uuid": "89870324-d640-4bb5-952d-59b5137e7a5c", "comment": "Malware payload (AgentTesla)", "value": "9575438d423f9f31bc8760699d7d7b6ea0887366be48034160797db0bdd9df5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977293, "uuid": "96773d76-9d84-4464-a7a6-10da7129d1ba", "comment": "Malware payload (AgentTesla)", "value": "a2fd2d1768a2bb72d1feab718963cd796725aae2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977293, "uuid": "adfd1ac0-143b-49ee-8016-3b4094b336a4", "comment": "Malware payload (AgentTesla)", "value": "4488341ab675018c8e79b5cb790db4794aee80967c5a11d2accbd6b4673724dc5d3546686a8f49c34f23b9f96531777e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977293, "uuid": "b13c1071-3a33-4912-92fa-83bfae5fe7b4", "value": "T1A3C6924D1B89E3B37320675C4A769920E54B620354C9EB16327DD3183F7DD8BA728AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977293, "uuid": "7d9c4666-b960-476c-a560-888f6a251244", "value": "196608:ENWy8/QzMfkUq6ee4QTx8rvyQS/EkJJ0goVMDK1yh75OuQx/:AmKgo4K1yh75OuQx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977293, "uuid": "5066ef9e-37c0-4c1f-9c85-0dc5cda10bdb", "value": 11477249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977293, "uuid": "e8206403-95d7-4532-9657-97bf6b310786", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977293, "uuid": "75fa58a6-31bb-4c71-b021-fff9b25f07f5", "value": "PO00090926.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e18c09-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788938065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938065, "uuid": "39f9cf03-3a82-44c8-8afa-797c7f12cb89", "comment": "Malware payload (JOMANGY)", "value": "1354d10418cc853d7f2e7e32137f652a", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938065, "uuid": "036fbe91-e6b3-4191-8172-c5bcdf27bcb3", "comment": "Malware payload (JOMANGY)", "value": "95c7dbc646714ae556a0a1f2bcfa8b1314a268295553d1a8086f6ea35aa2dbe0", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938065, "uuid": "00be33f8-4228-4fe5-962c-aa2eb72eb1b1", "comment": "Malware payload (JOMANGY)", "value": "046f1c3a80f289c3d3222704708d257459063610", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938065, "uuid": "f9c37f4e-8f33-4ea7-8c41-44d4110cbef5", "comment": "Malware payload (JOMANGY)", "value": "c821158a1467b37242b6ef682c24db69b3e6e2956b5abaaf3b396d6bae28ca3afed790e98bdbd94659b3d341b63b5c5d", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938065, "uuid": "0f609956-4c4a-458a-9f22-3d5d1d88be0a", "value": "T126C27C966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938065, "uuid": "8604f960-409e-40a9-9a1f-9561f0b18c9e", "value": "768:G8vCB+25j6es8RtQ9FYpMSUpi+20qUpi+20YQX:G8l25JtWd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938065, "uuid": "5694cbc5-7a77-4b66-9e97-46443f555ec5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938065, "uuid": "43fa3cf1-016b-4f69-af0b-bb7482e1e63c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938065, "uuid": "493d2024-a0b5-467f-b3ee-3c3986215a7c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ed01e4-ac5d-11f1-ab4f-4201ac107002", "comment": "Malware payload (AMOS)", "timestamp": 1788965469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965469, "uuid": "9fcdacfa-f11e-47d4-a932-e2f8282f1199", "comment": "Malware payload (AMOS)", "value": "bfd0de4ccb92155b6f307a19448c191f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965469, "uuid": "89df3ecc-1b34-440c-852f-21ad5337c712", "comment": "Malware payload (AMOS)", "value": "970d309161a68d460b7183f2912b459fd1206229794b28d818e0b82f4fd22f3d", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965469, "uuid": "b7cfea2d-d976-40b0-b35b-87540de53dc2", "comment": "Malware payload (AMOS)", "value": "c4a996ee021de1414200443bba29997d4f477dcb", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965469, "uuid": "9fd736dc-369f-453d-9b5c-579bdc6e7e25", "comment": "Malware payload (AMOS)", "value": "783f340abbb894c7518e5473eb7050e4308ef678587e3f8ef73ec39142336f1033fa9e49cc69081f2696bd4b8e18fe7b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965469, "uuid": "d96829ab-8e4b-4bc1-9959-19049b851d7f", "value": "T14E515CBCD68C18B6D275446FDDF578E4980A70B20FD430A2F132E7DE087B864602682A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965469, "uuid": "b0925c4f-141c-4a6f-b287-4c966dbf73c3", "value": "48:2ldc+BTU2eJh+6VrrCJRQpVr6ipnsOkAjCJSjI9ukn4wWxAxURf:2ldcOT74h+0G/QpwipnlktJe+LWxAxUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788965469, "uuid": "785b0633-f06a-47ca-8a68-b937600e6246", "value": 2745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788965469, "uuid": "940cf90a-4d22-4142-a361-0cc6de244ad2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965469, "uuid": "c6aff260-3dbe-49df-80c9-ead1ea955c0a", "value": "stage2_served.zsh.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6ff4c4-ac73-11f1-ab4f-4201ac107002", "comment": "Malware payload (VexxStealer)", "timestamp": 1788974827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974827, "uuid": "1f42a6ff-3780-432e-baa2-72a5f35a2daf", "comment": "Malware payload (VexxStealer)", "value": "2bbbba5c564cbab1a1e632f46efded9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974827, "uuid": "beb4fcfe-cb29-4383-b45d-a3312c57b2a3", "comment": "Malware payload (VexxStealer)", "value": "9876d52353f34099698ab861fec6c180d5be0fba12a8097620474a151f2e6824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974827, "uuid": "278834eb-8112-4402-bc1f-de91e2a7079c", "comment": "Malware payload (VexxStealer)", "value": "552a902ab73c0a588e15c08284d49d3e80ede9d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974827, "uuid": "e180d563-f916-443d-b475-234dae582c9b", "comment": "Malware payload (VexxStealer)", "value": "19fa8075150b6c6b45d7ef50a78f44a9ee8db5dd23b3cd3338ee2bc75b54168a95d528fc516b66bf6a1a0d014a921d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974827, "uuid": "4d9dda82-3211-4b2f-a1b3-46f646df19af", "value": "T1B3089E0633E60167E56392798ADB4103EB32B0576734CACB358C43582F9BFF49A7A764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974827, "uuid": "80f53a35-4aa8-4a42-a169-602c452cc049", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974827, "uuid": "4dad5bce-8a66-4e1d-9f89-b902ffb0037f", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfy:fMguj8Q4VfvtqFTrY7VoVa5q1/WyXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974827, "uuid": "5654364a-3ec0-478f-ac67-bbe462970f9e", "value": 81929959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974827, "uuid": "9d852a4d-dd7e-46a2-a4e8-74813225ed6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974827, "uuid": "be29b4c5-bb1a-4a58-9b41-3e8d3ddd5ed3", "value": "vexxstealer_stage2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f61eee6-ac4e-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788958830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958830, "uuid": "0feffaf9-5b5d-400a-843b-1d7ec45390d6", "comment": "Malware payload (MassLogger)", "value": "ebb80273474c044c92cb0815fc0ea42f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958830, "uuid": "4ab7bb55-5cb3-4e3f-a7d7-763d40ce029b", "comment": "Malware payload (MassLogger)", "value": "9b24eede0b83fe9b4039b311d161a5e49d0981ac6caf867bdfb0e685ccfe84ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958830, "uuid": "cffa0c29-03fd-4396-8600-f5f5a6123b1b", "comment": "Malware payload (MassLogger)", "value": "d448204b2f27a96eb1de102fc8ff4b688ce68c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958830, "uuid": "5f0dd26b-7551-4423-aafd-ce554fb885ec", "comment": "Malware payload (MassLogger)", "value": "b4ab82621d40c9fc4031f2db5ac2734ab65159bc46b71bc9f26f56481369df0d490ad8d5fc9e4cbbd9d2de4f9b2d1c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958830, "uuid": "96ff9f80-c958-4786-8fa9-76bd60987eaf", "value": "T1724512A86A26D103D855ABB84A71F6B8177D1EEE6911D3134FE97EFB7A32F041D00243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958830, "uuid": "d619f1a3-1ade-47bf-96cf-2303783a6eb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958830, "uuid": "ac4c04b9-d041-4526-8d8f-30c398756ef4", "value": "24576:TkLqwb7XFh9jExVjUlVzJe9XbZ1npzKU5DZM1Ocqj0qdP:TkuuL9jaV49exPnp+SOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958830, "uuid": "5cc8c81f-326a-4068-9943-700d182dd51e", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958830, "uuid": "8dd1eff8-142b-448f-b2a5-c6e478ee9187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958830, "uuid": "565fb7ac-7d27-4a19-bcf9-fdcce706292b", "value": "APAYDIN METAL- TEKL\u0130F NO PRQ26090060 Sat\u0131n Alma Teklif \u0130ste\u011fi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca58edb-ac7d-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788979226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788979226, "uuid": "3d314b3f-2180-493b-a32b-887223c3cfa3", "comment": "Malware payload", "value": "965a848cb24604fb9c29abf07cab19a9", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788979226, "uuid": "d359fcc1-a416-4bad-a6b6-b9f6a0843716", "comment": "Malware payload", "value": "9b344a299cf74f414ec990711777bc4bb2d5b819527cadbbe94b0a7b971f02c1", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788979226, "uuid": "d8c2fe56-c2b0-4e92-b8aa-0a7bbb4fda9b", "comment": "Malware payload", "value": "190e86170068f27e8014816375788fead6e35daa", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788979226, "uuid": "98d56c66-d394-4db8-8602-4782ae5112e7", "comment": "Malware payload", "value": "e97dc98239a3114b238e8b44e88a8b7cb7688cf88373115c11963b22f3e43e138984f8d13a48b72b4f8e7081dc923d8c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788979226, "uuid": "a7b79d58-8e57-41e9-acc4-694a58afa60d", "value": "T15E46AF0137F8AE37D26F97B6D4F19401ABF1F45AB323EB472280A2A95D53B505C422E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788979226, "uuid": "061dd4f5-962f-4e78-b388-8def8bf1c1ac", "value": "53e4e12437621212a425d294842d0a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788979226, "uuid": "27812ff2-a572-4885-a57c-3f64bc4baf48", "value": "49152:MWPy/lVujLvnoCoi67v7g/hbyw0QfEJ834gUjKabK00IUreSsCrpmDyYVCb4RKAw:nPglVuwNg44q+7sEoyYVCb4UABp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788979226, "uuid": "2479524d-7aa8-4cbc-8120-99037f3c2cf1", "value": 5582904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788979226, "uuid": "471b49ea-0510-4c5b-b633-c52cda6e192b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788979226, "uuid": "04aba907-71f5-44bb-a916-131312fb2fee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa8121c-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788943100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943100, "uuid": "4f1d4b42-3d63-4f5c-86f4-42435301f2c5", "comment": "Malware payload (PureLogsStealer)", "value": "998657bed1b4eed2f0b5ae70c7e8e3e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943100, "uuid": "4606f225-9c2c-453d-a0d7-48f1c1e932fa", "comment": "Malware payload (PureLogsStealer)", "value": "9c2b14d26cea958757168f181d94098bcbeb6eb263b6bc9f93288e93a8b3029a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943100, "uuid": "4ed5590e-c436-403c-830a-0b1306e8cca7", "comment": "Malware payload (PureLogsStealer)", "value": "8969742783ca90205507746179f617522b4bf59a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943100, "uuid": "8ec1f218-a20c-4040-a751-05380ec60aec", "comment": "Malware payload (PureLogsStealer)", "value": "1a1d6e8a9f4c6943a61d6f44c22808cdf56f58bc15ac42dbe27dd5e4e7151d32f8afa13aa6fcd78a5b50c78bc22f5b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943100, "uuid": "d7c05afd-dae3-4066-827e-8526db01b9ce", "value": "T16D8512642B27E403C66123354AE2D5B403B85F9AF823E3575EE97DDBB66AF164C81303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943100, "uuid": "c351a2c0-1a0f-4b86-8093-35cd2eca0f6b", "value": "49152:ZhgVsbrKDuTkcE4NSlw9Q132QRleyUpkvPP7vMrTGM:ZKVs67cvO2Qm6XPTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943100, "uuid": "8e6dd06c-00de-4982-9a56-67e6b3aa3559", "value": 1831424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943100, "uuid": "cccdf842-67ca-42fe-a0ba-7e5870662610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943100, "uuid": "7c763077-d9bc-4ceb-88c5-ec49d52eb1c4", "value": "E-Statement(SI33488777).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d523c435-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938385, "uuid": "fccf2769-8ba2-45c1-b271-45c96bad27a2", "comment": "Malware payload (Mirai)", "value": "accb1cbdfd7ae30064b9faa08b1b25d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938385, "uuid": "119d5d77-42f7-4dac-bf13-69091a78bd5a", "comment": "Malware payload (Mirai)", "value": "9d8aa64b79e871e6af6601a1c65d29dc74ed314294cf4dafc8c3c4ecae44d6cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938385, "uuid": "1e57b2fb-ea70-4e22-8f0d-82788e5fb915", "comment": "Malware payload (Mirai)", "value": "ce058a7300f3a75c4ee31097deaac2c3d66f0944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938385, "uuid": "b7f9cbb8-4dc4-40bb-8fc0-d3e8cdc3e7c6", "comment": "Malware payload (Mirai)", "value": "b8a8911cec28b1657d237150414d178d39d524c699c99184fa0fa655fdcde9b74eec5291f50d5f6c371f23aa5c58ec22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938385, "uuid": "bfc69228-52f5-4b88-b16a-592bf8e55049", "value": "T19114B80E6E228F7EF6A9C73547B78E24975823D613E1D645E1ACD2111E2038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938385, "uuid": "06c0fe09-ca9b-4fe7-92f6-bce6ac517f90", "value": "3072:QDy7dLvKdqzLH6p3o1s7n+Xnn3Z+32Em6hh1PU65:QDy7dLSdqXa2G7Yn03D9Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938385, "uuid": "ba04354a-24ed-4ade-b35d-f2b0cc6d5510", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938385, "uuid": "c867215e-84b5-47bf-bb7b-8f3896ca6df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938385, "uuid": "c032b57e-368c-4f75-a6d4-8699b5810170", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53c6a26-abf6-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788921151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921151, "uuid": "9fb03f35-bc4c-4cc3-8169-b7174a2b1482", "comment": "Malware payload (RemcosRAT)", "value": "fb3832f242f5a31a119de3430ecb4e59", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921151, "uuid": "a1c842d7-ce9c-4244-84ca-889af97d3e00", "comment": "Malware payload (RemcosRAT)", "value": "9e8d5a90140383c459626e04b5e44288f90b6952da0cd10bb15d621f7093d35c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921151, "uuid": "bbedb693-58fd-4561-95c3-04bcede4077b", "comment": "Malware payload (RemcosRAT)", "value": "40a3e6b8445ae76bcbe600dc8a44c95f5edb284d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921151, "uuid": "650e7b3e-9e75-44f7-97f3-af2618d85056", "comment": "Malware payload (RemcosRAT)", "value": "56486471c293e77607c159e8d3d76d4676e4d39e92bcadb534032ed9b384bf8d002b8671c8d0c7b456ebd8e7e8a8e397", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921151, "uuid": "9c1ba688-d9db-4d21-b5d8-1c16f966d4f8", "value": "T108C229AAAF3423624D4F27EFE8484C6585A4412508230CB17FB9735E2E45B9CF7BE15B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921151, "uuid": "df069ba6-fb0f-42ef-baea-0877da0fa13f", "value": "768:zt0SQSmJqeIUO3mD8HiUjD+cDzSrlSo2UDsdLw3tBtTi:VmoAsmD8CUjDXzW0oXDssbtTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921151, "uuid": "a8287dbe-570a-4ccf-b7a7-250c05e3107a", "value": 27340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921151, "uuid": "f81e9a52-e6ea-40ae-9050-6ac81cd10c78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921151, "uuid": "96792ebd-7942-49d7-9339-e6ccf039c25f", "value": "Havnelbene.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49b525e-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959805, "uuid": "2d3d0a01-1dd0-4fd5-b9f8-0a1b131f0438", "comment": "Malware payload (Vidar)", "value": "f8a6ab95694462a7108fce7b3215b6be", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959805, "uuid": "592d4a5f-349c-4a30-95a1-a9b165cfc8e0", "comment": "Malware payload (Vidar)", "value": "9ec7c7f127f617eca7a0a77b42b38c940f775482c054ca2efef0972de427187f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959805, "uuid": "424f0b34-cbba-4953-b228-9ba992efc5f5", "comment": "Malware payload (Vidar)", "value": "a50a33563bfbf1be8786e2f67eb9bfa437baf77e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959805, "uuid": "fb24885c-d432-43fd-a75b-89a058618613", "comment": "Malware payload (Vidar)", "value": "7db6094f2196dcd6866054d4266438db228d4669323862e367a6919fbdd20094f309a65397f7dfb543b4bdf2aff7ad19", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959805, "uuid": "89f886ad-9c9b-4b04-8426-6578bcfa9332", "value": "T149845B31A3C29172C9892234693FB7ED9E70EF222B0189DBDBC0FC1C6E796D15A71516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959805, "uuid": "c914bc8c-63f1-4cce-b630-59ee9d0d3cf5", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959805, "uuid": "5badcb96-c054-46cf-a12c-785fe48d8e11", "value": "6144:A/rLVPW0nsP2Xy+TJfyzW7V/rLVPW0nsP2Xy+TJfyzW7OWMksY55jkZR:A/rLVPW0WcJfyz4/rLVPW0WcJfyzw5j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959805, "uuid": "b9760c5e-0541-45a3-ac4e-a669f96b42a9", "value": 384952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959805, "uuid": "768c4459-26f1-4581-98de-a643dea6d26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959805, "uuid": "2f578b10-3c75-44e7-ae3e-cf9a358daa12", "value": "9ec7c7f127f617eca7a0a77b42b38c940f775482c054ca2efef0972de427187f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c844ef47-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788977447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977447, "uuid": "b406ae38-4074-488b-9c5e-de6879071046", "comment": "Malware payload (PureLogsStealer)", "value": "b34ccbd46ae2bfd18dd021f679138aa0", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977447, "uuid": "d2488ce1-f45e-4ea8-b2a4-d184655ac45c", "comment": "Malware payload (PureLogsStealer)", "value": "9ed811efeac2d92a10d2e1a061180e8cf7947508b2c0e3db745e19804dcbf276", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977447, "uuid": "9f2e5665-cab8-4a6e-86dd-665a27f1e1b6", "comment": "Malware payload (PureLogsStealer)", "value": "d28a245883186c3c5bfffa978c331fdf0a3d82aa", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977447, "uuid": "6a97067a-7ac7-4d73-bc46-b5d324a38924", "comment": "Malware payload (PureLogsStealer)", "value": "e26f10c9839aa78075d44cf44ba9e56b640058a7daad169973c7082492ad85868b03d61942637e5bce9a1af5fc1f2e1f", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977447, "uuid": "0af07f8c-def6-455b-a6ca-a44eda9f85f4", "value": "T1F8051876C2FD2F3DC4275A59CDB93C0C98B154A10B4EF87AED3764C4D87CAEA66A0250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977447, "uuid": "d83c512c-035c-4431-b7c1-f406a323dede", "value": "192:eaE8iSoHdNEcqZX0TqFg28VYjGkfwiNmdKMoEnO8w9CXvTXz+Amcf/i4hfE4aQMa:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977447, "uuid": "330eb095-6f3d-43f9-8ebb-5c15a4883ed7", "value": 809198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977447, "uuid": "f1064a36-8cf2-4352-850d-2f2a0d6604c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977447, "uuid": "61a8ae73-b6ca-4dfb-92cb-a472d177c9ae", "value": "BBVA 09092026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0382cd-ac40-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788952972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952972, "uuid": "3b7d04da-07f9-4f69-8fe6-ba3acad3acae", "comment": "Malware payload (Mirai)", "value": "5fedb37334faa51430fe1519bcffd294", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952972, "uuid": "554a1a41-ad33-43db-92eb-2e1da1393270", "comment": "Malware payload (Mirai)", "value": "9eeda179920277a1756857016918d246a0ac0289074464843eeb486cb473bece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952972, "uuid": "796e88d2-b4cf-4ef4-bb82-5d220cf35cfb", "comment": "Malware payload (Mirai)", "value": "b0fc0d3595d7437d55362cc9e11047da44b6f318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952972, "uuid": "06073e90-a7ef-4589-b0ae-16fa9cc56aed", "comment": "Malware payload (Mirai)", "value": "c792e97b215e296e1acf641297bf24526548e77d89b5fd9a9e4d34d7ed7853c1edf9b308d9e1ecb6d09f0c1d54d017c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952972, "uuid": "b2c03d3b-ed97-49a5-a900-7724bcf9a5c3", "value": "T125355A17B2B774A9C093C034439FDBB2AD3AF0B902126D7B32C09A342D56EA15F59F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952972, "uuid": "01cda6db-1ce4-43cd-a220-d3953f273cfd", "value": "24576:IdaPEt/bkdErGpzGd1YQwphT6bM9UdDqD+wcuvg:IdOEt/bkK0GdxjASdDqguvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788952972, "uuid": "a84f2610-e39c-46d8-a270-5739cff62b2d", "value": 1150264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788952972, "uuid": "1acc7668-4628-4a0c-ae90-393902d2ac8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952972, "uuid": "4e50fd7a-39ec-4bb4-8100-9648ec935da4", "value": "x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd34592b-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921594, "uuid": "35fd162d-cfc4-4c7e-af97-b4c729c0a0f9", "comment": "Malware payload (Mirai)", "value": "8fa418203e79c5412eccb674d9ff05c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921594, "uuid": "1be4ee79-ad35-465d-8b03-7865a0b9d510", "comment": "Malware payload (Mirai)", "value": "a0983541675c369ca18843d757644db9f33de26ca9c5373c1bf61a67ca4c908a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921594, "uuid": "65f6aa30-fcda-4240-987a-a359b2eb49f2", "comment": "Malware payload (Mirai)", "value": "0399137e13fb8bfb403b005e3363ba75752b7f46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921594, "uuid": "74cb9ca0-79aa-463d-be20-251827f185d1", "comment": "Malware payload (Mirai)", "value": "c9814b69cbbb2cd30e90ccb395fd217307b9697b56f15e915e30bef3297f854307322ec633fd6f4d60be1bd9cf4ace4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921594, "uuid": "7004428a-f629-44e6-ac9c-191c06764c31", "value": "T14A516D95B3424831BFF59E9EB5F448147180E0A1EA84AE05D9FC7AF98A4DF0C26DC653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921594, "uuid": "6fbce540-3430-48da-8f5d-5d57c1e07bb2", "value": "48:vuVbqlqrsFCgpZJo5VQLMlJ78Xk3E0uau7R:v0mkIQO6aLiY03E/VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921594, "uuid": "5303a269-142f-4709-b5db-789a57e789ab", "value": 2690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921594, "uuid": "72542425-7db4-4273-8446-c2cb0eac935c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921594, "uuid": "dd51ae98-92ec-4dd9-8bc7-986fbf2db03b", "value": "a0983541675c369ca18843d757644db9f33de26ca9c5373c1bf61a67ca4c908a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549cc295-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963509, "uuid": "39e47dd4-5419-48aa-bff2-d4ba0d0f062f", "comment": "Malware payload (Mirai)", "value": "02d09618a143b9ff7359939008964319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963509, "uuid": "5a77ed7a-0d4b-4245-9df7-ed6ed4d069f9", "comment": "Malware payload (Mirai)", "value": "a18e61253ff7dd0ed63f2f9f3ece677058e8f86fec26a83b2bfe620c68240511", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963509, "uuid": "7de1b53c-495e-49c6-846e-07fcba4c1f02", "comment": "Malware payload (Mirai)", "value": "457e57a68d7699f5ec89e10ff48c51d84447ceee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963509, "uuid": "09a32a4c-62f5-43b7-bddc-4e7eb842a007", "comment": "Malware payload (Mirai)", "value": "dd397813672d45d578131fab33ae9c3cbcd9133e392a90ebf162c56bdd814d79bd3c2fb12a88ae08f315b70c5a402711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963509, "uuid": "39589f8e-8cca-45fc-bba3-151788a6876f", "value": "T15234751A6E22DF7FF668863047B78A30579877D63AD1C585F19CD70C1E2028E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963509, "uuid": "d615ae42-264f-45cc-8fc7-3b95a42fd4bc", "value": "3072:aXrH/7x7q7li54o26l/+4mWgHYKNpgylr7V1sr:aRe7cF2HYKYQr7jsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963509, "uuid": "05477f2a-1347-4083-b536-ec65f34ca6f3", "value": 249444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963509, "uuid": "dc2d525f-7eb7-4300-8fd9-4dcfb5eec89c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963509, "uuid": "37865241-3e95-4513-b454-11bfa0d1d274", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556d9129-ac53-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788960934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960934, "uuid": "9deed775-af7c-439d-b0e0-8c25c7ab0e2f", "comment": "Malware payload", "value": "afd3306af0168902d350d1ab2a139ab5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960934, "uuid": "c06c196c-ffeb-4983-b407-954e3a37adae", "comment": "Malware payload", "value": "a286de012954013e57dca6fe2d110c732576aea9b75c72d8a149cd5f6332ef6a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960934, "uuid": "eb373c0e-bb9e-4d72-a2b0-033b823e76f3", "comment": "Malware payload", "value": "9e35241423187d22db58d839d435c705c00ad016", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960934, "uuid": "3bee15ac-a3a3-416e-91f9-984b7b39ce5c", "comment": "Malware payload", "value": "cb209364eab107ae287d979ec06a87f6385cd103b3285e3f720773af321e2999c25d4af8820bff1f04d2f9c9b3952ae6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960934, "uuid": "7867c9a7-2640-435a-a5e8-b7435765d8b2", "value": "T1AF51760039A94205F2B63D3ADCF2F352496AB921EC31F6B54C60818C256058BDB3BF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960934, "uuid": "e238da4e-8d6e-49f4-a4bf-f0bafc9dcf9b", "value": "48:8WwmPaIW5FPAtRKTY1geNy1TGJbaq1TXX0JIWx:8hNbz+Rum1yyPTXkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788960934, "uuid": "aa9be579-3e35-4245-b20b-17cec6e3f9d4", "value": 2617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788960934, "uuid": "9d01312c-3186-429f-8c25-1ed252146cf9", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960934, "uuid": "6a6fe6e8-24a1-4694-bc69-fa65722be1ba", "value": "a286de012954013e57dca6fe2d110c732576aea9b75c72d8a149cd5f6332ef6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0134b5c-ac62-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967582, "uuid": "fed17fba-21d1-437c-84bb-f36da56d1d2f", "comment": "Malware payload (Mirai)", "value": "29b54be8f29c3ca2f7cd93b1f1226e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967582, "uuid": "841be416-8e9a-4c29-8b3a-9635531ea5e5", "comment": "Malware payload (Mirai)", "value": "a44a7ebcba0026c9b167b02e732c16e5e08506434c196c37082219027288c50c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967582, "uuid": "7e306724-a090-46f0-9474-f2c37ff29883", "comment": "Malware payload (Mirai)", "value": "7ccd04e7e0deae231b04720c9cba7b927a6097a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967582, "uuid": "91306f22-847a-4b1a-bc81-c0ec506a7387", "comment": "Malware payload (Mirai)", "value": "073252c454e9030473560aaf15757888bd343aec88ce75902519649a9417512c590fef722e6f72f7e6772492c9ce2daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967582, "uuid": "8724e07e-fffa-472c-a3a3-467405e98d97", "value": "T1D9E2944F6E328FDDF669C7344AF34E30A799238226E1C686D36CD1501E6024E985FBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967582, "uuid": "3a126c4b-e6fb-40f3-a5a7-32c1bc20eea9", "value": "768:HFPuV73QkBfPgmj2/S3zLMiXoQ0eTK3yPn1:HVuVd8SDLLYIBn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967582, "uuid": "40f549eb-2ab9-464d-9cb2-f5dd4f99449a", "value": 31724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967582, "uuid": "05f5e1bb-f71a-4422-ac51-0612075cf66c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967582, "uuid": "e8737368-f1a3-4fb8-895d-cf57423433ff", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41df292-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977494, "uuid": "51944a4c-367d-436c-9ef6-c874d1279ac3", "comment": "Malware payload (RemcosRAT)", "value": "ec5706a405276dc1e2d55e21eaccabbc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977494, "uuid": "35bd3a9b-d2b8-4bbf-a978-edfc7a8853a9", "comment": "Malware payload (RemcosRAT)", "value": "a489005dcd9b9d37b3b2205eabd21c0cccb9d962455e0844fc19455b0ef62f5d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977494, "uuid": "d64a8894-a745-4ae2-90ea-962b35cad1e5", "comment": "Malware payload (RemcosRAT)", "value": "36e2fce01478c683f2f71a286f9a6e7d7632ac66", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977494, "uuid": "1a468000-622e-4a6d-a2e2-84e118a8918b", "comment": "Malware payload (RemcosRAT)", "value": "d5e20e36958ecca881f1c9c7e032cf21c55047691c4a82e43f838bf0b02c20da404282e4649e1a02ec60a56850d706ce", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977494, "uuid": "be0a7b6b-0711-4bf3-ab99-bc3f6842130c", "value": "T1C4A24A71CF661392CA491F5AAC705A47C4BC411411122C78FEF93B8C292DE9CA7ADB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977494, "uuid": "7fabad78-18ab-475e-ae4b-9f324d3c7b3c", "value": "384:amBNkZ4mJqSeD+RMzxCa+mo69d4mEN+F9BYfuSDAccD8sy46XnJpsfP0+omDxp4c:a+NE4mJqL1kmtLX9BYf/3cD8XnZ60+DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977494, "uuid": "4ec0cd3f-7f33-48c0-ba34-68b0fefd9cb8", "value": 23152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977494, "uuid": "0e100e36-1e50-4d41-a4ba-a41bd2518a1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977494, "uuid": "432da4bf-ba11-4b40-8d64-028c5969d66e", "value": "Employee_Performance_Report_2026.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c572bd87-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977442, "uuid": "2f94aacc-34d7-435b-8fe8-af57b4dfbd46", "comment": "Malware payload (AgentTesla)", "value": "fa96e15ffa6972b8626cac031c34f57e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977442, "uuid": "8df8e556-8df2-4e17-a70d-875368192d3e", "comment": "Malware payload (AgentTesla)", "value": "a49f1bf6ac9b7335b993fb2d8c0d37db768cb71ca4ecf51634c5dba9157ebaa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977442, "uuid": "c83e6ad1-e6b7-4e64-8bbb-95f04cb5e514", "comment": "Malware payload (AgentTesla)", "value": "6c69e7c32683d17188567f8120266cc31ac81fe1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977442, "uuid": "ceddfa26-18ee-4a75-8fdc-221210069b84", "comment": "Malware payload (AgentTesla)", "value": "d237e53ae743b0fca2c4396902d0f35866d38d98e5ae8d4b4b0d3585b2171b562fe999de687ea4b75c1466d2c6f8b889", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977442, "uuid": "27001622-c114-40f8-af36-21316cd57355", "value": "T1B1B4BD4608EFC9065F72D6A16467D419B4701927B6FDEF4BBE7CA8C02B6C81260876FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977442, "uuid": "d73e5e1d-2fd6-4a1e-b98e-0f0c0266c8c1", "value": "1536:FeMtezeDfg10nYdh9hsvWO4STKmcBx4I7NJj3E585RtgHqIH+uIWq:T5xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977442, "uuid": "a39caa50-ed62-40bf-b7b1-885cbf084f9e", "value": 503107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977442, "uuid": "3bc0c27b-fd67-4248-a756-a15f081f834a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977442, "uuid": "82982b16-e402-4ee0-91c5-c86a899698e1", "value": "Pago_780304560.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578c415d-abfd-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788924000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924000, "uuid": "dfba7524-f883-4d27-9aed-47cd70306dac", "comment": "Malware payload (JOMANGY)", "value": "dc6f7df42ad2dc7f8664836e62f38003", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924000, "uuid": "c410da45-c902-44b4-81dc-b0c832d7d236", "comment": "Malware payload (JOMANGY)", "value": "a5af2c9eead719aae42ef1fd7a8e78b3a1caebd7f053e3bb34cd74a1e5c470ef", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924000, "uuid": "81d58c7d-6353-4a3b-a370-74c41f2f1ef2", "comment": "Malware payload (JOMANGY)", "value": "144b53a1387029cb2a583cc49240218f093dab13", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788924000, "uuid": "197006c8-cbdf-40b8-9fb3-69e432ee9d34", "comment": "Malware payload (JOMANGY)", "value": "48046d151d6f4503bc5d7e94c06b264ba20666f45f0844f61bc39f57b3c3429fa2088c4fec501a6661367dada4fcc5f2", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924000, "uuid": "e2ca91d6-da5d-41d3-824b-cf042be71345", "value": "T18F236C6516857C15AA99C4371C7E2F0CBDAD43E6320452DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924000, "uuid": "6ee5efc4-f8d0-437a-a98e-149056733227", "value": "768:4csr0a1ldXal9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:2h9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788924000, "uuid": "e3a1ebb9-b859-4447-94dc-6a06ff22f51d", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788924000, "uuid": "82a23f31-75ac-4a5e-8a3d-2922615512fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788924000, "uuid": "070d6d4e-f1c0-4358-acfb-a0660654b605", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2e6eda-abfc-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788923768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923768, "uuid": "a2aa1cf9-fb47-47ca-8cdf-9a5911c32033", "comment": "Malware payload", "value": "503f6644d405ea64eeb00eb9a29767a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923768, "uuid": "3f5b7848-5aa6-454b-8009-76a93bb554a8", "comment": "Malware payload", "value": "a64f579aaddbfe0f05cf6fdbd528ed98e35ef54d2c9869b35fdd800ef559420b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923768, "uuid": "63db9af6-8c50-4033-9f4e-b54629c03e28", "comment": "Malware payload", "value": "2a279952b72ed00104981cd34ff04a900eafce3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923768, "uuid": "9921b07b-aeae-464e-b60c-c74844d89f85", "comment": "Malware payload", "value": "b3eaffd943eb1f47a23ac90673afef1c641c15525bd4e1485476e8cecb4642745a527d592c7bcf0c2fdf5f960d297e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923768, "uuid": "362d99db-152c-46d8-8708-b667a703b1b4", "value": "T18F459CD175528039C69603724A7C7FBD117DADE81BA1C9CFAFC8362CD6331C26A3664A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923768, "uuid": "07716519-ef49-4d2f-9bf3-51e819706ec9", "value": "0578002c9fc8279f752de56cfee7a485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923768, "uuid": "d9780555-0acf-4a8c-acb0-513edacc40bb", "value": "24576:qH8HmJaIgNYsfbDJvioYMhBt5svWNGFpZC9dYh:4pq/5svCGRCHYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788923768, "uuid": "c4124ccf-2377-4371-a2a7-65833fa6a8a0", "value": 1190608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788923768, "uuid": "61aab40f-e769-4d69-a09d-054b759c1a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923768, "uuid": "b5c68ac9-7fa5-4c61-9efd-91ab72f38819", "value": "youtube-music-free.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038619ec-ac3d-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788951347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951347, "uuid": "07d673f4-971b-4cb5-97a7-6d1f29413493", "comment": "Malware payload", "value": "c18970754a2026d112df352276e00f73", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951347, "uuid": "3ea3a0a4-284d-4aa6-9b87-7c392bb2f378", "comment": "Malware payload", "value": "a64fcedaf549b6edb3da1480ea42ac56eaa3baa32a855abcf4fcd22842f6de8d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951347, "uuid": "c1e3f8d8-7ab5-405f-990f-1a2cadfbcf81", "comment": "Malware payload", "value": "c58eec99b54de3807062369b4c1e5da56693cfec", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951347, "uuid": "5d750c74-cfe4-4b8a-9aca-8d95e78738fe", "comment": "Malware payload", "value": "27a58dd21ddac9911bf2c9cbe6233e05073fb4d12383d0d44c48adfae77cc15a5fc98ee58f6e853165c76de27765019a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951347, "uuid": "71140ee2-af2a-4422-963a-d9ad1de78947", "value": "T17625ACCBC83635C8C5348A18B685D7C7F6ADAA9B749ED99C7A3C53840F4201DC7E8E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951347, "uuid": "62077d80-400b-482f-b18e-d2b5bdf08c22", "value": "6144:698X30uPkNg6Q+M79Dc6i6Z+8X30uPkNg6sM79Dc6i6t34qEmDhM79Dc6i62n56b:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788951347, "uuid": "6b250a4f-b7a9-4895-b154-e441d24fbb14", "value": 1033352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788951347, "uuid": "8ef33f5b-2e9e-4ecf-a658-98ee1a5d94f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951347, "uuid": "435d46db-1ded-4c60-9aff-5e7306fa6a4b", "value": "Dekont.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed12edc-ac3e-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788952037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952037, "uuid": "0b612b5b-fba5-43f8-bd0e-abe49740c7b0", "comment": "Malware payload", "value": "7a5cdb2f590cb85a36ca6dd188639767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952037, "uuid": "bad29f49-6187-41e9-81a8-2d078df516a1", "comment": "Malware payload", "value": "a66c01c55a294a773c5a98b9f286b6ad32055668eb9fe8d77f1f0f55f1a481b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952037, "uuid": "b58cadd3-3f7d-4857-939d-8afd88f642ad", "comment": "Malware payload", "value": "7bc33cd10319657b75f33c698cf4a84dc7d07c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788952037, "uuid": "aca873a1-9f08-43bd-bd03-5db7d99b4628", "comment": "Malware payload", "value": "d3e3e4a87129215ac0f5e6eba4b313a406ac11bd909af904dec0b20e2d6e1e43e8920b6786f08d88434245e007aa2341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952037, "uuid": "d278ea0d-5bd8-43d9-a9d5-a8f3ddf4799d", "value": "T1E6F67C57A85514ECC1ADA178876793027B327C6D8B2113D72B70B62CAE72BD0FEB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952037, "uuid": "a64c7b09-224f-45d3-8c90-23e5f129e357", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952037, "uuid": "0bcdc9fc-d4a5-492c-a28e-7363bd3395e1", "value": "98304:KppZ62It+o3NXBfEIb+3p6WtIWmaxx+Zwm3cH3yprhnGWQCoXgxg7mmWU3E:Ca7tZ/fy3p6WtIWHxx+0H3KrQzG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788952037, "uuid": "66bc8e8e-b5f7-46cc-bbf9-d51efcedc607", "value": 16049448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788952037, "uuid": "d7f59c47-e506-44a2-95a3-fdda7b07707d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788952037, "uuid": "665b3728-6db9-4552-99e9-ff79968aceea", "value": "PDF_Municipal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561479fd-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963941, "uuid": "61c9172d-ff7c-4419-8729-40c57ed96b77", "comment": "Malware payload (Mirai)", "value": "f1298c419eaedee451aa5ce3128838a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963941, "uuid": "6104505a-1cc1-48cb-bc89-eceb2ddeb382", "comment": "Malware payload (Mirai)", "value": "a68ac7eb9fb4402e1590467f223c3d6eb5c567d7d7905a53f6b0d9709a331691", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963941, "uuid": "f0e436c0-9594-43ca-bf78-b704a3353797", "comment": "Malware payload (Mirai)", "value": "4b99bb6c10f9d245affdac4bdd4a84a432d93d62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963941, "uuid": "35f35ea1-f9e6-4b76-a483-39c539da6650", "comment": "Malware payload (Mirai)", "value": "7ab63d40283d5eced85140a9f3d0bd6aab558a822c883447a07d65003ed23c2db416a0b4f064f55fdb302a0e4e8144c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963941, "uuid": "bfc57dc7-9b15-484e-a73f-606d7f524233", "value": "T10D41A98B33601DB3CC0AAF45F35554E4E0DF96C2E1678EF8B4B54E63189960CF996E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963941, "uuid": "6d3ff583-a8f8-4ca7-bee9-1dfda410d3e0", "value": "24:TJOJYOcI6dF3mBFANIINI+KPmKPLV2vyN2vndGHr7R:TSYOkF3kFSKPmKPJ2v22vAHr7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963941, "uuid": "7000d485-bb08-481a-9ae9-2c3006f71f83", "value": 1924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963941, "uuid": "59a95149-abe9-40f0-9712-83fb006eba36", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963941, "uuid": "7b83eeb0-b21e-4198-993a-1346c90bd665", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4b3c05-ac60-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966720, "uuid": "de8dbe15-2ff8-454c-b876-f0974ed8df1a", "comment": "Malware payload (Mirai)", "value": "6243d65146bdedb214751d9e4fb4e550", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966720, "uuid": "7bda6780-e5a6-444b-8a69-4f26d58440ab", "comment": "Malware payload (Mirai)", "value": "a6b71afc682acc97149d05d0ea2383ea622bd5580b12d13e12f895c40bf38848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966720, "uuid": "5b09f298-19d8-4c71-a812-0967a134eee6", "comment": "Malware payload (Mirai)", "value": "fed5352af1397236d1cc03713c5667223fd50802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966720, "uuid": "4a407c1c-ae7c-4bf0-8eb9-4c4b5edebf55", "comment": "Malware payload (Mirai)", "value": "103ca0b209e2d7c9887fe72c6c83695de810a6c3a94650319e8c760575abce8f1b7e3f81495254c03444710c0676e9fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966720, "uuid": "69927fb8-10ec-4cbd-a5e9-02c244a4f04a", "value": "T17283129B8295E3A2DAB278320B587654FD31B6232D304F869DC8766BDF379A11934F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966720, "uuid": "f7d7056d-7436-4734-8d01-328579d10d42", "value": "1536:8F495GsNpGzO/P72cxfDrC57JuqKB9yrUuEoVSYecA9Zo/IOy8WKZYU0XFRg/+x:8FOGSTL2cxfi50vBIUQMYeccZGnVLZYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966720, "uuid": "37ce3867-65bc-4dd3-8319-fc482c413bd0", "value": 85588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966720, "uuid": "677bedd7-bd94-4821-82f3-f5f04f2cb5ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966720, "uuid": "0cf9ad9f-3a80-45f3-9b1f-93cd8f4ef5e7", "value": "wj0s.