{ "Event": { "published": true, "date": "2026-03-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-13", "timestamp": 1773446582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fbf6be6d-3901-4c1c-a916-ab9258fb37a1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c29d161-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390803, "uuid": "045f9222-b9a8-4e28-8cbe-25d567bd7f36", "comment": "Malware payload", "value": "9e84be2ca7062a85e868513225ebc0c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390803, "uuid": "bfdf5309-158b-45cc-bcb0-cec3a8a6a069", "comment": "Malware payload", "value": "02197537fb6fae29232ead1da76e794c6e0397f99a7467a494abc6ea72903157", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390803, "uuid": "fcc72937-a739-47f3-a6f3-eb805f4a2b17", "comment": "Malware payload", "value": "cff57d9085d0272e2325559df586a09e8e3c020d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390803, "uuid": "77660866-b5c6-47f0-827f-5aecedc80bc0", "comment": "Malware payload", "value": "8a26e3fd66295d909e4bd8074dcc43cd90a916c49e4dbad7d37830154f7b946c72749e0207485f853bbea40d0307ee40", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390803, "uuid": "cae8916d-d202-46ed-a446-f9a29168be01", "value": "T16D465D12780BC1EBFD703879916A5EE2BD380D08776684D794AA3D1C49722F2B77D70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390803, "uuid": "37b22b20-fbfa-45c2-8c30-72f9e46f79f3", "value": "2e462581e4698975b231ce7bb9ba4cb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390803, "uuid": "9cff271d-89f4-4ad4-99ef-30371ea30d9d", "value": "98304:d8igihdJyWS+EhWtraRxn4D4foexe1HIMJ2x0hXXkK:d8igMnEhUNbJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390803, "uuid": "8e8b965f-37e2-467b-a2da-41b56405999a", "value": 5660160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390803, "uuid": "878b1be4-d0a6-40bc-bae2-d454ec6b1939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390803, "uuid": "fedc3a42-1d7a-4908-8678-5911f9367905", "value": "python313.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070e6665-1f1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773434925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434925, "uuid": "551b3c6a-cdc9-4693-8263-2c6783c83c8d", "comment": "Malware payload", "value": "09ca1a6950f4c60a0e7eb834cab70267", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434925, "uuid": "3ab8a362-f9a3-4439-9d6b-5aadae3911d6", "comment": "Malware payload", "value": "0323fd24e26cce811693b77073fbf326a838083f038e6aea58f5fd3d8065d965", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434925, "uuid": "7bfe322a-8400-4e53-948d-191fc1dfdb4a", "comment": "Malware payload", "value": "5ad338bf0b73b512f9b24e89330cee8ab0c18705", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434925, "uuid": "4a8a504d-c184-49e6-b539-b68544df3fd0", "comment": "Malware payload", "value": "82861bdfa4cab8952f39c06f605d6037708afab1b0cbdb4c06ab01617ae28fd3c95ec86d81e9b66ac39858430b37b803", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434925, "uuid": "159a6e3b-de63-4d51-a889-e8d864845f1a", "value": "T14A626B7621F04A335B9065C4A33717914FB2A61B44A720E8F4FE1E359F5AB03B0FBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434925, "uuid": "635689c1-ab8c-4891-869a-b84465753435", "value": "192:cCu/K6nC4hvZ5mzj7V7jiDDDM79E44+TLO:+C4hvZ5mzjB7joDg79E4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773434925, "uuid": "f48da79a-bc32-4b55-a27c-5cb86329c2e8", "value": 14688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773434925, "uuid": "4f2c824d-b565-4c42-b9df-609630d439b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434925, "uuid": "2895f290-c3cc-41a7-ba69-1ba659ae983d", "value": "0323fd24e26cce811693b77073fbf326a838083f038e6aea58f5fd3d8065d965.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f79a38-1f18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773432646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432646, "uuid": "cfe9b71f-43e6-4297-964c-d86a3df6f8c9", "comment": "Malware payload", "value": "5ecabb5341d15f0a9b5b55906b560905", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432646, "uuid": "f104a070-f258-4943-bc7d-8656b5a875dd", "comment": "Malware payload", "value": "0435da3a2f6b0dc53ac3508958d53aae7fbca818b707494f83431f4357768428", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432646, "uuid": "d7ab16a7-1d79-42ba-9d08-fe5509a67535", "comment": "Malware payload", "value": "762b7b5bf0d1bef60e6e3a8e154da39a0b0c0f1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432646, "uuid": "2ea475d1-34b4-4407-8e19-4d9a02ff6d1e", "comment": "Malware payload", "value": "7d61ce76d59b5d35438084811738e0b40579fdc8911fbcc66b785256cb3b8e176c4d6a12a068dcbe90f6a921d3b3a817", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432646, "uuid": "f509e464-f5d1-4c26-aa8c-e1142b1a7096", "value": "T154B332CA09AB85E88F1F6058791F5C078E9D46170B5DEA407A8FAD543F32E6831BF6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432646, "uuid": "40e1012a-df0f-4b6b-bc41-cdb6695dbc53", "value": "1536:7avh9/fXL/+HLqm+QVzlrqZX2n/KNEVDF+cmSgjFPNRXU/:7avnqlW2yNEVxnOFPNhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773432646, "uuid": "fb43020c-8198-4ae8-80d2-500c3bb14ca4", "value": 113172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773432646, "uuid": "d72b1afc-a54f-4c2c-a4ea-0d9358cba652", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432646, "uuid": "d4c0babd-4101-41b1-9e47-9e483ab0aa3e", "value": "Family_Journal_Archive_2032.mp3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2b0360-1ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (Braodo)", "timestamp": 1773396356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396356, "uuid": "907d1fc5-bd3d-496b-b569-435d34cdc985", "comment": "Malware