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae6b625-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788933160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933160, "uuid": "964628c8-dc69-4a2b-ab92-14c3853a2f9e", "comment": "Malware payload (RemcosRAT)", "value": "d9da5934d287b381dd24670a6361779c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933160, "uuid": "d646d66b-7f1d-40d9-8ac9-f54b0c35233d", "comment": "Malware payload (RemcosRAT)", "value": "a71e0fa3ad7f95eb11838384bbf07a6ed964da60cb94e063a6cf49d26ec887a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933160, "uuid": "436e6035-78bc-4388-a7a9-278d9db6b472", "comment": "Malware payload (RemcosRAT)", "value": "aa50b8b2f7bb39ba3b99981cddc77660d379ebfb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933160, "uuid": "e0feadde-0825-40d2-ba8c-c30adb0976dc", "comment": "Malware payload (RemcosRAT)", "value": "a3114c8c5b93fedc4095d5c3a319ba142584865152612d952d0fe67cb4d08cf8115ce706110061e852b32d1fc8cbd445", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933160, "uuid": "e5d265a0-3b74-4987-9964-5375dba8ecc6", "value": "T11B975BEBAB7C2F1ABB7FC04803B8B877BE4B721E2313B915112C649961E1DD05E519E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933160, "uuid": "221b68ea-998f-452d-a771-b397bb2189dc", "value": "3072:XmovgBz4U2hxcSyuX6R9iieDApowGiG3/IfzlM8zGzwxKWSq6vIj00d8W+khhv3x:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933160, "uuid": "d8cae9dd-79e0-4026-8eb9-dc4b3e793027", "value": 40574972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933160, "uuid": "066a691b-3299-4aa4-93ea-e0344364f9ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933160, "uuid": "92351d0e-c0e8-4345-9ff4-a284edb5f4bc", "value": "DHL-AWB-2800294755-doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b602fc-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921467, "uuid": "0892abb2-0e81-4d26-b372-445a7a87420b", "comment": "Malware payload (Mirai)", "value": "669e7f6a34f03f9be2e67e17245878b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921467, "uuid": "e9a34b0e-0c88-40c1-acd2-5b25b2286ab2", "comment": "Malware payload (Mirai)", "value": "a8655c0314ffb2321cf53e6965271ae02a3a67af8cf9c89b163090e7e5b68634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921467, "uuid": "6c4b20c8-dc53-49c7-bb95-56b6516433f4", "comment": "Malware payload (Mirai)", "value": "bf377a5d9f88ef24f95d2ef0b850a4b0bd1e1e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921467, "uuid": "d366d3f2-5f33-430a-80db-0a1027d0b3b7", "comment": "Malware payload (Mirai)", "value": "4ad8823f0080f5eaae735595ac5eb0dface8257753f36ba81a63c8b1597f0de21bea22acffad1e439f545731f2e6bbc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921467, "uuid": "f17ac66c-2695-493b-ba01-93012a56b6d1", "value": "T1BA33026227AE2AD291B05777FC33BC16669C17F95C6730993CF05A1977C48024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921467, "uuid": "bd39b1fc-e2c0-4a3c-91a2-a35fe1a3bee1", "value": "1536:s9O/ZMAXIxNUk0VzL9O+LcPqF1aBexo4opKZbU:s9O/ZNKyNL9O+LGqFUFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921467, "uuid": "6c6707a3-9a12-47f4-bdef-7caee1543d79", "value": 52521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921467, "uuid": "e5953997-da6b-425e-af4d-a2c657825be0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921467, "uuid": "a9ef87c4-76ce-4615-b583-1d3aa0ea5fa1", "value": "a8655c0314ffb2321cf53e6965271ae02a3a67af8cf9c89b163090e7e5b68634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848156cb-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938249, "uuid": "48f86944-c0ab-4f4b-beda-7a8667d3ed66", "comment": "Malware payload (Mirai)", "value": "5b2d3cc87c5169d4de4873e27c76b3c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938249, "uuid": "25da2cd7-bd16-4f39-96de-afaaa273b449", "comment": "Malware payload (Mirai)", "value": "a9806bf3bcab0a102b0276920752216841cca4e23c42b68e5553b997a9146fd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938249, "uuid": "9a235400-a623-4f7c-af28-5f0525a3e635", "comment": "Malware payload (Mirai)", "value": "9bf5435cb26f46e6da29921d5329b043a2b035d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938249, "uuid": "55fd7000-39a1-46ca-ac6d-67f303bb38bb", "comment": "Malware payload (Mirai)", "value": "9939178a3cee89407f7b62fd786e5b045dbcb03992f1684be847e7d92e5d4daef9c1e1acbfbd0d927c3bdafa475e091a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938249, "uuid": "9ce74835-8d70-47fa-9643-e92876ad1dae", "value": "T10CB44A45F8819F52C9C136BAF75F4258732B47A9D3EA71029D189B383BCB95E0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938249, "uuid": "4e9e6b6e-d4cd-437f-9bdc-f401342e2343", "value": "12288:Zf9PnZWX0CTi7HojJMKFyGZO6JmFNfjpZY4vU/I04+43:5WX0CTNm3LzU/b4+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938249, "uuid": "e15cbd64-b4bd-47a3-93b0-cef3b766202f", "value": 535256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938249, "uuid": "3a2a5837-952b-4c28-92aa-1a0b83928b90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938249, "uuid": "5457d7c5-db01-4951-9f9e-b6554b5e8c9b", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2ef8ae-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788946798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946798, "uuid": "0cea96e9-b91f-4fb4-9f3a-8a980b5e3bac", "comment": "Malware payload (Gafgyt)", "value": "4315793a54981ea7d10728cf2d830479", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946798, "uuid": "b4a5134e-7962-4584-872d-c332421fdb72", "comment": "Malware payload (Gafgyt)", "value": "a9b07a1e0dfefdca86ca624d3fd15345e0730728b0b308601ef9bcad9eb845bc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946798, "uuid": "452242dc-4626-47c1-a053-55e7f753993f", "comment": "Malware payload (Gafgyt)", "value": "74b9223624e5b8f448873210d1b23b152286b5cb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946798, "uuid": "5dff3e08-35ad-497d-ba14-1857bb3fefd4", "comment": "Malware payload (Gafgyt)", "value": "6dd2ba472c39be5479085d4368a9f81d412b1130b65d2522376835e9decea05338f5aa452c184c2e5336d5815a282d6b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946798, "uuid": "0c8910dc-b471-4ba3-9461-92d7171233c3", "value": "T1156302C3BEF1AA5CE503787DB6C11B89914794A419038BC87CCEBBCC362D695CD9BA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946798, "uuid": "506e9328-7438-4108-952a-7ef018eeebd5", "value": "1536:uj8mZWMwO6sE00GxdffgGs2U8080/JICF8GPKrOc35kVmLeENn:uiu9KVJz2GPNMCENn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946798, "uuid": "b1efb220-7e06-4b77-ae52-a5d726c9ecb4", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946798, "uuid": "cf6b3f70-93e3-47d9-80e9-cd872a9d7d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946798, "uuid": "80681a44-9fc8-4dad-868c-76c8e15ed092", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce1db0f-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938397, "uuid": "7691959b-b895-43f4-bc1d-07da49cf1ecb", "comment": "Malware payload (Mirai)", "value": "9b970d5c2112a7ef59336be5c520e35b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938397, "uuid": "da0eba1c-87fa-431e-a9cb-cadbf79533b3", "comment": "Malware payload (Mirai)", "value": "a9bf903e992239560febcb0592857b6e5793c16affa0b4abf40e0adf9f5f86f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938397, "uuid": "3c9c00c7-1687-4cd3-baa4-323b51d3407d", "comment": "Malware payload (Mirai)", "value": "3b107b621f7cc930a5f44da5f1f21c2aa39dde32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938397, "uuid": "b2304ce8-3bc2-43f5-98a6-41c1fb4269f0", "comment": "Malware payload (Mirai)", "value": "e5978b8519483c5f547bc2610d3162706116a878b2d4227f1fb274deefe8dfce005c7a8bf33df8bac630a264889da5e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938397, "uuid": "5e9a410c-6375-45ee-9bee-aa6ac3cd2d43", "value": "T17B056C8CFE5F7D43D2C6E23ADB4A83A57127B0A9D15311A332C1014CE68DDED87B199A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938397, "uuid": "6eaf7a1a-9899-4959-87ec-edb416bb4d6f", "value": "12288:dQ16tgZdsEAztVgtr4QLcgJxKfN4xj/I5oEWP4NP0Sivw+4JV:mivckywK9wJ0SV+4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938397, "uuid": "f66de6e2-a70e-43ce-bbf1-2b7d253f9c59", "value": 861864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938397, "uuid": "6dfcd373-4992-4844-8c12-4b9e451e5767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938397, "uuid": "567ce40f-fb18-4536-a69b-0f28531679c4", "value": "sora.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279e77a2-ac76-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureRAT)", "timestamp": 1788975889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975889, "uuid": "1717c393-34b8-4932-b156-7c95ad21e0f0", "comment": "Malware payload (PureRAT)", "value": "7a436940373475bd5be44a654879ca8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975889, "uuid": "3cec9f32-56f5-463f-9ed0-5f902020fa9b", "comment": "Malware payload (PureRAT)", "value": "a9f49d8d36e1cae8c15426b1cd0b71453f0f2196e5c9f6a084b1e56c18fa63e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975889, "uuid": "fd78b7e2-95cf-4232-9e1c-c5841b275f3e", "comment": "Malware payload (PureRAT)", "value": "506b8cdc3d08e6d1f5515a72287e641508be4a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788975889, "uuid": "331a54fa-6601-42da-9e93-1d3cf9dc530d", "comment": "Malware payload (PureRAT)", "value": "649c7b9dc7fc469d7a2335d36fc7880acc4590c8afdf1b625f2d891f361ce652daf734a6e8a1b6d5b631a9f8d47efab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975889, "uuid": "61b60d14-1d54-4197-bd1a-6c3f6404c5ff", "value": "T140943A3B72914E21C2C64372C1CB590083AA96577AABF70F31C613D619473EEDA4A7DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975889, "uuid": "c2ef9388-2b57-4f65-86ce-bf1286c33ebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975889, "uuid": "7d7233c4-7346-4859-afdb-4c5f78840c5c", "value": "6144:nJVF0R+jMp4b820Bt7iuDzARK/ysbdEaGi:nHSR+W4420rWuDrJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788975889, "uuid": "a940822d-c43c-4bb1-9d97-a6268354f6c6", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788975889, "uuid": "517aa487-59fe-472b-91cb-7707739b2e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788975889, "uuid": "8eff76a7-d766-4fbf-a63f-1e73f1da2fa9", "value": "7a436940373475bd5be44a654879ca8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f01314-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943161, "uuid": "ec89c6a2-2867-4e5b-afe1-c99faa174429", "comment": "Malware payload (Mirai)", "value": "b3645edb4f6c3f55e219e1086a1b1008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943161, "uuid": "32d8ddda-4dd9-4635-b045-466fb9951069", "comment": "Malware payload (Mirai)", "value": "aa3335e50dc50dfc00d5b698174eee02a6b06bc5969bb5c53449454858922d34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943161, "uuid": "2fe63c67-4f4e-47e1-b8e8-455c1f530b1f", "comment": "Malware payload (Mirai)", "value": "321760ade746f2020024e9e0162f65f8a3257529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943161, "uuid": "24b6f45d-eab7-4f6d-9d42-8180dbb58434", "comment": "Malware payload (Mirai)", "value": "d986d0b1d8778c77d8047d49c785e55f3c80493312b61b4c39d3090e116be1aa024402c5d0cd96e8c5f54c43be56b2d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943161, "uuid": "d34079ec-bad9-4231-8708-b57977df320d", "value": "T182732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAD2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943161, "uuid": "abd0e7cc-50e0-40ee-8a0c-06b1d7967c3a", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943161, "uuid": "ac876254-76ab-4bb8-acb8-6cb660dcbdb6", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943161, "uuid": "54fc56d5-bd13-493d-aa47-e37e2be8d32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943161, "uuid": "1b76dc62-2419-4508-9309-9a2a58c86135", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949c658e-ac3d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788951591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951591, "uuid": "5f62dd31-f450-4d36-87a7-df034436ca4a", "comment": "Malware payload (Vidar)", "value": "3227194e4eb8754b59942d2efc58f8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951591, "uuid": "6dc1dbd3-151f-43d5-bbfd-2234dc6f6775", "comment": "Malware payload (Vidar)", "value": "aa52d8e22ee3db115d77660115640d0d840dbc5102a86e43eca024201fac9124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951591, "uuid": "d3987bcb-e726-4d9b-ad23-f5ce401f1a14", "comment": "Malware payload (Vidar)", "value": "e972fc07d9abaea5d1dad096cffa2f7c9c80f909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951591, "uuid": "d41af2b4-a9f2-46cf-a280-618d631512a2", "comment": "Malware payload (Vidar)", "value": "cdb5295ff7b86ce02d04379da1c354a28caa90433e639d8c5ceb4e8a38ad6bfab71cef800b5d9ce0b77ad47e7971beef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951591, "uuid": "e56b74d0-01e5-47e4-ac99-71711e041f6b", "value": "T182666B037FAA71E0E06AD9798677921AAB607C8D873263A71E507B302F267D05D37F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951591, "uuid": "6b9ed17e-9b50-4593-bfd7-dfdf9fafb305", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951591, "uuid": "718ab1d1-4fa3-464e-a2f7-6ac23fa8c4f7", "value": "49152:AndDUkBsHyhjnCHpFXrD73Oz1URWxhLu7SVPSUcFrEm/GLynRv8gWmrXL17LbzUC:An2AayMX73RWjLuJHlVlHbIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788951591, "uuid": "16c126f1-35b7-43ea-94d1-bb0231644765", "value": 6692216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788951591, "uuid": "ea84cea1-bda8-4bf6-9dcf-5770ffeef058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951591, "uuid": "599f6cd4-9372-4508-a5ee-12e753d70e9f", "value": "aa52d8e22ee3db115d77660115640d0d840dbc5102a86e43eca024201fac9124.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc2ebbe-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938370, "uuid": "4c6995a3-890b-442a-b41b-87e9488108fd", "comment": "Malware payload (Mirai)", "value": "b5267d0241f511cf041acce866144f37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938370, "uuid": "6bc1d3f5-8004-467c-9c4b-9aa865ca1702", "comment": "Malware payload (Mirai)", "value": "ab30f913af3ae0e0020873a0aca593f8389b1118c6270a956a28e0072ed2f0a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938370, "uuid": "af52dd6d-0180-4c83-a8cf-2c843931b7cf", "comment": "Malware payload (Mirai)", "value": "c9cf76e6ff0613a318402e584e49d0fb43d102ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938370, "uuid": "7b92a2e4-3eac-452f-ad35-07cf00a7c156", "comment": "Malware payload (Mirai)", "value": "230b53d04e1cb97d35fc89ed8ba7ea27021707eab77942b05b01d95257ad0577e36ed283b7258d26d1be5066f7631c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938370, "uuid": "ec4e7a0a-16e9-4224-b716-d047278987ba", "value": "T12B631903EA629F96C1866AF55AE34A304753FD164F531FBA7628F9F84507ACCBC09360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938370, "uuid": "3ca6d15d-00c2-4448-86c3-8991287820f4", "value": "1536:ztp+0WD2KK1jKtpsJnICV8xJ6fg1HwP28yGvqR9oHyHqcEfn:ze0ZN1QsJnIzxQPoGvqR9oSKcEfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938370, "uuid": "420ca16a-c121-412b-8e0e-116314dc3d38", "value": 73194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938370, "uuid": "90b2c6ee-36d9-4314-a27a-768c4dd9e3f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938370, "uuid": "fe2dac7b-afe8-4984-a616-38469cd3a075", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb57e5fc-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1788977425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977425, "uuid": "18e7352d-03a5-48b7-8051-a114f90353c9", "comment": "Malware payload (LxBaseRAT)", "value": "c9099661298dec14d993b54830d6ecb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977425, "uuid": "d5ac7a99-5865-4bc0-9824-bee8dc7428f1", "comment": "Malware payload (LxBaseRAT)", "value": "ab35fae5a6142cd1ece0556f6d16bb2480e699accd643d7c15f7cedf992fbc70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977425, "uuid": "d843c7de-c9d6-41b1-8641-74bce423b7f6", "comment": "Malware payload (LxBaseRAT)", "value": "4aafd68c88211e59575a85e11c4fea1043fcf735", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977425, "uuid": "a7e8b186-6b80-4c37-9142-5973f8c02d7d", "comment": "Malware payload (LxBaseRAT)", "value": "a6c0fc239550ac9eaec1431ab2456ce2856304645d90ff14f6d1c388217c23cc904fb668dde59dd7f65bc0533b05129a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977425, "uuid": "77c446d6-bdef-444b-9771-081325a00e4e", "value": "T14F2523449F291EA4C1689D542C6F7B6A58F7428044D8ECCE53EAF099FDFDF82803D968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977425, "uuid": "bbe137d0-4e9f-4e6e-85fe-f7fbc0103091", "value": "24576:el5rbr+t37D9cUKZvHC0KHCSi2JmaTZCtYjj64KZ:el5UFXviS9JjmdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977425, "uuid": "4bb88493-3822-4ede-9b84-53c80bda6f6a", "value": 1013798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977425, "uuid": "62cb3df7-5bf7-4034-a839-0c405a6699d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977425, "uuid": "b1da43db-a6f3-473d-be7c-2a41fe058f1a", "value": "OC-97364.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b4def5-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950138, "uuid": "4cd04d2c-5d36-4a66-aa38-e33367f8cae9", "comment": "Malware payload", "value": "c4829eb928890da41ed16e66fa9e0146", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950138, "uuid": "4ac30281-6cf0-4699-ab65-d49c95d34937", "comment": "Malware payload", "value": "ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950138, "uuid": "171ebbb8-a6e5-42f7-9320-ba4b03360722", "comment": "Malware payload", "value": "552a1e38e5bb9a9d5710d7f66c6fd903833dca3c", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950138, "uuid": "3256157b-5abd-443e-993d-989be60d1a7d", "comment": "Malware payload", "value": "012ed908ac72b4e0b684c95d6054d10df9ed6af4ccbbe8ee68052019cc1605bebdf517d767be94f72253c9f2b4b30a11", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_DoubleCheck", "colour": "#3B4A67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950138, "uuid": "76a0adb4-100c-48e4-a566-41c20944db4d", "value": "T1E834F605739C25A8E86F4578474F25F3D3B2F44D07A0EACF02A446765EA7FDCA8AA311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950138, "uuid": "00d8c201-71ff-460d-983d-4238dab32ab0", "value": "5499238704fd996aa25323143b50cb5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950138, "uuid": "2beebaa1-bfae-449b-bdff-424c148d07e6", "value": "6144:rwmQyVxbhekuVxb6tVxbxrVxb1qVxbUW0VxbXFVxb+jVxbOBVxbkyQjqBLM3waZ3:rwmD3IT3O313k3U3313A3+3kyQjqBLIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950138, "uuid": "e20cd972-1c3b-4e44-af76-4657c4845949", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950138, "uuid": "8b075bd8-46e7-40b2-8cb8-31d8450ac318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950138, "uuid": "08fac369-2733-4879-8ffa-b781a23e4804", "value": "calibre-launcher.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71026541-ac9c-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788992333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788992333, "uuid": "754e13cd-d650-4c5b-8aba-46ec42b42966", "comment": "Malware payload (JOMANGY)", "value": "118a309284f76308fc639d62a22a0ace", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788992333, "uuid": "5b4450fa-3ba3-4f23-9406-26df1edf5241", "comment": "Malware payload (JOMANGY)", "value": "ac8f07ae7099f33c630ce8f9d0f7b49c6ecb475f68397c9be192b9dc9e56543a", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788992333, "uuid": "2f471ad1-305b-479f-ad07-9e862a72057e", "comment": "Malware payload (JOMANGY)", "value": "d44e9813fddfe71ec7802c9b1cd7d1d3fcd6fc98", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788992333, "uuid": "1e7ed178-cdd8-47bf-a135-391ba813bfe9", "comment": "Malware payload (JOMANGY)", "value": "3210cc4661f6773130c5bb60f99025da3ad6a5066b28213e83cc837f9ff4f6a332a3b8971d8940e505e776789cf672b8", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788992333, "uuid": "fcdd4336-2fa9-4acc-9bc6-7c0b039af04e", "value": "T199C27D966A967C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788992333, "uuid": "7e7e3c44-179e-4210-b70c-2b713c9def32", "value": "768:N8vCB+25j6es8REE9FYpMSUpi+20qUpi+20YQX:N8l25JPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788992333, "uuid": "4aaf169f-ab5d-43cc-bcaa-358b5c770c4c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788992333, "uuid": "01d3a24c-de2d-49b0-9941-a7983244d0a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788992333, "uuid": "0cc36195-8de0-46bf-8a31-399570434558", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769fd79d-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977310, "uuid": "f8e239f5-8e52-4470-a3bd-cbbe9c21b299", "comment": "Malware payload (AgentTesla)", "value": "7ae50a58e49855086232fefe79fe5820", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977310, "uuid": "1f704bcf-1c84-465c-843d-a8a202bd49b2", "comment": "Malware payload (AgentTesla)", "value": "ac95e3876e88aad0657928aa96d794e8aaf5753ab182b429a387a412a3589378", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977310, "uuid": "22aa277e-8c45-47c2-a6a8-8ce1f99f4a9a", "comment": "Malware payload (AgentTesla)", "value": "3f28dbff8cbc6dfc33989a964accf7c46456694f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977310, "uuid": "1259a994-1477-4d8b-b454-bb5542371f7c", "comment": "Malware payload (AgentTesla)", "value": "5df39d07eb8316a38aa5edb794bbffe2c873373aabecc1023a54626709ac40e85cc35eb30db6930f00b147aa90e0f763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977310, "uuid": "7d9dd0c5-1f21-45d7-94ca-73ddf76863eb", "value": "T19DC6B7695B879635B321978E8279ED30950ED60319C5EB0B70BED31C3B7CE275318AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977310, "uuid": "af03ba43-5ae2-4822-a6f4-4703b01be58a", "value": "196608:JHCKFONSYQ6+9jhzst2tYzdSus8+UG7CSpLniV4v0gQ+XPuW:dQZzdSus8+UG2SVn4gZuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977310, "uuid": "c6a7fa32-8043-4a08-973b-ad9a43a04f6a", "value": 11495457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977310, "uuid": "a68945c2-e212-469c-8121-cb9b378f4831", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977310, "uuid": "bb03f2ba-2d0c-455d-85d4-c5c4fcc09e98", "value": "doc0090092026090909.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6474cc38-ac66-11f1-ab4f-4201ac107002", "comment": "Malware payload (HijackLoader)", "timestamp": 1788969119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969119, "uuid": "07ecfade-0fb4-4765-b627-d83626617a8f", "comment": "Malware payload (HijackLoader)", "value": "051ade16953e6344c0f9ef65633f869b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969119, "uuid": "633a44b1-372a-48fe-9902-2c2256afa3ab", "comment": "Malware payload (HijackLoader)", "value": "acaab98854d6a0a86b9af2b77535a850e147e57c8261ef7b51b5e91a41cf7620", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969119, "uuid": "014328f9-dd18-4354-a71e-50cd9d48a057", "comment": "Malware payload (HijackLoader)", "value": "24e4ac3a9ca945545b0967b66867afb1edc6fcf3", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969119, "uuid": "ad65a50b-7496-4d14-bcd6-f37e22e96bfd", "comment": "Malware payload (HijackLoader)", "value": "fb5cd403e9dce6bf102d19a6d13bda0b99febae8b1185e12801d7dab3c1a0689a50dd7f119cb45e60ab3431433e29eff", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969119, "uuid": "46c5cfb2-bbb0-4b0b-800c-03a59e286675", "value": "T16B463312E3E31176E0096E75C8D9AC904E27B86C15E478427D35D20D3ABCBD18EB9BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969119, "uuid": "259fe901-6b1b-4d9c-89ab-529f3d050e29", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969119, "uuid": "493e2051-90d3-42d3-a166-f10672c05e89", "value": "98304:6dcjBmrd8vVKrWJbTXWDmrRe7pCcIQSoavwZwUzr1S1p4d:ARrd8tK+bSue7YtUZxf1C2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969119, "uuid": "784a332d-169f-43cd-87c6-872ceb0b4185", "value": 5635780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969119, "uuid": "21beee23-48af-4b02-b43f-8a1e1d2eb244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969119, "uuid": "2bdebbea-cd06-4887-b911-f0ccf74f5059", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ba1b60-ac9b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788991858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991858, "uuid": "8027dbe1-c758-4992-b893-408578cf57ce", "comment": "Malware payload (Mirai)", "value": "0e6ec80605143998f5f1e910247a943d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991858, "uuid": "c36ad729-c518-41ef-8101-cd72c49b5cdc", "comment": "Malware payload (Mirai)", "value": "ad213ad6b82e9eacb350d32c5605386d2e8fce86114326d7b9d7a48655a59891", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991858, "uuid": "1450c763-ff49-4792-af56-7c12a0f3353d", "comment": "Malware payload (Mirai)", "value": "1ddc6836e96eeee9660270260b406e0feb3fb043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788991858, "uuid": "3f86ff5f-bbe8-496c-ba25-9595a67bdf31", "comment": "Malware payload (Mirai)", "value": "5e1d88e37d4b4db55cc5db0eaddc48590856a201562a0befb2ca1357918148428e63f843693245b134d01824535fc065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991858, "uuid": "ee90d804-778a-4d07-9d00-9345c66f2253", "value": "T1F8261957B8918683C4E4267AACBEC1C433631EB99B9723576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991858, "uuid": "48c4aa0b-9ed0-4ef4-82b3-44268b4f2698", "value": "49152:t21nWdSgfEvwAOaMlXhf49pkiAAQeU1F1:twnWgg6OaMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788991858, "uuid": "791900a2-7b82-444f-85f8-74494bd347c1", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788991858, "uuid": "dad5ef86-e79b-43fe-bad7-6fca1aefa677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788991858, "uuid": "92bb2a22-6c55-46a3-8db9-234087c1c6dc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5f7719-ac2e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Akira)", "timestamp": 1788945327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945327, "uuid": "6f1e8a4b-5bb3-4356-8839-d463eb96fb75", "comment": "Malware payload (Akira)", "value": "d3d636486941e411942512a20fd5b152", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945327, "uuid": "c406dab8-dc56-485d-a043-7450f8055642", "comment": "Malware payload (Akira)", "value": "adef929e7c44596ed1cb4c1300826874fc48d6adc9edde45f0cfa45e9792ef42", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945327, "uuid": "bfd58d8c-414a-41cc-9af3-5f9d3138ba58", "comment": "Malware payload (Akira)", "value": "87c9b47aacfc8b350bff1c898c7d3b7534bff6d4", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945327, "uuid": "885ef529-c367-4865-acca-39cf6d59a514", "comment": "Malware payload (Akira)", "value": "d0e3ca8fe622ea9f19696a286d612d43e2b2ecddeb557a32ab910b9c97ff466f1d5bdfc11c4b62871af3dd77efe59f50", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945327, "uuid": "f0a62330-2f22-46f5-9786-04ef3628bafd", "value": "T1AB552B87F4809F42CAD466BAF35D4388770217FBD1E971069D254A347BCA8AB0E3F946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945327, "uuid": "a0b1f420-bc29-43da-8333-8bd7f3389f73", "value": "24576:33Vc8rXA7SuIijC1/TtttMFlwSyi/G32mgRXM06eGZWOTX3y:3hAO+wzi42mw6TTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788945327, "uuid": "15e9b9f6-50a1-41f4-a78a-342a4eed3b48", "value": 1393070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788945327, "uuid": "904379c2-ffff-44d3-bd5c-d7e2e3a49e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945327, "uuid": "09bb7287-6e27-4c1b-8c07-d2e37ff17a98", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb25cda7-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977506, "uuid": "f72e9ea2-3b2e-4f3f-acd9-174ca3f07eb1", "comment": "Malware payload (RemcosRAT)", "value": "e16e41cd2b83c55a55f4b3079e8d63aa", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977506, "uuid": "02e90437-0351-4ba4-8cbb-e8576eeba349", "comment": "Malware payload (RemcosRAT)", "value": "ae7c6d24e74f7e254351b83312907dc10c253ae381953d859bcc6a0a8ae71a2b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977506, "uuid": "5cd1f1c0-7379-454e-89f4-c5e338a97b37", "comment": "Malware payload (RemcosRAT)", "value": "412525214cde70529d06636fae49ab511460c35b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977506, "uuid": "6d27cae7-4a67-4b6e-b38f-4519977fc103", "comment": "Malware payload (RemcosRAT)", "value": "38409711f95faa91f59b4dce66d5608fc5f81931f4135dab4a411889ff30c92b7aeb947c8a361e07cd537f9f0063dcc9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977506, "uuid": "1ea2509e-5a4a-450b-8d41-cca7a28fbbbc", "value": "T123A26BAEDB2D0E55489E2791FC250D8595FC4104222B0078BEFA0BCDB94B99CE37D79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977506, "uuid": "a7553918-51a6-434c-8976-35f181a57fd0", "value": "384:B12mJqSM+eOBA+RM+6mo5dRr+P6BZxBcot6X76PJN6t2TRzDmdQRLwb6q:BwmJqr+eOKJmYq2JcofxZ1zDOQRLwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977506, "uuid": "e88a5ace-056b-4847-9816-5ebfbb87590a", "value": 23225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977506, "uuid": "8974fb17-5f2a-4135-bbc2-aa50e76b3422", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977506, "uuid": "4096adc6-d6ca-490b-83c0-2617a77de350", "value": "New Purchase Order.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59aeffb-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "2c8e6297-677a-4b13-bd00-ad38e799ce29", "comment": "Malware payload (Mirai)", "value": "c785fdcd9c8c02b28a26c83891742aa7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "e66525f2-1706-40fc-ba3b-4fe3a58e3dc4", "comment": "Malware payload (Mirai)", "value": "ae99c151bd3a18d1f9e04dd686c86cfa8a9e6d094e23dc7dd151a732403feaa4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "1eff6e6d-e7a6-46a1-874c-0504015ee092", "comment": "Malware payload (Mirai)", "value": "9f8279ac2cd578498d65ec0a0be4c2b59f1584c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "2a68800b-2707-4797-8cb2-181b927dcccb", "comment": "Malware payload (Mirai)", "value": "211628dac9cd19372ec771b37e3e6d9c882b4cec41a2b032cf0d5d380efed4276825f138f80c7ddc1ec275ea583a82ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966276, "uuid": "9f787a37-3602-425e-ac49-623d7bee975e", "value": "T1825195D573524A30BFF19EAEB9F69424B080E091E7C5AF05D5EC65FC8A4CF0826D8692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966276, "uuid": "60ff2c99-ee80-4137-be83-f1344a9e5b53", "value": "48:vXB4BaBgBuBg7zEB7BqBdBsB0BEuUfB7BoO:vXB4BaBgBuBkEB7BqBdBsB0BEuUfB7Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966276, "uuid": "cde20d03-a014-40f1-ad7e-93013bc06507", "value": 2905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966276, "uuid": "1ce6b3ed-26b4-4dff-8eeb-5a6973dfe328", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966276, "uuid": "513ce54f-d738-42e5-9740-64cc0a48de6a", "value": "thinkphp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc07a4a7-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938369, "uuid": "9774f86f-bae6-4ece-8eec-0e394b66246b", "comment": "Malware payload (Mirai)", "value": "83f5aa2bcbf7ab458f10121248246dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938369, "uuid": "28a45fcc-8789-4f82-a7d1-a137fa68fec8", "comment": "Malware payload (Mirai)", "value": "afc8b66a4a8df1b6600a79a2b51d350a6718be642f9a79170fbc4cf4717f5485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938369, "uuid": "8b84db51-cbc0-49d1-9229-8d81f216d373", "comment": "Malware payload (Mirai)", "value": "1612c808c5b3b0db230d35dbd136eb71bfe26f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938369, "uuid": "d1877175-8aa4-45ec-93e6-03aac8f4d33f", "comment": "Malware payload (Mirai)", "value": "3d5b3600d08b09d593c9ac3ce41abfb2c8b5006d181f7ba9675bf5cdf7b7dce2e7e17e309af53f2a3c9a91968da9fcef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938369, "uuid": "9accf0b9-f2e1-4a83-83f1-124147680ea1", "value": "T1E7A3C6167F11EFFBF65D86304BB38B2156D436922AA05386F25CEB581F2128D2C1FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938369, "uuid": "48f67955-ea19-4c8e-8a56-2d74d536846a", "value": "1536:aCU9uebFkUQejNGYcD8oM+P67Y23aPe4JKtfg1Gei0Tu3yvrPUX/3zRqzn:aCUQe+FejoDDV7VLPAyvrPUX/DRqzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938369, "uuid": "fb21f53b-9861-4e98-8e02-5e34f4eb7837", "value": 106375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938369, "uuid": "be61e1cc-a990-4c04-bb3a-f870930110f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938369, "uuid": "2e9da256-1f50-4524-b8a2-2af171e5ad73", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2323c140-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788977170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977170, "uuid": "fda61a68-fb0b-4a4b-bc42-6b5c4babfc04", "comment": "Malware payload", "value": "9eceadab31c21a3997284153eef5d01d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977170, "uuid": "b090eded-f15f-424a-9648-b67f6ab03658", "comment": "Malware payload", "value": "afc97f23f9958ee4d35eec1b3716768a9a5d046725b77530b53f8713ec31509e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977170, "uuid": "41d4a68f-e087-4f21-b803-be6d0dfb3f83", "comment": "Malware payload", "value": "0bbbf2481f0eb2d98b8b472889d1d03741cba48f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977170, "uuid": "a4144b4c-88c2-46e0-abea-978b72e1df0d", "comment": "Malware payload", "value": "be1b7517780aba68fdaa1a932f5bb07978e3e6a276e91559f2c46d0f692c1115c1590e2fbe5d2554c46ef46ff7910109", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977170, "uuid": "4ed313b6-3caa-4633-add7-026924c0e7dc", "value": "T19697570459AD8137F165F8C24701BAB8149D5FE3083F4D4CD9BB069A85BFFA7887AD22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977170, "uuid": "ed7fd0bd-6f83-411d-a033-2abb06279cc1", "value": "3072:ylREC7NdirchN3ufhtwNRmmktv7BzYtFJ1utOrcxsOrp98a+pDrMHJ/0T5jm6JEo:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977170, "uuid": "10c94e34-a111-476e-9bf0-e6a3cf6ce22a", "value": 40564244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977170, "uuid": "08cdcba7-a0c9-42c0-9577-634f814aeb4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977170, "uuid": "2ec7394d-0fab-4568-bd46-aa5d789bc2d3", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d159a55d-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921628, "uuid": "558d5e70-5181-4a26-af53-0133c9e6dea4", "comment": "Malware payload (Mirai)", "value": "c5307f145e440c2e3129f3f4cee13099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921628, "uuid": "77de745a-8e8e-4fab-a601-c2291fad32d2", "comment": "Malware payload (Mirai)", "value": "b18df0c8e3b445e4f6581b354f0de6fc47b060834ea4867d32524f2e4032eefc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921628, "uuid": "2d2b5e8b-85a2-4708-a995-755f2a0b728b", "comment": "Malware payload (Mirai)", "value": "c711a253f8d95b2065c51cf9069d6c27fce0cd7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921628, "uuid": "234c3ef2-e23f-4f4a-b827-d79cb996c2d5", "comment": "Malware payload (Mirai)", "value": "bcbc134df2b6f02ecab5616f4bed3ee6ad086404f0f45c3d5925ccbe113345153822214df38c8c0ba13da0556e4a0fbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921628, "uuid": "54578bec-10c3-41fa-9a18-dcfc33eabfc6", "value": "T18B5339C4E2C3E8FAE810087D317AAF729E73F13EB135D99BD3D959639505A02E10625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921628, "uuid": "9216f402-b039-417f-823d-018c6ab8e71b", "value": "1536:0UEMAWwPQk16qHTWKRmyaSkDu4eFOVgr:0UEMAWwr16qHTWKRmyaSmu4aOgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921628, "uuid": "5786d6d2-24d3-4bbf-bae9-d9d5bdbe36a7", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921628, "uuid": "842a0354-fb83-4396-9219-5437550858be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921628, "uuid": "a6ae3a33-20db-42af-9fbf-d84dee57f9c5", "value": "bdaf3c99c0dc9f4a9b75b30f228dd64f168de46da83546f8c3b7d93bc7298bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce132d39-ac22-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788940091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940091, "uuid": "34bc7a1a-6a22-4e35-aa39-736b021b854c", "comment": "Malware payload (Vidar)", "value": "86ae320f05a48109e6897dd4910d34ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940091, "uuid": "f0bb8506-d717-4160-876c-9906ffe7aa68", "comment": "Malware payload (Vidar)", "value": "b191ee16e958a8ad0db840fd4471dd92822cbf7a36b5e58a0caf168c68eb849c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940091, "uuid": "4367c66b-3bf4-4195-9201-616de5b332d1", "comment": "Malware payload (Vidar)", "value": "d704fc48d04a9e60b6a91cdf1cf90fb40d26ac9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940091, "uuid": "4581854d-e123-4abc-b5c5-80ebbc1b9ae2", "comment": "Malware payload (Vidar)", "value": "2d2e75073f4ceb2cc7612d3b275f79ecf8468d84c1638f1dc121bfcd34c16c24fbbf0a2c85217c2b74d6f94ef0fd9064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940091, "uuid": "5055ee11-28ab-4f6c-b49c-43e761722a3f", "value": "T12A26AE076C84906AC1959B3A886A51527B70FC69CB3173EB2F50F7782F72BC14D7AB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940091, "uuid": "651d4a34-e979-466e-a377-b19f4b1297fa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940091, "uuid": "0ea4ddb1-e017-4c05-b7b7-9212989e0ce4", "value": "49152:TTQ9jBwm0Vh0vLf/mZZETW63q83ISp8z8mUFQc32PfwGfysLwYMIqwQwYAi:TS+h8/WQqiIoVywVcwYMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788940091, "uuid": "acf521b5-4729-4065-a508-04040f9b558a", "value": 4734976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788940091, "uuid": "7bbecefd-ef00-40b4-b596-bdd56d2fc6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940091, "uuid": "da513a5b-def9-4bf0-9f39-4ed5465ae378", "value": "b191ee16e958a8ad0db840fd4471dd92822cbf7a36b5e58a0caf168c68eb849c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588322d9-ac58-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788963086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963086, "uuid": "92d699c2-8949-48a6-8e92-20c362ebd1a5", "comment": "Malware payload", "value": "98dd492db7f71df05568ccb8e65bcf47", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963086, "uuid": "9f5fca9f-84bb-4412-ae7e-dbdcdf8fb76f", "comment": "Malware payload", "value": "b27cf1261f52d0ff54f5fdf9b500f743a0fff43754a3185e0ef9f3736176e881", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963086, "uuid": "be3f54eb-e7fe-4f9d-bd04-a923bab2391d", "comment": "Malware payload", "value": "3a761fc0b8870acd63ba6426b5bfbc26ff56f6f6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963086, "uuid": "1f40a5ac-5458-4dc0-89c6-d922ca9239a2", "comment": "Malware payload", "value": "e1a743db9494144f7b68d58c0194122aa0e0fc62ff62e90eed1c96325f36b0ac8b4293412bad1b8b1f019115e82a341e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963086, "uuid": "4d0866b2-0850-444a-a7af-8c26bf009ac4", "value": "T1897175092C991276299ECA7EAC8450C2F34B89EF0E486DE574ADE4983F1C4D14FFD6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963086, "uuid": "37f5b687-e1cd-49de-9d83-4e8af64a531c", "value": "48:wDeD/4aBqygepfBGm+hOBO0OyO6aCEYigByTPnXXKI9K6SrSedYk0T:wD3aBqy/pfBLcOBO0O9CESByzAStP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963086, "uuid": "2c60c764-98db-43da-be1e-91159c6f8a87", "value": 3650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963086, "uuid": "28882bb1-51d1-44dc-a31a-05183559b3ce", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963086, "uuid": "e9869f0c-4b21-45e6-9af9-71ca39345756", "value": "b27cf1261f52d0ff54f5fdf9b500f743a0fff43754a3185e0ef9f3736176e881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b38fed-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788938067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938067, "uuid": "9bd16a52-23e8-4ea8-a55e-73067893e77a", "comment": "Malware payload (JOMANGY)", "value": "733be1304854e499e2a49aa847d66d2c", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938067, "uuid": "0a690b67-714e-4a43-ae6a-27e5dfe6e5da", "comment": "Malware payload (JOMANGY)", "value": "b2ef67f08614cae993d9a915795ae6cd8efbd9b7a33df342f8d6af8710839307", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938067, "uuid": "524366b3-c616-4a2c-bd2e-7932782d9453", "comment": "Malware payload (JOMANGY)", "value": "8f11cae03738f5d911b9adb0a3eac7b00116018e", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938067, "uuid": "bb10d37d-7bf6-4313-a7e5-2ef933e1b8d7", "comment": "Malware payload (JOMANGY)", "value": "ad1d93bb327a6e755f3ff2d9a15ad73c176727d65a8b4c4e553c81c49412d333d6884fa20f8deaef1841c4797fa019db", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938067, "uuid": "ef6bac83-b716-4a04-a9c3-f2059fc1e83b", "value": "T115236D2116857C14AA98C8371D7F2F0CBDA943E6324452EE7FCB3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938067, "uuid": "3e1f5c7d-5cf1-4c2c-9803-2d2616401f72", "value": "768:4Q6rDTPjHW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:4Hr3ncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938067, "uuid": "9ecbdb00-f4d3-4c9b-9f38-6937f763c8f9", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938067, "uuid": "5b29db4c-bb79-413a-9f97-83b2220b7a52", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938067, "uuid": "866cb19b-dcd1-4848-8d6a-d3cb96bd5d3b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d2161b-aca7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788996906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996906, "uuid": "e5b313ea-0fac-4410-83e6-4a7d3e3d16ac", "comment": "Malware payload (Mirai)", "value": "12f05ee9c29d099e1967eb48651a6550", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996906, "uuid": "08b02127-d909-40f9-9049-a2bd39ac7af1", "comment": "Malware payload (Mirai)", "value": "b304d47c357873c4259a69c82390abdb58e7861e6dfa9770d7742144dcea5dac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996906, "uuid": "fd5e0f6a-a269-4860-83df-a8fa59f93457", "comment": "Malware payload (Mirai)", "value": "bb9bc9d0684b07e854dabba75066345a76189430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996906, "uuid": "59940172-8001-4a76-bffb-908cb2b07fd2", "comment": "Malware payload (Mirai)", "value": "fdeed03f8a25be6a8ccbc484ba99d2e7883a456604239fe4102f94b9c98586b3c9b9470c26e459c762155bc0d907c487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996906, "uuid": "796237fb-b8ca-4876-a436-a35499d94014", "value": "T12894F15AF20F3D53C9D7D835158AC2859756FC9B33E383052B8664BA383927B8F28749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996906, "uuid": "a0295d07-8a7b-40ad-a781-6c061bc2f1c6", "value": "12288:XSQ3DfCUOLhpfXCwCt5ntUKr8pdDBFyi:XSKDw6XtQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788996906, "uuid": "29dc437f-6953-4fa2-b178-328ece34d786", "value": 411640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788996906, "uuid": "6c5efa6b-8a12-4b18-ae9a-bf09acc30b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996906, "uuid": "4f47ca6b-725c-4a7a-ae90-eb6febf5b7f0", "value": "b304d47c357873c4259a69c82390abdb58e7861e6dfa9770d7742144dcea5dac.