payload (Braodo)", "value": "f7c0bdc2785a978c2476f664a313a045", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396356, "uuid": "08f0aa82-0b2e-4e01-a1f1-632b1d7f7f3a", "comment": "Malware payload (Braodo)", "value": "0661ca7ff085c73479a32aea48135bbf59867ae0a7ca4d5bb65467cfa1ebbb7e", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396356, "uuid": "372ccfaf-fa9d-4b30-973e-3164af53544a", "comment": "Malware payload (Braodo)", "value": "ba0d7374648b683f61665997c7612cd18ffacbe8", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396356, "uuid": "e5b5cd54-b4f4-43c5-9f2e-89e2f8b3d73c", "comment": "Malware payload (Braodo)", "value": "74c545466037b049c980d39dad2d7592ba8c806c6f4555314e3a197d638b0a05baaaa71dab831852b683767fa9499748", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396356, "uuid": "96a2362b-d555-4034-9e8e-6ab361605c39", "value": "T1E90633C178D6A752531C5FB588CC34AD51C91E32A3AC3B7AE87B35EA2A6F0D446D20D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396356, "uuid": "c32e1c0b-38df-4961-87e0-83a4ea958c94", "value": "98304:QOsntHrcXcUQyh0b+QJ0hIcKUZkLJZtbAn6Ek1zi6YYmJfxy:f2tHothq+QJ071k9Z1An6zYYc5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773396356, "uuid": "ef549c71-9a44-47bf-95e9-eca8bc673933", "value": 3655247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773396356, "uuid": "ddbb00a6-9cb8-480b-9dc2-748e396e2a04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396356, "uuid": "d0b3df1d-953a-4070-afe0-195d83ea0cbb", "value": "sim.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb14298-1f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773438288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438288, "uuid": "c3c20ec6-e609-4035-8a14-4a0f990b1295", "comment": "Malware payload (Mirai)", "value": "b4511c1871f23131b2e1d114b94c598d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438288, "uuid": "7be38fba-6796-46ad-953e-f914f4ff05e7", "comment": "Malware payload (Mirai)", "value": "07228022677dfb7e88734540608fb757da7b26ea4de00fe7554b0b389c501bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438288, "uuid": "c93d23f7-12bd-46c9-8822-fd505db4700f", "comment": "Malware payload (Mirai)", "value": "33302e4b297837e15954152876833a963b0e3185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438288, "uuid": "b062a714-53b7-44cd-b062-164387d53ea4", "comment": "Malware payload (Mirai)", "value": "d3e63ed3b100dab0f643a69cd0ae67c69f171168f5205a0e979ce84ef79eafe7b8aca8a390089256f4d4365ae3eff1f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438288, "uuid": "51725830-eb85-49c0-9513-fdb56a455e5a", "value": "T1C5739D32C42A5E98C18406B4B4A0CE7947A3F904D1972FF6569AC7BA9447FDCF6093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438288, "uuid": "74f69265-d2e1-48a7-89f1-4b8db2dbecba", "value": "1536:5AOocarcRLFDWGJMm0ID1caUXK2EvF7F1c4Ct5omH7yhmw:5hhv5D1caUa2K3c4d87yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773438288, "uuid": "9166eef0-49e1-45fc-abfd-52206c87b137", "value": 79536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773438288, "uuid": "4ebe35f2-017f-4237-855e-3da7ffe321b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438288, "uuid": "d8b99d1a-87d5-450c-a621-afc891f3e50b", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585e30d0-1e9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773379656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379656, "uuid": "8de94b2d-abe1-4cd4-b87a-de2f0b24d6bf", "comment": "Malware payload (Mirai)", "value": "314d8aee6b7104adad8e55705f36fed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379656, "uuid": "6253cf8e-f805-469a-b552-a0ce813fd4a2", "comment": "Malware payload (Mirai)", "value": "0c0cf97259deef9093748ed30509b8b94e8b21839885d2a57156906cb2054035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379656, "uuid": "6bf63171-9a66-4ac0-b6e1-af044ccee1dd", "comment": "Malware payload (Mirai)", "value": "61860b32b3a7c446b9d2f31ed6d70faded3826ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379656, "uuid": "8089e13f-6b77-4f9f-9b0d-a53aefc2c705", "comment": "Malware payload (Mirai)", "value": "a690f56fd9740cfcc4e4088ec230f28dee211af4a9823fa2750755086581665333122fc4cb1a143185fb277ec66eeff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773379656, "uuid": "b932ff1c-004a-4ab3-82d5-d732a200b821", "value": "T1A4341845BE409E37C7C1667BFFAE42CD332617FCD2EA3202EE015B25369A55A0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773379656, "uuid": "8838bae4-2eac-4466-8797-e1de13e613ff", "value": "6144:Ar5JapqBX86lRZpFzUt0cyfoNbhmkLjC7dXOle0jMCKyq7shqqCe0Fq4I6aRi3B0:EJapqBscR3FzUt0cyfoNbhmkLjGdXOl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773379656, "uuid": "f9818f4f-e205-4a24-881d-a4d49d5e9913", "value": 250648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773379656, "uuid": "1080498a-72d9-402a-ba58-13719897274a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773379656, "uuid": "6abf15af-b156-42dd-a0ce-b543700ffedb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380ae4ba-1ea0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773380890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380890, "uuid": "2bfd3189-0e4d-48c4-94f4-433fb27d0d52", "comment": "Malware payload (Mirai)", "value": "d47966dfd5d466bf84792306f9cc60fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380890, "uuid": "6c2964ae-8c6d-4139-9b4a-0f20291980cd", "comment": "Malware payload (Mirai)", "value": "0c4754a63d3d3a5a4871d238c8eeaed440cd3943b0915c3c9d0c3856d165bdb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380890, "uuid": "13a8754e-a0aa-4a78-bd78-efdd390b84a0", "comment": "Malware payload (Mirai)", "value": "35f90ee80b9b003b0bef6c63c4ba55be0b10e10b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380890, "uuid": "a8805547-afcd-4fc3-8bbc-c8428e0d858f", "comment": "Malware payload (Mirai)", "value": "425ee505ef68124f9e4b2b987fa3a3c36cbb3c4b2008cb3c63824f8d489f33f91d2dee66e81b9b759eb5f49679ec014e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380890, "uuid": "e9a91963-4619-4719-ba2c-99bf0fece348", "value": "T17E242955BC416F25C6D126BEFBBF81CA33232BFCE3DE7112ED0457143A8A85A0E26552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380890, "uuid": "50f7a25d-c31e-4094-b33a-8572ebcb06d9", "value": "6144:CVMnmK67/+LZmppaLYB8/44JaQKiB1IqjwZYBkID8a9Q108W618lydqmLPa:dnBM/fpa08/44wC1Iqj7BkID8aK108W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773380890, "uuid": "0c84ccd3-e580-4999-a630-e9b27e311bc9", "value": 228544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773380890, "uuid": "175ae720-4d9c-4828-ba5c-6483980b48c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380890, "uuid": "e404c30e-33f5-4487-ba28-eb3b3f363c11", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da84ce0d-1f33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773444299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444299, "uuid": "34cb2d7f-dcad-40c0-8228-89c80973a23a", "comment": "Malware payload", "value": "7846b810927322294da505fbfccfccd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444299, "uuid": "2c38bce2-b9b2-4001-a7b5-7a9dd01d9355", "comment": "Malware payload", "value": "106625e85a7e40e5183fd6bbb30707ded4c25cd081589856d4cd5a6a703f2cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444299, "uuid": "1d78c1d2-3fa7-463f-88f7-a23b92bf0a93", "comment": "Malware payload", "value": "19b6dcd683016519b1bc4a8cccd3d1a59eb3dbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444299, "uuid": "569e0ded-b353-486f-bf31-811893cca40f", "comment": "Malware payload", "value": "d7f3c87d23a2fad6de12d01240847446817911f847424271b2627d0d62d4f773e983b98b2f60a859aaf125ba205568e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444299, "uuid": "ddb58ca3-f90a-44ce-8a7c-6fcfa19daa8a", "value": "T16E367B5FF95124A3E7B4DA3DB267AA1C872DE26BE906E757017823C3CE21291C6C1707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444299, "uuid": "8d9dae7a-e755-4606-b037-26e81ba076ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444299, "uuid": "0a2ca744-ae90-45b3-956f-eba0ec27f5a5", "value": "49152:0oRdxEeeb5ZDCvzz3ex4a77hTSEWJjCE9tkZxh3HBe:Rx9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773444299, "uuid": "760c9b9b-195d-4646-b3ef-0986063a9799", "value": 5317632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773444299, "uuid": "8efc9e1c-c0b4-4bb8-8eb0-8ae4d4a25b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444299, "uuid": "461a33a1-1f77-49ec-a785-37b7131f8c2f", "value": "SecuriteInfo.com.BackDoor.XWormNET.4.16493.3494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d744b73a-1ef0-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773415517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415517, "uuid": "ece8dcd0-589a-4db7-a835-614030907e75", "comment": "Malware payload (ValleyRAT)", "value": "8e8319ef77aa12f2335b339abf0ddadb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415517, "uuid": "1fc672b9-92a1-4c06-9b47-f1640df50494", "comment": "Malware payload (ValleyRAT)", "value": "1144433760a0683413a85da271bc37ff9f296ac287e722825f27577b529b9d27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415517, "uuid": "6ae7d987-e274-41ce-b3d6-aa12f24ba6fd", "comment": "Malware payload (ValleyRAT)", "value": "7e0e21949852a56e1179302ecef5898086aef80a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415517, "uuid": "dcf2ac36-be18-4c1d-b567-78c136a4716c", "comment": "Malware payload (ValleyRAT)", "value": "5156e21657b72905caa5c99704da6508375d44b1118a510d840648bea56251bb836908dc08708957032fc9caa2cf38e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415517, "uuid": "5a9ec6ce-c94d-42f2-8147-0283997f1598", "value": "T1062502413946C431EA9E0470943A87A59A3C7C218FE4E9DBE7C87EAE4D315C1E736B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415517, "uuid": "c7eef110-c21c-46a5-adc7-f4623c3dfc98", "value": "77d4de2c85e6058a59d6b0df92fde89f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415517, "uuid": "b4f672a4-2aae-4d76-a72d-131fb40645e0", "value": "24576:WoDh78drtnHBuiJsR9vJviJIdxV2u/dju:HDharrui6AJYb2yZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773415517, "uuid": "e3621a3b-6d51-434a-956d-d868da7c3589", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773415517, "uuid": "57a3b607-97c4-4381-a6f0-6ac08a79b3b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415517, "uuid": "4501e107-ff83-4532-8f7a-b586cbba88ec", "value": "1144433760a0683413a85da271bc37ff9f296ac287e72.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea47cf0-1ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773398403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398403, "uuid": "b767cb53-3f57-49cf-a4bb-5ff54ea63daf", "comment": "Malware payload", "value": "a18a813eee8f6bfeb6a19d963f9e53bc", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398403, "uuid": "e8965793-c40f-4cef-8e59-fb2c1e816b2b", "comment": "Malware payload", "value": "11eb7ebba4b3d73872986dbe767b76a94db38139975bd9afc0af0c17e73afccb", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398403, "uuid": "a824cb7c-7da0-4d17-861d-c166c7292442", "comment": "Malware payload", "value": "2f582dcf84d30af58d05dbcc2083fa7ee7d4d939", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398403, "uuid": "2e2f1ce8-ff12-4e97-8e44-2e7492e9da2e", "comment": "Malware