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696b3c45-ac41-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788953236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953236, "uuid": "bd5a45a9-8050-4688-9ed6-08bfc17a0360", "comment": "Malware payload (Formbook)", "value": "6fc2d239aee3525ab9d8ffa93b60efcf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953236, "uuid": "67089133-f333-413c-9f20-498c6923988c", "comment": "Malware payload (Formbook)", "value": "b35d2861ee9cb3c8f746964d93c0e392341003eb895841f27be11ea0e1d30ed4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953236, "uuid": "2ef806a0-1d48-4ce9-8fce-666a670db72f", "comment": "Malware payload (Formbook)", "value": "51a302b469b36ad5cf181c0b227e1e3b31495d73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953236, "uuid": "1baa494c-c682-4313-a787-a4fca5889c33", "comment": "Malware payload (Formbook)", "value": "6051b97040ae496ad1526bf3493214e502c02f861ee2a35e83c57ca6c4ee9b4ea4c0900496cf1de0b32196b0aa62c5bc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953236, "uuid": "0edd48f8-b603-4b66-9c6c-df3dbb3cad15", "value": "T1CFE5B7F357ED920649247729DC193CE90F4CD1658EC1B5E8A0DF04E6900F96FBAB8C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953236, "uuid": "afbcf97d-28f4-4a67-85a3-72a5b2d7a5ce", "value": "49152:cDVpSScYPI9D3Zvayauzg6zSKaJU1LvsMorr:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788953236, "uuid": "8d2f56b7-6661-4106-a086-5deb1135480d", "value": 3083992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788953236, "uuid": "925a91ee-3152-4452-8c9e-e6079ab9ef8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953236, "uuid": "9a381c4d-59d2-479a-b6ad-5b24333d797a", "value": "MT103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367e63eb-ac73-11f1-ab4f-4201ac107002", "comment": "Malware payload (BTWStealer)", "timestamp": 1788974626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974626, "uuid": "92251a88-c5c9-4c69-8359-722c8d03d69d", "comment": "Malware payload (BTWStealer)", "value": "f4109f42789a7bce1ace3a2ba786ff3b", "object_relation": "md5", "Tag": [ { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974626, "uuid": "537ab4bc-0640-41f0-b275-7b8a232ee782", "comment": "Malware payload (BTWStealer)", "value": "b377fb7c454dea093ba4c63040f6177dd6a1ef7cf623497c043a9ce631e5d0b4", "object_relation": "sha256", "Tag": [ { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974626, "uuid": "8e71d92a-f04d-4e4f-b16f-e42a12bb7093", "comment": "Malware payload (BTWStealer)", "value": "21d3e177b1b038066619ddc2a67d02abd99b301a", "object_relation": "sha1", "Tag": [ { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974626, "uuid": "be17994a-b55f-4177-9969-d0609220b009", "comment": "Malware payload (BTWStealer)", "value": "ba7589097766022dd2211bd9374051d65636cd501426ec0017bcab35c63cd42670b51a3ee4176623f6d3b417b3ad2870", "object_relation": "sha3-384", "Tag": [ { "name": "BTWStealer", "colour": "#68B3AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974626, "uuid": "f63bec98-a532-41e7-bada-ee57ce85caf8", "value": "T1E7E79D1233F60162D4A3A2758B9B4103DB72B0576730CADB354C43681F9BFE4AABBB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974626, "uuid": "86dca6d8-b84a-4830-b9dd-864a3a8d4209", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974626, "uuid": "96f82da9-3651-47f6-a555-86ed5a4ad98f", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfj:fMguj8Q4VfviqFTrYTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974626, "uuid": "743313a8-d325-482b-bb72-7a1c6e68c41f", "value": 65098479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974626, "uuid": "f51807a2-a99e-4430-9f7b-7be8941ad71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974626, "uuid": "4dd0342f-32b1-4017-ac18-eac0e5a58566", "value": "btwstealer_stage2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7597b835-aca1-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788994488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994488, "uuid": "64e5e51d-33e0-44ad-943d-d0ca410f4a79", "comment": "Malware payload (JOMANGY)", "value": "61074ba1cabfd8db0548ccd740f90379", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994488, "uuid": "385bb25d-0e5e-40c8-976f-0d3f7eecede7", "comment": "Malware payload (JOMANGY)", "value": "b54aeb4be97cd1a8c99ed3cb973088884c962097762655ff27fcd32ec7e0af32", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994488, "uuid": "04a2927d-3b52-4ef0-9e9c-3f126ff74012", "comment": "Malware payload (JOMANGY)", "value": "a38dd96befa1eec3083ab9aa572cbd64d28fd174", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994488, "uuid": "6d4c4532-91f4-4d59-846a-2be6184d5ddb", "comment": "Malware payload (JOMANGY)", "value": "f1b0fdfd351d5b5480f06c59d9db3485356ddbcb64caa810d24bc22c33b5c33223b89a14c27f91c468cbbec960bba7e8", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994488, "uuid": "26d5a210-0c77-4e5f-acdc-747d50052357", "value": "T145236D651A857C14AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994488, "uuid": "ad0031b6-ad04-43d5-b4f2-f31c207b150f", "value": "768:zXRWNGxVX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:NlxCcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788994488, "uuid": "1b943208-07bf-486d-9949-b87d3b98df1f", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788994488, "uuid": "004fa2ae-8922-40bb-b8b4-5a728c875e0d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994488, "uuid": "e450fbec-1356-41a5-92ca-cc2cf32d2f2d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd6cad5-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946799, "uuid": "1461b455-18e6-45b5-bf18-fa0cdfbdf918", "comment": "Malware payload (Mirai)", "value": "676417d281cdbfd1267b0de3ad1e2ddf", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946799, "uuid": "728cc085-fd60-4870-825c-1a00f4bbfd81", "comment": "Malware payload (Mirai)", "value": "b5a7d7e5feb875c6084d5755386509d64684249c31bf30aab2a0663aa0b3521a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946799, "uuid": "7e43b425-4b2d-48f0-a22f-a1a8b775636f", "comment": "Malware payload (Mirai)", "value": "7c9315995582b498ceab685230b94cba5b0da843", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946799, "uuid": "db1c48fb-c5c4-48c0-aca5-8801c9a10582", "comment": "Malware payload (Mirai)", "value": "a8815bd44acf592f31e46039a8272f6c00fd67928031631c3e4d46434bc4ec0316dfa141a5df64412468ddc0d8437f80", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946799, "uuid": "16d4efa8-f289-4e08-9677-86dd746bc23c", "value": "T1D7146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946799, "uuid": "816e6ea8-d7c2-4237-b05a-d3d77a0cdbac", "value": "6144:SNROm5155gL6mTX7zRR1Lwt8Al7IKTty:qgLnLzt0ll7I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946799, "uuid": "207cde3e-0544-421d-9eac-f854b7cb4e0d", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946799, "uuid": "df9eba79-1c72-4c44-b0c3-aef0c81694fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946799, "uuid": "2394cb78-dfc3-4880-a722-3a69e97350a1", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66aaa65-ac6d-11f1-ab4f-4201ac107002", "comment": "Malware payload (SalatStealer)", "timestamp": 1788972263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972263, "uuid": "6b6cf759-ebe7-4236-912d-f55969a41150", "comment": "Malware payload (SalatStealer)", "value": "b819d5313160452653e881ca50d29e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972263, "uuid": "778b03ad-4f43-489d-be03-798c3ba3755f", "comment": "Malware payload (SalatStealer)", "value": "b5b6270e77cec673eb599d3fccd78b8f42209c688368697a26bff022ce81d985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972263, "uuid": "dc606ce6-099b-4a71-a55d-99a4e1e2db62", "comment": "Malware payload (SalatStealer)", "value": "71661705fe71c6a9d1ab26dc884d0675f9c7ca96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972263, "uuid": "a5a8e4c8-5bda-48e7-a443-76e7c813c833", "comment": "Malware payload (SalatStealer)", "value": "40d3d37add301475dac1d39fc68d3eff9283140772a4fb20e4bd94b662d4d71b6e2e37c22017f6688ca9d6c5ce2e3134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972263, "uuid": "77396f0f-890d-41eb-9122-1b5d6df8bca9", "value": "T1A5C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972263, "uuid": "e516917c-391c-408d-8d9d-03ae9c87c5e4", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972263, "uuid": "a220d5b1-7786-418f-b93e-3b9e128980af", "value": "49152:KFf2ErKQn0XD9KXkgu9Jl+bTCm16Vxlh1/C7SElRkdAQVwKYsIjv3bO0SuvNyJjZ:3EmQqgurUfCDVLKi7+S/44CQEfO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972263, "uuid": "0fc8d9f3-7710-4380-a010-7a6e123444c3", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972263, "uuid": "0d33e27a-3adb-44c6-a028-696315cac57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972263, "uuid": "97bb4d84-3dec-4c1e-8962-8b861223fce3", "value": "RKNObhod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4276d956-ac77-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788976364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976364, "uuid": "8e264c8c-0cbd-4c69-b583-b1fbd05bcdde", "comment": "Malware payload", "value": "1e0c02ace8ec794cdd6cd9fd0edcd065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976364, "uuid": "94988390-3548-4205-b6d4-2e576b6b646b", "comment": "Malware payload", "value": "b63a0a7d22ec1c8ae332eea943f636e5a4d9548c2a875fd3c10de7f304ef1c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976364, "uuid": "655f5260-0a80-4749-8dfa-96bd1791af4f", "comment": "Malware payload", "value": "23881ee357f325db977778ea1eebae7304ea6de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976364, "uuid": "7a430bdb-a872-4b15-a623-1ad3dda15db4", "comment": "Malware payload", "value": "39343107b8e784cf217cf1446d665a9cb8d93ba71dc7ae5eed87780c660244dac62a6c3d0136681be65ee03de90da92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976364, "uuid": "63791b9a-d8ec-4ba0-8b85-b5961482fe17", "value": "T13216023FB28B653EE06A5A367976E210543B7A61A5138C16D6F4C88CCF254B01E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976364, "uuid": "9ef9617c-d635-4206-9922-f196a2468420", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976364, "uuid": "12fdbc32-807b-45b5-80aa-90f6af7c8044", "value": "98304:p5OblQHYrP2lvTS1ePuA3z0Tw4uDV2rJztL:j4lQ4rP2Egu5T8V2Vzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976364, "uuid": "ffb419f9-ecb2-4b9b-9add-49e8c5d339b0", "value": 4394607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976364, "uuid": "5056362b-b989-4eda-abc9-2bf5ea24a3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976364, "uuid": "25302cfc-d499-40b1-8f26-041e07df7787", "value": "1e0c02ace8ec794cdd6cd9fd0edcd065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2a5de6-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788977130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977130, "uuid": "3552cebf-fa9e-4eed-bdf3-3b917b769dbb", "comment": "Malware payload (XWorm)", "value": "c924c35667f97a6bf7960f5ae0246ec6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977130, "uuid": "64a87238-64e0-4c70-b79e-fb40631b0537", "comment": "Malware payload (XWorm)", "value": "b72e09658cacf2b6e3f15e1982b48fb6bdb2b1480f91848dffea98d54ffd5309", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977130, "uuid": "bed77752-fcd0-4960-9f9f-43842af843f1", "comment": "Malware payload (XWorm)", "value": "b6bef5f143ee9103f6ae1bfcb71a7e2bbfb994a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977130, "uuid": "ba922b4d-f764-4a23-918b-3b6668f52baa", "comment": "Malware payload (XWorm)", "value": "11db0d45beea74715e9873ababee0be56680d945f1d2715cdd9649e1f69e39b520352622ec5f95b141b02249a0accd18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977130, "uuid": "40e87ed1-3095-4071-81f6-719d4c6c4896", "value": "T18124E16D5F8D6023AB2319BEC05EE60A08C537E0CBDDB6E48A9DC703E46CBCA457D945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977130, "uuid": "39fc3967-8dc5-44c2-80fe-aba2b38d62b3", "value": "6144:COzKlehemXT88PvbM5gPSZeZ+cyaqLKBf2H:COGlO/QWzMCqZeZbqLKRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977130, "uuid": "93f01dd5-f1a7-41c0-9f58-18c94546ab79", "value": 219391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977130, "uuid": "45761909-0f1a-483d-871f-0da6a73d3bf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977130, "uuid": "007cb2ac-5473-48a0-bfdb-795caf1fa122", "value": "\u041f\u0440\u0438\u043b\u0438\u0432_83-11122401333_20260909.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de059371-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977484, "uuid": "aa80affa-c61e-4785-9a91-bc87b97a7c5b", "comment": "Malware payload (RemcosRAT)", "value": "5050a1fa488ef3e07b791d320ff9c087", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977484, "uuid": "b96ded04-4306-427c-b708-5fbeb6828305", "comment": "Malware payload (RemcosRAT)", "value": "b735114585f2b4f1a16745a15e8a73f7855d5beca6aba1fdddc76ca5da0c5cf0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977484, "uuid": "704abafb-7599-452e-90cb-3b71e4b274e9", "comment": "Malware payload (RemcosRAT)", "value": "2479c14fba6ea4194c4e598fbef2784b766fc6f0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977484, "uuid": "ee3226a3-7b2e-476d-b823-b3e54235cbb1", "comment": "Malware payload (RemcosRAT)", "value": "c97376b62bab9735b528ba1f3965bf4be94e40dcb28eb17a08c3eacd90520198e8536e96f91c9f35b9e799311af9cf06", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977484, "uuid": "a478e6c4-55a7-4379-a630-c29dc570af96", "value": "T190C22921CF132B559A0F2FB29C580458C27A556E143294B4BEE9B71C2C84FACB37CB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977484, "uuid": "7e1789b6-d48d-4d05-a5b7-a4c3220e2d18", "value": "768:zqvmJqLomMmqwMptNscb/Gdg+ED2g1LwKg4OrIwQ:evmokmMmqwMvN9Odg+ED2gkhIwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977484, "uuid": "6c235b70-4a6c-4a8c-b971-b8901bc9711c", "value": 27557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977484, "uuid": "e41c4099-9bf0-4691-a07b-4fd398e6ef3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977484, "uuid": "57880169-88f3-4d94-819b-0eae9ac11703", "value": "INV&PL_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b26053a-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963520, "uuid": "c7c9d794-f05e-4784-8270-e64c273e8716", "comment": "Malware payload (Mirai)", "value": "95eef5a9dbd5c7ca93e006d41e22a67a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963520, "uuid": "89c2d88c-ba9e-48cc-b7ad-91feacdc0512", "comment": "Malware payload (Mirai)", "value": "b789d8a1144f4544ce341ecbed9ce5ae5d7128bca6564d600f9228d790cbdc5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963520, "uuid": "bc14d9fa-d332-4ae1-a975-82f8466517dc", "comment": "Malware payload (Mirai)", "value": "424c821d02223a601030c6466c40b82902034f47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963520, "uuid": "56c01cb8-9d7c-4488-8d58-878f2c2a9318", "comment": "Malware payload (Mirai)", "value": "f4a95eecdd240ac1e8391399d3b8dc6b68a09ae080f220194c59b02e442822853d8161c5216fbae6913ffdd15053949c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963520, "uuid": "ca6d5dc7-5b02-4ba2-b684-d1862a6a716e", "value": "T132142B03E6519B12D0C251BAFF6E454937236FBDD3EA3102DC24AF64778A8EB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963520, "uuid": "9e4cfc14-2fb1-4515-b12d-9a7a41486083", "value": "3072:jvD4IzTgFDYYYAuYkXQod94qwMya7fFj5w4/20WUG6mFhvPhU7Lz:jMIzUJzYXQfqwTajFjyM2NUG6WPhqLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963520, "uuid": "66f6dc1d-bde6-4d02-a887-4331035aff61", "value": 196720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963520, "uuid": "20ac258c-d6ad-4c44-9fbe-f91f90a79527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963520, "uuid": "0bbeb8a9-edf5-4d34-824f-6594471651f1", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6a5966-ac0a-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788929508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929508, "uuid": "fb49604c-138e-4900-8d29-5c4e2ea4d7bc", "comment": "Malware payload (JOMANGY)", "value": "65c35b8dce54cceb7793ede80be1b40e", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929508, "uuid": "889c5f55-b966-4057-b935-bee08e6768ca", "comment": "Malware payload (JOMANGY)", "value": "b79acbc7cc544aeaa2a5ac8ac517976a2ab04f28318f78ccf3ef5b86c0f756ef", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929508, "uuid": "7e54f912-e2b9-40f3-ae10-a304f9b1e2bb", "comment": "Malware payload (JOMANGY)", "value": "ebc758bb08d6d9592e71519c7e56271d71a90cfd", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788929508, "uuid": "d31337ee-bb44-4f27-a1f5-d5704a6713ec", "comment": "Malware payload (JOMANGY)", "value": "814b70d0bb6fc698acb879756274b810bf845d8fe5fa9518a2cff44000bf809365f1968d1bf4771d9b4bc6e2fcdd5f76", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929508, "uuid": "7cdabed9-d080-4cfa-b92a-5b5d159f2545", "value": "T137236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929508, "uuid": "82777e2a-99a5-4823-aa4d-7fe099fd06c9", "value": "768:mXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Clxvcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788929508, "uuid": "6d724b7f-f558-49b4-a4a7-9904f0e7a9b1", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788929508, "uuid": "7eafb33e-62f0-410c-a7d1-23d96787a1a4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788929508, "uuid": "8a32dd76-39ea-4bf9-8c0e-b2e84a3de7e4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e922d3-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921496, "uuid": "c17b1ea4-f7c8-4c55-af65-6a79fe5ba0fb", "comment": "Malware payload (Mirai)", "value": "7b61dfd04e206e7dced233b9a931ccc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921496, "uuid": "c1a2292b-9990-4524-9659-399cba09d4ac", "comment": "Malware payload (Mirai)", "value": "b7ed37d1f689a8302fecfb64ef4bc8828603d093926996965faca45e1ae869a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921496, "uuid": "5792e7a4-3e46-49c2-bd49-75e2169dd908", "comment": "Malware payload (Mirai)", "value": "7e9343dd09123ee39d3bf0c0bc6670141f7ae780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921496, "uuid": "cc35fd15-e759-4696-83d7-2b0cc2de6d94", "comment": "Malware payload (Mirai)", "value": "d38b20558fc0161140586bbe6a4579e5707b0195f4f539d9b232bbb6a39497bb940557180140bc010f0c986626d35b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921496, "uuid": "92c4a1d3-99b9-464e-899a-cbb9c9d78eba", "value": "T183E33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921496, "uuid": "4dc93bf7-de80-477b-908e-07436245d2bb", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdVo2J:sqlhEFZBTqPoLmpMguHcUlVUHalw7Wg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921496, "uuid": "b55a3141-28ac-423a-aaed-0ed590cf4780", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921496, "uuid": "f4710c02-dfb7-4c80-b003-5aaea6279a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921496, "uuid": "b61a9257-ab28-4348-86bf-030ce44595f2", "value": "1002269048f762683b0f553c5634460fa709390598b3cf2b7021bd6c453c08d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de57800-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977295, "uuid": "15da283e-621b-46e7-89a9-0e2d9177e404", "comment": "Malware payload (Formbook)", "value": "fe4544e1248e5f8f4e02a9390849a2bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977295, "uuid": "d8cc9a3d-ae00-416f-ac5a-8c6473cee773", "comment": "Malware payload (Formbook)", "value": "b848b6ca51f45888f7e0545c3c99d8bc722fbd1afb013123ac31e4c2bf6501f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977295, "uuid": "1c1473c9-a5d3-4701-aabe-990316bbd07b", "comment": "Malware payload (Formbook)", "value": "b21cdd42e8395832298630089299888f77211d93", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977295, "uuid": "6f5a5879-74c9-46a7-b9ed-7260dbe4b5e1", "comment": "Malware payload (Formbook)", "value": "9ccc188d3d46ceb279bb5cbaf3836cb473a3a7e4f137c6d2870ea9a117cd3468691d60d54fa749da26f09bd461d64191", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977295, "uuid": "8d910923-bda9-4112-acd1-b24556774625", "value": "T144B64B1C09CC9172727855A984C51A91BE94B31B99D09603B6FC4F4D7B78A323BBF2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977295, "uuid": "d3086afa-b7ba-4b1d-b534-e7d92706ac1b", "value": "196608:AWxM8lONZujLlHmVG//uhUSc36Xq6yQsh:xCKLtmVGWhUx36a7Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977295, "uuid": "6791607c-a721-4ef7-9e5b-15fb4739006f", "value": 11465687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977295, "uuid": "5e49b1c7-c4c9-44d8-af81-bd00949c9fc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977295, "uuid": "c062d1f7-e7f7-4dc3-8cb1-a1b630143536", "value": "206_NEW_ORDER_2QW3E.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef9dbcf-ac53-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788960923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960923, "uuid": "94be53fe-8f82-4fde-97e6-95b55ef74367", "comment": "Malware payload", "value": "c5c2ae23fa34d045d6a887f9b3977eab", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960923, "uuid": "3e2c87d4-5afd-4a89-92d7-b229dc1de348", "comment": "Malware payload", "value": "b902772635036ffdbc8f34877d923306ad1a66247fce31ca63fc0380c929542c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960923, "uuid": "50759433-0721-4763-8398-8d298d18d19a", "comment": "Malware payload", "value": "378193e34a149670163752e629cea6855cfe78b8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960923, "uuid": "f8e28911-38b9-418d-8151-fdf5aa459c02", "comment": "Malware payload", "value": "4ef23dd5db7aef70374a82c059b3cbf4e83b4dce919ad024f752c15ba8f02a686d23f80a07bd42c85789e936fc98e4ca", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960923, "uuid": "a1be4a7d-700c-4d7d-8234-73b8e42b7f36", "value": "T122418C2427F90324E3BB8B7BACB6F31256367C50E9935BCE129056885828525E476F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960923, "uuid": "abfe2fa4-9e79-4e39-bd72-f1e1ff09b016", "value": "24:8SPBAW9lKpqVD8FpHKnWWXtlAUW5+/CWPWe/CDCOPnSPoY4I0W4vQpK6+/CUPHqg:8SPDlxVDsWXtONTnsonItB6HitSq4WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788960923, "uuid": "ea0eef0d-321c-40c3-9210-b168f52e7ae6", "value": 2054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788960923, "uuid": "6f177449-e3e8-42c9-8b20-d8a94f753d41", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960923, "uuid": "ed0bf0b5-db4b-4d89-8e78-7eb2bf3d77ec", "value": "b902772635036ffdbc8f34877d923306ad1a66247fce31ca63fc0380c929542c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e0b4f1-ac3d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788951588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951588, "uuid": "7329978a-6d0d-4b3e-a32a-7bd99ed9c2fc", "comment": "Malware payload (Vidar)", "value": "bf68a2c7671b38eca58e3fc5e13a8a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951588, "uuid": "05d793e1-eb88-491a-a889-52d70d420685", "comment": "Malware payload (Vidar)", "value": "b94b6f6f588b8d04747f3e0e0598e88ba95d080f7786aa50b864007b65da76a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951588, "uuid": "2ea97af6-4d03-41d2-bbda-057548984058", "comment": "Malware payload (Vidar)", "value": "463bcb637d97d90b785448337a3e3efa90842604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951588, "uuid": "acaecaf1-2d56-4866-adc9-bb8c7defdc16", "comment": "Malware payload (Vidar)", "value": "d54fe87b90a564c50637e6b29ccae915c076138c422d5a423ecd42e1a57bb4bbcdee848cada1f4686853809c39c1b628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951588, "uuid": "8873dd1f-e049-48d8-98ff-4a13b69a8370", "value": "T123665A037FA971E0E069E9388676961AAB607C4D873633A72E44B7602F367D15E37F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951588, "uuid": "f07a9d66-87c6-414c-aa2f-30c0e483bd85", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951588, "uuid": "d41e6ff5-a53c-4890-ae44-96b2476208ff", "value": "49152:xygiCv+foh+/4ofdUAjQYlY9thusJ21FAEzmU5kiDxX/Nw8h0Xkpc1GRVa15g2Er:xyR6+Ahwd+9/ucEzBtVG1gaZCxrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788951588, "uuid": "1444fc8d-8f2c-4724-b8a3-59a262219e06", "value": 6757240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788951588, "uuid": "f3efd9d1-1e3c-45b1-9b94-fe210bc74fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951588, "uuid": "656d6837-d305-4de0-992a-4cedcee37bc6", "value": "b94b6f6f588b8d04747f3e0e0598e88ba95d080f7786aa50b864007b65da76a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15df4f0-ac5d-11f1-ab4f-4201ac107002", "comment": "Malware payload (AMOS)", "timestamp": 1788965463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965463, "uuid": "89a5356d-300a-4702-9884-479c2943da54", "comment": "Malware payload (AMOS)", "value": "6311d6c827d5e1d932b6991380204f63", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965463, "uuid": "82c5ee01-ff98-4667-98ee-2077e3e7d66f", "comment": "Malware payload (AMOS)", "value": "b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965463, "uuid": "8a1c8d27-9335-4f67-9f8a-e18b62fba359", "comment": "Malware payload (AMOS)", "value": "649b5835d1085dfd813e0c9be8486c57ebb8f176", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965463, "uuid": "67bc2224-dfd6-4e17-93ff-d8992b1e6b54", "comment": "Malware payload (AMOS)", "value": "995e20b758d525e0b9748ae003ae7b6200267ccafbe8d6b05dd225f472e6c384fe893a17708e3e85efbecab1b91c0ebf", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965463, "uuid": "dd781c7d-91af-40dc-9fb8-12f34400905a", "value": "T10B64F116F70C6560C47EE13C3EA76F426624B2610B7859AD2318BB041D9D29BF72FE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965463, "uuid": "65ec98b3-f9e6-4465-a385-e2d93639f07f", "value": "6144:vbeG6YCzkvSuC3U30Hb2zJTd8imdgqkvSOCHU30HL2zJTd8i:yl5V33SR9x8imKqVXHSp9x8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788965463, "uuid": "36b77852-a905-4ae1-8749-9584003ddf21", "value": 330704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788965463, "uuid": "836bdde5-ef0b-4218-a7a0-726a58eba25e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965463, "uuid": "3b5c2239-629f-4554-882d-0af8f6a36bbe", "value": "stage4_buildB.macho", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3071a745-abe6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788914056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788914056, "uuid": "bd3bda58-1167-4281-ba27-50b953ac7eaf", "comment": "Malware payload (Mirai)", "value": "631b794dc371f47a561aed62d90201f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788914056, "uuid": "f2675dd6-55ac-4d5b-bf86-a9e696e778f7", "comment": "Malware payload (Mirai)", "value": "b9a8f948feb4057aeec015eee181ceb5b5e7286f76d1215df249ce726b5c9077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788914056, "uuid": "bdfb882d-1c97-49d5-ad5a-d01dbb8701f8", "comment": "Malware payload (Mirai)", "value": "469cd0c2a923506a6c208251d6ef41a12ecfce38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788914056, "uuid": "16724cba-2812-4a8b-bbb7-1785006ce353", "comment": "Malware payload (Mirai)", "value": "b13bfd781dc8f9f7812fcf07b74a76f5dc416d94128832fa0979294e48d298ca5da902ef7fef6dc8d791b007afbf3306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788914056, "uuid": "5cc907c2-d1cb-4644-aa9f-9cd30178aa92", "value": "T1DE436B8ADA93E1F1E69349710057DB8AAB78DE358008DE86FB097532ECF17D2565B30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788914056, "uuid": "847c4408-5b20-4f41-80ef-d19e01b84111", "value": "1536:f+1vlL0F/IWUqHm5mV4vIU9fhWSa5oIZGV9ior:f+1vlL0ZIWZHm0V4vIQfhha5FMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788914056, "uuid": "9c6cd218-f168-4526-ac52-e397124525d6", "value": 58052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788914056, "uuid": "5743aecd-1075-45b0-b114-e55b00b197c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788914056, "uuid": "fa51a40d-aa26-41c6-b22c-fb7377fa17d8", "value": "b9a8f948feb4057aeec015eee181ceb5b5e7286f76d1215df249ce726b5c9077.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85a8500-ac64-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788968401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968401, "uuid": "5b7c36a0-c98a-4ce9-8c38-090cf2a89f40", "comment": "Malware payload (Mirai)", "value": "2bb156a17004f7a0b110f33cfb1cbd11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968401, "uuid": "e460e4e1-735c-45b7-9aa9-6014248ebc19", "comment": "Malware payload (Mirai)", "value": "b9f320b2abe6ecb3bbd1e5a45ae57e89ca9e23630948c0436f06708de61f8502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968401, "uuid": "37540bd1-3085-42ec-8e99-42bf4f9aab11", "comment": "Malware payload (Mirai)", "value": "7b7530ddc20b9a753639e5081f822dc06b2c082c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968401, "uuid": "10ba4f12-c6fe-4fdc-8325-4e8974ef2497", "comment": "Malware payload (Mirai)", "value": "c63411f51d67e54b659438ba58babd7113468542a0ff0afc8b27b9fc7bb78011d892aaade5c41a337029e5913b4721f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968401, "uuid": "afcb348f-79f8-4cad-b324-6eabf900975e", "value": "T1F9F38D63CC357E5CD218D8B0B0319F7D2B23956581831EAAA6ABC6B58447ECDF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968401, "uuid": "a13fe9ac-6382-4604-a09d-d69d8df71735", "value": "3072:IY+6tW+XDD+oW0sOyVPOA5nP7W9E4kVSURI:R+GxsOyVWqq9sVSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788968401, "uuid": "a9b7b88c-4384-42f2-9b23-3783354c9ef0", "value": 158948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788968401, "uuid": "029cb5fe-a8ea-45f9-9c3c-bb8aa3b57eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968401, "uuid": "c54c9525-0b05-4b6f-ad30-a7f5ba8528d9", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fabb309-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788948093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948093, "uuid": "0fee20df-c749-411c-a6e7-5611766ba894", "comment": "Malware payload", "value": "6a73698ea1af620faa54ea20e9f5614a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948093, "uuid": "1a7d861e-2209-45e6-b169-1b3e5cdcbe9f", "comment": "Malware payload", "value": "ba20494fe5a12955a408f076c3677bf8ae600c890554b9906049b8cd07206cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948093, "uuid": "5bba6224-a67d-4229-bb10-bb2b28288a8c", "comment": "Malware payload", "value": "fb1a26c7c04d2ffba5aec8b5370a3a5e5afc5d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948093, "uuid": "2d0b543b-bd80-4f47-80b3-4149ad6d921c", "comment": "Malware payload", "value": "868c99a05825325a4187bb78b04b1538c1750578b5126c99368d0cd0d67ca182581ac1b081a299ef749ccc8c701dba1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948093, "uuid": "606ab3a9-31d0-4271-bb8f-ad8d434a310c", "value": "T15DB34903B5E084FDC4C9C670879FD127EA36F8C963217A6E3B946A612F36E216B0D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948093, "uuid": "9c2be760-66a3-4a97-a608-ca29e9f9d132", "value": "1536:NRefnXyE8AaCeW3IiXq7m8qBwD1G5rPtcopiE1wv4P3GbzPtebMB/Exloruj:NyncW3IicYuEl1iEev2qPQbHxOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948093, "uuid": "1a6dee68-73ba-4315-9650-af4037cc9646", "value": 112496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948093, "uuid": "278e92a9-331d-4c14-a6d7-516e5bcae116", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948093, "uuid": "5497a2fc-c8a0-4951-8361-9b59877f9e93", "value": "ba20494fe5a12955a408f076c3677bf8ae600c890554b9906049b8cd07206cfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286af41d-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977179, "uuid": "4ca41bd5-a9df-48e2-80ac-849b5c3156e9", "comment": "Malware payload (AgentTesla)", "value": "9889edbff0318f5853232f2392c6cbdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977179, "uuid": "048fb1a9-3976-4bba-9582-d35f2517273f", "comment": "Malware payload (AgentTesla)", "value": "bb362ba82d2482a38ba3b944ed46c486d4f5f0406d149ecea43d74df99f935d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977179, "uuid": "0661dd49-208f-4e61-b94c-7ec9aeb850c7", "comment": "Malware payload (AgentTesla)", "value": "11be7e50b00063bdf352a2bcf061cd945da0530d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977179, "uuid": "dbeff55d-3202-40d3-90df-542358e01d31", "comment": "Malware payload (AgentTesla)", "value": "99e04fbbbad5ae92048bd0baf785902c367bc00c689ebfebde1ed9355ad39b72d660994b179cedf16be652b55bc63d29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977179, "uuid": "672a8d5e-2d2f-4180-861b-209eaacf20e6", "value": "T114C6A4481746E0367326674E82359D24874B218316C9FB1A357D932C7B7CD2BABCCAF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977179, "uuid": "f44966d5-0f9d-4f2b-be16-b269dd5c4dfa", "value": "196608:4i7hGoiB5E+gdfrS5s4tf8SEmKnA/PBWalh:4oPrYltf8SoAnBWalh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977179, "uuid": "bb73295c-4805-4a20-89bd-c8dc5e100d28", "value": 11497265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977179, "uuid": "e7c22a30-22c7-419d-8d21-32e54a22587b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977179, "uuid": "128baf49-651b-4253-b526-6907939fda4c", "value": "INVOICE-PO2021295864.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4451f257-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788948020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948020, "uuid": "a10c2c22-a28c-46c4-ba11-01547ead07ce", "comment": "Malware payload", "value": "066df21b7180f7e664520a92bd9acaef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948020, "uuid": "332cc51b-5b7e-47b1-8fde-b68624caa5ac", "comment": "Malware payload", "value": "bb404c5f48e217cdc5a2f598c4052f228a378ae21e339c874846ec6fccd4c29e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948020, "uuid": "2c454dc0-397f-41d0-a132-740efa3766fd", "comment": "Malware payload", "value": "928e3d8487b619064e97e4e2eb8befccbadc2bbe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948020, "uuid": "bd2686b0-b42f-4457-9eef-137b2c2f5c91", "comment": "Malware payload", "value": "40115558d16dc9b838de1ea96186dfbc694cde080ccec0240dcc455a2401865fa66728a2f2a1e136d8407118e03d9789", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948020, "uuid": "e29aa1b8-5ac4-4675-8411-e64a449daae3", "value": "T1AA0221B1B404667135A9C02C97FAD0025951713735546C18B9AEF9347FFC346B3B8BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948020, "uuid": "ecf6ed4f-4988-4c5c-bfd6-c145f88378d2", "value": "192:wFSIDVI8Ub7Y4/qjsvlzO78tfBmvTEGq52EXqbsJ:rIDVPmYjsvlzO78tfBI4Gq5nXqbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948020, "uuid": "191b83f0-b25f-4f35-ab81-dbb76802dbf7", "value": 8747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948020, "uuid": "dd949a21-be6d-45fa-819c-8dcd6c9cf4d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948020, "uuid": "522569bf-281f-4dd9-be85-c29f052c8a54", "value": "bb404c5f48e217cdc5a2f598c4052f228a378ae21e339c874846ec6fccd4c29e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb901ede-ac55-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788961964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961964, "uuid": "9583faba-8643-4253-813f-a00ce721d49a", "comment": "Malware payload (Mirai)", "value": "0eb1ef31e03ccf41ae77b6e1d2b4d145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961964, "uuid": "d05c7cb2-edf3-4bd6-82c1-86a90381c80b", "comment": "Malware payload (Mirai)", "value": "bbd6513aa356cd1c76f52076c443a937e9c79241ca4546912a09ef35ff0599c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961964, "uuid": "865a7474-2b25-4bdf-86f2-cd56b00d34fb", "comment": "Malware payload (Mirai)", "value": "275e18334cf5f08b9d1204a3d6f380fae6eca9ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961964, "uuid": "51773246-267d-49aa-999c-8185230deb47", "comment": "Malware payload (Mirai)", "value": "a18646d4db88002184210df2019665af7a27960a3fb8394a82b0ba3affab256ee332de7731e5152eb878ef85287b100c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788961964, "uuid": "c813f029-9b7a-4b1d-9086-cb341593b1db", "value": "T124832A91B981566EC6D063BFFA5E538D337663E8C2DE3213D9218B1133CA51F0A77A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788961964, "uuid": "5e3520b4-0e3c-4611-be31-4a08cfc84dbd", "value": "1536:ljZMGt7b7+WBDScgEKvJECHVgoKkQhMV01aWmPT/Iyd8K:9K27biWwcgEKvJEu+t+gazz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788961964, "uuid": "1021495a-c230-4f04-9ca4-d8e9cddaac42", "value": 83344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788961964, "uuid": "f400d982-5bda-4683-ae01-0937cfd0eac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788961964, "uuid": "9ca2a483-1025-4a30-87d7-5b4b158de1bf", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba4c94a-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977319, "uuid": "59e4e1f2-48eb-4e1b-9b08-546f7f5ca2c0", "comment": "Malware payload (Formbook)", "value": "3dbdccffb94ba8bc20647d00ea35b232", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977319, "uuid": "254e6352-a498-425e-a6b4-0e362f23a4ce", "comment": "Malware payload (Formbook)", "value": "bc1f9deff5c4425f0b594d12ade51c9f7bba5e7da53646a3c4cd44cf05d44702", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977319, "uuid": "97a13835-5e2f-450a-a71b-d8d3f1775146", "comment": "Malware payload (Formbook)", "value": "f9623ae2cadcf28cc6d4f67ee408184c2ee09b3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977319, "uuid": "4480280b-f1b4-45e1-8f09-a837a5fc8bf7", "comment": "Malware payload (Formbook)", "value": "47841d3d645c2a1d9faa785400c49aab5acdb1d20852df32fad328fe39691f943d58ba2e0d956bbe1aea4c8895beba57", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977319, "uuid": "ccc438b1-6388-49b7-9a8c-5e844eab8432", "value": "T1DEC4135407E088F506B6786A301F5B0B8A976EB00C8ADBD857DBD8C55F1CB546F7E838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977319, "uuid": "1cb5ab95-5ef9-42df-863a-1a817a8e0960", "value": "12288:7NnOmMrGR2IFhAsnJp/oGqDU1hnGHEzLNrLgo/Ujo:ZOmyGxDtnJpCU13zL5DUjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977319, "uuid": "00253435-3d78-41c3-a66e-8d76fdcffa53", "value": 574005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977319, "uuid": "98bd1bad-cd8c-45da-8589-74633ce87dfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977319, "uuid": "c53839ef-ac1b-42ab-ab55-f0da243101f0", "value": "SW_9007211.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a01e535-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950177, "uuid": "06787c2c-6ca1-4304-a060-baea4aeab5fb", "comment": "Malware payload", "value": "e8c73c5079ad31accc19fb9814f074f6", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950177, "uuid": "1d1eb459-8e3c-4722-a80b-fd15da784af3", "comment": "Malware payload", "value": "bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950177, "uuid": "37a609fe-b201-4029-8c5a-a0c94d0c8e26", "comment": "Malware payload", "value": "0dd7d1de665cee8c104ee95ddb7a721274bca6c5", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950177, "uuid": "2f3d13bf-2109-453c-8036-81805577af9a", "comment": "Malware payload", "value": "f86920a5c8e4e77f33121d513d6983b46d23830773a6cd1a72f53386bab477ecdd2146882c7d7c82bc79b0a5a9bebddf", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_LateNight", "colour": "#318ADE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950177, "uuid": "456324be-cfac-4e62-87d9-b01ba28a0cb0", "value": "T108D39DDB329802F5D0565231FAE35A83E7B3386616314B8E47C8025A4FFB791EE19736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950177, "uuid": "9a8c63fb-630b-41c2-9b2a-34dedcac814b", "value": "e90819481d49890eb77807afcad93568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950177, "uuid": "65b35023-8318-47b4-b256-4b9208bed141", "value": "3072:b9TMAo6ZPsZPFhEZcW+cS5i4Sb78q7wsuwFf80ctkIh/rs6VUA4CAa:hTro6lEdCyW8ib78q7WfkI1Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950177, "uuid": "4df31a36-0e08-474b-870c-9d8081b42160", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950177, "uuid": "f844faec-1b94-4902-a578-7903a4a1293b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950177, "uuid": "e59a7e2b-d102-48e5-adc0-88962f22a009", "value": "mctsetup64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5e282e-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788977290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977290, "uuid": "7580593a-10de-4ca0-98c4-7cbba261b173", "comment": "Malware payload (AsyncRAT)", "value": "7c0acc777fd382b6b6c091545d04125f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977290, "uuid": "345d0b18-602c-4bb8-aa38-6673dcbfd31a", "comment": "Malware payload (AsyncRAT)", "value": "bcf3256fdac5aeb1c2825ff6f899a21cdccecc6f9957250ad004afe50eddcdc1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977290, "uuid": "03b92d5f-db79-4ebd-809a-a5757f40bafa", "comment": "Malware payload (AsyncRAT)", "value": "fbda6ef8051d9bdb49e3743461a90da505060d6e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977290, "uuid": "46ff1473-d5eb-48fd-b5e6-998d89d4659a", "comment": "Malware payload (AsyncRAT)", "value": "6587deeef37dc63845711debd62825d839037937b4ef1ae7a5cc399a88c6fd9753e295823d03ab9830b2c8f395ebf406", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977290, "uuid": "32b68b8d-59e6-436b-a4ac-d56fd07b613d", "value": "T1C324E00C7F9960BB2A165F3E40CD594B03E81CE93B85F2DE5554CAEF089FFC5882A649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977290, "uuid": "766e6539-6c26-4b1f-bd61-1995fb6b29b0", "value": "6144:CzUhAMh5d5zk6OadBcE2DYqNuL8Mx0uMa6xp:C4hb5Tzk6OkODYqNujx0uMaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977290, "uuid": "851fe4ac-8fe6-4a24-973e-4adb33e1fa79", "value": 222410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977290, "uuid": "15d96771-4324-444d-977a-0a2f29ed83d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977290, "uuid": "38d8bd41-c1e3-4dca-b2ab-26c3e1792382", "value": "FratFNCJRg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be847859-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921596, "uuid": "0cf3db8c-30a4-48dd-aa93-5b62380812e4", "comment": "Malware payload (Mirai)", "value": "cd029fd1b0312ec933cf0eb0e44b946b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921596, "uuid": "c22fc73c-e22f-46dc-86e6-548c83332cd9", "comment": "Malware payload (Mirai)", "value": "bdaf3c99c0dc9f4a9b75b30f228dd64f168de46da83546f8c3b7d93bc7298bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921596, "uuid": "a06364fb-e47a-441d-ab38-92afb7f11d68", "comment": "Malware payload (Mirai)", "value": "33d4a702b2a120b461498de8eb0c46e78968b5b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921596, "uuid": "003a9d37-241a-4ab5-8ca0-bb6934c74382", "comment": "Malware payload (Mirai)", "value": "d7a91c8d4abe38db8fc13f0939ce8f15a33f5e3679ce205193af9290c507f979bc39df56af9c710eed011f856d0c8b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921596, "uuid": "ebcff191-450f-4645-8883-ecd072cd7a11", "value": "T186C2E1F53E777A9BEF2500383499CE329274F022D79FA613A241820921171BDBB715ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921596, "uuid": "19b64911-9219-433a-a9a2-3b83589d5c9a", "value": "768:HMwoDZLFbBy6HQHRYfeAxdd8zsKkVTJpN0NG:HolcYfe6Kzy9pqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921596, "uuid": "1a08d8f6-9813-4c15-9851-b368333c6a64", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921596, "uuid": "b33896de-f18f-4601-a588-dcdfcb2c1022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921596, "uuid": "dc289852-ba3f-4d31-9b18-4e4b8c2ad722", "value": "bdaf3c99c0dc9f4a9b75b30f228dd64f168de46da83546f8c3b7d93bc7298bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240ec596-ac66-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788969011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969011, "uuid": "f8c14cf8-2a14-4bb3-a70b-32ea74d2b2d8", "comment": "Malware payload (Mirai)", "value": "df1640d494a9dbcd7baf2f46c47d9cec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969011, "uuid": "c36a4c72-61ce-4875-92c6-f10536c21654", "comment": "Malware payload (Mirai)", "value": "bdb2f78c38a30f5ca543d50bbffab3aa217b578ccc39e15d7e831b9cb2b03c7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969011, "uuid": "05647022-73a2-4227-93c3-5eed9e4ad962", "comment": "Malware payload (Mirai)", "value": "3a167f3dd729aa90743b6b8a10a0358026dab40c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969011, "uuid": "cacb6a27-8eee-4acd-8f94-e30be58cff53", "comment": "Malware payload (Mirai)", "value": "ee054809b0565e06b70f147419edd9992a3e639fb66b4ebcb2e3dc802053e14e08489c15ceb68013e5feba22685e664d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969011, "uuid": "a9d269b5-0c1b-4f00-854d-e78b893f512b", "value": "T1FFB24D86FD814917CED11137FA2E828C37664BB4E2EF3307AB265F641746A1B0F3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969011, "uuid": "470148cc-f702-4e60-8040-276ebfb81ce9", "value": "384:Zi1e4fKN9F32SkSb1TGdAy31pBGST5efRBjMeY/Fx4e:ZaePt32SVNGWi1jdQjMex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969011, "uuid": "c74577f0-519a-4049-8846-e4e7fb7e063e", "value": 24600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969011, "uuid": "0ec9def0-e959-433b-abaf-b7108a960ba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969011, "uuid": "ade44413-1cb5-4431-9179-bc8815271258", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e91ea0-ac31-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946254, "uuid": "af218448-e48b-48be-b840-a7ee4efb8b36", "comment": "Malware payload (Mirai)", "value": "af6b9882e80e8643b62740c041f5e09a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946254, "uuid": "ff0b8bb2-f201-46b2-86d2-21319cb27677", "comment": "Malware payload (Mirai)", "value": "be5f52e4fead3639e7202231f8740505519bfb6a3ff41c6cb533df7385f6a97a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946254, "uuid": "a4291c72-72f4-4214-8465-be8dbd69bfd3", "comment": "Malware payload (Mirai)", "value": "e642144bb2939e3fac15c7cf1bbd90a5bd1b5c98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946254, "uuid": "56470282-7c3d-468a-81ad-2f7bdb45265f", "comment": "Malware payload (Mirai)", "value": "f61667b1c4206b9158507d6c70a9bd639e4abad4d91fe6320763ab97a8a7610103be6e2f052ea33b6e7dd9f82806e8bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946254, "uuid": "523e58d0-8355-4e97-87e2-0c997ba84843", "value": "T155D2E02CD99D7D09CABD3EB951CE96B53C8870C0A35DB6CE17168418B627B8BBC071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946254, "uuid": "560794d2-9981-43b2-9955-032aaf7d133d", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNjeJbUWUl:kbDs06t4BEub4sU/MbUjeYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946254, "uuid": "e1fb5f8e-4c3f-4b41-a9ca-29f019ded4ca", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946254, "uuid": "02033d31-22e4-489b-8842-a9ebd9efc372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946254, "uuid": "3f788adf-6b93-44a3-a903-5701aca002ba", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd82724-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963523, "uuid": "b9e9880d-af08-4270-bef1-5d366bc71685", "comment": "Malware payload (Mirai)", "value": "f0651d9d4173b8291f9824b128292971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963523, "uuid": "d8e281a9-cbcb-44a1-836d-1ca8ffa19dbd", "comment": "Malware payload (Mirai)", "value": "bfe2a7ccd9aeda5c97562406fd879397c13dcbd7bc0bc020533ba4b4fb61f139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963523, "uuid": "145f9422-36cd-4c70-bc9d-945cf91b2acd", "comment": "Malware payload (Mirai)", "value": "1ab96b59a4e1736b00b7dd8f0003afb511c4e933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963523, "uuid": "1cdd0a76-e6cd-41c0-998d-9e75b945be06", "comment": "Malware payload (Mirai)", "value": "8dfc6f586f734ab0ae8601f82d79b09f38014adbba48e655f16ed71d60cf013e1414cf0900abd430ef0ff90c54565ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963523, "uuid": "29124d51-e6f0-4a39-a5f0-8821b38c91bb", "value": "T1A8043B02770D0F43D2532EF0277B17E183AFFDA219A1A684751EBEC892B1DB22545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963523, "uuid": "8875d3bb-f616-4c6c-9234-056795c83a29", "value": "1536:G5W5UyUarQjqo+o2KQaFNvn6sU9zXxPFPK6IXdLZifO3W2uu1Dc0lkDa2nKfcgla:CCoz3NvnBUxxdPK5KEkDa3fG4AAIVkgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963523, "uuid": "3559296a-0c4d-40fe-966a-dd79883c4ae8", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963523, "uuid": "adc9366d-270c-4ca8-8d99-91a137f6b8e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963523, "uuid": "2c912857-fe03-4bbc-afb1-11f96cd9251f", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9939d842-ac2f-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788945585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945585, "uuid": "45c642ac-70b9-452f-bd61-dd0493b4d98f", "comment": "Malware payload (JOMANGY)", "value": "4c5d86aa8066e2b2b1f94c2540dbecad", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945585, "uuid": "9d84d8f0-5ed7-4dd5-98dd-617004b836fd", "comment": "Malware payload (JOMANGY)", "value": "c0741e6f1fa0a0f0575fe731651f4509f4613d93ae2e712516405a18665d68f2", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945585, "uuid": "fe96c470-2985-472d-afe7-34a9aee70bb1", "comment": "Malware payload (JOMANGY)", "value": "7f9aadc1de90b3f7484b71e4d88ff7f98d5c722e", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945585, "uuid": "e722670b-bfa3-49c7-87fa-fdf729c938ac", "comment": "Malware payload (JOMANGY)", "value": "89eb11500aed976d3175413a97c3f712ea0a853d14c2e246caaccc8c2c7afe423dffa4b8d4718a9968d754e9473b053f", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945585, "uuid": "c94d0cec-a600-46a7-8262-95189cb60dd5", "value": "T1FC236C651A857C14AA99C4371D7E2F0CBDAD43E6320452EE7FCB3CF28C8AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945585, "uuid": "78542643-7c4e-4050-8505-772f791dbd33", "value": "768:kVEJVIhtMF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:6EJ2MWcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788945585, "uuid": "131fd1a6-e910-44f1-ad3d-e025d6efa8cc", "value": 50079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788945585, "uuid": "3b79fd64-8075-48a3-a471-a65991ea8f1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945585, "uuid": "c11f4d49-2462-4f60-9861-f3643d81cf37", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e484f74c-ac9f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Urelas)", "timestamp": 1788993815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993815, "uuid": "71dc7703-cf46-4a88-86c6-a7e98ff7661e", "comment": "Malware payload (Urelas)", "value": "2ad704d002100e5f9fadf7c8d6c9d005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993815, "uuid": "42e0bb1c-fe5f-4552-8de9-44d44a75b5ca", "comment": "Malware payload (Urelas)", "value": "c108a1e19763ae5c39fe0d768253cfb16a3b9731dced076782268da84527117f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993815, "uuid": "a809f2e7-d55b-4fc2-affa-31b364263cd5", "comment": "Malware payload (Urelas)", "value": "e3baab524197c97a960a3ca45108b65b58de692c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788993815, "uuid": "9e26a489-b110-45e7-94aa-2de362af2ca2", "comment": "Malware payload (Urelas)", "value": "346e795d93988725f283d1224031cdaddde890dc03bbd148cc986d050d9cd8c884a54a94c1ca3b249377669ab83eba2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993815, "uuid": "46e6f69e-484e-4fa3-b11b-925bae7a8cea", "value": "T1F065D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993815, "uuid": "a6768314-a2f8-4fc9-b6c3-daf9cc266590", "value": "372467513fc37686aa91f0703e76e7b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993815, "uuid": "f9bb13cf-4033-4c4a-a9b9-007262c16883", "value": "12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMd:AIfjoga6u1AVDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788993815, "uuid": "e3106754-608b-4325-904b-ee00ea018209", "value": 1457776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788993815, "uuid": "9276ba45-7628-42b6-8747-a38e7f9c8ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788993815, "uuid": "6ea72ff7-5622-4ea7-9dd1-144ab6ea0501", "value": "2026-09-09_2ad704d002100e5f9fadf7c8d6c9d005_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b55b42d-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946851, "uuid": "739a6b8c-d1f2-432a-9a1f-fb54e616b4ea", "comment": "Malware payload (Mirai)", "value": "7db5751db91ee6606bb5553fdab599ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946851, "uuid": "28f63aa7-4bfe-46a2-87f5-032f3e60f33b", "comment": "Malware payload (Mirai)", "value": "c16c7b4061605d36caaae0e279c49086304b646600caf37d485cccb9953a92dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946851, "uuid": "92948a26-e8b2-4724-8bd7-adbe17909405", "comment": "Malware payload (Mirai)", "value": "5f1cd0528980af089cadce5c10642234274072af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946851, "uuid": "dcac434a-0444-431d-ae55-511be5299f3b", "comment": "Malware payload (Mirai)", "value": "10e9487cdcea9d838ce9405438c347f6fc83030015aba78bc03afca52286370e7ab4451ceb8a2e9406f3e6b26f6019a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946851, "uuid": "89ecf042-98f3-4e98-9ab1-49859703a7b5", "value": "T19DF33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946851, "uuid": "0f65af75-6f40-4b42-a63a-bee2bbb94e71", "value": "3072:I3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nxfau:IFJMZBtqCnFCtE1R1WpvDJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946851, "uuid": "989e3874-8459-4e9d-a5bb-ced82920905b", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946851, "uuid": "0a3659a1-aa25-42f8-94cb-2ad9c9acf493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946851, "uuid": "9b806f3b-b2a3-402b-8367-8328f8d19dc0", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af6e8dd-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977264, "uuid": "5f40431c-1809-4859-9e10-ca3cda1a455b", "comment": "Malware payload (AgentTesla)", "value": "3db9100bd50c5f0433cbf42b3cb18698", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977264, "uuid": "fbc6380a-377f-4cd3-a638-834e952494b6", "comment": "Malware payload (AgentTesla)", "value": "c1a2e5b71c1b3c8461d9aa204665593b61e2b8379503da9026f3ef7391fd3748", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977264, "uuid": "c4960f73-13d0-4706-a6c6-53577fb7a87e", "comment": "Malware payload (AgentTesla)", "value": "f4d2a30687a9ae03257657f8975897ee6ef38c64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977264, "uuid": "840c2f4c-96a2-47d2-87bc-b7fe8cfd7969", "comment": "Malware payload (AgentTesla)", "value": "42b3177d502a06a30496ea600e0581a8059f3e5301ccaa89849cbfd6fc96ea0045959c7d4e7cc50d6ca9eb2d9c22adfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977264, "uuid": "69729ea6-0e02-4727-a574-48bbe5f63379", "value": "T1ADC6F89AAB86D6709ABE035CC0356A90C55DE20B11D4EB1F3BBC1B457BB7B03278C4D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977264, "uuid": "bd78a126-bac9-4558-a2e5-5e011967303e", "value": "98304:UFxaTszld86xSOcLbOQlfYFrrW6eeMm5EhZxjXqW7/TK6G9G0Z4tIhXJn:UFz9mJlCX2eM77xj6We91NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977264, "uuid": "e82ca679-2c9c-481c-bffe-773c09a462c8", "value": 11477249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977264, "uuid": "4029bb3d-29dd-45f5-92c2-301e1bd82e74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977264, "uuid": "cf78017f-a282-4764-bafc-38a4584ba548", "value": "SOA AS ON DT. 08-26.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130d225e-ac68-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788969842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969842, "uuid": "31f59eea-60d6-4d70-9555-da44244c083b", "comment": "Malware payload (AgentTesla)", "value": "63f7f45c9b5132d9177bd2e97f6b89cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969842, "uuid": "c3f1aa27-acb4-42d7-94a7-ee61721a8ad1", "comment": "Malware payload (AgentTesla)", "value": "c1ae2ffffdbf2585bc522c6c226557fd8d45d989070fde4939cb039e580dba20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969842, "uuid": "b5738660-80c4-4b45-9b51-dce424517e11", "comment": "Malware payload (AgentTesla)", "value": "3f74a7b9c15ad1c278b67719a89d652d90c9d224", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969842, "uuid": "cb12d483-1f7f-48a4-a0a9-50f83cd46d9b", "comment": "Malware payload (AgentTesla)", "value": "421725005a58583c6c767f83eb3cc3779a7d55f98af58b866bb0d2334e88c1ab657103b8fdb6b777abfd68dfcd4109dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969842, "uuid": "59994ce8-adf2-4489-845f-679f993db8b6", "value": "T148B691891B069432753D5B1CC2369BA08A09310311C9DBBF327FD3897B71B1B579E9EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969842, "uuid": "3528a655-a1fb-44ae-b8a1-e289dd96e92d", "value": "98304:ucy9FLSg5qJXmlH9HTliTP/X3ItyDcZzpkTKiQcSO0ReNIH1swjM3xO1mksdD5l3:4zUmsHHv6pkT/n+8AKBE+lwIX73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969842, "uuid": "4358d700-4d29-462d-81f5-a54465ebec4c", "value": 11410721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969842, "uuid": "a7448225-9ef3-4c33-bd8b-6c25f76f8088", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969842, "uuid": "9c3a58fd-5d77-4ed2-a28d-109b31ad808e", "value": "Quotation 10124657.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df19e1e9-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943126, "uuid": "bd5b2efa-678a-445c-9b6e-147c9557a706", "comment": "Malware payload (Mirai)", "value": "965ab7af9172ce3b71edb95ca536274c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943126, "uuid": "26bbbe59-f72e-4ba4-912b-cd1fe5ad59df", "comment": "Malware payload (Mirai)", "value": "c1c39007005154132774f01c3e9aeaf7cfdc9005fc71c264e5e9c4c0af0d6759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943126, "uuid": "7ceaed2a-41cd-46d8-a969-409d256347d8", "comment": "Malware payload (Mirai)", "value": "2029fc6d73338a79c5541104e3d48bc4bff789b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943126, "uuid": "26ae6276-46e9-4643-986a-6ddc527121e1", "comment": "Malware payload (Mirai)", "value": "44fe08223b9f3d7c609d13928f4f0adfa7ff9d961714a4300749bd5dde3b972191586f36815377f0937aec7c49d1e337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943126, "uuid": "8d6efc83-6bbd-471d-9fb2-0ab6e55c71f2", "value": "T17B536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943126, "uuid": "e5ba6a2f-4dc3-487a-a5e6-297ef4e06e1a", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA83:p5VHV8I9cKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943126, "uuid": "9e75cafb-1440-4c5e-82cf-68f46eb687e7", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943126, "uuid": "0817541e-a3c0-49b7-b07d-5365d1ed9a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943126, "uuid": "2ed6c2c8-6d7b-4a00-a3a7-0114910d47e5", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c09666-ac42-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788953765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953765, "uuid": "c5a7e679-f78b-4d22-90f9-3cc329b03968", "comment": "Malware payload", "value": "987740ce202cc9a9e3c77dfa7da124a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953765, "uuid": "9c125492-7f80-4ba3-861f-cb2c01fc14bd", "comment": "Malware payload", "value": "c204b31a2682b45fcd4d8cc6d347ea6effdec8eab1607ad18df6433c54f2a275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953765, "uuid": "5536b275-acfd-4767-8b38-f1938e7dd2c0", "comment": "Malware payload", "value": "8634c06c24464da01aa66159c197d3f9bfa56191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953765, "uuid": "84d45344-b3c7-41ec-8feb-436f93650e5f", "comment": "Malware payload", "value": "0622a34dbe2dc33a1c4351ea03cfae4e537749c1f36d57a848083ba3e52dfe39af5688dbc98cf3977a6f1b49f6d4b7f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953765, "uuid": "02b9c647-9687-4756-8b70-9e0393558b5b", "value": "T14CF7339DC68ABB55F312B2711F561BE2E02831DA026E497730CCDD79FA36027CAD8439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953765, "uuid": "3ab0b769-f75b-4dfc-b3f7-7b0de9a44f59", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953765, "uuid": "28eccb57-a1b3-48a7-8662-ffee5d94f061", "value": "1572864:ZLdkC+wE7IjpyJJf1VDgKZipTenyaX103SAr4r3x/GlCQ2TsbZz7:Z2C+wa2yzfVZaLB4bB5YbZz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788953765, "uuid": "3642c7a8-9676-4f8f-853b-8930bb39aec4", "value": 72152060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788953765, "uuid": "dda4dcc4-ed39-4a59-8877-11b8cb4fd3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953765, "uuid": "2b11e232-f0cd-4c9b-9bf7-45b16ef3c5e1", "value": "CrimsonMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d03ddc8-ac46-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788955470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955470, "uuid": "edff7822-ac99-40cd-b71c-a51547b53bd0", "comment": "Malware payload (MassLogger)", "value": "4df7373313d56103951cd7607189a3c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955470, "uuid": "da92c598-ac75-4fc9-8b27-0b3e52fd56f9", "comment": "Malware payload (MassLogger)", "value": "c20e82ff57421db52fc63784ca77d533260b63de0b1d3fc0f6e1d658991baed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955470, "uuid": "a2012b80-9680-4698-aa37-fe2fe0b72f4b", "comment": "Malware payload (MassLogger)", "value": "88611119f32307b3269ca5f0e0614940e70c6756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788955470, "uuid": "bbb3f0a9-2133-42dd-ad5b-8b466c69efee", "comment": "Malware payload (MassLogger)", "value": "c87b96f5e1f218a9cce4203ae987322784f1a6d48b57bb5349a367d1b0cfa66f6536873c106275ff1d58ec597c63f9de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955470, "uuid": "5d2e0bf6-7275-464f-8a51-30481bd144bd", "value": "T18FD512553628AE27C97896F20A71E17407B92E99743EE6CD4CC66ECF7DE0F015E00A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955470, "uuid": "ade2de46-6698-40ba-84ed-cf0e99b20424", "value": "49152:Nc5qvbMowY6s2k1ZRB11v17h40aBjJlPNtf5zJ/bxoJOt5V68ifG70Z6ym:K5qKvk191BYJl7BpbIswlZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788955470, "uuid": "6faf7278-3ed8-4fee-a489-6d5ae574cff1", "value": 2997760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788955470, "uuid": "47d17c8f-47c1-4f5a-8b16-42a6b5f444c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788955470, "uuid": "039b532b-21fa-4510-ad1e-b0e32c7d6cfe", "value": "RFQ#886590_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f68ef0-ac65-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788968642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968642, "uuid": "c03145df-a313-4e27-9692-2c1a3e8d1804", "comment": "Malware payload (JOMANGY)", "value": "6da3a08fec1709ae90963cd2d83419b3", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968642, "uuid": "f95d1441-c8f9-435b-beae-0c81762b68dc", "comment": "Malware payload (JOMANGY)", "value": "c31264c1b97fa818c67b4ccd68b0f45140dc8fdf8f43684c59d67257c9916fc6", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968642, "uuid": "79ba0885-b74a-4dbc-a500-aca939ac03c9", "comment": "Malware payload (JOMANGY)", "value": "adfacf2bbe719e445aba1a2b4eb28b8cd09572bd", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968642, "uuid": "8945ebe1-90df-4743-8ca7-23a5bb7b4c9a", "comment": "Malware payload (JOMANGY)", "value": "ba961a2b41ecab283f49c11364405744d8906a8a0fc3eddb86b7473b5b5ca3580b6a02aaa6001f94c362466483772f3c", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968642, "uuid": "c61ee442-e565-4567-a75b-4be3920f2573", "value": "T13FC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968642, "uuid": "cba3716e-b8f4-447a-9a3d-6a658973f3e3", "value": "768:t8vCB+25j6es8R49FYpMSUpi+20qUpi+20YQX:t8l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788968642, "uuid": "accf17a2-c832-4e58-ae4d-116e8da6644d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788968642, "uuid": "3a666613-da63-47b3-981a-281c33aa9248", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968642, "uuid": "ea60ecf8-014a-4211-b434-e8291fdd4199", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c863e23f-ac44-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788954684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954684, "uuid": "b8cc65d5-eeba-4348-912b-6327645d5809", "comment": "Malware payload (Mirai)", "value": "f2a066d6bdcc268b79a8a1ee8cd375a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954684, "uuid": "a0955d30-f804-47c9-9cb9-8ed9411db54a", "comment": "Malware payload (Mirai)", "value": "c38d7cf3449f2ac7b114ad3aa254c0af2e807b3d5401daa8d50fbf51a96f7c56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954684, "uuid": "3de54d82-6806-447a-98a1-6b87ca41bb1c", "comment": "Malware payload (Mirai)", "value": "c83baba3ccac29a4870f09d265ec4444f869544c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954684, "uuid": "361e46f0-dfa0-42a3-965f-75844f497c31", "comment": "Malware payload (Mirai)", "value": "511961151a4911a649bc77f41ad930e0aa95924f034d9bccab58a62f2aaf8b0903fd83ed648202cb3de1f07ba74134d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954684, "uuid": "b471292f-ee17-4cc3-aa41-63812b0102a7", "value": "T1D5735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954684, "uuid": "c3981569-6852-4999-a748-77e7a7fa1212", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws80:YwfdNu4cmZvFqI3w70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788954684, "uuid": "4cdc41d6-0f26-48fe-8a25-52cf02916050", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788954684, "uuid": "c1824e97-9667-4db0-9fb7-3a31cf9ebf58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954684, "uuid": "63831bd7-a0c4-4b09-9fef-985f098f6d60", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5688b6c-ac97-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788990300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990300, "uuid": "9e9d41db-0c40-48af-b01a-bf0702fa1a4a", "comment": "Malware payload (Mirai)", "value": "cf73da5e939d841c7e11a276175a7cdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990300, "uuid": "978ee603-045a-4921-92fd-00294b29ff90", "comment": "Malware payload (Mirai)", "value": "c4540c78457873de6337aa2e23b6e2912188741facf13f4c35b9e35cff5e6f09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990300, "uuid": "197a58af-320a-44b9-9885-8f31011ece96", "comment": "Malware payload (Mirai)", "value": "a8e2a4aa5b70159acbf927c517aa84e321451d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990300, "uuid": "7035f720-af1a-497c-810b-6179f38394c1", "comment": "Malware payload (Mirai)", "value": "9eba7485e4b4dfc038dc1844b9762275a253e22ad00a12a8dee9ed875953604a3a0972beb73ebbdd48bcef7c67087755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788990300, "uuid": "4a2c14b4-620d-4644-84df-d9d4c07e5e78", "value": "T141262957B8928683C4E4367AA8BDC1C433631EB99B9723576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788990300, "uuid": "f65340d4-d664-4f2b-9bdc-201efb89b9c2", "value": "49152:Lk/x9iMG54PamkCK65OUV4FXhw1ofFrI5l8U1F1:4/xUMGKXkCK6PKrI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788990300, "uuid": "24f8bf51-807f-4e5d-bd91-19cbedf1f290", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788990300, "uuid": "03e532ab-cb89-438f-8e59-ab84e889ad86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788990300, "uuid": "ded1c7e1-1d81-4822-9062-fb0dba2831e2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b031a2-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946813, "uuid": "8a214954-c021-4bd3-aacb-2eb317e21f33", "comment": "Malware payload (Mirai)", "value": "ba7f84c6e4622b7c2f9a7b138f775585", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946813, "uuid": "de32f9e7-5671-4b15-94bc-7271810a452f", "comment": "Malware payload (Mirai)", "value": "c4e7ac3fe351afe4dcb1146532cf821b689f09d2fe42e41001663e966bb14c16", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946813, "uuid": "d08fb938-6fcd-4edb-a6ad-322bb52c85c5", "comment": "Malware payload (Mirai)", "value": "e9138c3184d1a256e6b4532dcbc7a04b9b60b841", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946813, "uuid": "c64bfcbb-b9d2-422d-a48a-1b902f4a7d55", "comment": "Malware payload (Mirai)", "value": "224dbde7875e933c74cbfc4108ff21c1b6976b33c6b42c0a483381600f7b8b5bf181a1e1e817eb10bd9f9626a776a4a9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946813, "uuid": "41d1409c-67f2-4b8a-aab4-0f2160ac1bf1", "value": "T18204392F258192F0F6411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946813, "uuid": "a0fc834a-7a67-46e2-be8f-452fb8b6157f", "value": "3072:bmflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wwUX9:bIJ5k1DVA2nDXNgEJi5aRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946813, "uuid": "14b93fee-d131-4c45-ad6f-742bbfd353c1", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946813, "uuid": "38f46085-7280-472a-8c19-e3899961ebed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946813, "uuid": "73b31a13-5b3d-4a1f-895a-c65e5fa71787", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6d4e72-ac2e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788945326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945326, "uuid": "2156b4d0-af04-463d-aca2-0a81aa137d9f", "comment": "Malware payload (Mirai)", "value": "b22faa4b49768a3edf0191b765078ea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945326, "uuid": "e25a6d6c-8678-46b1-bc49-d9680fb96dec", "comment": "Malware payload (Mirai)", "value": "c4e9529b30411b3d47fcb4cedd0416f74581c40d3f1bd7f01e8f00abb2344392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945326, "uuid": "a3c8b33f-3a1a-4de3-80a5-ce2e1eea3617", "comment": "Malware payload (Mirai)", "value": "5aa9748e176a4080288d329277a8631a518cbf1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788945326, "uuid": "2237d19e-c39c-4ad8-b6a9-53699f61981e", "comment": "Malware payload (Mirai)", "value": "22f6d599027a40308a39a6313353fff56c8e57d98710afedb7b1f4c8eaf8e3e01c4097ac5a223c651cda353121b0b3aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945326, "uuid": "840842ce-27b1-429c-996f-41441a29420a", "value": "T1C2A33B40FD44C76BC3C227B6F78F469D3B355A6497DB3315AA346EF42B817982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945326, "uuid": "8d3cd1b4-176e-4763-8fdd-19605cddb6b0", "value": "3072:cND5EEgYlkGbqVA1llQ7GsyKxZ1ZMmQwiQmvvhMXWyA:VVge6syKNCmQwiQmv5MXWyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788945326, "uuid": "080d6d7c-f750-491a-b96d-50bd338dd9a5", "value": 107395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788945326, "uuid": "31a5b4a0-98cc-4aa1-9aa9-bbfbf14f9296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788945326, "uuid": "28ed649d-3686-45d8-a368-fcf7e9eb1371", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbf3fc5-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788948007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948007, "uuid": "8cd0e3b4-9664-4eb5-bc98-712c07b36681", "comment": "Malware payload", "value": "e0b413a77a25334bf9aa78955615c7e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948007, "uuid": "d9f2c7d2-07b8-49c1-8473-d429bea9747e", "comment": "Malware payload", "value": "c73bd1c498a147e71e345a99f5f85e3442243c2a7b7cb65f0d00a72acc0a87e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948007, "uuid": "7e58c6e3-8d9d-486d-8362-5bb25d2d0996", "comment": "Malware payload", "value": "165fb8edbbd2d57dcb951a4441f8a1963e697e2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948007, "uuid": "30bdda33-59c4-4a4b-8aed-6d209a4aff85", "comment": "Malware payload", "value": "fbee15a6e1fc29b3e2ac0840b4db35fdcadf21616e13d1e6631795cebacad93a4182fd46604c63eabfec93a1decf2a9a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948007, "uuid": "2b9b383d-d736-4e39-bad8-365dbc055a0d", "value": "T1B30275B2B85565B13B9EC03C53CEA0015844302739143C28F95EB9287FEC365B2B8BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948007, "uuid": "d4e4be27-cae4-4b47-bbb9-4e93c03bf56d", "value": "192:2MpszBhueJMRJxHUcc+DktKolhaboP1+vREGq5TazEXq5e/:JqPTJF+CKolhaboP1AmGq5pXq5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948007, "uuid": "361a199a-4e97-4ea6-a79d-17a19a995054", "value": 8641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948007, "uuid": "be09b2d6-219c-4c4f-b7e9-143306a878c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948007, "uuid": "612aeda2-4af7-4065-957c-c67be44c4675", "value": "c73bd1c498a147e71e345a99f5f85e3442243c2a7b7cb65f0d00a72acc0a87e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1fa60d-ac6f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788972860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972860, "uuid": "62d8bafa-9c56-417f-87c2-eec27d37d9f6", "comment": "Malware payload (Gafgyt)", "value": "785eb9854f2971ec1a345f9145ee9d08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972860, "uuid": "e942f478-ea7c-4e82-8f5b-15bdcc198949", "comment": "Malware payload (Gafgyt)", "value": "c78352eaf38880fbc3ce60b4eec4c577478d618c990bbe510dd1367ee3274824", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972860, "uuid": "e54e63f6-32b2-4896-a22b-e2ab3a0d2ba5", "comment": "Malware payload (Gafgyt)", "value": "58d2d33c98c0a0a65172f4de0b6b126796e0328c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972860, "uuid": "58de726c-b5ab-4017-a744-163ad5fe95bf", "comment": "Malware payload (Gafgyt)", "value": "15ac9e0f64e72c07f7bc593816e1c1174be68a65b062c6ccb4ed084e9b2c458fbd5e76cbcbb6c593232e176e4c03094d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972860, "uuid": "e2d54096-e1b1-4ae0-b253-727406421742", "value": "T1CB244B24E5404B57C2E323F9A68E424E3B3347E673D773155A389AB43FC279A1D62928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972860, "uuid": "eb156c44-28ae-4673-8e3a-a24ecdc0fadd", "value": "6144:JVBuNSYagzTJJAFHuK95hFILE5M/9oJFnmjwBbBsDHn:HBuNSYagzTJ4Oi5hFpu/yFnmjqbBsDHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972860, "uuid": "a40c85c0-5f42-4c50-bc3d-514b9853404a", "value": 213734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972860, "uuid": "61decbea-24cb-4957-afd7-068839562def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972860, "uuid": "8cc88648-14a3-46d9-96c1-7d7e53bbecbf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009cd9a1-ac65-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788968522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968522, "uuid": "5e059e16-e539-431a-bcd6-1d50dd4a8665", "comment": "Malware payload (Gafgyt)", "value": "8a6f6e93614b799efd9dff420ebd2629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968522, "uuid": "5a8e6074-ee31-494f-ad4d-51bbcfadd627", "comment": "Malware payload (Gafgyt)", "value": "c8aa0e9d82b079b7df357099642ff942e8aaa014e5832242763f3e4a20263d88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968522, "uuid": "1f6b013d-aa99-49ed-a10a-ffa700a04f8e", "comment": "Malware payload (Gafgyt)", "value": "f1b761348495e497363771206d95975698da6630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968522, "uuid": "65aeccb9-f6ab-43be-b307-6ce62d353505", "comment": "Malware payload (Gafgyt)", "value": "a86149f1b555b3c1904bf54dd1c9f96389291647f2d1c4094aa83775badd16f39f23abe9246d570d56f2fbf5709af724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968522, "uuid": "c05d6691-e940-47f1-b42c-be433421af78", "value": "T12A142921B242C5B3D1830AF221979F220D33F5BB275FA54AE3796CB0CE6A185B155F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968522, "uuid": "2100422a-536d-4bd9-88bb-018c59c92e9b", "value": "6144:urmOvjs8wvVIBtri0csh7Yt45hI5M+rNmPxGHI/VShyv7f9/X8:urmOvjs8wvVI+sF5h2nmPxGHI/VShyve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788968522, "uuid": "164e233c-332e-46fa-8399-8d6f6c583e8a", "value": 199137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788968522, "uuid": "b0044990-8fa4-4393-a883-2a8c8964e784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968522, "uuid": "c6b1974c-d415-434d-8c72-7c627c10a6d8", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eee124c-ac2d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788944629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788944629, "uuid": "d0e58660-2f6c-419b-989e-92db223ef016", "comment": "Malware payload (Mirai)", "value": "7d74dae4c52290d7ce12b0bf0fd505eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788944629, "uuid": "74a99a75-8091-45f3-85f5-ebb932e59f58", "comment": "Malware payload (Mirai)", "value": "c957862d6546f40e9ae71e17b7fcc30693fb7deb5a5597f90d7450c4a8dc0d53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788944629, "uuid": "6f223113-a4cf-4764-8618-25aa4033202b", "comment": "Malware payload (Mirai)", "value": "3d10b573b4df23d6a93e97dc6e43530125b17955", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788944629, "uuid": "0fa83225-1220-495f-91a8-7a1cae536cd2", "comment": "Malware payload (Mirai)", "value": "e0450c40421b05436ebccf9f5dfea5c04a40530e26515eb2b08b5a24815be60715d695ed709a7cd505f2cb636438a7d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788944629, "uuid": "7cc2759a-c4f4-43d8-9ca8-6c49e144b6fc", "value": "T1EB310177B5175636DC9805EAA75B7251D40B00370AE2984E71CD76B83FB8B417131B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788944629, "uuid": "332016ae-2212-4be1-a230-d88725b9f24b", "value": "48:qcXtRH00xdfva0Xe7r8yGtsyrnZMatJ+SBAcFAf1Ach3tD:B9RHzxBaf+ZaSBAuANAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788944629, "uuid": "bb7ad15a-4305-4fea-a4b2-ae5dd5d2329b", "value": 1806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788944629, "uuid": "8d685707-ec4b-4fa4-b85b-23226e0caa65", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788944629, "uuid": "fba2ea9a-1a81-4181-a235-9b2696826075", "value": "c957862d6546f40e9ae71e17b7fcc30693fb7deb5a5597f90d7450c4a8dc0d53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eab9d74-ac65-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788968787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968787, "uuid": "8bb8b76d-d4c7-42e4-9d47-9fafbae00b47", "comment": "Malware payload", "value": "9bbf0566a004678be726f28d0f95f74b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968787, "uuid": "4c2e494f-a618-448a-84b8-0dc7d6cd1e2b", "comment": "Malware payload", "value": "ca3badce44966347b26495221f08d269bfa08dbed67b32edfcd430e057ddaae4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968787, "uuid": "5dcaea52-8216-48e5-99ba-dff9b8579301", "comment": "Malware payload", "value": "88f69703bf11c143e44967dfcbf1e96e63c2a4be", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968787, "uuid": "de59f9ac-d6dc-4ffb-8b50-1d23792bfd68", "comment": "Malware payload", "value": "0666e9decba8f708ed81503f0f4cbaea71279bfcaa37caeaadd71614bf05ea69a4419ff63499f59e891e4bf5769be966", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968787, "uuid": "8f88cf89-5b42-4635-bdbd-ca6ea8284cd7", "value": "T151437690D270ECFFE1BA623CE59BA2369178715517DF97B906F068A1FC406938250BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968787, "uuid": "7f3f8a03-dee0-442e-aa28-20654a3e1894", "value": "50d0d1884889bb77dc39b3f77d667512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968787, "uuid": "ead97813-04ee-480d-8a9d-b9ac3ff19c5c", "value": "768:3aM2aSf0ZGSKeNFCqpkJ83mhIfGFDELTU2475hPkaL1x/nS:3aDr0ISZvCgk9gTU24Rx/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788968787, "uuid": "074ffa5d-39b0-4e05-be6d-e8ac3c465889", "value": 58328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788968787, "uuid": "601f3d07-5fb9-437d-bc17-d209219e8c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968787, "uuid": "03238fcb-dfe0-4cfc-b3f8-895c8bd39a96", "value": "duser.