payload", "value": "fd91315ed556562b1318612eaefeafe839f22a9af9570af8f1402e3781c13b3537b6ed3730305f12257938cb621810ce", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398403, "uuid": "18b6ded4-4de3-4c67-8f11-954024b3ccdf", "value": "T175D17293944224F54775D6F68767EE34D303B26724068862BEBC89693FF0427B1A1EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398403, "uuid": "c9c0a89f-c130-401f-bad8-90251b1ce4e5", "value": "96:bRB8k6CR7VX1gylWIhNtCBIhNvxy+JaoRmolKOK2KieZKIMjDRDQaI3pB:H8k6CR7VXuylW34Eolbf2KIMRQaI3pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398403, "uuid": "78d86a6a-aff0-4d88-b578-d3808175b126", "value": 6237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398403, "uuid": "21914d02-22c2-4b1e-90ff-f23ab7eefe6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398403, "uuid": "96e19440-b813-441a-abdf-acad56a1a161", "value": "BkVZexp8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1246e6c0-1e89-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773370949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370949, "uuid": "0e1bac12-b872-48be-8f31-4481bd9c5874", "comment": "Malware payload", "value": "5ae507fa4227455ad5c2dee28c62b5aa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370949, "uuid": "509e4169-bcec-4640-8171-a30ee9db085e", "comment": "Malware payload", "value": "12ee851e4fdb49b7b4cfcc70d1a0d610ae00636ac08f1c3579182fed44980ff8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370949, "uuid": "34349b6a-a0e5-4f3a-9ea6-8dc0c587063a", "comment": "Malware payload", "value": "71343e98a6bf46f1e4c95a24968d7fe35fd1b46b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370949, "uuid": "d5dccb96-ae0c-4fa7-b9e1-e8625a528d19", "comment": "Malware payload", "value": "77c543af3d056b69748dd7f439af0f3d1796d6ba92008e728f448a60f60801bb4af8a80c0f23a7df630aa89504bf0226", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370949, "uuid": "7480a958-8869-46c7-a9fc-e74d2b9aea16", "value": "T1F062473721F14A33A6E054C8A2771BA15F72D617856720B8F4BE26369F5DE0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370949, "uuid": "42012baf-b549-4bc9-bc40-00c8ed3be8d6", "value": "96:cCuhmB6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6Ml6fz7+kxBhj:cCuhK6p4hvZ5m5FG4j4HKNphvIjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773370949, "uuid": "72f09923-7542-4028-8ac9-84bd78e03775", "value": 15322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773370949, "uuid": "b25a81d6-e499-4d81-bf91-5eef37c9a3b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370949, "uuid": "cfb6f1c4-d662-4d17-b0d2-40787eeedb01", "value": "12ee851e4fdb49b7b4cfcc70d1a0d610ae00636ac08f1c3579182fed44980ff8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9e30ac-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773412149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412149, "uuid": "f14061cb-0e76-462e-8320-57b5219a1e10", "comment": "Malware payload", "value": "50e412156c1f88ebf22be14490a57fb6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ProSpy", "colour": "#F759CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.ProSpy", "colour": "#95BCC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412149, "uuid": "24f01bef-f682-4663-b439-c1efd05d1bf9", "comment": "Malware payload", "value": "134327faf84fd493b16d027af9958fa93fc1129b6053c5eb0f372ea518691138", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ProSpy", "colour": "#F759CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.ProSpy", "colour": "#95BCC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412149, "uuid": "1069a177-078b-4774-aaa9-856606f320c5", "comment": "Malware payload", "value": "aec02949113876e7348a55cdb266cd879953a8ba", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ProSpy", "colour": "#F759CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.ProSpy", "colour": "#95BCC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412149, "uuid": "593842a3-a231-4d18-a0cd-a2888e2abe4f", "comment": "Malware payload", "value": "d0b8d5b7a1261cb02c1b80df26a4e58747b377ac043a25f0a7adfcbddd7b67e2ce9f10d475ae1a478ef64cdabe075e1e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ProSpy", "colour": "#F759CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy.ProSpy", "colour": "#95BCC3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412149, "uuid": "5a92b075-c8d3-4835-beda-9ee350fce3be", "value": "T1D0D5BE46FB58993FC47780334A6A1736716ACD168A82D747795C331C28B7AEC0F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412149, "uuid": "5946edd1-61e7-43ee-909f-4c10f76d068c", "value": "49152:TY1ry4tvqitqw7Rzt274Rd1dVDNGvENkLkmuf/7Pqpz4zfrzN+5O:T8e41Kw7RJ274Rfd22kLjufZzfrzNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412149, "uuid": "bf29645b-d8dc-43d8-a5c2-5441f5ff9f4e", "value": 2798738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412149, "uuid": "74d541bd-2195-4849-9eb8-9090a2024997", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412149, "uuid": "14f120b5-40d7-4f81-8b9f-dbf277c1d2e1", "value": "Totok_pro_v2.8.8.10118.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a7ab7f-1e9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773378851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378851, "uuid": "028cf56b-8ffc-4753-abc3-95e88d393b3c", "comment": "Malware payload (Mirai)", "value": "4132ab71bb8e4f2b44b2f9d32130d6f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378851, "uuid": "8ce360a1-eb5b-47b8-8c7f-7590d3da1181", "comment": "Malware payload (Mirai)", "value": "1523cad779e7f197e40b2b20e0b6a862b241028ea16cd3e74370071488069dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378851, "uuid": "f3122467-a744-4806-a590-810b083c6052", "comment": "Malware payload (Mirai)", "value": "137a30504c8e02aad22bc067f12cbf134c5b71e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378851, "uuid": "37610975-adf9-4a2e-87b5-8b1ff31292ab", "comment": "Malware payload (Mirai)", "value": "cda69101e665903d8620f116279a8aa7ae12a198783e8801477cff0c1b044e4c42644399a98afde4b4ce738f46be9cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378851, "uuid": "a1bffb2a-e402-4efc-bcd0-84398364c275", "value": "T1AA343807A99480FAC4D6C2788FDEA526DA75F80CA134B51E2BC56F263E9CF209F1D711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378851, "uuid": "2f5559a0-339a-4a94-9769-27d1f6de881b", "value": "3072:yVY/eEPC6dI2BT5xr+TFKeIuZtQZyNfzQjZLjY1jHdDgAnjzC5V6cIXW40RS:TeEdmq5xr+TFjZs9OMAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773378851, "uuid": "55ccf84f-b9a8-4919-99de-affd829f2c16", "value": 235592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773378851, "uuid": "6e0275a3-1b5d-435e-a623-c0529edc4d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378851, "uuid": "bb5ef500-53f3-47eb-ba4c-2fbc172850bf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181fe803-1e95-11f1-a769-42010a9c0008", "comment": "Malware payload (SilverFox)", "timestamp": 1773376112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376112, "uuid": "e77b4a71-aa30-41a9-8449-7311cc3717d7", "comment": "Malware payload (SilverFox)", "value": "50a39be199a68c6c955d742885a167c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376112, "uuid": "51bb91df-8852-4bd1-b244-294e95410737", "comment": "Malware payload (SilverFox)", "value": "15ffbf387a631a8fae5857cfbfef90d02db9fe86f7052f16f1c0e99ed9c01bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376112, "uuid": "3d9f8c32-1b20-4d86-a44f-70dba36377bc", "comment": "Malware payload (SilverFox)", "value": "a74d936a22f091db824cb859a11bf13922802ec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376112, "uuid": "4d717b10-323c-4562-9d07-77be7b4759bc", "comment": "Malware payload (SilverFox)", "value": "48dbef8829b6406bb9878804a7c98601f7f819ed191a3d08c9f8521d2b902e981558121716c4017e3fb5ac3470300cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376112, "uuid": "f2cc3521-b0d6-4abe-b9a4-fd4c392835ce", "value": "T19606334A7361F780F8C1EA7CA79DE1F58F9C7CA5370A808076BA35971792828DE7C056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376112, "uuid": "13be9982-32f2-474d-a2e1-936723ae237d", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376112, "uuid": "51bdf970-76ef-4888-8da9-5f1cf4718e0d", "value": "98304:ev7ib06EmG/9acF7IZg+PU4tPUE1H1ybjo:eV6EmCacF7IEIPUE1HCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773376112, "uuid": "c1c91f7c-9fed-4836-98e9-0d6fb7dd0bad", "value": 3731561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773376112, "uuid": "27e646bd-d5cc-48dd-9398-bc09e4c44495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376112, "uuid": "eba6e6be-6ee3-4a72-8904-8de761315aa4", "value": "164ipnew-\u5b89\u88c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81b921b-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1773412512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412512, "uuid": "2cc23bf2-d7b2-449c-9694-3b7083043785", "comment": "Malware payload (Cobalt Strike)", "value": "bae5c0247eca4650f03440fc927e3c9b", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412512, "uuid": "39984253-0191-4e85-9d25-1911ad9c1dbf", "comment": "Malware payload (Cobalt Strike)", "value": "168cc168723a7f267d476c3b334f064354ccdc19b70cb140d1b49128705ab587", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412512, "uuid": "ad496c18-8e98-481f-a6e7-54aaa11bda09", "comment": "Malware payload (Cobalt Strike)", "value": "dde46d5aa78397933c0e67071df085af50594085", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412512, "uuid": "7d94b7e3-8633-4030-9207-5723078adaec", "comment": "Malware payload (Cobalt Strike)", "value": "afe562cfdb7ca4ac3cc2e9359668e10951bdb79930c48142bdcee876b669b22664537da9c88c8ed01a7b23e61b61ed70", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412512, "uuid": "4b163d0a-7ef9-4390-8d6a-b02b3285a81d", "value": "T13325191BF3A345A8C97FC17887979772A970F8280234B97F1A98D7322F22D50976E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412512, "uuid": "aa36ab0a-21d2-46c2-89e9-81e1a0b50467", "value": "6f1cd58bf30f34a3f665cbe7825a9b81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412512, "uuid": "fce0abd9-1cd7-4b0b-984c-ca3f58945186", "value": "12288:iH2m62BeSMV1nwXfZbBzJDAW0Nq8jNnDdgTtRgEvCumcvY4rmM3Y:42m62B/MXKfpBzJDFteEv7vYmmM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412512, "uuid": "45825c8d-d102-4031-bf3e-c03118b6e6f3", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412512, "uuid": "b16e93c6-7990-4141-bb99-dffd656540bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412512, "uuid": "2784f17d-2f75-49bc-8bd1-7090e00397a4", "value": "168cc168723a7f267d476c3b334f064354ccdc19b70cb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7943156d-1f2a-11f1-a769-42010a9c0008", "comment": "Malware payload (IcedID)", "timestamp": 1773440270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440270, "uuid": "e9e851dc-75d7-4e18-8c7c-b10cd4d8336a", "comment": "Malware payload (IcedID)", "value": "8370a1edeea0634d8d5114d8dfb7762e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WiX", "colour": "#31DBE1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440270, "uuid": "b11a5512-2c4b-4231-975a-4a556fa43778", "comment": "Malware payload (IcedID)", "value": "17014299f399f71d1d6bed136b8c624a366b222166e692522d14e2bba70bb79f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WiX", "colour": "#31DBE1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440270, "uuid": "cfde0aec-d6a7-4244-9aab-efaf5fe8ee96", "comment": "Malware payload (IcedID)", "value": "584bb91abcf1999295ecd310d1166c46068692ee", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WiX", "colour": "#31DBE1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440270, "uuid": "fe7b34cb-69d0-4df1-91f2-c07d5862b1ba", "comment": "Malware payload (IcedID)", "value": "4d7abcdf7e61f4077ea47fd9c2619a5b7f400ca9b69d98d96a6f4e289bfbc19ccb571baf6f4bac600a245f6414e39673", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WiX", "colour": "#31DBE1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440270, "uuid": "843c6f95-21d1-445e-b225-1108ab51d3c4", "value": "T11D35BF86F3A405A8D977C1388617472AE3727C0513209BDF17A4776A6F33BE16B3A325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440270, "uuid": "371ad643-3f19-4a2c-b59c-bc7f52a6eeac", "value": "24576:uHL013k4usYYqbczfGtm4fSpHZ4LHpt0:ur013kFzczfKmUSpgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773440270, "uuid": "29671ba9-01bd-415b-a54d-2ef777150764", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773440270, "uuid": "ff8c1f2b-3dbd-4b2a-9679-8fdfe2115ecf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440270, "uuid": "cb957f3c-7db3-40a1-b6d0-e9d9c7819666", "value": "info_IR-99661418.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7919b92a-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402045, "uuid": "0b232936-4e82-4e53-9775-c1724ab7b27b", "comment": "Malware payload (Mirai)", "value": "cd182bfa01c275da6ba846aaa3f09eac", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402045, "uuid": "bbb19f7e-4a67-4f2b-a8c2-9b49cf79c114", "comment": "Malware payload (Mirai)", "value": "17eaea4bf6d745bdf1e8670979677ae45cc16b221a169185b35a4a05d393a004", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402045, "uuid": "df640892-ebe7-4bea-b669-bae4433831e7", "comment": "Malware payload (Mirai)", "value": "af922f092da9dcdfc79fe55d2c7113d5e6c78cc8", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402045, "uuid": "5ef312f7-7638-4d04-bea1-bf382179a3af", "comment": "Malware payload (Mirai)", "value": "178fe9837979601ca32f41f374d3efd808d190cd49dc2d8f728fe12a69e0892c52d0f4d29141afbbb0458b6bff5ea643", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402045, "uuid": "6916c7cd-b22d-46b2-a629-c198ee142671", "value": "T10F834B52BC819612C6D462B7FB6E418D371213A8D2EF3207DD256F2437CA92F0E7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402045, "uuid": "d3c25ff3-c528-43b2-a1bd-9882a49638ab", "value": "1536:+wYBsRSceObTT7/jJB/lptX9xxM/nJIlSLPza4oIDxnoRquYvAOob6OO4XXHeT2I:+wYyRSObX//lTP+/1PO4vxnCqrvA5VH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402045, "uuid": "da2a0fe7-10f6-4d39-b33c-ef102d346a0e", "value": 87300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402045, "uuid": "7e21a370-d260-4e4c-81a3-5e1ac782dc40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402045, "uuid": "82e534f7-a9dd-4cba-a300-1f6eac7396e7", "value": "tux.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945e6b60-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773433873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433873, "uuid": "e81583dd-4346-47fa-bc74-ff99203079c8", "comment": "Malware payload (Mirai)", "value": "18ced86789d1a361dd33a5552f4bd279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433873, "uuid": "40296466-e692-401a-9b3d-94d3079871d9", "comment": "Malware payload (Mirai)", "value": "189181e8ff6a0747ebfc84260846f0e7d032690e2b0431d798f2ae927f65eed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433873, "uuid": "733f7cc8-0ed0-4cf7-8915-94f16d1cb694", "comment": "Malware payload (Mirai)", "value": "4315ce0c9f9c89466ece795a87be7a723aa4ab4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433873, "uuid": "3c3b8639-ab42-4f8f-8a6a-b9383c84133e", "comment": "Malware payload (Mirai)", "value": "025b97dfa15ab980d80797e9725c7825e910f0a0344be71982f766b207e7f0404a054067c5acd9e00eef753229863201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433873, "uuid": "4521aea0-a946-4ad9-a6be-5028b13e9c18", "value": "T13B930856BC829B11C5C412BAFE2E118E331327BCE2DE72169D209F2477C792B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433873, "uuid": "1ca2fef7-ebe2-42c0-a76c-e4963e393ac1", "value": "1536:ilnblz3HfxY6osGTqmZddftvUo608JBhoXrCrUaqo2bfGCvd+YiMSVyi5tY47ypF:KzXZYtJVv7YiCrUaqoASVyivB7yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433873, "uuid": "a1aa2ef3-279a-4aae-bd7e-62a41ecaadde", "value": 96472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433873, "uuid": "aa39bdae-aa21-4d78-8e73-a7af5c047e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433873, "uuid": "cc0d412e-50ec-4449-baea-7e095a91c7a5", "value": "tux.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0de9c7-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773433807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433807, "uuid": "17c86e47-5ff6-44bc-ba94-75b2ece99466", "comment": "Malware payload (Formbook)", "value": "3497f8de4ea3088bb8253fa6e63fed31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433807, "uuid": "63e0540e-ed5b-4a7f-9dcd-455760934e56", "comment": "Malware payload (Formbook)", "value": "1894c222066a2123ead5e5bbdaea7fbb06d0ce2acddf5da9ae4bd9969276f1ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433807, "uuid": "4410692f-bcd2-41ac-809c-d704eeabdafa", "comment": "Malware payload (Formbook)", "value": "c743e3fa89088f6d8b3baef51ab0de1cbaa167b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433807, "uuid": "491ad019-74b2-42af-a2ed-558cc8a04178", "comment": "Malware payload (Formbook)", "value": "94e33261ab8b3683ddd8fec6da8ca5635d72a8c779aad662ce45cd0422f9bba5fe1a4e0120ed760d9eb3f8967b1373be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433807, "uuid": "b62e5fbb-47de-4585-898b-42302843e063", "value": "T13835BE0273D1C062FFAB91734B5AF6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433807, "uuid": "b5bba8c4-548e-4450-b825-d84a4754e523", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433807, "uuid": "80aaee40-7a6f-42fc-b085-3fe840c3265a", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdaFwTdMfX:vPVt/LZeJbInQRaFid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433807, "uuid": "0910b55e-e5f0-4ccb-bd96-b4b58336230d", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433807, "uuid": "d109016e-5b70-4cec-b168-11c013f77998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433807, "uuid": "f550f299-7d36-432e-9e9e-50f6395abf14", "value": "rConsultadePedidodeCompra_CRM07540001965_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2ed2a-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773412711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412711, "uuid": "f544be8e-e9ea-4310-a48b-49a746aa3324", "comment": "Malware payload", "value": "d6db096b235deef2074e809ed453e0be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412711, "uuid": "f463d118-0341-4634-b5a0-774317705fdc", "comment": "Malware payload", "value": "19e43b418f08501f87a2b6ab69805d18faf6ceb35ef1ce593ecf35137a43f472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412711, "uuid": "5514018f-2a4c-42e4-b46b-a3fbc7ca1f79", "comment": "Malware payload", "value": "3e5c70b1d80cc8e4d8c85f1c775da54642e01c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412711, "uuid": "2b6832fd-2884-4357-bf33-7e3cf44e0c50", "comment": "Malware payload", "value": "6d9c71e0cc3a4e56d9bf4c6a032384b9cee45e3e07ecbd85875d70eb94fb2485578c1463975e230bf431742222f12952", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412711, "uuid": "e4d39a0b-b674-4d77-b777-c5741685288e", "value": "T1FD04F186FD914BEFC09FCE35091F124222BC89EE8792632B517C8D4C75DA259DAE3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412711, "uuid": "e8b9da43-b6a9-42ce-84c8-207f7a1747d4", "value": "3072:oDTIzc663gmljDcfxykNYhVdY9/NF1VLJY7WvwIw4HYJN3qcJE:rzR63rNDkMkNYhAdJZhE356", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412711, "uuid": "63c950a7-0687-4588-a014-ab9c41a83566", "value": 180213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412711, "uuid": "a24a5274-4213-415b-baa6-f43aafe517f8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412711, "uuid": "0a1c8281-e3b0-4204-95f0-abcb626bc07a", "value": "nnzlphr2vt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45eac2b-1f24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773437900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437900, "uuid": "0e00beb0-6361-469d-8fad-5e8349eb72b5", "comment": "Malware payload (Mirai)", "value": "d8b413945f053698ebb243ebdf7a8e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437900, "uuid": "afda3dc9-1350-4377-83d4-f6b9707827ce", "comment": "Malware payload (Mirai)", "value": "1a60b4003018a74761517e47e4592a6b194e8e5accf64462a7ebd89c0e12c546", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437900, "uuid": "6df07884-2dc9-4184-bf1a-ddbc9d63ede8", "comment": "Malware payload (Mirai)", "value": "89f8856f1b8b1048a7857ce01f7a8fc232272e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437900, "uuid": "218940e2-c6dd-4095-8f84-53db5823e615", "comment": "Malware payload (Mirai)", "value": "9b54676082d3a2b1f7daa732f42a2add8c4830d01b8aaae3eb55939ecdae93f7d4e318d48a3eef8a0d89f282a1ac7fab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437900, "uuid": "404e8857-5df0-46f1-be0c-aa4f62bc38a6", "value": "T13043E765B892D957C2D01376BE5EEB8A332573E4CACE3223F9255B2C3A8651F0D17E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437900, "uuid": "a0839f48-b253-4401-86fe-9a1e52709c2e", "value": "1536:j6QISRZGnf/G5/UGKvfbskNYsA4aLSf9R+JRX8R:uQISzGQBJk6WaLSf9IJ58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437900, "uuid": "5e9394af-153e-4c4c-a019-ce1f64e255f9", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437900, "uuid": "c6adffce-c477-497c-a6ec-0c5fc98aab08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437900, "uuid": "9829a48c-e8f8-4d06-b442-96fba2659f82", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86faabd-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408271, "uuid": "b3db7974-b48c-479b-a85e-d00d7d9fc680", "comment": "Malware payload (Mirai)", "value": "e8444149f49c1187e96ba64959957531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408271, "uuid": "6110ceb2-9482-49b2-a345-51962577f77e", "comment": "Malware payload (Mirai)", "value": "1c2a76792006add10b0a1d0685c5e8c26790d3dd87fee70e738bcab340305568", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408271, "uuid": "8976ffe3-4eec-41fd-93dc-df1a17cd546c", "comment": "Malware payload (Mirai)", "value": "a95809982b61709a59d3e014729fe38fec043c06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408271, "uuid": "2821e5d8-f5f9-4691-b59d-500bbb5153ee", "comment": "Malware payload (Mirai)", "value": "2144578aae271b501047b31454b6e493e135536d0628337596a1586332a816e5096336d27cd7d38ae519863e360e9404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408271, "uuid": "96518299-1cd4-45bb-a6cc-2276468c6676", "value": "T152D3E125F8D0DBB2DAE1257EF74E114C73134379D2DA3302CD289F26B3A665A0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408271, "uuid": "9dd178c1-05c7-4ffd-a7c2-d593a183f83e", "value": "3072:rponhnSMawBelnegY5Drl2bTUm6LiNKSGgEN+Q+lJb:rUhSjwBesgY5HpiIh+zLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408271, "uuid": "43aac3ef-35d9-4945-9045-d3e438730f99", "value": 141446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408271, "uuid": "599f5a42-78ec-44fc-9b38-4dd7ee209eac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408271, "uuid": "31f828d3-adb6-41d2-b73d-5361432e1e71", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383dce38-1f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773435437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435437, "uuid": "e99b1051-9bf4-4d28-b73b-f10168ecf225", "comment": "Malware payload (Mirai)", "value": "17b6614a55653f0df850f9b8436bbb6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435437, "uuid": "9e0afa19-e0d5-46ab-a6a6-4de439e5bca8", "comment": "Malware