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbffec0-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966266, "uuid": "8a6650b1-47e2-4c8c-8b7e-dfeb157deb90", "comment": "Malware payload (Mirai)", "value": "c0c98e47e42843a708d631779550113e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966266, "uuid": "b5a35cb9-8920-48e9-9464-9610f85eb839", "comment": "Malware payload (Mirai)", "value": "cad3c450b7dc112b04e8df27858e8fc1d076694c073795a53060ff231b753b58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966266, "uuid": "fd1cabbe-456a-4307-93b8-347a65459691", "comment": "Malware payload (Mirai)", "value": "14c18608b51918e0a82ca38f8f1bbe566fbf75e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966266, "uuid": "7887013b-c520-4db5-87e2-1b205b3ae4a2", "comment": "Malware payload (Mirai)", "value": "0e3e2886ba232b5f9eafed3d8c9a7afcc5305cf905b02f9862b5989bec34944ea759cb7a933df3855939f95678ab1545", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966266, "uuid": "8bb2ead2-3a36-4883-aec3-1d396b7211c1", "value": "T122C2E13096EA1CB1C6200572E7B856C9BE470F7DE9FE3890214187BA3981D592EE99C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966266, "uuid": "451142ab-4da6-47ee-86dc-560881345981", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEGp8BkhymdGUop5hk:AWsoTAZ3alkXLvFh8nNEG8+s3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966266, "uuid": "10b2eec0-70e7-43d5-8981-7239fe9f679f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966266, "uuid": "7973e0bb-3b18-4b74-b9ca-825082131924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966266, "uuid": "52356e52-8a63-49f0-ab99-f4f7b5f513f2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf854cca-ac6a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788970990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970990, "uuid": "cb4a72fa-a9a9-4956-a7db-bb6a57bdb24e", "comment": "Malware payload (Mirai)", "value": "37b998774188c5211485bdf61b026980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970990, "uuid": "57998798-135d-4810-8480-80ec92f2cbb1", "comment": "Malware payload (Mirai)", "value": "cb393e090b800361d27e04deeed22df5b52c00ded81e3171a11d554a73ec3e0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970990, "uuid": "43b004a2-acd4-4fa0-ad6c-953f524599ce", "comment": "Malware payload (Mirai)", "value": "cf5902c04e7477c4ef4db65d3f09facc74aa9885", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970990, "uuid": "6dd9ae42-7252-419a-bc39-df47921f87e7", "comment": "Malware payload (Mirai)", "value": "c00ba05b3aa362642a2701b6d6059667f235c57871b51bb981757d82ff5a69d81952436d5533c33228cb82449073b2a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970990, "uuid": "1165e61e-5a0e-4a2c-b1ae-487a19d71fa7", "value": "T1A4441946EA404A13C4D617BAFA9F42453333E768D3EB7306D928AFB03BC775A4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970990, "uuid": "b43110a6-6691-42e5-abf1-f4b3849d2e77", "value": "6144:uMmS51tCfHhB+xLYQaQzDIxwRKcSaNWgbHqa8V/GWmz2c4is:uMmS5X8HexLYQaQzDIxwRKBQp6/pmzxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970990, "uuid": "fc07b8f0-aa16-4326-a9c6-23b053e0aa2c", "value": 256972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970990, "uuid": "4e540a51-0c48-4006-8119-b790290c0079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970990, "uuid": "e275cb27-608a-42cb-9858-c5d69952d738", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c6a683-ac6d-11f1-ab4f-4201ac107002", "comment": "Malware payload (SalatStealer)", "timestamp": 1788972230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972230, "uuid": "f9973076-66ec-4436-9de2-c25f1c9c0ab2", "comment": "Malware payload (SalatStealer)", "value": "430521b624aa6229cad92e69775801ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972230, "uuid": "9d276bb7-65eb-428c-8723-06919138e9d2", "comment": "Malware payload (SalatStealer)", "value": "cb82c80e1b79d91ec4c00bad8681e70be81eaef3ee1e326c7c7095eb2e4f0211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972230, "uuid": "687a134b-5dbe-4b9f-9496-d5aba1a5d400", "comment": "Malware payload (SalatStealer)", "value": "4928edf8d1385d12c2a5c82f0158c2c7d90037ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972230, "uuid": "581dc674-9d46-49fa-8818-e12aa9f5cd93", "comment": "Malware payload (SalatStealer)", "value": "f0ec7732413a623ffb4da53420490b74b9d9dda8ae452d5544e1743f06babb85e534ba46bf971d62d8615df9d4711662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972230, "uuid": "fd933c89-b97e-4e83-a752-0158c738541c", "value": "T107F5336D621B607CEB977230F1737B13CBAB050675D34422AB98AE32F8BD0B6741255E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972230, "uuid": "678320c4-2c7c-41c5-98d5-b49543dfb505", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972230, "uuid": "e8fe2872-6952-47a1-b8d4-1bed02e92518", "value": "98304:RAzzDFrOi3ZeNZIk5kd1qLZZV3snGJMOPx:epyI8ZIYkd1qJsnGJMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972230, "uuid": "eaea5cf1-70ff-4ad3-8347-72faf7a5481c", "value": 3587584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972230, "uuid": "8a79ab7d-55d1-4264-8a36-d92daa0e3ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972230, "uuid": "3378facb-bd58-4d0b-b85d-367d4960594f", "value": "RKNObhod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329d235a-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "0b754c1c-fb9b-4460-b643-44e5baa04217", "comment": "Malware payload (Mirai)", "value": "8b0896108c33d24d73149160177b9eb1", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "da112791-e1d9-4dec-90fc-f6a56d3254e4", "comment": "Malware payload (Mirai)", "value": "cc3f718b65509985455249a955d644ab24ef3a9eebf0ce755fb4003832b6ae37", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "3c76a111-129b-4954-87ce-0d8c5af33482", "comment": "Malware payload (Mirai)", "value": "dd18f79accde82d0ea3655498f21c719b0e8b14c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "89f811cd-2394-4482-a223-7a83c044dbe0", "comment": "Malware payload (Mirai)", "value": "ddd71edc8759170c92afceba0b7c4650d3ce41ab1e08c3c1766dfed05f1c5ed3c4b1efad45eb07cddc6e79a1775b9ac1", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "844172d8-217f-4beb-9b13-dd132545e3dc", "value": "T17E530213C5530D09EF623F71775AD254A781CF8DA662FAC16ED04FF9A083B5A21A18EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "70a07090-f9ee-43a5-9b84-503b175ba77b", "value": "1536:PMBf0bGUAWGAnH7mXJl8BDVTT3XdXhqJ3HVxnZK4u+qgw0r0:PMByuLAbm5uTT3WJ3TZK4u+qgwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963452, "uuid": "22f7773f-c856-435c-8256-21cc0068c7db", "value": 62404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963452, "uuid": "b07b474d-6679-493c-848b-12eb9c5a61af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "8b63f69a-5f99-487b-8f4e-fd1a0f8ade65", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdd680f-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938376, "uuid": "a2c1f7da-fe75-41bd-bcee-35fe41673e6f", "comment": "Malware payload (Mirai)", "value": "4dca2b8f7073bcc25c3ea55184f6eaa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938376, "uuid": "4eb230a9-ff90-4c5e-a908-5f63c3276bdf", "comment": "Malware payload (Mirai)", "value": "cd6165f229346015927caf8ce7dfb0953687d531c95258ad35d4bda6c73c7136", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938376, "uuid": "dea40963-a6f6-4f1b-9fea-164c2e83c324", "comment": "Malware payload (Mirai)", "value": "b48f037b5fa7fd99ed507398fa02377d92dc3309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938376, "uuid": "48dda3af-0b16-42a3-87b8-f77c87c71369", "comment": "Malware payload (Mirai)", "value": "d0a5fd1e456889c7e3140af96653c7b29a2feac2f3594b9ebaddedd0ec33d64fb7ead669706d3995af55f46293d9a73a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938376, "uuid": "6be414e8-8fe1-40ee-84e7-3b531497aba7", "value": "T1BF835C32BB1A4E27C1CAB4B612F34731A3F19A561D6A560ABD642FDC7F22BC03547760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938376, "uuid": "0707b5fd-a3a5-41a5-8665-0381ff8ca44f", "value": "1536:RBsAM6QlqtKP275L2tH/knEGNELvQR9oITXqBENn:RyAYq0P2VL3ELvQR9o46BENn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938376, "uuid": "e9d4a5fd-5dfb-4a23-b066-568a7d35fbe6", "value": 84550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938376, "uuid": "aae17961-677b-4c3d-890f-0312f8ee1d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938376, "uuid": "616674a0-2ee9-4d9e-b054-f8073d2bdbe7", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd41f12-aca5-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788996406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996406, "uuid": "ca320b6a-f3e2-499e-9dea-1df2ad8c8a25", "comment": "Malware payload", "value": "613fb7ed9637e38182bd25a40cbcd1e8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996406, "uuid": "0a9b39d2-6bd8-4663-a640-f448f8a12af5", "comment": "Malware payload", "value": "cf7549739e71199fa46bedbce06a15605d54051380100e81d2421c6391980d9b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996406, "uuid": "d4a830d6-4d08-4154-b264-33d91ee7ae87", "comment": "Malware payload", "value": "1749d6be884f18b913f669762a8b6cf61731c6be", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996406, "uuid": "a2451390-cd56-49a0-8f4f-c270791b0466", "comment": "Malware payload", "value": "5cfad3c335553566d3c90075a1f757e1f1056202c4fc5bad5c8ebacc994974f860776414e5488e6bcdabcaac52beffb4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996406, "uuid": "3b38c8b1-3b08-40ce-beb0-b4079cf7289c", "value": "T105B012106049DA290A1540DB0533550CCAA48CC82F01AF144700C80D2210D25EA43503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996406, "uuid": "0b8bc155-c889-409b-8f6f-48ff4e8f2cb1", "value": "3:FER/n0eNHnmRPIkVViE2J5xAIq8oRFlAyM:FER/lNHnm1Bn23fHoRvRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788996406, "uuid": "63de7e0c-1374-4315-a9b8-aa09944e1823", "value": 97, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788996406, "uuid": "10ae66eb-c4f8-45d4-b11c-c6985d3d5248", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996406, "uuid": "a02e1bd5-cd19-43d1-9720-50a2d18c55a9", "value": "_br_dropper.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84417a6-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977098, "uuid": "9d02a0a6-4b2d-415a-b875-e1a105c61b07", "comment": "Malware payload (AgentTesla)", "value": "702aa86ac7521bed1359e10a740a4584", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977098, "uuid": "c291d43e-ad95-4955-97d5-e9529d6eea6e", "comment": "Malware payload (AgentTesla)", "value": "cfa7488747bd2c7f8cd623cdebdd8154a2d2afc738b970b4a132e292b1c4e3c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977098, "uuid": "24a05bb4-7f64-4b17-9d9b-cd82c52707a8", "comment": "Malware payload (AgentTesla)", "value": "eb329b57fac484c5eed7224992172a28b0ad6274", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977098, "uuid": "26411090-3d36-461f-a01e-f7f81d445a16", "comment": "Malware payload (AgentTesla)", "value": "1053e8a40c724e439ab4af053bc0c4e67d6b7b0253934b5536fe83fe90f6c2296b29c1fb215ad901575a8d9c6ca67e4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977098, "uuid": "50c4c53f-4d91-4846-9b2e-1544ce7edb3d", "value": "T1A9D4F0C24A05E491583CF34F4B3B6E3626F0165BA2CF98E8D17466BC6666303F1D9CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977098, "uuid": "2428fa92-3d10-43dd-bb66-b21f1976704e", "value": "12288:dknGBVhd5HWSyu0g2M+OQhyR0sDLlgAjFi8rAdMcvQUzYlOfYXocI6j/cX:SGBWg/2MXOhAjxr0McvdzYIuIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977098, "uuid": "546b02b9-777d-46c4-b0cc-f4ed3eeb49ee", "value": 644418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977098, "uuid": "8aa0788d-5c78-4209-9d70-5c0c42532f24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977098, "uuid": "770c0bdc-5811-4f01-b92b-6bc3f74f9cc4", "value": "NEW ORDER 61935400.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96517d8c-ac12-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788933125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933125, "uuid": "955142aa-6eac-49cf-9550-c9e20ed972b7", "comment": "Malware payload (AgentTesla)", "value": "232d32291b2acbf4363999d1a29e954e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933125, "uuid": "4774000a-fd65-4727-b72c-92175f054a71", "comment": "Malware payload (AgentTesla)", "value": "cfe24ea30aa3c5f4508b149748dfa02a54657e4fc4bfd7a5b40b875f6c76c4b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933125, "uuid": "a32cec54-5edb-4022-aee9-77e05f2ed97f", "comment": "Malware payload (AgentTesla)", "value": "8dcb8e993adf4d31799e3b4dddd4cfc5e9b14ae5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788933125, "uuid": "c59cffa4-565c-49ef-bf5d-3b8bc5800501", "comment": "Malware payload (AgentTesla)", "value": "2813b6fd341347c50ed40520d26dbeec913c69d44858e3c31a30bb34813e6a9540b2ba55f9c9b2db3c5ea7eb5d6d4629", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933125, "uuid": "8af06f16-366a-48cc-a18d-ceec2b342af4", "value": "T196C6D7EA074491B1BB34674F99359E78990B290714E6CB5A34BDF3187B7CD0B1328EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933125, "uuid": "e54aaf91-87b1-4b57-8925-38c02ad8f5c1", "value": "98304:E9bBnHN1FROUiEhivPtgikyh6rVcU+2L0paksLaKTMaXbnyIJFIvPV:E9blHN1FROUiEhintVH65cUEyjy7PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788933125, "uuid": "85d676de-37ce-4069-b0cd-d24ddc2a9c2c", "value": 11495457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788933125, "uuid": "303f6b54-4359-4c43-9616-d16418b82095", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788933125, "uuid": "ca8436d1-9bb2-4728-8677-5b4a5c6eb350", "value": "SHIPMENTS DOCS-34437.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef58bd1-ac68-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788969862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969862, "uuid": "b8cb96e5-9b17-4c1c-bf05-57ca29b5c3e0", "comment": "Malware payload (MassLogger)", "value": "ee81e90d49e09b9b39116a916c717057", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969862, "uuid": "f7fd542d-4d77-4a8b-aff0-252a849ab7e0", "comment": "Malware payload (MassLogger)", "value": "cfe8f4aaeff1d8922995417f83f34f9d7683540e00ae2d6a5c27f8ef76ff1dc3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969862, "uuid": "8fde335f-d039-4d84-b3d9-44869db7df1c", "comment": "Malware payload (MassLogger)", "value": "aa222da8f5fb936dd03eb500e9ba386f94301242", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969862, "uuid": "0e7fde04-cb24-4555-a82e-e33b76be1b60", "comment": "Malware payload (MassLogger)", "value": "18cb08043a548be8f838d9dc92b9ebbfd7433fd6e5fd88871c4328a20a79a51c546bf21d6acf06d47c79de80759bc85d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969862, "uuid": "7aff9243-1786-411c-ba73-8bed21b0b780", "value": "T1DBB6E89C41569520567D165CD432BF40463EB28B22B4AB5E377C2388EBF5B036FDECA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969862, "uuid": "c7ca36bd-49e2-4f1c-a324-3e664ce17c75", "value": "98304:1n8vH93g39HGeHW8v4bXwEaxas3m3R37Ql7PQ8C9IYkZlJGD5K:W96GueB36MkcDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969862, "uuid": "119aa515-57d1-4a0e-a7ad-b90d1e5babb4", "value": 10956591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969862, "uuid": "5ac50a99-86b9-4064-9be1-e90f2a57986f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969862, "uuid": "c3d467e8-47ef-4d61-aadc-dae59560a8cc", "value": "BBVA PAGO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03092483-abfb-11f1-ab4f-4201ac107002", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788923000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923000, "uuid": "d7af40fe-519f-4d70-b0cd-f097857e472a", "comment": "Malware payload (ValleyRAT)", "value": "8ab97203e3e3d4d5d24e8c6ab6bc095b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923000, "uuid": "e5c4c30f-16d1-429a-9965-3e1a46e63910", "comment": "Malware payload (ValleyRAT)", "value": "d13752d409ddb0e6f87bd72259a343f7a70bd13c30b03943019123a96e4a2070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923000, "uuid": "a9647056-c628-44cf-b246-988b381fbe38", "comment": "Malware payload (ValleyRAT)", "value": "383430f170ef403df9a23269f56f040a2ec8cfe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923000, "uuid": "e25dbd39-bbaa-432f-bb90-04849c71369d", "comment": "Malware payload (ValleyRAT)", "value": "b57d9f3da53cb48cf44004ba3bfeaf436727309c72c9d2c0efa51c576e8da2c19a9f54f58e7290328c3d9c0125a1251c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923000, "uuid": "0287e9ab-a397-4e46-ab06-e9ab4101b5e6", "value": "T10B17336C3D65CCDAE2B547B0479E24521FAB8C4F05025DDBE385FE2A9EB27A37049B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923000, "uuid": "8576fb2e-d00c-462e-9e6c-ba827a445a02", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923000, "uuid": "b27cfc02-9af4-4eae-b197-5b3130f15d06", "value": "393216:TOsMYynxwj7figtUj8LF31j+tnF2zudKKtwmS0gUOvxzSyna2OP9I:TOuyxG26LF30F212w+2xzna2OVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788923000, "uuid": "5e567768-59f0-4722-980a-d536aad0373d", "value": 18919981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788923000, "uuid": "b9377e8b-36b5-4fcc-a5b4-082da0bb596c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923000, "uuid": "a8c72eb5-7f3d-455b-a43a-dd494e3f017e", "value": "win-Bundle x643014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5c4dd0-ac22-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788940086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940086, "uuid": "0261b83b-8d8e-452b-8d1c-dec0735a3285", "comment": "Malware payload (Vidar)", "value": "831cb3f72fc54a8de96dac5bc128339d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940086, "uuid": "75ccfa25-cca5-42fc-afb0-2eeae21589a4", "comment": "Malware payload (Vidar)", "value": "d15749fb8cc4fd3f4b9214197a40218d6428e3a973740c394dfb85a852a4aec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940086, "uuid": "de09ef3b-f829-4b73-9f64-cbdf826e4b0b", "comment": "Malware payload (Vidar)", "value": "842ddc82d86541230cc79fde5e9a203347817e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788940086, "uuid": "3bde3531-9193-4ef4-9a49-a622093e9b39", "comment": "Malware payload (Vidar)", "value": "0ead0137e7aac3752a8ba20859abf3a39123a5aee8c40ab3dd16ff198c0ef1ca3b7c43019e18fb8cc9cce9d2b81c617f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940086, "uuid": "adad5b42-e272-4487-b6f7-d00300d6311a", "value": "T140965A0BBA51A1A4C095EE34C2764211A7743D4DC33937FB1EA1EA742F267C2AEB5F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940086, "uuid": "dd74e653-e848-4216-8470-489d562373f5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940086, "uuid": "08783b17-5d7e-47b2-b386-49b59841734a", "value": "49152:osB7F98dX4ASHS+Y7ST8Aot2kg2Sufmryob63CzJlG+NyCDirz1QQ6amkqgt9u5U:oaA2b2FmGQJFN/DOyum9gt9CqUqQpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788940086, "uuid": "1c3c8a2b-73ba-4a34-927c-065fde3ce8ef", "value": 9437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788940086, "uuid": "a1946013-dd51-4a46-8ed9-e59020684c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788940086, "uuid": "d4132af0-64c9-429a-8156-a02e730a7a95", "value": "d15749fb8cc4fd3f4b9214197a40218d6428e3a973740c394dfb85a852a4aec9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e4b476-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977141, "uuid": "729b6c04-4ae1-4d4b-87ab-e67247758043", "comment": "Malware payload (RemcosRAT)", "value": "a8bbf31467028d7e4b69fe44ae36ce53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977141, "uuid": "8441fd42-8a6a-4231-8751-4148a01152b5", "comment": "Malware payload (RemcosRAT)", "value": "d16cbcb4e323018a90d4debefa96d51e6817e6a72d7b5a2536403c07466fe4b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977141, "uuid": "79125ded-9454-4789-ad5b-fee8487bf2f1", "comment": "Malware payload (RemcosRAT)", "value": "9db08f6e83ef24b1b81e664b13a4e89596a9e79c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977141, "uuid": "085f7f23-43d0-47c2-bc42-37b8d24defe1", "comment": "Malware payload (RemcosRAT)", "value": "3689256a5cbee0c189cab862d86f9ab757f772905365231933fcfbfb885359f24e390d0379b12f7698394d9dccc2e281", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977141, "uuid": "8e0841cc-fcaf-4f19-99c7-80dd05f266e7", "value": "T11F36E8A176EB9B80BE44376D744D5C1D8F5E8A3A5942A2C4F0CF17D4630B68F23A09ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977141, "uuid": "372ceedf-74c8-4aac-8c49-245c920e45cd", "value": "24576:IYa7D9qfZ5T6JzS21/gw60P87BrFD3VzMSc+aF3O4r7fessPsNx+plam4rG42G8Y:3a7D9qxH1CP+plaDhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977141, "uuid": "1f58c4ad-df96-4bb3-ac32-4065caac330e", "value": 5295730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977141, "uuid": "8f815af9-ef70-4db2-9619-0c7406fe9e07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977141, "uuid": "7976a0e9-2e5a-441d-a6c3-4e2470025a71", "value": "Receipt_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a7a7ed-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938406, "uuid": "b4c619d8-a45d-4fbf-8b42-0ceca2b8ccec", "comment": "Malware payload (Mirai)", "value": "d1c1525e244cf552a60d9cbb63c3e8e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938406, "uuid": "9ccea29f-8050-4e06-bfd1-58569ea260c3", "comment": "Malware payload (Mirai)", "value": "d196d4be303ce4745e189f1bf31936ca433a3867d3cad9147070e0f6f6b0ce64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938406, "uuid": "811477bb-5a80-46e4-901a-cca6ec2fde3d", "comment": "Malware payload (Mirai)", "value": "583e29f7450205ab2442aa160b026099c378389c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938406, "uuid": "dcb0fcf4-3b87-4122-be18-104c9d6d9ee3", "comment": "Malware payload (Mirai)", "value": "88953dd71c761bb0e5e7f680c173f6555ee3babae5e902cd34e8630f9aa36c0c4e7e04a188a3cbb5aa3ea099add57d92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938406, "uuid": "e417dfca-19f4-4eae-9102-3c45d627251e", "value": "T1A5E34946F58224FDC10B8038453F2572F435B4BED23A6E7B77D9DB313916E681E28A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938406, "uuid": "0114d874-496d-4f07-ba59-0930f6fd258b", "value": "3072:z/VQqWAHzvopKGivjTZxy3/A/3YFMGiALRs7j6r:hQIzvokpLsSGiAL6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938406, "uuid": "c35df51a-2476-4759-a100-0c2de991439c", "value": 148232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938406, "uuid": "818bb1df-b680-4c15-b283-524440c565f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938406, "uuid": "1319d425-31e7-4cec-bd6e-a13a48943a59", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e694a3c-ac32-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946802, "uuid": "dc775f66-127e-45f2-9a5e-b4cff1706318", "comment": "Malware payload (Mirai)", "value": "6443fc47d8cb6ae6e911d7ec28cfb576", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946802, "uuid": "7c6876a2-c58c-4bb2-bf84-213a94475daa", "comment": "Malware payload (Mirai)", "value": "d1ab83e8d0cb8b4f86d5827d3de0417102b147b8ee68298fe916cb1d4995c551", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946802, "uuid": "0ad08dfa-0e83-4617-87f9-550d8aee47ca", "comment": "Malware payload (Mirai)", "value": "71ef2a786ce11e7c0419859052aab85ff01de3b8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946802, "uuid": "cba61a5b-ae0d-4b2e-8a7b-32843c12f52c", "comment": "Malware payload (Mirai)", "value": "2770a23aea3e43234dc6b3b16679bfc37594316b48a8d7724b47d96b8ca4043a4f08ebc228db0966740113c73e9df046", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946802, "uuid": "636828a9-f012-49e5-a79c-0ef663ddc739", "value": "T1EEB3E085B210AE56C02272FCB0870990D3B16E7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946802, "uuid": "e82ad3bb-2ddc-417f-b00d-1311175abfd0", "value": "3072:15Apzl9NOvXoVLAE375lhYy5SkOXNwuz:sevXCLr59hmNwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946802, "uuid": "ac74918f-c234-4473-891d-02845930de77", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946802, "uuid": "6cdd20f5-c977-4735-b6e8-7423ceb91d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946802, "uuid": "cf16343a-7d33-42c5-9455-47cf772f2867", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcb89c2-ac68-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788969863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969863, "uuid": "d253306c-263e-4148-aacb-5bba1921012d", "comment": "Malware payload", "value": "f1d3a385d5a032b1b0a0954dfbbfe81d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969863, "uuid": "9c501049-d09d-41f7-991a-72cb2666a064", "comment": "Malware payload", "value": "d1d683ccb74e1f261adb4b092d32db145b1287faa4b0b4b4e4a683f8cdc0cd82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969863, "uuid": "8c593195-57e6-4a55-813d-6602b1c5aaa1", "comment": "Malware payload", "value": "c89e5b0efef76a640a99a6f1ab313e00626d628e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969863, "uuid": "0611526c-a118-4499-ae45-4c48fe0048a8", "comment": "Malware payload", "value": "2c360b62e5d7efdef81c145959aa32eabb59d730c00762745496ea44821b883fdfa2a6d2498a80af89aed692770b323d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969863, "uuid": "6f178755-d825-45ad-bbca-f7c4cd664725", "value": "T177256C2AB2B2F1BCD007C0345BDBCAA25531F47525312D7B36C4DA353EA6CE12369B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969863, "uuid": "7b65952e-8945-47f4-969c-43e8cfece868", "value": "12288:qOvgVj2cuyxrKpF3+OXodyHGFpNgY5sePE3UyFlc3EX4Fd9r+ayVVACgHX:qf/xmpF3x8NgY+YE3UQa3IGd99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969863, "uuid": "515d3275-7f1d-4bda-aca8-61b0cf3b2d0b", "value": 981168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969863, "uuid": "2bda9852-9176-44dd-918e-8e5c71f309d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969863, "uuid": "96137bef-6f75-4320-a788-78622c9c7957", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c0915b-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "15ae95ee-d108-4f25-830e-5405fc1e50c8", "comment": "Malware payload (Mirai)", "value": "204c73ad4906de89e8aa58d641660e34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "8483358e-ef1c-4473-ac57-a5315cd3543d", "comment": "Malware payload (Mirai)", "value": "d2ef357b3d3c3cae60a09fd8381f2d2b58e868047a1361f62e8a1cb000684ae4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "4a0e6c7b-8ad6-486d-8e04-789418bc7477", "comment": "Malware payload (Mirai)", "value": "764f47c54fc92f3f698078338d290212be1d7586", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963947, "uuid": "6961f4c5-67a1-4983-92d6-d4b4b66f3b53", "comment": "Malware payload (Mirai)", "value": "9e19f6e99f1f29398b980bb668b3cb2ad83bb32ec423717a318c16fd81a2ecf27e6d56bebbfd82671a0c792df67faba3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "32289d32-820c-4503-b870-831ade83b004", "value": "T118261850FACB84F6E9031A3044AFA27F67315D058B25DBC7EA507F2EE9376D61936208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "df183d5d-3ed5-48b1-8be4-cc8b2e1466c4", "value": "49152:rnVxX4AGLQxe/xar+H3xvoDRmNCF/cti2EaMjr9nMGcnGRMY:zVCl0r+H3xvMmZMl0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963947, "uuid": "f06f4404-ed05-475c-b8f3-89c5e506ff43", "value": 4792320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963947, "uuid": "2d1a5922-60e6-42c8-8847-a8cf1e9fc4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963947, "uuid": "c2f707e7-39cd-4eba-bd47-2d9fcad742f9", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d695e988-ac7b-11f1-ab4f-4201ac107002", "comment": "Malware payload (RustyStealer)", "timestamp": 1788978330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788978330, "uuid": "91f2a58a-da7d-45b8-948e-3a1e15d0a61c", "comment": "Malware payload (RustyStealer)", "value": "ea7aeeebfda6f39a868a6ba491695737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788978330, "uuid": "2a39811a-d761-4047-a490-7794c3d5448d", "comment": "Malware payload (RustyStealer)", "value": "d49785f0195374536fa826a9f2228da105b80fa7bff5d8bee24c7260c665a09e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788978330, "uuid": "39fb060e-e405-400f-84ee-423c4f4496d1", "comment": "Malware payload (RustyStealer)", "value": "01adc9b0769c2bcd81bac32d23ff9776c1a3eab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788978330, "uuid": "6f02b23b-3da7-4f43-9d6f-a507ece3d1fe", "comment": "Malware payload (RustyStealer)", "value": "31ab9e0fbcc833f086ad70bfc00e45419e991b2486054183ddbe25754a9fbfc0d626ae34b37beed2ff3e14d7fcdf478c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788978330, "uuid": "b1855907-a11c-4477-9edc-7c71d15296b8", "value": "T193663B11BA6B94BCD557C8B483068A239E2130DF1B26BAFF418486393F69BF11B3D754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788978330, "uuid": "5b031a00-c5dd-4e02-8dc7-7f0fbb4e5f5a", "value": "091957ba6d998b6cb4666637b9c53b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788978330, "uuid": "96f42fe3-45a0-4ee5-a74f-9f96c5facbde", "value": "98304:/HL3d0WMOPQ2p+COJx5C/YDX6XC7nKj54:7vBOoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788978330, "uuid": "c8c4bf5d-0233-4405-a152-842f01baf37a", "value": 6739456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788978330, "uuid": "b0fe64c0-209a-4360-9a56-680cf1b4a2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788978330, "uuid": "28db1c42-95f8-48ab-a567-87377218efc9", "value": "SecuriteInfo.com.Variant.Doina.128020.34997494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320b6770-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "612ea2d9-8ec7-4bff-bcde-91de1a517dfe", "comment": "Malware payload (Mirai)", "value": "8ed00f2ca31cbc1721bc23faff884f44", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "79387338-677f-4819-802e-ee697d9a240a", "comment": "Malware payload (Mirai)", "value": "d4faff6df0fd3ada35ec3287ce7897f5f552566a906336d035a0c954f25eb592", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "62b60bf9-f762-46c4-9278-5086d59c4d48", "comment": "Malware payload (Mirai)", "value": "546cb8c2fbbe4605394b9483ad01d59a4770a917", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "4834c8e0-630d-45c6-969f-a68049bcb2ee", "comment": "Malware payload (Mirai)", "value": "a16707ff7e7d1dd50986c776f86fffdf3cced0d3fc10e29d84af7a165fb61bd031b9b4420333c30f443f2c390f1e7d17", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "6f98a68e-818e-4199-88e9-475b571df5ea", "value": "T1905302D6A253CA33FD32B9F489AEC7D47B00335873B54EA1D581C919792543C92E07EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "2eae1c4f-bf5b-42ca-bf3a-156b218fac4b", "value": "1536:Auj72gSCVK5VmSnr7WEebiuxJKTjEG4u+qgw0rl:ARgs35xeb5xFG4u+qgwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963451, "uuid": "2b432fd9-4252-4f29-a7ee-b7da317e56a3", "value": 62556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963451, "uuid": "c8dae55f-3f41-47bf-bda7-07654b52d47a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "8a096ac9-55f7-4c8e-87d7-c9fbc51e40c0", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d52d5e-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788977435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977435, "uuid": "37178a47-5910-4a34-89b1-fbb36d2a04a1", "comment": "Malware payload (AsyncRAT)", "value": "2c91a83ec61129fb763a818a5d88d13f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977435, "uuid": "db134afe-9015-4f78-b575-3a1d7a5bab07", "comment": "Malware payload (AsyncRAT)", "value": "d5e2f1423707af91513ee47f20745a210f70adb5e43c306cbb911b1c266de627", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977435, "uuid": "9f4e9ed0-fdff-4a7a-bca6-cdd6a17f08b1", "comment": "Malware payload (AsyncRAT)", "value": "339b714b2757d56f58e76f1544495c8999d9914c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977435, "uuid": "b57bacbf-195d-4ff0-afcb-e435dc4c5a30", "comment": "Malware payload (AsyncRAT)", "value": "3f16b0df58c93da6863d48804bccf0cca3ad3a685ae1d5a1fac8d90b07b413f2a1fe653e5d897384a262e1111fe6d384", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977435, "uuid": "3089abd3-2469-4572-a037-426164063293", "value": "T18F24C0A11BE55163D5620C288CBEFE7910B01A734ECDA698472CF771EE34B478AB5F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977435, "uuid": "3f813cdf-4057-45ca-956f-177f9da00f7e", "value": "6144:J78BSVVZIVKqsUy/lfNPAgG2cGs5E/Sd4NmK:B8BSV6sUy/XPAg9cGh/Pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977435, "uuid": "dcf4d269-464f-40f7-9e01-a29393a0f903", "value": 222702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977435, "uuid": "578a40ac-6791-400c-a71a-6d4fa0b3362e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977435, "uuid": "c0aebc9f-e8a5-40b3-9211-4ab82c748e61", "value": "Recibo de pago 09092026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1e919c-ac77-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788976487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976487, "uuid": "59bccd25-8799-4f59-a4d9-31c1a8f8e095", "comment": "Malware payload (RemcosRAT)", "value": "e3c45c192fa09dc9cab757d305c9d71b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976487, "uuid": "eedeedfe-3f52-403b-98f8-0efd19ec2f95", "comment": "Malware payload (RemcosRAT)", "value": "d64af63b3c818348366ac1148f44ae6125eeb02291c2a236eb839f8b4ba997c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976487, "uuid": "73842520-1d63-4128-9453-b8a0452a6740", "comment": "Malware payload (RemcosRAT)", "value": "dd04643b6cdf1bfc16035515dddd377389876264", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976487, "uuid": "0740320b-1808-41f6-a0f7-ce1b31bc1907", "comment": "Malware payload (RemcosRAT)", "value": "05e75362dd4243a3ca7867b03235b064999c427f10d779b5273f16148c7379aacf1b95076617628174d3e98fa818fe38", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976487, "uuid": "e681cd04-4137-4d6c-ba1e-c76bd45d17ec", "value": "T1071522222BA4AFF5433C252528BFDAAF12F8439104FCE59D5EA5BCD8105CB86607F91D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976487, "uuid": "12850019-b260-4d0c-a21d-315370b163f5", "value": "24576:5XWvEVAFETDRxKc1dxXcWgjxAOWC83kNQJ+RWuQCvsf+cz:5mEVsKPHLc/BC3buLvs2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976487, "uuid": "152b9d37-741d-4cb6-837d-4d6b4b0ccee2", "value": 915084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976487, "uuid": "ecc28148-f11f-4054-9487-c8b8f09c811e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976487, "uuid": "9caefb93-d82d-4f4f-a570-ebde4259907c", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d866f8b0-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977474, "uuid": "fab4144e-0344-4e7e-868a-ef363ff779e4", "comment": "Malware payload (RemcosRAT)", "value": "b49d2ae7225ed676a1c92aec3e684822", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977474, "uuid": "79cdba9f-582d-44c1-af6e-4c9976635172", "comment": "Malware payload (RemcosRAT)", "value": "d64c8bc998a539b751a511c73e61ac773e0a48bc6a85735d0e511ecff2d19756", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977474, "uuid": "1d5846a0-5b31-46bc-94cd-e45630bf8190", "comment": "Malware payload (RemcosRAT)", "value": "d634dbf456c717a7a6871d5de943bd3de6e5e092", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977474, "uuid": "05310f23-122d-401f-8794-4545deb139a3", "comment": "Malware payload (RemcosRAT)", "value": "b0371b35c887fc0dff9201cf3103cdb000522d3950bc270a851e83292d8cd30fc4a36efb05a8ab1c1ec145d7d2251786", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977474, "uuid": "e9927060-af37-4167-a6f9-27fb61962842", "value": "T105933F71050CD3979C8434546A8ECE74E678FE2E7FF41942572ABEA19C3E193FAE4281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977474, "uuid": "c45d0ace-ff51-416d-8305-b8f02c1ea9d2", "value": "768:KZegHo9xQzbwxVSYLaUXYztbzdIqZOnUUxoLyM:KZlixQzbeloBTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977474, "uuid": "c4bfd363-ac5b-4615-b844-de61232b6c1f", "value": 88998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977474, "uuid": "cc036ff3-bf54-4523-8916-8abe467b45e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977474, "uuid": "0b999d93-5764-4bc8-9502-03821e7d0e55", "value": "payment-897887.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c7c2e4-ac41-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788953425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953425, "uuid": "e1d58221-2a13-4fd8-9515-61b68f830f43", "comment": "Malware payload (Mirai)", "value": "d51000568f9c69055641ffbf59ab8c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953425, "uuid": "531d44c0-a963-4e21-9ba7-97ba8819eeae", "comment": "Malware payload (Mirai)", "value": "d6dbc73627d0b1a9beec2e114c85ef4fd2788262dbe6796f4b803b6daccd3231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953425, "uuid": "d1eeda8a-d37c-4bb0-aa85-f8edbbed2d33", "comment": "Malware payload (Mirai)", "value": "772ebc6d99412adb0b9c733541ee062d437fac80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788953425, "uuid": "534ac018-e179-4582-9db6-e45429b51c47", "comment": "Malware payload (Mirai)", "value": "895c0c424758d56fe8bf713d6269cd39709cf37b3f0f486b4b53ffc9146496a65eff95433ad0dc628e2bf479df9137b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953425, "uuid": "14cb0c79-f46a-4418-a598-5c1371047158", "value": "T180043B02B31C0947D1632EF4363B27E0D3EF9AA220B8F645750F9A8D91B2D365586DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953425, "uuid": "c8e8f17d-c160-447a-a2a6-4bb63a996207", "value": "3072:/9h6FYyMeLmZyomyVzxvxWnLwoVm9W6RdMRG3d+:WrHKZysVzxvwLwoVKWKd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788953425, "uuid": "b01a5425-cac4-458f-b4ef-147779de9148", "value": 178896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788953425, "uuid": "760570dc-09db-43d0-9abc-b034034752c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788953425, "uuid": "51ddd77b-0e5c-4697-aae0-dfb4afb93765", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c327d5-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788977181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977181, "uuid": "86e66861-c19e-461b-ae30-fe5f3cee8898", "comment": "Malware payload (PhantomStealer)", "value": "b9235cd506ca71c00b2cf1d03b0ef713", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977181, "uuid": "52b58980-a372-4a0f-a5fe-ab7d1abac37d", "comment": "Malware payload (PhantomStealer)", "value": "d6e4ea76ee3057452937e7af5dc15a8fae0edcd6af0c032a6cb3cad3b0a03301", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977181, "uuid": "ff17c6b4-fe91-4f6e-b317-14b0ede4585d", "comment": "Malware payload (PhantomStealer)", "value": "7a72fccdd3ed82257b56821d23e112b0f0f18553", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977181, "uuid": "853aa9f8-4dcd-44f2-8708-19c3ce888a97", "comment": "Malware payload (PhantomStealer)", "value": "158c5e81a3c9747760311b460454d65068b164117a3a5530d6b7048f2b0bba35fea9a2b631b6090079432c931449efad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977181, "uuid": "ca04ae02-e64a-4ec3-bd97-4b60acf51857", "value": "T17BC6F88E5388A6327730574C6277CD38994A612324C5FB95367CE7087B7DE07A39CAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977181, "uuid": "2f438215-3331-4f72-ac3f-9a8ad243576d", "value": "196608:16sgaDGNbxQEJgkIfEWtX/f0ieY87wg9Y:9D0xvJgkIEWv8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977181, "uuid": "2eaf0962-fd6b-4cd8-ba84-1055619562cd", "value": 11956849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977181, "uuid": "85b79e29-06c8-4b49-8ba2-32f542650988", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977181, "uuid": "81ae2255-5ddb-4e33-b6ae-93a9ef9dc241", "value": "Payment Details.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7b9d6c-ac50-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788959823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959823, "uuid": "b7e9bfa6-aa68-4797-a43a-c38013ad0f11", "comment": "Malware payload (Vidar)", "value": "2542a2f44ae1613766b3573cff8a6148", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959823, "uuid": "bd89d2e3-5bee-4511-bfc0-1ee3d721a765", "comment": "Malware payload (Vidar)", "value": "d72337cbff9268e71bb0ad438b29372e7696c95bc856532510bde3e15ccaf0be", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959823, "uuid": "ae69408d-4277-4af3-afcf-cecd80fbc859", "comment": "Malware payload (Vidar)", "value": "acc93c19b1b6a349b97befb4d2dc9a57dc06ccc6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788959823, "uuid": "2167b271-467d-47b8-9e6d-db32c4d77ed0", "comment": "Malware payload (Vidar)", "value": "3f09331c42c2a844d1ec91743978c45a70bfc6a59569cdb3847f94e84d43c0df3d334d29fd89d5366f6ac9b5a478eec8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959823, "uuid": "b9dd9fb5-4d9d-49a2-b2ec-8e9589f568bf", "value": "T113345A31E7C29132C9992234697FB7ECAF70EF112B018ADBD780B91C7D366C16A71526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959823, "uuid": "38ded7fb-c5ba-4f98-b399-8d64a184a4e5", "value": "8329c46c809815bc572f208fdd794284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959823, "uuid": "e9750e97-869c-4b37-9c7b-86b64249d9b1", "value": "6144:A/rLVPW0nsP2Xy+TJfyzW7OWMksY55jkZR:A/rLVPW0WcJfyzw5j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788959823, "uuid": "6fcd8b14-8fb3-497d-a5f6-62dac6d0c4a4", "value": 236976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788959823, "uuid": "05c51374-8f91-40c8-995d-14b2845e12c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788959823, "uuid": "2af4e9fa-e6f3-466b-93a2-798e38fe7977", "value": "d72337cbff9268e71bb0ad438b29372e7696c95bc856532510bde3e15ccaf0be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a08d7e-ac35-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788948076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948076, "uuid": "491f993f-7ff2-485b-abe4-eb0452d9e1a8", "comment": "Malware payload (Gafgyt)", "value": "a2e9642da449b4d59dd86bd38366ff1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948076, "uuid": "3bfd819a-e1a2-432e-8a08-1d1b8c90a091", "comment": "Malware payload (Gafgyt)", "value": "d810f1253ee4bee05ca96a70a9c293f2839fb00b2aa238861f7b89e3a66bd357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948076, "uuid": "647226df-c87d-44cd-bbe1-a79da1ba9f30", "comment": "Malware payload (Gafgyt)", "value": "14672ad0467fd6f472b742190ff00d09d61b3ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788948076, "uuid": "dba2bba1-b1e3-4e87-b07a-9482dd8792d3", "comment": "Malware payload (Gafgyt)", "value": "3cfed6a827f6ec710d1964faacf8f2a48354f19b31529eacf18d77e156ba547f3d3381b1a3d08ba74a179ce2e3b01bfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948076, "uuid": "9f2f42f9-6b75-4081-82ba-42f47b562ee0", "value": "T140935949FAA3D1F1F1934532006BE76A8B34ED358111CA4BFB1A3E35EDB6601865B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948076, "uuid": "a1dc74ee-8898-4f4c-812f-c2603759ad50", "value": "1536:9hDyoBfckTGXS2RLTuaIsWq5gRcfZQYgUHddOpQToiR3RBor9:9hWolcuGC2RLqaIvqSCOxSXTDR3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788948076, "uuid": "6758524c-efba-42d8-a57e-b64188cc1f06", "value": 95456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788948076, "uuid": "4bf5bffa-4152-42fd-ac7d-138b1e6c78a5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788948076, "uuid": "477df278-6da9-4621-818e-b7be814a627e", "value": "d810f1253ee4bee05ca96a70a9c293f2839fb00b2aa238861f7b89e3a66bd357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e53a49c-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977162, "uuid": "9b994d72-4a21-427b-bfe8-4a2e3c1473a8", "comment": "Malware payload (Formbook)", "value": "9af3219524f4b6336c49a48549b77141", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977162, "uuid": "64d1b63a-0540-409f-8c83-54fcd93c6e9e", "comment": "Malware payload (Formbook)", "value": "d8d241938d1f211f4678fc9929cbea0b3316fc3f0b2119f53ea8a92a23bccc35", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977162, "uuid": "88f16716-8e73-474e-af96-8bb1af68bb50", "comment": "Malware payload (Formbook)", "value": "a0c3129c26f3ff4d743fbad4c45df273c5763be2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977162, "uuid": "aff33074-6c12-4bcf-916e-1259f976828c", "comment": "Malware payload (Formbook)", "value": "6ff29262dde86d812feef16c6474104f24d407a04ae340f75c1af3fb9a74b95affad0ff3bfc6bdf45796c1f80213e62d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977162, "uuid": "b8194491-c1d6-47bd-81a8-b0882c243838", "value": "T196E3214555C7398053376B7FB22AE8D5F76A076701804943B5BC3860AFF1E09EAE0DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977162, "uuid": "31465700-ed48-4f30-9a91-093238b19e4f", "value": "1536:LdX0lsg33Hphvz0pejnP9sqGMXVDLUI75QKXpfrI3t1whrlmgrntj4CAclzL74NG:mnjPlD87FynbWm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977162, "uuid": "2f32a127-1aee-4d62-ac80-e7f261e2f229", "value": 149829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977162, "uuid": "aa0e989f-7a62-41e4-83bb-91c631748399", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977162, "uuid": "54b0d6c0-96e4-4cf7-81e7-9978a9c0225a", "value": "file001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12802856-ac4a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788956956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956956, "uuid": "27cf28f0-6680-4a87-a078-adbb3848573d", "comment": "Malware payload", "value": "38379f9b9df7b36dff80ead955aeed18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956956, "uuid": "d31db905-fd91-4302-9590-dbde6c054199", "comment": "Malware payload", "value": "d8e666ed835e5b80a6a8b3dd2355f4a2ac4bf07d8d348fbbad444f19a5071219", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956956, "uuid": "c13703bb-5296-4163-aa5d-750d00bc8f84", "comment": "Malware payload", "value": "3fb1cddbbd7378d2e404706dbae5e9da74aab31a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788956956, "uuid": "d9d221bb-5b1b-45b9-92c6-49bcd9fe752b", "comment": "Malware payload", "value": "c923086220100171673ad9b9a8b4d700826ab196aef2274e75e56246105a268953a5a3db7b4fc6ef758dd9872cd261b6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956956, "uuid": "1dac7d34-b602-4d2a-baf5-f7c5669c0d38", "value": "T1C7D4B75AEA48126B4BCACDE68640F58F8CF4333F5926F5D44CD2086FC7A1AA58251DF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956956, "uuid": "ef077af2-b64e-4af2-a75e-60bb380e5482", "value": "1536:ePnPYPnP9PnPMZfPQAJPnPTPnPb+PnPHzaa:2PgPdPKfPQARPzPbWPHGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788956956, "uuid": "2b4ede77-d5b4-4dbc-8221-669c1ff2435d", "value": 647839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788956956, "uuid": "7110100f-749e-42bd-be31-95c3104c1fb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788956956, "uuid": "f69bbda8-6e09-42fa-9e9b-b03a120bf397", "value": "61830120260909_115802_89ddf00cc5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a9638b-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938382, "uuid": "79fe6c30-9d74-4bbc-b1a0-1250fcc33ba0", "comment": "Malware payload (Mirai)", "value": "79f68cca497a1a2809bb4a0febbdc8f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938382, "uuid": "c436e949-3949-4ffc-b1ec-fe1b0496e838", "comment": "Malware payload (Mirai)", "value": "da75a850cc621e0a93db9b156ceae0afa2a3f6581b6f8082682df254cac0ef01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938382, "uuid": "847747c7-46b7-4909-843d-651a59b72ace", "comment": "Malware payload (Mirai)", "value": "bdbd7f578195cd25ff7bfa28a94c5954b3cd498e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938382, "uuid": "f55f953f-de6f-4ffc-b6d6-f426713501b8", "comment": "Malware payload (Mirai)", "value": "203fa0ee01b22ee88ec43caeca1800a0c727433897a6bb44efbbad6245e6a25aee0fd86703e4b1522f7618063a62a99e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938382, "uuid": "de14e8e9-6303-4c16-bd24-c5ddbdde0849", "value": "T115E39FB3F30B1051C42306F417CBAB9C2E3315425F6B86E3BCAA313A2A765DE5911BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938382, "uuid": "ea7c769a-8bf8-4ae6-8523-e9fbe8884c24", "value": "3072:JbUCLX2tCmjRuuKX+3kWctWHaFL5EQg5CrdtRTPub01ioq:xpajnKM36FL5EjCrdtwoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938382, "uuid": "08e19f9f-1e23-4572-8145-66e88d980e64", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938382, "uuid": "7efd3279-edbe-4cb0-97aa-6dc30dd163bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938382, "uuid": "4a0a4824-3e2e-42ee-9ff6-4eecd7d0403b", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc18c9c8-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938396, "uuid": "f91e2c1b-c818-4708-8adc-afa8580203c1", "comment": "Malware payload (Mirai)", "value": "f5de10b25b35f301402efec47a34d7fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938396, "uuid": "f83530a2-3771-4f49-bed5-3570fd015541", "comment": "Malware payload (Mirai)", "value": "db8339ec6c48fc10bce1f6422f348e51a5d1159c4a9eacc38ba75bb411e38426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938396, "uuid": "cf4dc589-776e-4248-a3ee-eda3f3a583b4", "comment": "Malware payload (Mirai)", "value": "926198d097b7f0cb11b631a974b01bfae0020315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938396, "uuid": "a4b8e138-4065-4c78-b388-17cdd65985b1", "comment": "Malware payload (Mirai)", "value": "909a25adb45712ea88250bacd351a677d291e34600883fe4a47960c8d5a5d5a254cfd7989d928c19ca3433c2126cb06a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938396, "uuid": "db8e06f6-4720-442e-abe1-2962ddd1ca23", "value": "T1C5931946B9418B13C1C21BB7BBDF86643B21A668D7D73302E9197FB42F4369D1F2A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938396, "uuid": "99a112a0-2acb-459c-b86c-e2443db0839d", "value": "1536:dhJjY7R5Er9PhzCMyNeqP+3U4KtXUsn8fk5AOOy5PuNFNUM+lf6hWTOsFrkIHbY7:bJjaXErruPP+EVtksn8fu5uvNTmOE/U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938396, "uuid": "0244edb5-3b92-4992-b26b-4f22e188535a", "value": 94885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938396, "uuid": "9a3d36e8-3bb2-4a26-a60b-0df395989641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938396, "uuid": "c2eefc07-96bb-4b37-99ab-9cca2cce28b3", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95ce100-abfa-11f1-ab4f-4201ac107002", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788922849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922849, "uuid": "e73a922e-eeec-4895-b548-1ac9103f8636", "comment": "Malware payload (ValleyRAT)", "value": "774616bf1d36bcc134257e31cd5f9ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922849, "uuid": "22603a58-723b-4d0a-99a7-a294f65cf4fe", "comment": "Malware payload (ValleyRAT)", "value": "db9ce8f0eed015147b99abe421137da2be91f6496edf937b934c2b4123f0fd4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922849, "uuid": "87e669f4-0127-4ef6-93eb-4efe4823274c", "comment": "Malware payload (ValleyRAT)", "value": "40ec018d94e13480dc84499452932bee76b16c74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788922849, "uuid": "b4cb79b8-4d58-42ed-9039-c188dfad2606", "comment": "Malware payload (ValleyRAT)", "value": "dacddb41947c266c338aee11e84b43e1c03718ce6f0e1f99f70f95f7a32ee833618ff1455e73d1e658fb89ce24abc261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922849, "uuid": "dc0833da-c05f-4ec0-a119-48ee0a048901", "value": "T1A3777012B7018DDFF066A234689B8F61E332D8B106B1937723B1675D1FEE38C4EA6564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922849, "uuid": "ef9f2cf8-df1c-4360-bdb7-dfab4c57c04f", "value": "ce08ab0a87007f1423c570fdfcd13219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922849, "uuid": "8fa7138c-7a0b-4a11-ae87-91bab7a0f9d5", "value": "98304:v+dP6pfrf0qBvdAmx6bc4a+4Z7eSv5GdCdAmQf:vY6VsqIuH6S0dCdAmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788922849, "uuid": "ea08e4f2-46cd-4ff2-8508-7972abb1cb4f", "value": 35473200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788922849, "uuid": "db8e16b0-4cc9-4422-a355-ab73627bcf6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788922849, "uuid": "39813fc7-812a-44a7-a061-12dbe0cdba7d", "value": "instell_s2.0.07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a4b295-ac61-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788967074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967074, "uuid": "32172c64-5a7d-40c9-b047-f00e13a719c3", "comment": "Malware payload (Mirai)", "value": "671fc39f23edab894e79cb70a4408558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967074, "uuid": "96484795-be65-4be1-ad6f-44944471ff9a", "comment": "Malware payload (Mirai)", "value": "dbd1c263651e6ffc4d5cc03af734d7c76afe9feee388848439e48405c835dd9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967074, "uuid": "b0a5b909-60a7-43bc-866a-e09b663bec5c", "comment": "Malware payload (Mirai)", "value": "251cafbfd4ee2c97baf9bf9920051a216825284c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788967074, "uuid": "693f31f6-d684-4beb-8978-e30f22de08df", "comment": "Malware payload (Mirai)", "value": "7d60dc9865da8a3fe681939db165eaa053a4952c1cd5a8abe7912cac0c63ecea4003e37ee02fbe18e78c4b5ef08e390c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967074, "uuid": "6ab623cb-28f3-42b0-bcb1-0b3eb3234ab3", "value": "T14FB3121E0D1529A9CB246D3E713E27E44EFC81D016CEBE8A87821F84D7539BB1965FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967074, "uuid": "6cde8089-a841-4d3a-b321-ec3e697470a3", "value": "3072:6SnuKILrU/MuKzIntsWLk0DvCxhkBKFRQ6XG0olI:6O6rUPRLnDvwFCndlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788967074, "uuid": "311da978-b79d-46eb-a961-a8114ad5a221", "value": 108452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788967074, "uuid": "996d78ca-94fc-4b10-918a-b31670695f7d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788967074, "uuid": "82039c95-c883-46c9-bc2e-0cd0f8b744ef", "value": "wj0s.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd965191-ac71-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788974101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974101, "uuid": "eb5374b5-1b0b-4c42-850c-2825185b8bdc", "comment": "Malware payload (Mirai)", "value": "d1219420ad1c8867c6f7b548bd4b0f1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974101, "uuid": "d20a1cfe-ae01-45e6-a5b7-7e99808c169e", "comment": "Malware payload (Mirai)", "value": "dbf5373811d5d3efdadfee71741e311c06c7677cf4953deb0bf98e20af604bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974101, "uuid": "ec4f9999-11a0-4c65-b3e0-2fa7e3dfd765", "comment": "Malware payload (Mirai)", "value": "e8c340a620c7509e79c58c2166b80c140352472c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974101, "uuid": "528b10f9-942f-4309-8526-9ce5e306888d", "comment": "Malware payload (Mirai)", "value": "38b30d139881afee00061c325e6c1118a546fb909f120c10b640859457ac031e8b6f66cc06a75272712f9292b9f7c49b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974101, "uuid": "09956ee0-f9a7-4d7d-983d-810d0a6ef2de", "value": "T1AF72AF57C7E64504C13E90722C6E3E153DB4E21EF14CAAAB7AE870365122F5A3D3C69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974101, "uuid": "f204bb6b-b78d-483d-ae37-39a1b80bf001", "value": "384:MMCu4BjdrDUZRY9A+/xV1c76N3Cau1q6pANaNJawcudoD7UqkX0qWT+IV0M:Cu4BOp+S2N3C1Y6VnbcuyD7UB8F0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974101, "uuid": "21a7346d-8aba-427c-9178-6f451697bb94", "value": 16008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974101, "uuid": "7939b5b1-2aab-4c1b-8280-a0d89f761dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974101, "uuid": "1c3802e5-c072-48ac-b8a2-45c6eec5a418", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d4b925-abfd-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788923999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923999, "uuid": "2be89fc4-384f-459d-af85-e3bea58c5eb0", "comment": "Malware payload (Mirai)", "value": "0566d137b0d610df1e5e8db6741d4358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923999, "uuid": "ffa87479-d3ec-42cf-88a6-e3cb6b75357a", "comment": "Malware payload (Mirai)", "value": "dbf8a577d037022a5c8834874be21590b399b0dc5e5103241b3d34d723d05186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923999, "uuid": "e4d43395-c97a-413e-8b18-beadb18f4c1b", "comment": "Malware payload (Mirai)", "value": "1479faf30c193950f4666f25e0f64c75b8dccc5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788923999, "uuid": "04c7ab07-cf20-4ec6-aa24-bc06b49e457c", "comment": "Malware payload (Mirai)", "value": "2351f5847ab99df1b3cdd97157a022bf2383b8380e20a1066640df415dffa3cd55bcac1dd6c9e9fe4cc6e031c25d9781", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923999, "uuid": "f1ff49dc-778f-4d22-9db8-aa2440b9abca", "value": "T1E3B33B41FD408767C2D227B6F78E479D3B365A6497DB331169397EB42BC1B882E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923999, "uuid": "5adf4627-9f44-4ba0-b52b-55002ba7a7e0", "value": "3072:Xqd1uE0YlkRt5RiUlaYS6KP5Vyuzw5dm7ZTQOh21JXwQA:RiUlGFRVyu4m7ZTQOhMJXwQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788923999, "uuid": "98f4cc47-8f41-4f47-90aa-63881e83e68b", "value": 110845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788923999, "uuid": "57fbeb84-825a-4832-bcd1-b49b314aa1c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788923999, "uuid": "b1a77c0b-b703-4404-9d1a-f1b7df765014", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8852c95c-ac4d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788958442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958442, "uuid": "2e70969a-b073-4cf7-bf0d-698cd870a0e2", "comment": "Malware payload (Mirai)", "value": "854fed4aa4750463d50019cfdab03da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958442, "uuid": "41cb0003-ee1d-4385-a749-9b84bcf5e16b", "comment": "Malware payload (Mirai)", "value": "dd803a0e98492bd0de2d68e2627838633661db22ac305082070de0fea2e37439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958442, "uuid": "dc92c370-d13c-4208-be47-aadff4d8ec74", "comment": "Malware payload (Mirai)", "value": "a9b115dfcf7db7d0076ab2b625269ade1c2b36e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958442, "uuid": "3870a551-ed9c-45ae-93f1-bb07114747dc", "comment": "Malware payload (Mirai)", "value": "2751e9ad2708f8246f8c60be8451a9d1cbde1c69380fe880c23d153c43c87a16aadd36d8409fcd47d5c58edebf3e3c3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958442, "uuid": "b568c5ab-1d83-4f2c-a3dc-0a6ebaeba23b", "value": "T149642913F304449AE1104DF0213B3760DA8F41776CBBF09BF91A5A59AA699BE01BBFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958442, "uuid": "104b5b75-7714-42f9-a29a-719d2c52737d", "value": "6144:YWPBqlNMtWmXUZQv10T9pHqojd5I/5SCccHOJtbxVwEH9m2EGHLj5wke:YjN/AaUuZ4die", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958442, "uuid": "69595996-79cd-4d44-93d8-dd131dfa6421", "value": 329128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958442, "uuid": "7150b275-e003-456b-9751-11e9d03b12fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958442, "uuid": "16336daf-9ed8-4741-b8a7-7e02d4f0139d", "value": "dd803a0e98492bd0de2d68e2627838633661db22ac305082070de0fea2e37439.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a6f0fc-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "c6943523-ce3f-4199-aede-330b0f0cf302", "comment": "Malware payload (Mirai)", "value": "43204532faadc7a8bb9f2773942ea019", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "a317ee2b-f139-4a60-9dc1-110eefd47b59", "comment": "Malware payload (Mirai)", "value": "de1a06be6a36e42e37721543f516eaf42d34acdce60d95f71dc5d87eeb687f40", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "61efd0c8-0392-489c-a1a8-7aa9732cc0ae", "comment": "Malware payload (Mirai)", "value": "da28da3532cc3e629cd1972735152f206a811748", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "4fff21f5-2b94-4209-a0aa-115a2151e87f", "comment": "Malware payload (Mirai)", "value": "e5c19b84e2848116974d8b08b4f517ce7dba3db2552340c50894a513aa0e475856883306f29f2524ae7844c842254053", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "50f0a48f-81d7-4eae-9796-9233bedcaa4b", "value": "T11B63025EC74602C6D60DBE7842E01AE352F0A1D19FB7AF7D971C2A809D569733C4B836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "e6f11211-02a6-4a78-b2e1-100b7b1d6ea0", "value": "1536:GNHKYQqRi48S5UeZebnYWgB/ItWL6cTdPpy7TNtQO:GsYQS3Jue+eBx6cJxqyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963451, "uuid": "9af39098-7488-4d7b-837f-d5c94fd3669f", "value": 71096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963451, "uuid": "acce3998-fb92-450c-bacb-ea38bbf747d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "d00765e1-d6ad-4464-a318-6ff945a53b5a", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67754ca6-ac4e-11f1-ab4f-4201ac107002", "comment": "Malware payload (CoinMiner)", "timestamp": 1788958816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958816, "uuid": "fca0cfa4-bb3e-4b87-893a-c46fd7d46f23", "comment": "Malware payload (CoinMiner)", "value": "2951d7fe65f0f20c6e22ef04a62f91ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958816, "uuid": "161728ee-4ec4-49c7-972b-0101a334e0d8", "comment": "Malware payload (CoinMiner)", "value": "deca3cb7361c87f0199a3dc7314e7029cf9965df4cbfb5db52e56709b0504c41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958816, "uuid": "5002360f-19b5-4116-912f-1ac67d5d0c66", "comment": "Malware payload (CoinMiner)", "value": "99785ef32c4c9ef9ff91597ca6727c188b83dd09", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958816, "uuid": "8500a7dc-45aa-4ed9-96e0-f99fab10991b", "comment": "Malware payload (CoinMiner)", "value": "6332dd5d2cbdd59e93a8ae2df01db411ba056d0aa64c5a11d794331c5db618afac474594011e406126f342a37b551381", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958816, "uuid": "8e88a6c0-7e10-4994-aa86-3beb54614a58", "value": "T19DD533152DD9DB2B6FF0E037A17C7420EDE127BA927E84A0B7D5DA75A0A94F50C2C0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958816, "uuid": "9b21bb2e-013e-4936-aa9f-abc340ce238f", "value": "49152:yqCeyU99K8VJRNj6ujE+oGGOlAgmfFbJRDANf9wBL+0s3fXMltEYoTN627WPKZOv:yqbBX3Dw+oWl9m3RMNVwjsPGITN6qWPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958816, "uuid": "6970d1d2-1efb-4b14-962b-a1c705c10b0f", "value": 2797568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958816, "uuid": "b9f23caf-0b34-4a44-a26f-81a322061a19", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958816, "uuid": "81573f21-9851-479a-90d6-603a18f66c1f", "value": "deca3cb7361c87f0199a3dc7314e7029cf9965df4cbfb5db52e56709b0504c41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32455f1a-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "7290358a-3dd1-4930-a791-fa5bf868f838", "comment": "Malware payload (Mirai)", "value": "419c47056c5a8126efb1e383dcd8a88f", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "b574a772-9df2-4d4d-8487-c5edd24bc2cd", "comment": "Malware payload (Mirai)", "value": "dfa1801523f99ce72f02b956bde77a468e783e30c96ae6142a6cdb6db6875544", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "b61949ec-7f3d-46a2-b61b-6ea3aa9efdaa", "comment": "Malware payload (Mirai)", "value": "c3a97b26d551ee67a9b0160b216c6b2e26254c70", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963452, "uuid": "1c2653d1-3a66-41dd-832b-6ba6e1071ff9", "comment": "Malware payload (Mirai)", "value": "5db40c87f54dd1c752e7f580825a405ae14b38aa1aca3e615b86297388d3341ca2f9e86a3133fe0ed4fea1f4357cdf09", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "74679c20-13b0-4fc4-b104-456c7c56bf03", "value": "T1922302DAAE8ECF48E6A5503B88436C8F257CC32CC3CA97FF8F5450948146D24656D6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "10eabaac-465f-492e-a48d-72160ec0b892", "value": "768:ISQVGJLAIeHIdArPa1BXT4i8jllVFKvJgLNnkiaffM1WeOzJRFnbcuyD7UDMuGRs:RIIeodADEUi83X/QPRFnouy8DM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963452, "uuid": "5ae704df-97e3-45fb-8c98-f68023c1d15d", "value": 49980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963452, "uuid": "a94534f0-1aa1-497c-af57-46b30fc29d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963452, "uuid": "82668e95-9609-4f10-b5b4-6736c5056867", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b7e273-ac53-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788960929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960929, "uuid": "a8589b10-f960-4bcc-9917-da42ceeb8204", "comment": "Malware payload", "value": "e1a6a48a556b04b7331f6ecb9b5d5d05", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960929, "uuid": "bfb2d858-4267-4881-95c5-79dedf9077c6", "comment": "Malware payload", "value": "e006533c1b522644f08225cd562b072e18fdb85a02b0ef1bf86cffa8cdbe2a42", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960929, "uuid": "af40844e-803a-4d8e-a1f5-3f3043c30e46", "comment": "Malware payload", "value": "6bab889f83c9f324b219f19c7967efad07a511b9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788960929, "uuid": "5f2a613f-46c0-4000-88cc-ac1a736d75ab", "comment": "Malware payload", "value": "d956b69a70aa559a11ec1ec8b7df5db20b9c263b2537674c2f9b8ad4276dd3d33b1d4a4f5508bab928d80431d30be30b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960929, "uuid": "f138287b-56c9-4f56-b3b2-212cc8109ed8", "value": "T109519B210BF10319F3F7AB3AA8F662525A76F910FD529BCE815483491CA1136DCA4F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960929, "uuid": "4708d737-70c3-4a83-9613-e4141b580fd6", "value": "48:8xzoeFrcaoyI9Jbnr3rxXujdJdub9wk8R6BrXdPgqrs:8xzluLfxXuHdX9RIhPgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788960929, "uuid": "b8291709-05c4-4c1d-b931-b27793048ef2", "value": 2891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788960929, "uuid": "961b9f74-deea-4098-a7ff-de994970c679", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788960929, "uuid": "0eb6b94d-17a4-4c86-835e-832f014529af", "value": "e006533c1b522644f08225cd562b072e18fdb85a02b0ef1bf86cffa8cdbe2a42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff042737-abea-11f1-ab4f-4201ac107002", "comment": "Malware payload (VShell)", "timestamp": 1788916121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788916121, "uuid": "5a0aed94-1f40-453e-a290-e7f2277deb5e", "comment": "Malware payload (VShell)", "value": "c2a5db8ee303bb338f754a8e5875b560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788916121, "uuid": "62c0413e-af3c-4db7-a58e-22df6dacc829", "comment": "Malware payload (VShell)", "value": "e12dbf049019f00e5ad30e55e04314a080491617cca6b099d81334ae43458dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788916121, "uuid": "e871b3c6-5ffb-4f81-a4a2-e0370e3f7b28", "comment": "Malware payload (VShell)", "value": "003282b13fec5446f26687a530a0afada47b8cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788916121, "uuid": "0acb0ded-0a37-4254-9447-3f4c8689849e", "comment": "Malware payload (VShell)", "value": "4299e6447a04b407357264abb2b708cb62b4c5ea2e27edc7d3bbc91787f898134de49f65558318f7f7ebcd3288b7bb2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788916121, "uuid": "fcbf69b4-71be-41fe-a185-362c5a3e9620", "value": "T1E871B54160501AF2D94CE3BF8487B895FD4EB288A2C84B0B0798D81A2F7647BB0D9613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788916121, "uuid": "4d497a0f-8621-4144-8a73-8864145db6db", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788916121, "uuid": "7030432c-4f5e-4265-a1ea-b6f802991697", "value": "48:6IZUBQYxZul2EywS6D78jk7QLzgzIzQz4zAzo157D9N9XM/geu3ahr0/x:2BQMZ7EywS6D7G++D9vXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788916121, "uuid": "d2f9bb14-015e-45fb-9c9e-83c3679c8c89", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788916121, "uuid": "5a0fd9d9-be42-43da-95be-e9d989815a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788916121, "uuid": "d758578e-aee5-47e9-b800-2c724bf0e544", "value": "e12dbf049019f00e5ad30e55e04314a080491617cca6b099d81334ae43458dd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce28e525-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977457, "uuid": "3aa0c2e3-d3f2-4559-a400-08f5a0e465b9", "comment": "Malware payload (AgentTesla)", "value": "53b99807c92c8f835297907accdd7d62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977457, "uuid": "23ad35fe-70d5-4b9b-be6a-f1aad19222f1", "comment": "Malware payload (AgentTesla)", "value": "e174a7fd7d054ab5962f7b2a40965ba45125fa6b44b4962e932b09e80a3c7e57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977457, "uuid": "e040f197-8586-4990-b25c-3200a3e12d38", "comment": "Malware payload (AgentTesla)", "value": "1cf63319109f708ca6d8cfa16ef9e11deb9d0848", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977457, "uuid": "a31e589c-c20c-4d07-827d-8e6b43a4bc95", "comment": "Malware payload (AgentTesla)", "value": "2960b87fef681a73228639b46278f8e87953e011be611427b5079eeffd5fd1195bc5b62ec8937fd6897f6560d1aa7ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977457, "uuid": "41e741e7-879c-45c0-b427-c3d2d2b920cb", "value": "T1D4346580B86E98A486770BE1D2C95FC8FD484BFE96DB5951B222C2752778F340C349ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977457, "uuid": "93bd50a4-96fd-4978-a2bf-9530937d474e", "value": "192:bclgYBblPYBSMH7wYBDzH74gYQsjojigJIxCGSsjo7igJpj2tigJlm0pTxQpTfn3:bwmMGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977457, "uuid": "a9eb7efc-a0ff-4769-afa7-f3c683b1449f", "value": 247885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977457, "uuid": "d66e31d4-c147-4d21-aa6d-72f3d33ea22f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977457, "uuid": "3b6bbf8e-4bb0-4934-9575-2f72e9b89957", "value": "po 100980.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f0e530-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963453, "uuid": "4e22afc7-61f3-49e2-b4b7-1ce58d4fb95f", "comment": "Malware payload (Mirai)", "value": "1cfebf6fe71e77eee47ecd5cf4d66bdc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963453, "uuid": "2022996b-8eda-4c97-8edc-86ac3b1aeca2", "comment": "Malware payload (Mirai)", "value": "e1e7f55309754c643a39bdc8419fcec16ffcf6f78b5a3ddae827253b7b54b242", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963453, "uuid": "22c6d6ef-5eeb-4bac-8cae-db84a419b3b8", "comment": "Malware payload (Mirai)", "value": "13e53ad61d501998579a9964f14629395daabc7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963453, "uuid": "864a3b96-b5be-444e-b6e3-35fa69865617", "comment": "Malware payload (Mirai)", "value": "77af32b5d19fc551055d70a79e01e33197e20400cb5706cd7026fa976d42b8bc96397d3dc99c57b8b64ea4b8303c41e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963453, "uuid": "7c4de4bb-e4cc-48f3-afe6-06292c4510d2", "value": "T1BC3309734A7DD607D0C2A63602CB8313B1BE6BD21318894F7C554F5E2AA07D4266BBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963453, "uuid": "4a906f0b-a033-4948-9885-251a35af1606", "value": "768:sW5oUphip/tQBbvjnvktftQsFglrcnaiaN6dAskby1PEPYxEHL:sW5NphipQpsFglrwC321cHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963453, "uuid": "a377934a-9d5b-42ad-835d-b441906c959c", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963453, "uuid": "949a50f6-5608-49e3-a7b8-6fe45459da11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963453, "uuid": "a4f2cf89-2127-45cb-87bb-e7461e18acff", "value": "wife.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1d31f2-ac6a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788970931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970931, "uuid": "4be48a7f-5bf9-429b-821c-ddec93d3eabd", "comment": "Malware payload", "value": "0237864896798999a7f2c89fae965320", "object_relation": "md5", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970931, "uuid": "8d58b9f7-7a4a-4af1-9d53-8a3df9677da8", "comment": "Malware payload", "value": "e26a536a087fa187d2204e615b100efcc258cdc4a587d7304cbfbabe17e659c1", "object_relation": "sha256", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970931, "uuid": "e969eb18-7902-4ce7-9776-173e5f723dcd", "comment": "Malware payload", "value": "6d9650c9c27e2f5678b484854983154eaa42b64c", "object_relation": "sha1", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970931, "uuid": "cb4c5624-61fa-470d-aaf0-6a58b853afa2", "comment": "Malware payload", "value": "261b63413901ac65e6c0594ee879ef4d3395bf690751892ce79325d5f14e234bf52f22b49e64e57ac620ece909d37e99", "object_relation": "sha3-384", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970931, "uuid": "94fd5069-ddc9-4729-8b89-8bbc89b48d14", "value": "T1DBA633696AB710E5DCB2C1389A628106E370BB131B72DBCF176457263E17AE3093F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970931, "uuid": "bb18b66f-06c6-4fb4-9787-dc59b334a037", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970931, "uuid": "a13e8bcd-702b-4e65-ba4b-d809e0e9e8c8", "value": "196608:2m2SVym5txE2hLOJwVqiqpCJVmdziYPSS3ua9zZHsonrUbRjMFi:25AyNGqaN+96guuZHsonwbpii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970931, "uuid": "79aee3ee-6afa-4728-894e-54cb5d14d529", "value": 9646922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970931, "uuid": "8e484d25-a907-4b52-a20e-2272ef031c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970931, "uuid": "7a1e6c9c-ef4e-4108-8974-077eb6913054", "value": "IronChain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a464a5e-abe9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788915522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788915522, "uuid": "d48c0f5d-80cb-4212-8071-c6a5c2504800", "comment": "Malware payload (Mirai)", "value": "c8909d4ca3383f068bcb32bf35b40d2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788915522, "uuid": "1c20e30e-f634-4e88-859d-42a55eaaac10", "comment": "Malware payload (Mirai)", "value": "e3e5faa2660cd86e4608017e59a1808a5d2491b56b1b87757ba539e19c457c22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788915522, "uuid": "00d6a133-6018-42ad-b35a-46d3dc59047f", "comment": "Malware payload (Mirai)", "value": "3fcf95830809235e72c104882e9e882eecc9541a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788915522, "uuid": "7a34b019-cc13-4fa8-9a28-e94936140661", "comment": "Malware payload (Mirai)", "value": "02934f1e4e8c78d5fc6a68a808631ced9ca2a31ee2398f2b8cace56332d6315a056bbdd158b2ef86b76f2eb23482865a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788915522, "uuid": "c1518ceb-2b9e-44cf-8cdc-b9b7ccc9473a", "value": "T18C437C8AE993D1F1E69349710017DB9AAB38DE358004DE4AFB497932ECB17D3965B30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788915522, "uuid": "37e04ad7-7945-479c-a370-b8e9b40d3bc0", "value": "1536:rQtfQ21I9pwHUqKJgsYUryt2W8aO2DZ8n9Jor:rQtfQ2ujwHU9JgsYLt2DaOc2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788915522, "uuid": "aad162cd-7fe6-499f-888f-f77ed1301576", "value": 58052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788915522, "uuid": "b8c00d5e-d8d3-4a8c-a7ed-c379083c56af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788915522, "uuid": "91e66ac1-48d9-4a60-a584-7e6dda625cf1", "value": "e3e5faa2660cd86e4608017e59a1808a5d2491b56b1b87757ba539e19c457c22.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f58e02-ac29-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788943136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943136, "uuid": "eec2fbe2-d887-4dde-acb1-7798b303a2bc", "comment": "Malware payload", "value": "0405063fc6c03dee72026179a22a9810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943136, "uuid": "fd409bab-4820-4b5f-a38d-d2b7c493fe2a", "comment": "Malware payload", "value": "e43ac0a947355bab19c363b08530662f6b502b3cc15f7f771810730c1c6e63a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943136, "uuid": "0c12064d-03f1-48e9-a7b9-6a32bc4b70ba", "comment": "Malware payload", "value": "52e0fa461488cb6e2c6ce1d9f5d895ae35b9d2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943136, "uuid": "26259e48-2e93-4357-80c7-e535c74886c5", "comment": "Malware payload", "value": "618b2e8f9c57ab20df1fc07ed8fbc9a3b25443cd49d3824f49149cecbd3a43b11769d2c5ee56d0ab13097a08e3919221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943136, "uuid": "e8e29a5a-0fb7-4865-b8f2-cd8f8a2c806e", "value": "T128144B0777935CF8C2AB803582D697B2F532F8180325FF6F1698CB736E62D540E5AA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943136, "uuid": "b1e4acdd-a435-4209-a81b-3ee13b1ae3a4", "value": "d387947538c03b89934e723d4a530d42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943136, "uuid": "27085679-2c46-4acc-a920-f567e9f179f2", "value": "3072:pKVzyBvHLwixY4eo9K+6l1+KingVZFv0NvFlMRWBEYJS2H6OUN+K9UZ:G4jmzmQCoIBEYJHLUN+/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943136, "uuid": "eb787d51-45ef-435b-bd9f-d2776e74ee11", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943136, "uuid": "45d4ff3a-4bc2-4e04-a6d3-34ebc3db487a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943136, "uuid": "e663682a-b409-48bc-a3d9-e324d0616b68", "value": "0405063fc6c03dee72026179a22a9810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd14f7-ac6e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788972495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972495, "uuid": "4cdce696-6757-4d34-96ef-68241e2c8900", "comment": "Malware payload (Gafgyt)", "value": "6e8a925c31df00564cb78cbcc98b3a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972495, "uuid": "065ddde3-6faf-4e50-9803-cf578b8028f0", "comment": "Malware payload (Gafgyt)", "value": "e5224d537fdb2ada061b9a0da5ab39818733fdcdebde06916f1609f208384399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972495, "uuid": "554f6cd3-335c-4864-8cd0-6a6b527337cf", "comment": "Malware payload (Gafgyt)", "value": "ab328995b08a28c74f4e1b3b9dcdbe552fcfed86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788972495, "uuid": "fb2bc6da-4a61-4a52-bee8-b92f66b096eb", "comment": "Malware payload (Gafgyt)", "value": "b83079d4a53446f88408a0abac73d4697700b4fef1bf622fb0160e807c1c96394362987232aeed660863990f833e04f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972495, "uuid": "f8b3595c-68fb-4aff-b793-3bffc64a8465", "value": "T108342937B2D08DFAC0824AF026EFD9B28C62F0BE0776311B73A46D709F5D9D91958A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972495, "uuid": "d77fab67-c2ff-453b-aef8-199596ab8996", "value": "6144:smOt6olUlY0phaufHdwBomvxGS/aVhqyQ3f9qXy:RI6oll0ph5NmvxGS/aVhqyQ3f9qXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788972495, "uuid": "3a20fb22-f967-4988-8418-642d7fb6633d", "value": 244065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788972495, "uuid": "ffbed099-e485-4e05-ba1b-f5251e812f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788972495, "uuid": "71a0d212-7c7a-406a-892b-6a6290b3ff1d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaa77f6-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938399, "uuid": "1ee08371-4133-47a1-984e-087b673e4338", "comment": "Malware payload (Mirai)", "value": "d4078c3f9ae4782f3b87a28e7e31736e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938399, "uuid": "0141e787-6104-4ebe-8508-4064b52baa8a", "comment": "Malware payload (Mirai)", "value": "e56b32c7b18f0a5e8a0308e45a1e11eb642d928f5efd554280b7cdf03babdb13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938399, "uuid": "d0b7528f-e962-494c-8c6a-8b5bf34492e1", "comment": "Malware payload (Mirai)", "value": "80c896a8f249d8ef1d8d660e8ea1e507c9d7703b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938399, "uuid": "29f71448-327a-4d71-adcf-09fcc1008012", "comment": "Malware payload (Mirai)", "value": "cedd22b242bf8fb0b083cb96a1f8895ef8361d469393f9df1025e81a8ca789efa6221344161601409aa8ced8ed33b23c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938399, "uuid": "e2d66806-e9f2-47b0-981d-879e9ab86ac2", "value": "T1E7158C1AB2B3F66DC007C0304BDBCAB24631F07569312D7B26C49B343EA6DE5176AB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938399, "uuid": "62fb6ce5-ea58-4fd2-93f9-162e2c759c27", "value": "24576:2oW2YcCVP9ySKVQALzpNgo6docRf1tCJAts:dVQy1Ngo6d7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938399, "uuid": "bfd1b681-f377-4e86-80a0-d832d48bb5a8", "value": 957752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938399, "uuid": "461dc927-b342-4ab4-bec0-48749174ebba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938399, "uuid": "67c0e1e7-eb5c-4179-93f9-7c991ae825bf", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dc9d8f-ac58-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788963297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963297, "uuid": "8f3d48f3-f6fe-4011-b13b-73dcaaf3d8d5", "comment": "Malware payload", "value": "cb3a99e974ef6a20aa2b7c621ed40918", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963297, "uuid": "50522e2a-8234-4479-9957-c7c8c76e19f7", "comment": "Malware payload", "value": "e639dbe6f23bced41eceaba211c46b73037ea23994a3e3d3c9e9c5ceea233c06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963297, "uuid": "2e84d8ca-c92c-4f56-8334-ad9ae388ad5b", "comment": "Malware payload", "value": "37ec3c21b075438ae85e5eb60bdf7c854c785015", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963297, "uuid": "f6bf4917-70df-4a11-ac94-c60be0dafb34", "comment": "Malware payload", "value": "deb930fddfb4596bf1685798563e440c6d0c94206f158b0c62e1fbcee4c32373509ec106f79956d6bcd19c85c34a256c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963297, "uuid": "9eaef8fe-0547-4903-8953-e83a944e4659", "value": "T136619593B45622F72365C5D84CDA35C8311E109B4EE83624BDFEBE0C3B39692B12920A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963297, "uuid": "c179fa7d-79bd-44b3-9ca1-8b7ac9495e4a", "value": "96:wUs+Gz/pR4j6ug4lgU8789wgYQJYRFGxRc91A7XMYRiA7XMYFa:w3R1RGc08YR18YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963297, "uuid": "abe63f14-d838-429e-b28e-bddb6e874cae", "value": 3452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963297, "uuid": "344bda0e-f9a6-43f8-96f8-7d3b3ea70a41", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963297, "uuid": "6d6310c1-0652-4dda-a190-1b2daa78dacd", "value": "e639dbe6f23bced41eceaba211c46b73037ea23994a3e3d3c9e9c5ceea233c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d0ea5a-aca5-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788996395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996395, "uuid": "eda2acab-49d4-425d-a9a3-08f352221cbf", "comment": "Malware payload", "value": "68ead6214cb58b9576f73e0a5ca303f2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996395, "uuid": "40967d57-ae4e-43a2-bcf9-1e8c5d5d17a3", "comment": "Malware payload", "value": "e72f262ab63bbf92298349e3ad1e7d7c23441b80886e886f659a02250beca1a2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996395, "uuid": "7fb7daa0-9e3f-467c-9445-7ede2219d149", "comment": "Malware payload", "value": "d36f1a47d9238234cd7c225c3603388e9be71391", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788996395, "uuid": "16bc6a5a-76f1-4b3a-9da7-f05876663f5e", "comment": "Malware payload", "value": "04d4f9b3c5582e04a42378b61b357d04cb7927f48d7c007171b3d4525e9303aa33712a9792c543fbd59fafed41817326", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996395, "uuid": "47738e07-9ded-44dc-991c-773a0c5f5b75", "value": "T19B7292F9BE48E55402D0C67FBAF3B483EA49626D6024AF04FDADC0D6A31276BC27D145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996395, "uuid": "ca1146b1-66a0-47d4-92bf-f4a7c71b2bc0", "value": "192:EOGrznJqRQfLt/yYO2hZuRylxh28YDQSQ81l27+x5YlONMN1V0Uwge3E79lPAh6L:EnrzJcCwYvPjKw+xmQNyVMgZPcL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788996395, "uuid": "54f5fe99-7910-46b8-a054-d2c86c3ab820", "value": 17374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788996395, "uuid": "9272926b-8ae6-4b8a-8b95-2cfcf5770273", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788996395, "uuid": "cb4c0329-f4d1-4d66-b004-209e09079cd1", "value": "FURY.