payload (Mirai)", "value": "1c40d55cdbef793aa41d94abb4005a82937a67650bff11adafa9820341249ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435437, "uuid": "95e93005-03b0-40df-85f7-73ad6d5122f1", "comment": "Malware payload (Mirai)", "value": "75983375285980d688a780b509e24a577cdd13e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435437, "uuid": "7627f01c-6f72-4ee1-a5d1-eb62286d40f7", "comment": "Malware payload (Mirai)", "value": "bac4c400c63816137c703ab59ce6c9b261dbd3bb675c420807cb9950cf42a512b7fef42021de7ada4fe8ef57acba1883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435437, "uuid": "7ba1028e-d87d-4d4e-a3a4-c0b931c4cd33", "value": "T164934A52BC829A12C6C012B7FA6E428D3B1213E8D2EF3217CD255F2537C696F0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435437, "uuid": "7a9e3282-4422-4840-9fec-6cbce11a9882", "value": "1536:k02D9fd/sCV59afIFSHLdCfIx4T2nD4+GQcM6sYjrD3FJq/xYX74oVOWXr9HQz0X:k0o91/sy7kLEijhc/ZjrD3fqZYXESB59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773435437, "uuid": "157132b0-0c3d-46ab-8be3-a88fdd0b4e8c", "value": 91772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773435437, "uuid": "4c43af6e-ed6b-447b-83cf-0152b456d0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435437, "uuid": "96a2765e-298f-4e7e-9277-acaa50166f7d", "value": "tux.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f17bf7-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1773412985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412985, "uuid": "af71f371-2f59-4f8b-9b04-8e8c183c1024", "comment": "Malware payload (SliverFox)", "value": "d9bdc7e6df3245feee2f9666e52ac922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412985, "uuid": "63a8cc46-0df0-4aa4-b5a7-92e0f6303cb1", "comment": "Malware payload (SliverFox)", "value": "1d0351d580e3c10a3178b614d70d1867cb003ff8da0a25fbeb1e8a75e0aad68a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412985, "uuid": "cedc55d0-7fc3-4315-a295-d8ead4d4ace3", "comment": "Malware payload (SliverFox)", "value": "730dac84723982fe9bf65ac086ababb0bbea04c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412985, "uuid": "b4603389-4531-42bc-b68e-9cae4c42a4df", "comment": "Malware payload (SliverFox)", "value": "15778c7a8fadb3efdd5474025f18a753fde812f37fb9bd590080d6ab1e2eba8faa46d008d5d9b96edf0857dee97789ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412985, "uuid": "8479a589-f0aa-4577-8090-ead53482f1a6", "value": "T172A533BE9E6D92C6C0AAF1B4A2315193B4503C4CD170E6976B801B6D17E36B0E8D63FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412985, "uuid": "2e73cb63-1c8d-47f2-9e1a-1e930db7cbc1", "value": "24587f39ebe7f0e9605e30bcc578e5dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412985, "uuid": "5618f34f-e323-4960-94a4-f29a9c3b05d4", "value": "24576:sd4sdwMufeW9tZwJIiTOTbcKNURo9P9KXhVy0LOTpwwOTpw/j:AX2F9ohewwew/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412985, "uuid": "97556ec3-7e95-44d1-a704-6216ccceadd6", "value": 2176512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412985, "uuid": "f249ff3e-9c7c-4f2d-b75c-0df0313f6628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412985, "uuid": "168875d0-8d5a-4325-be59-988b3a59b9ed", "value": "2026.03.13...\u4eba\u5458\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d722df3-1eb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773389140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389140, "uuid": "226fb7d3-ff1c-4301-beca-05b136a94624", "comment": "Malware payload", "value": "7329cdbad63f6ae80dec4cdab90566bc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389140, "uuid": "568bafb3-f58b-4f9a-8ce2-fa2f286e65aa", "comment": "Malware payload", "value": "202dbd0d7381da0ee94666e120d17652ad54d628ed98aa9d8b43e4a83603cc8c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389140, "uuid": "14269826-66be-497c-a595-e544aa61d6f0", "comment": "Malware payload", "value": "abf4fe4ba7de93adc94e98687ed70b6cb78f9a61", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389140, "uuid": "cabe1bb3-6509-4aa9-adba-aaaa7d670bb8", "comment": "Malware payload", "value": "c10eed334d63004067e4cc07366011eda3ef051fe22a92f1e1ffa8db7f6cfcf586016d3686d0e0306cc3c976048342fd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773389140, "uuid": "7c13dbf1-1466-4840-a874-e14196c66ec8", "value": "T14625230C73D9ED34C9BA833C45163121A2B2EE920412E2D22644777AAB7FE577B1D2D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773389140, "uuid": "d7a2eb6c-66df-4b94-820b-027b5686a4be", "value": "24576:32cqFCanX1JbjMPGT5/sTl+JfC89M4I8syE1ATaj0pXBo:14/XHoi5el+JfChoE1ATRp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773389140, "uuid": "5db1fe2c-c6f0-4c80-8968-f9ec016a84d4", "value": 1021152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773389140, "uuid": "8e2555ff-4c24-4b0f-a8e6-f6c4e77728e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773389140, "uuid": "7d95bccd-3226-4885-ab21-b394902acde3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2868bcb-1f22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773437011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437011, "uuid": "5f02ec9c-c5ed-4ca8-a0c8-1e63aac73b6e", "comment": "Malware payload", "value": "2d212955d91e4e37951ff4149337f7a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437011, "uuid": "9f510195-4d0c-4026-a1d9-16a440331d70", "comment": "Malware payload", "value": "2122aff7c0fe08dfd973c421f4fd6211406f6b9f2f9526837bdc947ad5c342a4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437011, "uuid": "708370c7-fe0c-47a3-a72a-d19ecc5b02ae", "comment": "Malware payload", "value": "2194f6afb168589afa66f88c909ee7afb69f7e72", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437011, "uuid