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd39960-ac77-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788976517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976517, "uuid": "1edf0dea-a752-488a-8b20-3bd344e5e514", "comment": "Malware payload", "value": "4a6a7fa1fe6a203696bf1547915809a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976517, "uuid": "f96580ac-6981-4bbc-b133-06cd7b738398", "comment": "Malware payload", "value": "e78d93af9705147fefe25ab8c7d7a4623a41c9d8c6f7afafbb12b4c3061550d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976517, "uuid": "a63c0de6-f82f-46b5-9458-40ef6702ad58", "comment": "Malware payload", "value": "9aee4a01c75181e7b9b64f39f3f885ed442f5968", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976517, "uuid": "0a900016-92f6-407f-9382-55110489ef80", "comment": "Malware payload", "value": "ccde55b753d288d82c335b6f50e50b69e7d64ffcd4dae7b02ba8ab9667586c0a00dd39d016432e65f3987c42c846120e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976517, "uuid": "410ca971-1c1d-4a32-9fb9-5eaae3c380cc", "value": "T1A03445823349E5BCE2DE0BA1BC070415E2F8D516F99F5444B7B27ED73B6A9840AB4EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976517, "uuid": "ca114b26-720f-4ac3-8011-294190a89dd8", "value": "6144:moO5JSfoas9CqIAgPgkDBFY3CKVer0R2ld3DLzXFm2oIa75qv1ZFnakN/yDB/bm:OKAP3CsCld3yAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976517, "uuid": "3727a440-c14c-475d-9958-7882ebba552b", "value": 236804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976517, "uuid": "be246e05-6c85-47cf-9c43-d2ff6a90608c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976517, "uuid": "659c3c55-77a0-489c-82c0-cdcfd534b922", "value": "Z_Dataset_Tokyo_6627.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3667cc18-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788976773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976773, "uuid": "0dbd0086-cb42-4fa9-8ae7-bb10aef73954", "comment": "Malware payload (XWorm)", "value": "59cf3e8fc28cf7d9d36e9144da1a6164", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976773, "uuid": "a3dce7a7-0780-4273-b4d8-46ac8d6753ba", "comment": "Malware payload (XWorm)", "value": "e7a41ed98a7fdf008756b9bbcd72c405e498c7a866c0fbb7cf5c45e60259c301", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976773, "uuid": "179f1ed3-4021-4521-864f-af602313cca0", "comment": "Malware payload (XWorm)", "value": "951fb7439e6b072af9676fec7d82e19880d852d0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976773, "uuid": "ec8b0b4b-7b22-4e9a-8e21-1af30bb321cc", "comment": "Malware payload (XWorm)", "value": "fe172b64fa89f3fda69f61569bbe0e19918b945c088d55723c7bcdaea60bb9193713eea6ac577c81436aeb5b32b8cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976773, "uuid": "d242eb1d-652f-4539-8320-e0918d29ab45", "value": "T1BDE4BB2DBA3DB154CDC97527A23A6671D48B4EBF13365B8B3C11FE80A542CBACC61613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976773, "uuid": "4bfc2c30-08d3-424b-8a8b-2fb1ded1cc80", "value": "12288:mvyVg5bqi5C3dt56o1UJ5nCfJD59rNh5SKrGb56IEQ51rg5WxD5kW2m:+p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976773, "uuid": "01e37364-efb3-4dcc-b752-eb3f912da5ef", "value": 661356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976773, "uuid": "6493b759-d3d6-4062-a237-fa261d809066", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976773, "uuid": "960ed7a0-3c75-4ace-9a39-9223b6276349", "value": "scan_docs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bcca7d-abe5-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788913736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788913736, "uuid": "c5919b91-66d4-478f-b791-8801081b02b3", "comment": "Malware payload (Vidar)", "value": "0925803a819f9eb4ddf4a821a99ec73b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788913736, "uuid": "1bdf4e44-dcba-4b42-822e-6071e0c8f3ca", "comment": "Malware payload (Vidar)", "value": "e7be5fda5fc08571870d19a5006aba7b23c5ed2271d3b0a5449b7c6d078c9357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788913736, "uuid": "a3386690-c4d3-4dac-9358-8a9889e21f6e", "comment": "Malware payload (Vidar)", "value": "7e6c69e634ef3e77d3fa8c44d61db1a8a674902a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788913736, "uuid": "9d5cdef0-cccc-4b40-b5c4-7dac22d2c1d6", "comment": "Malware payload (Vidar)", "value": "6211c6828de488f4dc3acb5febf967820eede702e6b8b913b49d1cb91e7aa9dabbc120a97df2772707b719e949cdd6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788913736, "uuid": "acd080eb-66f8-4cff-bdc4-64101837642d", "value": "T11B567C437F8181A0C095EA3A84F642617B787C0D873433AB6EA5A9703F7A3D1B675F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788913736, "uuid": "66a4cf40-1d5e-4af7-8381-a1df6270f251", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788913736, "uuid": "7578746b-e672-498a-9fe9-cf57ddb2967a", "value": "49152:L5tX7HzAKsVqkTeqNjWIreE6tzcDiYi7vzPDd5OF5V7QVBtNffqVgGNGeflWszwn:L/naldreIOY47d6T7QVNf1GFN3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788913736, "uuid": "f8be48c8-b500-42ff-b59f-d5b558ff6aa8", "value": 6451200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788913736, "uuid": "f316b7c4-c4c6-4003-bbc1-1995550f591c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788913736, "uuid": "1dc1d9d9-2433-4985-a582-8c5993189e12", "value": "e7be5fda5fc08571870d19a5006aba7b23c5ed2271d3b0a5449b7c6d078c9357.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4366de85-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788976795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976795, "uuid": "f93163d9-13bc-4b88-8fdd-f964f22064cd", "comment": "Malware payload (VIPKeylogger)", "value": "0a685e976e4f0aa73bf5a441e7193c75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976795, "uuid": "4548e5da-0eb2-43f5-9cb6-b421fc27a5c4", "comment": "Malware payload (VIPKeylogger)", "value": "e809e1d8165c6bcf6a828badb965825f431399cc92957bcdbbb20e78dcc5f3db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976795, "uuid": "266b308d-9361-4daf-973c-fd18e12e8975", "comment": "Malware payload (VIPKeylogger)", "value": "192ff86ce6182166fe956ad10de942541d386a4d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976795, "uuid": "b062ed37-b4a7-4176-abf2-8faa867ceb2b", "comment": "Malware payload (VIPKeylogger)", "value": "cc38a2520a9f15d90318c161a35db09ab0607618bbadd83f0d5483fddce2f3874d0e7bc7bf1f14fdc6ae2628c6c4bb0d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976795, "uuid": "88a6e966-32ca-4fe1-a744-9fa7f7211f53", "value": "T15965322DBA3DB0588C8D3526A22567B1C44A5EBF23775BCB2C10FF91A642C719CB2717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976795, "uuid": "ce9ee8ad-c55c-42e1-bdbd-632a7a5bc5c0", "value": "24576:2J6RRuYRM/siotExGAYjJNHU1L4ti4ar7AwtMqE:2J6RRuYRM/siotExGAYjJNTUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976795, "uuid": "a0b6cfcf-b9b9-4917-9f05-416b0c0a23ae", "value": 1469383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976795, "uuid": "e898c372-2a35-418a-ad90-75bc034318d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976795, "uuid": "702dbdf8-c661-4272-b9f9-1931b1aeb007", "value": "SDS0987654678.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed24bd0-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788977243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977243, "uuid": "f5034f40-37bc-4f13-a65a-bead9716d1a9", "comment": "Malware payload (XWorm)", "value": "e5b6265bd6f12cf92ebd5ac830e56d5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977243, "uuid": "d060f41b-6127-400f-a4ba-2029be0dee86", "comment": "Malware payload (XWorm)", "value": "e86535d55d88b9ad2034d05bb216bcfbb41c4a3fcee120c5850bfcadb7734182", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977243, "uuid": "15d8b8e2-cf77-4cfe-aa84-d4e02f7a2f0a", "comment": "Malware payload (XWorm)", "value": "6d77d4000bfbe98cbd11004b51993fc7048161ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977243, "uuid": "32a7e24e-b347-45a8-9334-3874cabb4b64", "comment": "Malware payload (XWorm)", "value": "df7ff2e12c32b88e36e09f407aff955c2427a36caa0349ada0f5573160e0b5dd5f151dffc7ad2186f033be05e3dd2edc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977243, "uuid": "5b7167fb-c108-41a8-a0f1-cc29a0176582", "value": "T1F6B66F089700E336A6BD572CCE768928894AE10368D5DF2E717C53097BB49273F9D9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977243, "uuid": "212c606c-3cc4-4819-ac41-480f67198f57", "value": "98304:rhjRQMTT3IK64qDTlDQIRNzvSr1s/BPgwM3:rhjRQMTjHulDXRNjOy/B4L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977243, "uuid": "bb87221a-a4a1-496c-93ad-0da116a48bec", "value": 10655241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977243, "uuid": "966fcb74-b9ce-4eb9-a680-f58f15f84bf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977243, "uuid": "c7039ad9-d83e-4320-8be8-93a60726271b", "value": "ludbiufi.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7b6252-ac3a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788950231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950231, "uuid": "9137e4f6-1921-42d5-97d1-d057db4ef117", "comment": "Malware payload", "value": "c0bb1be1997085f666f4cf0509648859", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950231, "uuid": "c7e06cb6-7e6b-47f8-8d38-7c32da8c05d4", "comment": "Malware payload", "value": "e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950231, "uuid": "77bd0c95-346d-4495-afc9-b3a429e731e8", "comment": "Malware payload", "value": "1a1c3350fc64b0b77623683bc6757b8fecb3d6a5", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788950231, "uuid": "451a2ab9-53e9-4d2a-983e-34ca1809cfc5", "comment": "Malware payload", "value": "30fd159e76eed5d3793a8ca2cdaa6f5d80948e5ff33da244a003656551d13ea5ace143c36424f97f42857a5cfd725f51", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "TA412", "colour": "#AC7041", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950231, "uuid": "49adfc26-07f9-4963-8ea5-f961a741f546", "value": "T1A9C2E19285DB857AC75BF7B403030092353DAB2E66E53BE48A0C7F268E949DA437553C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950231, "uuid": "75c8e1e0-bc3b-4f88-b33b-162f3b69d9f4", "value": "768:QOJrUiXyNY7hQ9WiZvbCgjWfRyw5O5gpsSKAeguuOi:QOJnv7e59CSMYwkKzeVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788950231, "uuid": "e5579b60-63f5-4645-bbd7-fe64735d936a", "value": 25935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788950231, "uuid": "0d955a7e-9069-4fa3-9d11-a709522c2419", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788950231, "uuid": "572c612e-0fd0-4d28-a127-9c7d4c877bdf", "value": "dist.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e968f43-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963526, "uuid": "de51a493-5d0b-4b0a-a27b-ef2129877def", "comment": "Malware payload (Mirai)", "value": "163ca025bca064362a7052249cb09172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963526, "uuid": "65dc4efb-ee17-4c8d-85d8-24fb2e1c2a73", "comment": "Malware payload (Mirai)", "value": "e98c2876a4e26b6250c2e4bdfb0e40f78b031c1979821ea0094300eb3e287f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963526, "uuid": "16cc5d9a-8360-40a7-b683-96b751a759ed", "comment": "Malware payload (Mirai)", "value": "6e20250eedbdd706a346b4f330c7039fc0618bde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963526, "uuid": "5f862fea-3b03-4992-8888-7c89cd26b913", "comment": "Malware payload (Mirai)", "value": "4c82aaba99e73d9a65f1a17008da6cfbca5d9b9bf1509e6039cb8f8c865df4cabdad04a859fbbf1ece475d8e563b8dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963526, "uuid": "0e00b873-5fbb-412e-91f7-d250774e0f0b", "value": "T14AB33B86E793D0B9D91710B041A7E7396770ED720220CD5ADBA0BFF19871FC2A15A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963526, "uuid": "1b26efd4-fb68-44de-86b0-0628156f6263", "value": "1536:mU3Vf4ETDnvDmB65Psp+kOInfqzyIWqSkUy31cDZQ0VsgQQSktOJJnr8:mU3Vf5TTKB65PM+dQfqzyrBI6ygSz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963526, "uuid": "5e62cc88-ac71-4d66-8df2-acdde70864f9", "value": 115132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963526, "uuid": "3119e038-de55-4675-8ed8-b8437fb13991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963526, "uuid": "0a6ad3e1-8da3-4a03-9fec-1271527ff4f2", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892722ac-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938257, "uuid": "b503de40-7e4d-4523-88e0-60131cf31c46", "comment": "Malware payload (Mirai)", "value": "f55d54e418b0c3849b1e88153a6b5bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938257, "uuid": "c713cece-b152-4a88-a694-be2f920c9bc6", "comment": "Malware payload (Mirai)", "value": "e9a7c47bd60a67a39e15eead4821210b4edba9368f140619b6f22c77cc874887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938257, "uuid": "279f2330-9d40-4e75-b9f6-c00fda7963e5", "comment": "Malware payload (Mirai)", "value": "11ccd3b203bd63746fa0608eecacef7745e19704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938257, "uuid": "7c003170-fa7d-4316-9230-50cd0f19dcd4", "comment": "Malware payload (Mirai)", "value": "6dd69430677a1b56de1b6d0ee0030a48fe30e9b7e67e469c5e63cb0b50dc1acee48b8afe6f63651d088c8e8aa295ae0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938257, "uuid": "3d689381-0ef4-4236-8cd2-a270ddf4e607", "value": "T187D48D2273618FA5D365D2B206E3871186F511930BE31592837CC738BB51A6CAD6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938257, "uuid": "d152f7d8-a55a-4ea1-9f4d-cc0f075a9c11", "value": "12288:acyr4LUgvlSa3yz9q+5jFC6WCHo5y8GiFrn06EiZ89jpisFlf+65u94V56i1:2r4L1SaUq+55C6WCI5y8GH6sGynuuV5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938257, "uuid": "1622b341-2c78-4deb-ae2f-ca579cb781c3", "value": 621544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938257, "uuid": "97c95407-2508-41f1-97a7-2c2f5785c65d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938257, "uuid": "0aef87dc-63aa-467e-9183-b0f4d41b36f0", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888af023-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977340, "uuid": "566a5d6f-4575-4b1f-ba93-528f923f3d9f", "comment": "Malware payload (Formbook)", "value": "798e2c634173ea6b5a75104fa6c4a158", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977340, "uuid": "fbb448b8-febc-4332-8e88-aab00ec7e1c1", "comment": "Malware payload (Formbook)", "value": "eca3f15cb2246af227dcd153fb1b3d463279fee69ce9560db1916c63e59d26fc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977340, "uuid": "eeac3633-c355-48b7-8f30-29ed1bf87e8c", "comment": "Malware payload (Formbook)", "value": "057335ace7ce3ba2fa7ea971af917831fab63ddd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977340, "uuid": "557c83e2-d579-46b9-b504-5b178a9d0889", "comment": "Malware payload (Formbook)", "value": "25b94db6fd0b07b07fd036f948616f8dd1e143e6face1a420a77db1bddff3e66e942abe13ff3db19b88126467009ca60", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977340, "uuid": "f7ec578e-df99-4753-9686-e7a9935193b2", "value": "T1C2B609CC5F0E92C3207C2925840A79D6EB5066A79572DF0E717D1BFB5BF8A013A25F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977340, "uuid": "36d23d5c-7d8c-4f42-a700-d5ef8e03b0ed", "value": "98304:nNdvxJD4LzewaQjXIzI6rtvoTXTk8z6qzYxr0WtOFNzSprmIGYa:v4fe1Qj4cKtvojw8YxQNzQxpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977340, "uuid": "a88687ad-5b25-4146-84d6-faceb260b1b8", "value": 11452953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977340, "uuid": "a11d4d00-42ae-4673-bfe8-7de024ff45c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977340, "uuid": "f3a4e49f-2f40-43cb-9c4f-b8503e61d466", "value": "Deshmia e pageses eshte bashkengjitur.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff2b066-abf7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788921599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921599, "uuid": "396927a3-a910-42ed-9210-9b722233115d", "comment": "Malware payload (Mirai)", "value": "d7f19e1854be867357dd8c63f0a3e6c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921599, "uuid": "4780109d-cfed-40f4-aee1-ee38a09f2665", "comment": "Malware payload (Mirai)", "value": "ecee64f2446c402df5024227ab3217e82ce4f40fd3f509a306ce731de3fa71a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921599, "uuid": "6c256490-ec84-4abd-be35-59b955334986", "comment": "Malware payload (Mirai)", "value": "8b99ea57428eecdae169a9f1213e6265ea5fb789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788921599, "uuid": "58001cbf-07ca-4d2c-abd7-14560f6e5e4a", "comment": "Malware payload (Mirai)", "value": "d45bf72fbc2b2eeeb01fde59546a30a70cc254f5a9f7dac83bbf346e07a6b678c85d3ef79ec3dc0a0ddd784323a76a0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921599, "uuid": "b79fffcf-c984-4b05-8f70-beca9d7c8c10", "value": "T102D2E0B91A0A46CEDDAEC8FAC3A413A019660E126903FC4BB4ADD7475B5B5C0B107ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921599, "uuid": "db88b1ac-2ac6-4bfb-a19d-ca0af9f1f62c", "value": "768:yxMWBhAHuLegF1aF4NscfOl8liVQJgGlzDpbuR1JR:yxdBGuLea19acfjliyVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788921599, "uuid": "399662f8-6dbe-4c15-8c23-a89b00cdc8e5", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788921599, "uuid": "b736e702-148b-48d9-9e75-50d6de1d0d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788921599, "uuid": "1a2c62bf-4b80-4956-af5b-526f79b3f28e", "value": "ecee64f2446c402df5024227ab3217e82ce4f40fd3f509a306ce731de3fa71a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1497ede-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788977462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977462, "uuid": "91f00d1e-f42c-460c-8336-fec7719c64b7", "comment": "Malware payload (AsyncRAT)", "value": "768e931c1483d9be625b20297cbbd20d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977462, "uuid": "7037f035-64e8-4c8f-9b1d-a83935aa7f3d", "comment": "Malware payload (AsyncRAT)", "value": "ed34f60ff0356c29bc8e54a3bda288a779c1f1f8479b42ca21df74dbaeccf113", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977462, "uuid": "902190f0-8441-4acc-b837-c300d875c671", "comment": "Malware payload (AsyncRAT)", "value": "33774bfd89f013cf1ab2aa6e3e7652a30adf09ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977462, "uuid": "f90fecc8-460b-4f80-9ae6-c70a3cdb288b", "comment": "Malware payload (AsyncRAT)", "value": "2c5c43befd773e8a1941e5f847f365e665957fdef0f52868b5217c27f7dbbdea47b6c6bdf43e73360fa34c8c760eddf2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977462, "uuid": "0cd87cc7-179b-4eb0-8197-8b5a46cbb652", "value": "T19053E101E9A414FCA9651A7EE06E4F3D4A263A970F54B45AF004C7E32E0CEBDD5B7217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977462, "uuid": "9872fe95-4638-49b5-9aff-89fa6a36f043", "value": "1536:kHdgtqKfekVIngO2Xh7syCDDRA8Ga+l56z:V9A52R7s7D5ol56z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977462, "uuid": "f7a9ea49-57e6-4652-a68f-0d0a92b3bd53", "value": 61425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977462, "uuid": "9b6936a6-f828-44f9-a19a-4d295d7af19f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977462, "uuid": "6d2b562e-d688-4855-bb76-2cbc27aa2b9f", "value": "COTIZACI\u00d3N.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684a2f2b-ac5d-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788965260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965260, "uuid": "77c85eb7-2c69-4473-9949-d760e3ddf869", "comment": "Malware payload (Gafgyt)", "value": "f87bfb0d1f66e0505fe9a6f4c0cce705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965260, "uuid": "5d80c54a-6eb5-45e1-8c3e-16318bdd9813", "comment": "Malware payload (Gafgyt)", "value": "ee5fda0b22ae5dfb3ad28bbf63c32d9ffe7d976caf789797b2b401c7d634a7c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965260, "uuid": "22d15514-c0d0-4b9d-85eb-fa842279dc7f", "comment": "Malware payload (Gafgyt)", "value": "54f46908b503b469d48888f632cba6cec357eeb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788965260, "uuid": "626e5e7d-e346-4b8f-bb5e-c2f7bd6e17ad", "comment": "Malware payload (Gafgyt)", "value": "740441daafefc65508cab45a8114c49078015ce2677933ced060067ee9324d89701ab179c72021d8875b0bd6424d07b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965260, "uuid": "845c3ea9-1658-4ce0-bf4b-70b3dac309b3", "value": "T1023408A3F900CFB2F40BF67204D34B316A31BBE216536523732679669D7B2C5285BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965260, "uuid": "3a093c44-45ca-4764-9852-3db2bb66574c", "value": "6144:p+smTXe2LrZJPWLqyDcJ35tVm3zGxV/lGE/S749DXy:pWVrVJ35nm3zGxV/lGE/S749DXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788965260, "uuid": "1e268ecf-ab0a-456a-a64c-2f312dff17a4", "value": 236122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788965260, "uuid": "1237a743-cf28-47b4-81e3-b6470d96d9e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788965260, "uuid": "83ca84f2-8497-49b4-814c-f7db11e8f41c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d93e41-ac31-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946350, "uuid": "bf2bc3b2-8b5a-4099-a23e-fd54e9853109", "comment": "Malware payload (Mirai)", "value": "a05bb036f9ea615b202ba99c92d68d5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946350, "uuid": "cd7f8dfe-bdc4-4f87-a917-829c34772f8f", "comment": "Malware payload (Mirai)", "value": "ef3f7b177ca0382ca3237d0c03f90b5bd3ad2684495138a6db4568d69051bc93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946350, "uuid": "0b3822f1-1aec-4238-b1b5-66798b671670", "comment": "Malware payload (Mirai)", "value": "0a9133e08cf53e64bf52e728a98877add9c0e4f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946350, "uuid": "4dc50f43-2d20-40d9-a48a-ec5e01014236", "comment": "Malware payload (Mirai)", "value": "08304d2e6210f92aa843b1d8e4229e408aaf38f3869200e2ae334ab3dd51a884f19b7d548670b716924d03009d7a9a10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946350, "uuid": "e8522763-c212-44ea-90e6-ae3104d9f43e", "value": "T1A9768E2EE2B1556CD04FC0B0679FC2621A30B4B41675387F3B859EB42FA6D6513ADF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946350, "uuid": "b935e53a-b383-4e10-a5d2-12704ad1cca8", "value": "98304:7Dxv+zeDVQyQHjXMHUBOp0vhbfOLSiP07+I/50x8/EBKfzhIn0cr:7DdYrKWXNrLhRcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946350, "uuid": "36299635-5f1c-40f7-bf5e-fc1905627eb5", "value": 7809832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946350, "uuid": "3d297adc-bf2e-489c-a8a2-29f79c56f392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946350, "uuid": "7caff913-a2c0-4167-96b3-55779fbe130a", "value": "61052dceff9cc8c4345784ba84e870a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59184dcd-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963517, "uuid": "3dc08def-dc06-4b38-b8ef-fdeadf020958", "comment": "Malware payload (Mirai)", "value": "4d82a23ad21aa6e6598309ef851209cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963517, "uuid": "64b1db53-6add-4710-948d-e88c1db2be96", "comment": "Malware payload (Mirai)", "value": "efb7fdcef6ac51e29b30efecbc7e7c762a35bbf929f8082d92d9ff7ab24ab17f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963517, "uuid": "6d5c68df-6e90-401d-a8ed-4cff0ee654a1", "comment": "Malware payload (Mirai)", "value": "9180733c116975b00f8f171111d5ec0e1aa66e1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963517, "uuid": "f3c05838-3f97-421d-b501-5bfc99b4122d", "comment": "Malware payload (Mirai)", "value": "14bd181230462fb3aadd9155c8269a9c7104b970526bb1dd2311731e7d2cd98039410b084be2c316a4e3b10d3d394ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963517, "uuid": "ad4c9054-d63b-4549-a3fd-d1a1b6232656", "value": "T18B34B50AAB519FF7D45FDE3305F9870124CCB85321642B3A7270EB5DB95A68B09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963517, "uuid": "f25dd096-5ce3-48c7-bd30-35ce83e909c2", "value": "3072:yUtMHw5H1/mOpqNLXZ6lJzq8aQr9TkJRzj/ZOZFi:thmOMbmq8aCTkzj/4ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963517, "uuid": "91a2e81a-e362-43c7-a6b2-ac316260c367", "value": 253060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963517, "uuid": "cb30a23e-3231-4d1d-94ee-af07db5696e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963517, "uuid": "655f9fae-aeb3-4b7a-beed-2fdf4bf20315", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df35e77-aca2-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788994851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994851, "uuid": "a2815283-38d5-463c-9985-a7a285046508", "comment": "Malware payload (Mirai)", "value": "39c1015cbc91a4954d210915a47b29dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994851, "uuid": "be50edf3-e7e0-485f-abcf-ccccbe69f4ed", "comment": "Malware payload (Mirai)", "value": "efcb6102a660423dd48d8fc198d4a4732b1a5d028477e25371d811d723c0fe03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994851, "uuid": "5347da0f-c4b5-4ba2-830b-5f246bb5cef1", "comment": "Malware payload (Mirai)", "value": "3fb18a10c0d2edb892ee6e93251ce805f8604f68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788994851, "uuid": "a3141f21-0d4f-4036-a728-7a52a4fd5338", "comment": "Malware payload (Mirai)", "value": "14c6ebf1da266976da1daa92855546b7c72efafd6e228d2ec441a547febb3ab6c04d422d68197b79f7a34bf3f3a11c35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994851, "uuid": "ba8c6526-6668-4341-9ed2-22afdfe26e16", "value": "T1E1542803BE455AEBF41FCDB089BDC3C22DE1A0D751E5B93A757C8ADC7A6B10A0593488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994851, "uuid": "641a1825-886a-4d86-a0b3-d28264a2bc1d", "value": "6144:ITollfyuYK+yRjgUxn62es1rMb3PcZ8P3Oqw:IkCXKv6eeb3K8POf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788994851, "uuid": "c1a3e8dd-9929-4cdc-9c86-1a78cdf635bf", "value": 282888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788994851, "uuid": "f3a9c47d-90f3-4b24-96c3-46a069f4d8c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788994851, "uuid": "a3e6256e-8070-4c24-b2b8-193bbca4e42a", "value": "titan.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357d1156-ac54-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788961309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961309, "uuid": "3b9a0029-54e6-4a19-9c19-43bd4d5825ac", "comment": "Malware payload (Mirai)", "value": "76b7160542233733eefbee1dbaa88e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961309, "uuid": "3a0d0b3c-8c05-43f4-82d5-ec59f328dbca", "comment": "Malware payload (Mirai)", "value": "efeb7f29d142cf3387f20cb184b3995a89db6bce93f6af97d2605942876196fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961309, "uuid": "eeb11b50-449d-4d53-a708-6a3fa87eedff", "comment": "Malware payload (Mirai)", "value": "575e00b7ace31dbd7d72ee1637fb4c4e7b31a8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788961309, "uuid": "e0002dca-fde3-4df8-92b8-cf292be9c33c", "comment": "Malware payload (Mirai)", "value": "bdb0ac9676dd5cfffcca252f82980a01afe292f4d6a13d36d97d3d07cc8134804bd8d17e1683a3da64fb06a6f8e95f49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788961309, "uuid": "1dbf1eb0-19db-444e-8f1f-9471dcd893f3", "value": "T1F9D38DC5E743D0F5E89205F1103BB7228B76D43A593AEB46D7AA3D319C63A409E2735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788961309, "uuid": "572f1134-3e69-415e-b3eb-7c11adede2d0", "value": "1536:1vuXKX7i1t5QCP0mowOWRAXbRr68Wivtx4nuUdZHVPp1uutZSqEZ9oylr7lC:DLMtuCP0IOWyL961i1YuEHRpbwRfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788961309, "uuid": "0b568bf2-7e8b-4ecb-8e20-e8d76d94c7aa", "value": 130060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788961309, "uuid": "25cf135f-fc4b-4ead-a2d6-26fc77d28078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788961309, "uuid": "8ee8403d-cf41-462a-b82e-93bd6808d2f5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e550512f-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788977496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977496, "uuid": "04d57c92-2f8b-4a85-b8cd-501dcf8ad61a", "comment": "Malware payload (RemcosRAT)", "value": "9405531f2feee1ac8fec768612444a19", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977496, "uuid": "82380766-7438-49b2-9633-38e0fd2d072a", "comment": "Malware payload (RemcosRAT)", "value": "f09d4977766ef2972702968bb18134153c7c6dd600a2b2d99bd4e4db6129fcdf", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977496, "uuid": "56feca2a-e6aa-428f-a8f6-33dc2d6163df", "comment": "Malware payload (RemcosRAT)", "value": "95cd23068de5bcc26c99886186220b5a7d6e420f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977496, "uuid": "ea1f47c9-fca4-432d-a801-801f30e1c1fe", "comment": "Malware payload (RemcosRAT)", "value": "904da3b240af24daa180497232a2b846987081e7d80f87b45e37017680bcf124f5494fcc3f81e752f7820ea348373336", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977496, "uuid": "e74fb8ee-6ee0-4695-a5f6-77afc51c8897", "value": "T1DBC23C50CE2A12A99D4B3FD2EC48E427D56885670013097CFEEDB37A181CA4DF76D19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977496, "uuid": "c4dc764c-0c68-4bb6-afd9-10aafc3a8b31", "value": "768:2gumJq6IUQ9mKEP1MccgnfG1w1DeULwI/pf:2vmodUMmKUmgqw1De4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977496, "uuid": "ae69159c-d28c-40b6-bb78-59394afd7448", "value": 27530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977496, "uuid": "f3b619f9-e070-44da-aec2-c9200225a5c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977496, "uuid": "efdf3850-e6ee-4150-a3f3-05d998bb896c", "value": "Pre Alert ALMT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43703520-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788977224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977224, "uuid": "80993cdd-d57c-4446-974b-f64f031a76c3", "comment": "Malware payload (AgentTesla)", "value": "784d03081e9c2849be4c4c7afd67b343", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977224, "uuid": "fb631290-7ab3-409b-939a-3babe1bd20b8", "comment": "Malware payload (AgentTesla)", "value": "f22adb81209558b7bb36dcd38f54b6af0dd6a8378aa419c59960c6c4d7bd812a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977224, "uuid": "1808b4ac-b5dd-4e1b-9cc7-650a0fada19e", "comment": "Malware payload (AgentTesla)", "value": "746d63f2538205a77064a2cb05be869e6dd0d662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977224, "uuid": "b1a606b7-f4e5-4b68-897a-98f6bd5bcaf5", "comment": "Malware payload (AgentTesla)", "value": "43e0a19986d10fc9b6f3930689b844337575a72e8e46ae8476e3a7f4716464ccbbb8e1c2a018924552dcd23fa953f8d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977224, "uuid": "5174b0eb-5f04-47d4-ab85-d7c362c6b0da", "value": "T180B6C6485729BA32753D973CC0368A51DB4922631098EF1E31FC1718BBFE997276C8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977224, "uuid": "fbbd08d6-441e-4198-987f-654e97f97f40", "value": "98304:JqZrPL2UoCvnds3W6WwkEoDGdN0CkWo0qCSUJBRKScgqwGXBwNb5fbNJConoT2bC:8JNddO7gCSsRDcM1JPoTO5T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977224, "uuid": "ee6e843d-72b4-495f-af35-1805df45f832", "value": 11410721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977224, "uuid": "619f8417-253c-4d79-b573-11cdcc587597", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977224, "uuid": "086caad9-3331-44d3-95c7-c9980575f492", "value": "qrzzidjq.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316a8733-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "2f21bb9c-1ea2-49a4-ab74-9eed0c29a67b", "comment": "Malware payload (Mirai)", "value": "f7f7be1acc4d25dcf2e76e895038514b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "e974dc7b-c01f-40a0-b432-2c092b3f456f", "comment": "Malware payload (Mirai)", "value": "f2bc968b6946bcfd923f409b4a8f7ac4075452a1ef8980789299d915b0299f84", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "2e80a632-178c-4587-b320-c2f2d1ff5e3f", "comment": "Malware payload (Mirai)", "value": "ebfae66f644d1c40fb3a4fcbc69b045601e8dddf", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963450, "uuid": "1e90d1b6-4c79-4857-95b3-b55900aeba0c", "comment": "Malware payload (Mirai)", "value": "a14e36cc6f60f6667279ac6f8dce984cf05efbefa64b281e07436217f80f5ae359c6f8a3b0c9c4b0cfeac1379afe55d6", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "20b1b2cd-1311-4258-bb9e-186b7968d04b", "value": "T1425301B54B822EA2CDB57833D03ED04141994FA8FAF6F77A3DDA85A4ADD0350323C656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "207f59ba-a181-4a37-9e35-6a1ba3a2d52f", "value": "1536:TvRnZ1ufHaJf0ixEdh0gURrpT6CUVGxB81YfM:dnZ12oRtTjU2BdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963450, "uuid": "179abce7-bd0d-4571-b27b-8e1e7a2d10b6", "value": 65664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963450, "uuid": "85b5340b-7c20-45e2-b7e4-4690512fc1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963450, "uuid": "8289506a-00ec-4e34-bd62-7ba53e67c6c2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3100cc2-abe2-11f1-ab4f-4201ac107002", "comment": "Malware payload (VShell)", "timestamp": 1788912531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788912531, "uuid": "97056f0e-9654-470c-8cf6-b954a498e63e", "comment": "Malware payload (VShell)", "value": "f6ce703f83dc09e0f13f9d0ae60543da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788912531, "uuid": "e383c460-f91b-4b3e-9a58-fee4e835121a", "comment": "Malware payload (VShell)", "value": "f341190f94840430742555f0ef402c162ab7fe5cd736923cb579a1ae33be47e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788912531, "uuid": "2b50d781-5bbf-4a5e-b4ae-406672e82ca1", "comment": "Malware payload (VShell)", "value": "6662cab084ad1a0f2028dacb2170f95ff403beb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788912531, "uuid": "d00eaaa4-1595-4a2f-9a62-aff2f70b6c6d", "comment": "Malware payload (VShell)", "value": "d65f7028ecc16167f225145e21da583275804cfcf50767524907851bdf6ce37b61bf13e865eba3587c06739e69bc3faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788912531, "uuid": "f94dd57b-a958-4fed-98a6-741adeb5d39e", "value": "T1A7716188F3176AF1E43C47F800D3A614C459ABB8C250BF4D5E60381D3C220BA255EF97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788912531, "uuid": "c4d3ad29-9c4b-4f49-bf37-7f9aa5961a48", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788912531, "uuid": "9488feb4-52d7-4e16-8399-20545fec1728", "value": "48:6Icwm0It2WSJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4jdtQSNSYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788912531, "uuid": "c3ddeb1c-c81d-432e-b132-4337a75d2535", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788912531, "uuid": "996365a7-b4df-4725-9040-3b359fc3173a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788912531, "uuid": "77e44fe0-3bb3-47b1-a15f-fc5406670a8e", "value": "f341190f94840430742555f0ef402c162ab7fe5cd736923cb579a1ae33be47e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5453f83f-ac69-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788970381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970381, "uuid": "82aec5ed-045a-4f99-bae7-15f91dcdba46", "comment": "Malware payload (JOMANGY)", "value": "80e84ed720a9cf650c94c7115eaa1512", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970381, "uuid": "23c21c3b-c1f5-4f11-b740-5fbfca87ca1c", "comment": "Malware payload (JOMANGY)", "value": "f3b6ea46be088c4862e56f8bf0aace92a81caf848de3edd5e3509409d3b9304d", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970381, "uuid": "214de5b4-63a7-4a9e-ad34-82bfb19ec626", "comment": "Malware payload (JOMANGY)", "value": "fc002c8fe2448b408eed0c1944cd46fdb28d5523", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788970381, "uuid": "abd5adf7-a8c8-40f5-8ee4-4c1df06cced4", "comment": "Malware payload (JOMANGY)", "value": "8f2e47c805cc852fc8a5965969d817dc33d35f715a571bc27f05495b9941d60daf006196401a2cd049bf657e0a42b52c", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970381, "uuid": "50ba1b98-7204-406a-989f-0c03711b1efd", "value": "T1F0236C6516857C14AE98C4365D7E2F0CB9AD43E6314492EE7FCE3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970381, "uuid": "9aa5c8eb-7a46-4411-bd9a-293fdf65d28c", "value": "768:Fr9NyXsZztCJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:NHusZPcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788970381, "uuid": "c124bf92-7537-40af-9e39-c636cfdc40f0", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788970381, "uuid": "4fee7ee0-89ab-4d98-b56d-7b151f30a51b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788970381, "uuid": "26ce5ea7-926e-4c59-90cf-96982a0658e7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb6efeb-ac39-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788949965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949965, "uuid": "f13d3f1f-8917-4749-bf49-9a50a73865bd", "comment": "Malware payload", "value": "758235724135900a587181eafa3bf71b", "object_relation": "md5", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_QuietRacket", "colour": "#AAD484", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949965, "uuid": "6de7ef36-4c4f-4de8-85b5-f1f99d362659", "comment": "Malware payload", "value": "f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7", "object_relation": "sha256", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_QuietRacket", "colour": "#AAD484", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949965, "uuid": "c827e5c1-0192-40c1-9c98-7b1986f5f665", "comment": "Malware payload", "value": "4560a8881292c74b7da7cb1cabbd800d678b603d", "object_relation": "sha1", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_QuietRacket", "colour": "#AAD484", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788949965, "uuid": "7804a0f4-0424-435c-af26-6f75c42c8b96", "comment": "Malware payload", "value": "b3ffd188d9bc9642b502004faa4612f487f1e7692a0f6b5d2ad24c5fe7b3de994b604d8561a5103be02c862a69c74a90", "object_relation": "sha3-384", "Tag": [ { "name": "BlueMoonEK", "colour": "#2876B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNK_QuietRacket", "colour": "#AAD484", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949965, "uuid": "a15b5924-40b2-4f6f-97dd-21ab57636133", "value": "T1BFC48E4BE6AB31BDD51BD534860344B6B611B8A70720AFDF0394D5722D76BE0863CB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949965, "uuid": "fa023b6c-d060-4008-877a-b6bc62445e26", "value": "7d8b60128e7e3056a8ab022b0c2cd8d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949965, "uuid": "cd74932e-d8a5-4bd8-82d4-f7f9dfd20d2c", "value": "12288:Zwy0Md3Tv0IrWhVynCmJfHoPC0OfKX/I17/fNMAO7M:ZJ0Md3Tv0IrWhVynRJYiI/wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788949965, "uuid": "6c15be6b-b839-4a29-bb95-3ff7e867e34f", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788949965, "uuid": "4fbba5ca-7bec-4392-979f-ff1d40842142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788949965, "uuid": "d0229f5e-b9ec-4049-8484-fd8d61133208", "value": "GFExperienceUpdate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a73278-ac06-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788928071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928071, "uuid": "ecb28799-1502-4650-a76f-fd63a64edee2", "comment": "Malware payload (JOMANGY)", "value": "de1b41efce47b995662f2b0158139174", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928071, "uuid": "ab5a5f64-3097-48f6-b8af-b09d2576c22a", "comment": "Malware payload (JOMANGY)", "value": "f45af05d0c72ce3125c41cfd4b87b428f9466be5137ac41ce4daf84b12a06eeb", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928071, "uuid": "e8f62c60-27b0-40d7-9e02-28cdfddfd002", "comment": "Malware payload (JOMANGY)", "value": "892bd93f458bfd96604c6b973f1581ec28ccf0bf", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788928071, "uuid": "73558a18-c655-466e-b537-fc06abff4729", "comment": "Malware payload (JOMANGY)", "value": "dc813051ef066b9cfb11b547df45cd066ecab507ac10ac78ca5443e9447edadca506363d0cfee3a59ba4f782ad0e6787", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788928071, "uuid": "f3a78f0b-0522-4863-a7c7-60cb04eaf0c6", "value": "T188C28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788928071, "uuid": "8d59870a-04f5-485b-bf39-95a61e142383", "value": "768:Y8vCB+25j6es8RF9FYpMSUpi+20qUpi+20YQX:Y8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788928071, "uuid": "7cdda300-dab5-406b-aa03-fd3cfdbec77e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788928071, "uuid": "bdbcaf99-ae5c-42b7-996a-55e67314aea9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788928071, "uuid": "d579175f-a6fb-48ff-a6c7-6cb2ee23b58b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1a8a12-ac84-11f1-ab4f-4201ac107002", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788981967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788981967, "uuid": "e5476b89-318b-4245-84e1-78e9e9f5dcd0", "comment": "Malware payload (PureLogsStealer)", "value": "2c9a835f41069f01db46d3d505b1919c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788981967, "uuid": "211c3508-e4a7-4b71-8afd-8524d53625c5", "comment": "Malware payload (PureLogsStealer)", "value": "f5909238ccb916af6b8260268318f58aee16961d42699521de049f18f0743787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788981967, "uuid": "0ef8ad92-7331-486a-adf8-9279ba426aa1", "comment": "Malware payload (PureLogsStealer)", "value": "8e31a1d1299f326d113069cb064fc53febdfcceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788981967, "uuid": "dcf45a18-9c47-4271-999a-35de743f1e46", "comment": "Malware payload (PureLogsStealer)", "value": "b5abfd9950caa950feacbe4ff1824ec4b311ce6db8c52f3283771ffb8ff7e8c30a8f881bd8bfbb8f7875807a090a9450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788981967, "uuid": "951d4635-5cf0-46a5-82c3-8867477ed275", "value": "T14E06D0A101C189E4F193DA3092D5F2BB5E39337AEE4C6FA355E9BE206731456AD33C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788981967, "uuid": "0415f5d0-b74d-42e0-826f-9182aa11439a", "value": "328acaba140a2e6fca9823ad6b84eb6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788981967, "uuid": "0c2ac48d-8d1c-47d1-8a75-b243bb46d52e", "value": "98304:nuTNEoIIZSTqxds26P6IAks3VZPHIUamFL2GeNvL:nuu26PKv3v/ld2GepL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788981967, "uuid": "e9008dec-528a-4b76-a0d6-c8e0b8677593", "value": 3917312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788981967, "uuid": "cfed3dc6-348d-4c8a-b804-089ab2c3a4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788981967, "uuid": "ff92041e-a9ce-49a7-96f5-234796d386d8", "value": "SecuriteInfo.com.MalwareX-gen.47527872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a82a10-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966335, "uuid": "e685cfea-eae6-4e64-980c-db6a26f6a8f2", "comment": "Malware payload (Mirai)", "value": "c891fb774a4931a98397091cbc2152b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966335, "uuid": "aa907d41-9695-4306-9061-c31495e91d6e", "comment": "Malware payload (Mirai)", "value": "f5b66de387be277a491d34aac6ec460f25e6f9c25e9194875ea1e1783dc00e8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966335, "uuid": "667e588a-9a44-4430-a187-c61c09bf8e82", "comment": "Malware payload (Mirai)", "value": "521ac059a22fc313c40fcdcc2483f909b8621d39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966335, "uuid": "f2e6d8ba-1f7d-4899-b0b1-ebe91b1fddaf", "comment": "Malware payload (Mirai)", "value": "86a8d8d54db670a5739911328985fda817b0cf825cade6959d13dca0508c9b65b83c9f96aef75e7a0876e38164a8fdf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966335, "uuid": "608244bf-e5db-4509-991d-d22848ae47fa", "value": "T1BC43F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966335, "uuid": "c4ee936d-a25b-47b8-b9c4-93c8f174328e", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966335, "uuid": "cd4ebfee-dd6b-405f-9720-7120df138c67", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966335, "uuid": "8b7729bb-aed4-4dc8-8090-f67d8082b853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966335, "uuid": "254d729c-8efd-4a1d-804b-31d772e2acec", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ee4123-ac59-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "8d786c90-9e34-45bd-a059-5936ef71b839", "comment": "Malware payload (Mirai)", "value": "0abbce258de01fd607afd0ebc2a4c75e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "1df09fd9-109d-45e3-9800-b27609a8d7d1", "comment": "Malware payload (Mirai)", "value": "f6c22d1bdc59f94aa47f4a9b5244465164f50925c3cee7ce320b98ec80cd528e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "075fac04-d940-43d4-bdcb-f948e9871059", "comment": "Malware payload (Mirai)", "value": "0b4a0a2710e532c06c152c551e6717d7af402304", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963451, "uuid": "7ae6a87f-2d96-423a-8612-ff1388ba4a19", "comment": "Malware payload (Mirai)", "value": "e0dbc389b94327225ac89a8d7ea75e3543ec9fce9955913c6f7e5715dcecdea084e24b0a6f627f09dff375800fea3b69", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "5a582865-0b8c-4985-a362-13fcde00ca94", "value": "T15E630247B390720CD5B51DB6CC24ABCB01AACAF8D6C255051184C64BEEC3D5DABEAF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "1d9f8aad-8c2e-45d8-bc0f-ccd4502b7037", "value": "1536:agzRkse6qYIuEua0L6FRe0G1zG5IHC0n7U7DwVsGIVpHJRqfn:rCsHlI0L6F0d1zGKHC0ykVsRPTqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963451, "uuid": "d9cd075d-eb0b-42ed-9b05-415df5595bae", "value": 69052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963451, "uuid": "e4000697-e2ba-4a14-8d65-4835485a4123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963451, "uuid": "be8fa986-34af-44f5-9aaa-b54394c30ebe", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3ec726-ac72-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788974122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974122, "uuid": "76618370-4c03-42c4-8c4b-476af8e2cdfa", "comment": "Malware payload (Mirai)", "value": "5a3265d777ec230167720ee60837db4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974122, "uuid": "3045f22c-3d8b-44b9-86bb-3a2965ac9b77", "comment": "Malware payload (Mirai)", "value": "f77f4c910bd86b09c57bb51195338fd81f884cc35043c907855814eef90e73a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974122, "uuid": "79297283-b3fb-4346-bd6d-917d64ab0501", "comment": "Malware payload (Mirai)", "value": "9707af5f430b00970e5278d7af3f71824023a4a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974122, "uuid": "20a3f487-168c-498d-8b5f-0944f5102c6b", "comment": "Malware payload (Mirai)", "value": "a82287ddcf7e3161bb777493ab022130a1f7fe6b49cd4611c9a6c4bd60c851264bb13e13687ae6b425a265e6388f5c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974122, "uuid": "943efcb7-c024-4307-b4c0-3f62a51e504e", "value": "T1D3B22B81E487E0F2E41B46B98092A77EDB30D61A2515D91BFF7097BDEE13911830F319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974122, "uuid": "ab98b8dc-28c9-4132-ae74-11e0b97b0eda", "value": "384:fCXJdg5g3tI4cjfaxWapnTUIsc83SFG1bhs7yURpOLja0pqKEtkzw:y7tIffgWkYIsnvdeGURpwa0pqK+Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974122, "uuid": "597ccbdd-6162-459e-84d1-dc89b8c072ad", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974122, "uuid": "2c0768b2-f711-465b-b6d6-3b8d7475a622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974122, "uuid": "ab03986e-4218-4aca-bbd2-8071e58463ea", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cee957-ac1e-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788938407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938407, "uuid": "5a4ad7cd-d57a-4d18-8a5b-2d5779875a9e", "comment": "Malware payload (Mirai)", "value": "f27a518e00076674ee357d8077e3e679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938407, "uuid": "2bb83008-0594-42e3-90ca-d4b2df25a2af", "comment": "Malware payload (Mirai)", "value": "f8903ac2c1129c9168c55c53d4a02fc2fbf20c4eb22ecc479537966d2bfb309c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938407, "uuid": "c435dfc9-c8c2-4e6a-8dbe-12d3bea50d99", "comment": "Malware payload (Mirai)", "value": "17fd35de69f597953839f6faf84e7f2090e23110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788938407, "uuid": "c6b0ffe5-c675-4c3c-8f24-4bffd8c40383", "comment": "Malware payload (Mirai)", "value": "f5e894957f3bcb88279d331f8cf79c16fdc5b22b51d8deb6eadc9b45b2b4d214b28c5a792713ae57f758f5e442aa7209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938407, "uuid": "245c286a-15d2-46ae-8e77-87d2791395bf", "value": "T197242A46EA408F13C0D717BAF69F0245333397A5D3E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938407, "uuid": "29f9cefb-1395-4630-aac4-0395c9ecb6e4", "value": "6144:wemN2RYISMmiWc5d/anDsOZ2d/gwR621rpsGM/RdGwmH2WBLB5n:aN2RYISM5d/anDsOZ2FvrHsf/jGwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788938407, "uuid": "7f05b72e-4544-4086-af5c-4b77b6e0e032", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788938407, "uuid": "04c3b608-d8b0-4f71-8fa3-c11924d5bfff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788938407, "uuid": "e8bdb7f0-4ee0-41da-934a-287ac6e3b961", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d96a8d-ac73-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788974834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974834, "uuid": "620eb957-c1ae-412c-a70a-89bd6171082e", "comment": "Malware payload (JOMANGY)", "value": "6910abf8d362f8f6c83b6e2b37ba58cf", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974834, "uuid": "0b29a243-4825-460c-88be-1ad659de2518", "comment": "Malware payload (JOMANGY)", "value": "f8e2d5fb4a837101120a5562ee0850580b657f8b4cd3a844528aff118887389e", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974834, "uuid": "55c067c2-d8e4-40f8-ae6c-bf4f305e52d3", "comment": "Malware payload (JOMANGY)", "value": "7e769de8b52681e80c94c77106596053936c1d18", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788974834, "uuid": "f826f122-88fc-4edb-aa7f-6df05b93bdac", "comment": "Malware payload (JOMANGY)", "value": "19dcc4570c50c92c92f1d869a9d40861f48252e520175d310f507601016f374704b528b64dd3018b8dc732d594a09132", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974834, "uuid": "499c1266-d4d9-43c4-b22a-4f9a80b4cb68", "value": "T1C2236C6516857C24AE99C4361C7E2F0CB9AD43E6324452EE7FCF3CF28C4A6AD910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974834, "uuid": "bd030ead-55bb-4195-b287-8601afd6a5c1", "value": "768:s+jF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:s+Ccr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788974834, "uuid": "bec2b046-1fb1-4c70-9dde-95f2204f83ea", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788974834, "uuid": "b3e49ec4-5ed4-4a15-b735-3a9fe9923a1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788974834, "uuid": "e2a78f35-4b91-4fff-b667-b47ca13c4bb1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e28bfe-ac5f-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788966276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "6c041d44-d090-4621-964e-d04eac8b8956", "comment": "Malware payload (Mirai)", "value": "1626ff5d9a7d5cf98e7b38ff91f20ad5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "68805cca-b516-4b81-abd4-ba6cd3e0a05b", "comment": "Malware payload (Mirai)", "value": "f92c27bd2bb425a9d346a0ff64592dd7d76678e9d1f5cffb2cdf7c37d74885bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "8cb545d0-d9d9-40b4-bc67-6e4e56656ec8", "comment": "Malware payload (Mirai)", "value": "b36bff26ecde7eb92b748c0a426e6a8513f0268e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788966276, "uuid": "3b0936f9-0c78-43bf-861a-000f45b5db58", "comment": "Malware payload (Mirai)", "value": "afe3b20c943fe0c40e6ab174ccf921d8fb3bdda63470323a2b07567a4394c73638aadde1bb0601fc76789ead259c009c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966276, "uuid": "553a2502-5086-46ca-8111-aad823464393", "value": "T1C35161D432124A30BFF19D9EB9F6486470C0E092E6C5AF05D9EC66FD864CF0826D86A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966276, "uuid": "c9ff4475-926a-4937-bcf2-636789b0717a", "value": "48:vXW4WaWgWuWg7zEW7WqWdWsW0WEuUfW7WoZ:vXW4WaWgWuWkEW7WqWdWsW0WEuUfW7WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788966276, "uuid": "643ca363-71f2-44cf-9469-c80398b5b93f", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788966276, "uuid": "26c48c6b-63af-44a6-a092-1713b58dfd94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788966276, "uuid": "13b8f8c3-0e21-4c23-8695-5bd7073335c8", "value": "zte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b946e0ce-ac64-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788968403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968403, "uuid": "9908a340-6fa3-4418-8747-545be039319a", "comment": "Malware payload (Mirai)", "value": "f69d0effd48daa67bf656c59c560706f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968403, "uuid": "d9a4f440-54bb-415c-a289-0954680d39e9", "comment": "Malware payload (Mirai)", "value": "f96215c68cbb8bad180587fb89c2d9bccff554694a5ce2a2209ff8c19f16b8e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968403, "uuid": "4c362235-23f3-40a4-92f2-19770cd8ded7", "comment": "Malware payload (Mirai)", "value": "04b7d5690e8d51203f8444aeaf39f270f8fa652c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788968403, "uuid": "73b94755-2b77-4912-b856-2149af840731", "comment": "Malware payload (Mirai)", "value": "d449dcdbbf42f3b68f8984a2dafe7c57773664b633c924de1dfeb21ee0036c35552e157429608650b8a390154d4d49b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968403, "uuid": "91dfbf2d-2484-4f91-8d06-a4f6c6d2e7f3", "value": "T1FC141956F8819B15C5D512BEFE0E528D33232BBCE2DE7212DD246F30378A96B0A7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968403, "uuid": "5aec4648-f7f3-4d1c-9224-cade57f6e9ef", "value": "3072:2b6s9Pb/0/1nYSXR3mdUJ4Yw8Xf8b0FaMyRWGlycymYeQCG91YPe:cFb/61Y0R2d+G8X0bQa6GPymqn91d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788968403, "uuid": "0256a6c7-71e3-419b-a644-5ab20f927218", "value": 195228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788968403, "uuid": "cc0feace-fe56-438a-b48d-b1bbb49bc958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788968403, "uuid": "5dd26417-f7bf-4138-b3c4-0e01a0637751", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0cb446-ac4e-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788958849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958849, "uuid": "86404eb3-2060-481b-be12-64dccb6f360d", "comment": "Malware payload (MassLogger)", "value": "560bf95fc5a4b95beb699c104ccdfbb4", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958849, "uuid": "6e264c64-43ce-49ab-96de-d215ad4ec79f", "comment": "Malware payload (MassLogger)", "value": "fa4c85398b343abb47d85ac173762974125bf375059ffa58d5cbc982059aa626", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958849, "uuid": "8795f62b-ac85-4b10-bda1-f53d07693626", "comment": "Malware payload (MassLogger)", "value": "0411a632bb1b288b4498664468325da85d6cf9c0", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788958849, "uuid": "d89c5eed-fd2e-44ad-9792-85e36aafe55c", "comment": "Malware payload (MassLogger)", "value": "696bb5dff111cfc83d95b927578dd226314c5a3c4fdeefc02cc1bd2eea668d1325c169f72e94774b8611c2e6b30b5819", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958849, "uuid": "a8f32077-1271-4399-bb33-79451d1d47bd", "value": "T1474455BE30AD41E4F97CB859F702D654061CE923C51DEAD6A142FB64893D2AC231B1FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958849, "uuid": "d962934d-86a9-4b62-986d-9ff7ec9d76d7", "value": "384:bRtodBNketbpWExCpIiExeOXvm5uOkVStmy5mWONwuXWOBObrWOBO6CwyPpavIRG:iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788958849, "uuid": "c503c218-3fd2-43b5-ae1e-71c71860ea7a", "value": 278465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788958849, "uuid": "9373e77a-865b-4fd6-a0b1-1035fd373d0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788958849, "uuid": "3caa624d-1355-42fb-b9b1-2c86d9a82132", "value": "rok123.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90af7b9-ac44-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788954766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954766, "uuid": "8b731b27-531a-47f8-90b1-6cc772e59edd", "comment": "Malware payload (JOMANGY)", "value": "d563c64b3199541648f32f5c9485f13a", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954766, "uuid": "9be654b4-53b7-4d37-ad3c-cf858796e731", "comment": "Malware payload (JOMANGY)", "value": "fa88073cb9e5831cf50a57f77b8ac6cb4502a92a6b696250791e7c216c1a080b", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954766, "uuid": "9e4025b8-e03f-4c8d-bf89-46acef6e89a0", "comment": "Malware payload (JOMANGY)", "value": "c502b612bc83176ab731b26e95a2b0990860e8af", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788954766, "uuid": "97ffe03a-ce20-447c-89cd-40d592929576", "comment": "Malware payload (JOMANGY)", "value": "7beb8677b6d0088c8cd9488644224a861f42cd6b3a8713358119502ec357fff0f51e5f4e6a73054ac3c93a142cd37f31", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954766, "uuid": "7c5294fe-86d7-4132-a3f1-9cce21acbc5c", "value": "T1CDC27D966A867C44BEC94A3E4CBD2B0D6DF4C3D1324D52AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954766, "uuid": "3278a42c-7a06-48fe-aec0-46e8e1ce703a", "value": "768:B8vCB+25j6es8R59FYpMSUpi+20qUpi+20YQX:B8l25Jfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788954766, "uuid": "e976986c-c03d-4b08-9310-c6f9ab8a349b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788954766, "uuid": "feb60751-ea7d-485d-bb14-a5ba6166d014", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788954766, "uuid": "449ab5f1-cf28-4906-9347-b9ce3ff07515", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d427364-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788976784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976784, "uuid": "bf1cbe95-aa76-43b8-9e80-047685f31fc7", "comment": "Malware payload (Formbook)", "value": "9a18f81a2d3cb8873ee9c6f6fb0c818b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976784, "uuid": "7732ac10-d8bd-4fec-aa43-775d3e95532b", "comment": "Malware payload (Formbook)", "value": "faa5decda0d9c2864eb1033ac1a448766d51ba9703875afca420f246f7ab05a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976784, "uuid": "04609001-7a09-43aa-9ffd-6f4f8bb17738", "comment": "Malware payload (Formbook)", "value": "3f81b1dab79aa0dd3dbcfaf93538742050825341", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976784, "uuid": "a50d0d07-bcfb-44fb-ba16-2cd4b821b6c5", "comment": "Malware payload (Formbook)", "value": "39f83d23f7fc224a719e4e665a52ecc8ffa626f4c64fdea43b6808f68fb6fbe029422a0797764184af38026baed3f294", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976784, "uuid": "8ac8d828-97b7-459c-bad0-f4f412ddbb9e", "value": "T148E52BF113CFE6424915B391A81D0B4D8B5AEB249F835EC939CE07E88B1749275C4AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976784, "uuid": "097480a7-e61e-413a-a643-6b32026dd290", "value": "24576:hhZ4iWjP5Ms/OGETsGbuIk+f2cuggWfjrlPOlw3eDvErDO0rbhc3HHnHxSouzm4r:hrQjPGgOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976784, "uuid": "9db67818-5572-4b06-9606-2de3a42a2e83", "value": 3221866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976784, "uuid": "5cce7af8-e943-49bf-b43f-a2ad3cf90c78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976784, "uuid": "7e80ffed-72af-4758-bf4b-21aa159f7f5a", "value": "PO#441374-LOA-AD-142026944-7K.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5812e01f-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "49472fa0-c9d2-4296-a3a3-aa6082f0c5ed", "comment": "Malware payload (Mirai)", "value": "e38de3e605faa0200bf4ba9ed27c2eec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "ed280b28-2ea1-4831-8d96-9341f2994d73", "comment": "Malware payload (Mirai)", "value": "fab6ceaf87c6a1baa24a7a58456222c0db4033ce984def890c5c86e4698b126d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "cbdc72c7-ff64-4661-97a1-d43229d1d411", "comment": "Malware payload (Mirai)", "value": "e50467e7ccab5cf7307ee9816c79063855b959b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "49ea81c5-d281-4dc4-af9d-854c801c176a", "comment": "Malware payload (Mirai)", "value": "35832069a5618cef97e8490f57a5ab51aa431c75c241710fc9e5382560835e870c8bd482ecb2aa2cf983ca6b7844a2b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963944, "uuid": "1d035b67-ddd1-4d8e-9571-57a08ab28b8a", "value": "T148360897B8924983C4E42676B8BE80C433A35EF99B9713576D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963944, "uuid": "81e1aefd-9a80-41cc-a552-18b098901de9", "value": "24576:c2/5siQtS9y1+LaX7Yuj2HCslKdu3pYX/ojmzcC3uPFXimymdW/ARS0LKSFO/P0Y:crVCSynS1f5Q2dykay31rDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963944, "uuid": "f236ce14-df47-4bea-a8f1-d4d14af7b78d", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963944, "uuid": "74686b6d-526c-4b2e-b0d8-8e264f1525cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963944, "uuid": "aef9ee2b-9205-498b-ba46-d022ca946354", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda732d8-ac30-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788946130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946130, "uuid": "d98b02da-c82b-4a7b-8c0b-d6d1486e6c90", "comment": "Malware payload (Mirai)", "value": "43ed0511c0a162af2ba7dfee04b3a30f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946130, "uuid": "505d7f8f-f2e4-4fe7-9ac2-efa36837b68a", "comment": "Malware payload (Mirai)", "value": "fabcc316d07fb260404b4a64df6af18fbbf4dec23b659ba5833656dad306f7f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946130, "uuid": "62e75531-a4a1-4545-8cb9-bc42f055609a", "comment": "Malware payload (Mirai)", "value": "dd3f83eda0c91c969b0ae96b24132a5505fc4d36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788946130, "uuid": "87442079-21e1-48bd-8d52-a660f12d1c8f", "comment": "Malware payload (Mirai)", "value": "6b02e47b7b293b6c6f241141c055739cc08f99a748c8a0c40cc5cca43c96a51d96b549c8f8d120c06ed90780d2da1104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946130, "uuid": "6a67ac07-c131-4cbf-94e1-9b626c37419f", "value": "T180C33A01E9809767C2D2137AF79F469D33336B68979B33259A247BF42F8178D1E39221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946130, "uuid": "09d0f25f-3cb4-4a62-a8f8-ff9f53668be2", "value": "3072:wxulakgzy7L8+m6a2xiuNuF+40AiaPysbiqMnrjYmcQY47aGgp:pL816a2xp40xaPyworjYmcQY4+Ggp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788946130, "uuid": "908a11e3-1f4e-41cf-afd3-4fb459136a2f", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788946130, "uuid": "08e777d4-cc1b-44f1-9738-26e8c9bf5657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788946130, "uuid": "8dfc0067-4947-4e0e-9ea2-b4a975417dbe", "value": "fabcc316d07fb260404b4a64df6af18fbbf4dec23b659ba5833656dad306f7f3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec72b2a-ac68-11f1-ab4f-4201ac107002", "comment": "Malware payload (Gafgyt)", "timestamp": 1788969861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969861, "uuid": "beebf8f5-9673-4a9b-a14f-ed03465a61ab", "comment": "Malware payload (Gafgyt)", "value": "3887083cdc9bb26a14c327a3bba5d493", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969861, "uuid": "d69de87f-2a50-494d-8f5b-96cd7934e9a0", "comment": "Malware payload (Gafgyt)", "value": "fae61fec124ce7f66aa589c1ceda269ae723519dde408086d9596f19e5721a2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969861, "uuid": "70d56ac7-d44f-4daf-a64c-f18cf5877d43", "comment": "Malware payload (Gafgyt)", "value": "f6a43a79239dd285933b2b8c3d5a7b81b2394aaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788969861, "uuid": "e63791a4-2a31-4b07-b682-7628091e3f9c", "comment": "Malware payload (Gafgyt)", "value": "feef44a0a0465be3224c2dcef080e5cf2ce330470d294c3b818fd3767fe2d41d136dbef0bd2df90abdc72597f6db6f1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969861, "uuid": "acc58456-6ae5-4f5e-bcd1-40ca9a9f937e", "value": "T179245C23E4944FB7C182AAB624F69D310F12D5971B5F2687623DA6B04B4F4CDB40EF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969861, "uuid": "6de9aa08-c6c3-49fe-9331-aeab9b30b86f", "value": "6144:K+/F2mPWt86e1leW5hO8Hg+mgjvxK/lf3rs749OXW:J/FzWtM1lb5hO6mgjvxK/lf3rs749OXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788969861, "uuid": "ca399f6c-78c5-49f8-93b5-bdac09ef8a30", "value": 217701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788969861, "uuid": "8ae9d235-6235-40b0-bf88-f8adb999e3d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788969861, "uuid": "bb243689-710d-483c-aa51-d51b24479d0d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b3105e-ac3c-11f1-ab4f-4201ac107002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788951158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951158, "uuid": "3f067bda-1bd7-4b07-80ff-2b0fa0552761", "comment": "Malware payload (VIPKeylogger)", "value": "92e32e6137cbf9ca376903054ec224a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951158, "uuid": "2c8aeb86-0f97-4514-926b-95aa969612e6", "comment": "Malware payload (VIPKeylogger)", "value": "fc675b6c3333a4c20c2d0910017d91ecf70aea38fab054a2a11c1ef963f352ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951158, "uuid": "2cc42dbb-997d-490c-91e8-ff0de332cdbd", "comment": "Malware payload (VIPKeylogger)", "value": "a1aeacc21c12b72f8a4489fbbeadbd95379f9702", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788951158, "uuid": "f936fa8f-55a6-45e3-87c7-a7f521744e2b", "comment": "Malware payload (VIPKeylogger)", "value": "71ceb5ba6ea0e5c85af7a2524cad50866f5cdcaa7d9372e1463db614835f147fb4dd403cdd1cae3346c41474886992da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951158, "uuid": "b1a36f9f-5754-4b93-842d-bd0aabeac958", "value": "T15B45322EB939B0588CCA3126623963B1C44A5EBF63375BCB2C10FF95A542CB5DC62717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951158, "uuid": "23c22ec6-6c29-41ee-9758-696ea5c65fe4", "value": "12288:oKGpTY5Epppp3LnWFo/2Q10hBPvwZEgsi24UuAl6cEqrzl8N5sTq5QhppP5dm5Eg:WnqoNPZEgsFp7cVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788951158, "uuid": "41f50906-6987-437d-a201-69e3d2b3ba37", "value": 1272122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788951158, "uuid": "5534a152-9635-42a0-949f-2f208ecf6bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788951158, "uuid": "ebfe569d-d032-47bc-8650-19927f68ee2b", "value": "BRWD81265330816_041564.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb4e7af-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload (Formbook)", "timestamp": 1788977184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977184, "uuid": "bee3a5e2-6772-474c-b66b-059df5caa27d", "comment": "Malware payload (Formbook)", "value": "c938e52cd17b6dca54e7fa3bf073468f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977184, "uuid": "17a5284f-264d-433b-97a1-a8df1a81a4f1", "comment": "Malware payload (Formbook)", "value": "fc6b71109c64fe90710996aa333a475793468277c51e1895aa1e7b10b8cc8843", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977184, "uuid": "d2fbe8f7-8635-44b2-aa86-51fe86213708", "comment": "Malware payload (Formbook)", "value": "7c8a775970100f39da49723206a591753a39ac62", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977184, "uuid": "62d02ec3-5ea9-4ec2-80dc-2d5c13138bfb", "comment": "Malware payload (Formbook)", "value": "46658952972cc3b81a3de69ff64d0448e180ead013319b46d055f3542e3ade5b1ef0c2a9583ee66ceea26cbf96a09167", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977184, "uuid": "28206203-393d-4f7b-b7eb-1c9a6e9ee5d7", "value": "T1BBE5D6B23BEF640A96033B5FD94EE9C40B6E91213B07E6D0B8CF1A40575BD4F158678A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977184, "uuid": "2f7ff81b-2353-4cd0-b118-a426cf3ace50", "value": "24576:grN7dzdnGTnPDMz4+blIsaf2gDLPtx9YMxM0x+SqPWfp3iIuGOjM7ju73QhlcYSe:gxh8TwwfzfTy5KyI/8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977184, "uuid": "6b1ec27b-c65b-44e3-95ee-a4b0df13525e", "value": 3217110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977184, "uuid": "6b6d92c2-f9d5-4340-881f-cc81c11b65c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977184, "uuid": "7807f9a1-75a6-49f5-b24f-3fd70c1e5b7f", "value": "TAISEIMUSEN \u8be2\u4ef7\u5355 159.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bd16d1-ac2a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788943595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943595, "uuid": "3b16ef4a-b569-4d91-9d08-e7cf85ce5050", "comment": "Malware payload (Mirai)", "value": "79dfa912e6ba60f8c529401dddf1ce3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943595, "uuid": "d9d46116-6516-46e7-90be-4f8673a9f789", "comment": "Malware payload (Mirai)", "value": "fcb77fd480619d6b2b4b95a942b3eaf36c5232dfa72e7934495a1410e37011dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943595, "uuid": "9a621119-8513-4deb-b1e0-a4e4bc831d14", "comment": "Malware payload (Mirai)", "value": "89305efc8454d6e128b3186889da21576b42ef1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788943595, "uuid": "8196e778-7611-44ca-bc24-8f008ce133c5", "comment": "Malware payload (Mirai)", "value": "288db6a3ea0d7b27ccfaa6c8a67b44f27050c4d5f8daa798d8b4b39dab0b7c776fb8b9f9a0bdfdd034eb5128280334c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943595, "uuid": "9f08f76e-0776-4318-8811-725ba59c922d", "value": "T162635C47B64268BCC58AC0B00E2B8571F177B0B996515D3B7E94EB783D13F58CE0AA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943595, "uuid": "5f7ce2fc-0014-42b6-9934-c1caedd32a6f", "value": "1536:gPi+fjncIiJXzMZCJycKGbhK//AyYxAx:HMWNrJycKGVKJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788943595, "uuid": "33e898af-e9da-442b-bafb-87e39386c05a", "value": 67120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788943595, "uuid": "303cbebb-5505-4636-be2c-d95f57675f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788943595, "uuid": "d45ba8a2-a85e-4994-b563-7c2fc2f20327", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9b4d92-ac79-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788977428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977428, "uuid": "bea3199e-ece3-497a-bf08-dbedbaace865", "comment": "Malware payload", "value": "7b4aa9862ea426aad1ad4c55451d0fd4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977428, "uuid": "059eb9ed-0210-4be0-95bf-642423790839", "comment": "Malware payload", "value": "fddc41a02102e30ce234eef8de8701831ca2263579310a9f1b1816686868435f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977428, "uuid": "146f2c06-a8e3-4526-a68c-6cf9ae1d30d4", "comment": "Malware payload", "value": "bae0bdfb47bd08e9c347fbba4a9c6abc21f32fa4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977428, "uuid": "18fbe74a-f137-4c48-a6f9-c29ec31391cc", "comment": "Malware payload", "value": "266016d986d698c1992c14fdd67e4b088e7c28be6824154ee2ae023c4f664cbb2ff267e6822c5bb8a6d0e1b088518dd9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977428, "uuid": "c1e20e87-7d55-4151-81c1-7f81aba0b79c", "value": "T1B244A4C83AE3F45186531377362B66BAF22DCCC1B18CC858F541B8ACFD78A18E6B6554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977428, "uuid": "270eddf2-094d-4590-8020-3c76d7ffac2b", "value": "6144:Er+mCFSmYkDD52uJAHJ+1q+JIq5RMRRl8/ftA5uQDJ6:dthYkP5dJ0J+1ZmQMRRe/VA5NDJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977428, "uuid": "4ff9d310-5db8-4d65-acfa-a2917214fe88", "value": 271733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977428, "uuid": "f2c3775c-3d1d-47eb-a226-70b22233defe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977428, "uuid": "deb47942-04de-4c55-b534-943754139f64", "value": "QUOTE 2026-009-036.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1730f546-ac99-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788990894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990894, "uuid": "66622281-ff33-4ea8-acbb-7b09f2b503ca", "comment": "Malware payload (JOMANGY)", "value": "ee4b390b4debe61be66e081a8d6b057f", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990894, "uuid": "06cbc6af-771b-4a98-ae12-5403fde152a1", "comment": "Malware payload (JOMANGY)", "value": "fedb43f28aae435630a14cdd1e79de8bc02c136e9fd206c68d32c12ea1eec11a", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990894, "uuid": "b49bfb78-923d-4845-b0bb-2ec7168234d8", "comment": "Malware payload (JOMANGY)", "value": "ab40e5fd3994583dc870bc815007365d7c7232e7", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788990894, "uuid": "7fedad13-7121-4a77-b9d9-93ab2cacab97", "comment": "Malware payload (JOMANGY)", "value": "120e0e20368992a131639ec9953180c416590172240c17dcac86fcebe29f1a0a53f1815c13f4d77d5836a97bbc46cbcf", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788990894, "uuid": "a8133a9a-b1da-4d66-9c0c-9f91ffd484c5", "value": "T170236C6516857C14AE98C8375D7E2F0CB9AD43E6314492DE7FCE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788990894, "uuid": "2ddf28ce-d4fc-403d-b650-a912c3fcc742", "value": "768:W99NyXsZztCm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:WHusZacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788990894, "uuid": "c8a00d85-4cba-43b3-87fb-d5c6300bc476", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788990894, "uuid": "0cdffee6-f176-4132-be67-6c1d6868d684", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788990894, "uuid": "3d7fbb85-25ec-45d9-b40c-bff6bff1a038", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5805cf0e-ac5a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788963944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "8f343068-530b-44f7-a3b8-32d582b29535", "comment": "Malware payload (Mirai)", "value": "f00e97dd800881e7d9e79cd3a0e47a9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "cc6beaf4-2cbb-4990-93bf-baaba1911430", "comment": "Malware payload (Mirai)", "value": "ff0944aa6c41f4960f3bc64c34a0a245d37fb6d665aa455c2852f4d4355b2af2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "8b484838-05f1-4268-8b6a-744a15f19805", "comment": "Malware payload (Mirai)", "value": "90ac7c49f5c33b5e69dec3a46683292d50b35b09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788963944, "uuid": "7a34d7cb-d170-41e8-9dc5-8ab24e46dd06", "comment": "Malware payload (Mirai)", "value": "952ecb93c247b3f3ec00cf6d86a61903b221c96d24b6457bf3c4143770b93716aa03e1d92eed7614e0489748e70f1718", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963944, "uuid": "1ff46b94-097a-484a-9986-9de38c67c749", "value": "T16D260997B8924983C4E42676BCBE80C433635EFA9B9753566D04FE3C3ABE1990E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963944, "uuid": "8268eed4-104b-494a-b91e-a3ea85299c58", "value": "24576:2B3qLam87be+o9Ylfwks9hc4XSu3+eVyVPc5jYnUGvFlzYij/h8pgNExsix67E5Z:266FkUPp6P+gb82ieaoYRr4DSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788963944, "uuid": "e7c585bc-82ce-4924-8b7c-9afd788abce0", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788963944, "uuid": "2369deee-b616-4957-b8f1-90cc0d3d5b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788963944, "uuid": "10edef48-4d7c-4877-9ecc-30ee2611570a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd4d8ff-ac7b-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788977992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977992, "uuid": "5110bb81-e25d-49a9-9dc1-ea30b1bcd92f", "comment": "Malware payload (Vidar)", "value": "9a2a4ac4273e0633e37e774ac2618379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977992, "uuid": "c3a3ffeb-f6d9-49ca-907b-5adea2da3ffd", "comment": "Malware payload (Vidar)", "value": "ff394679232be326f86b65908b12b230af7e9e54884224774c657f8bdf138c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977992, "uuid": "b9e52595-90ca-4712-84e1-91cfddf44cba", "comment": "Malware payload (Vidar)", "value": "eb8f94065e5c200ad7530c89fb3d4afbde7b4559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788977992, "uuid": "21c39537-92cd-4b82-adc6-0849595457a9", "comment": "Malware payload (Vidar)", "value": "989dce65a7543fa973c071bba4ca28609da8c7fd03e3e97048e4fdad4189ccf004746f6ebdd33724f8f08bb238ca8448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977992, "uuid": "424c177b-4614-40cd-a9b1-c3a1a3073e55", "value": "T181D66C9369858199C475873AC2BF812169B8785CCF3233A32F62F4352FB97D1AD76720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977992, "uuid": "bba7dcfc-e9dc-43ba-8dd6-9e7b4e955bb1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977992, "uuid": "8aa72670-769d-42d6-838c-abf1a7fd9990", "value": "98304:tj/Df29FubTxWF3ZBb7SHYSWk++SW2lSo2ThP2RKNOJDIdg:tjLoPiza21d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788977992, "uuid": "408d1e38-3546-416a-bedf-df60414aa4d7", "value": 13680640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788977992, "uuid": "31070ac7-7e5f-4af3-9b61-428ed5b0bcff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788977992, "uuid": "a97b9645-b9e6-4d58-b544-a1336bdb3428", "value": "ff394679232be326f86b65908b12b230af7e9e54884224774c657f8bdf138c7a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6c2f4c-ac78-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788976786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976786, "uuid": "d21118e3-4920-452f-b0d8-ddaecb758abe", "comment": "Malware payload (AgentTesla)", "value": "0a9515f26f42ec43de5440e13684a3c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976786, "uuid": "9af6f3b9-967f-418e-8086-7cf38beaf6c2", "comment": "Malware payload (AgentTesla)", "value": "ff587b5684660f1b3ffa5d4c2d905c98693124a8285404f13f6c2373709a4966", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976786, "uuid": "f5fcfdd6-d55c-4da6-98c3-01a440038d60", "comment": "Malware payload (AgentTesla)", "value": "ded3878ca5d7e853971493c0e25407ac43a9fa56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788976786, "uuid": "4a23c77a-216e-4bcc-8fc8-d13229d0af88", "comment": "Malware payload (AgentTesla)", "value": "6336da141923c15a8245a4b351f2e728f05669b7d0f7a410b65212ee9f277aa89ab495dd8802c811cd3fefa4dd7bf617", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976786, "uuid": "aa700526-7352-416f-b173-6f2d1292c3c7", "value": "T1EF050676C2FE2E3DC4275959CE7A3C0C9CF054910B4EF47AAD3764C8D97CBA966A0260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976786, "uuid": "8f99f05f-4878-4839-b163-ab419fd01202", "value": "192:uf4tp0wZSq/My8aTnlfXLksZGs9yVPpk6ptUT+w9cT+VeFysjAihsZvmxVuKcz/l:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788976786, "uuid": "9c262a0a-c5b1-4491-bda6-408daec27b13", "value": 822422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788976786, "uuid": "8d14632e-7f74-4820-be7a-25026ac181c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788976786, "uuid": "0f836079-0bbe-417a-b04e-ca5e28c96bee", "value": "PO-8022 , Saanvi Enterprises , 09.09.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }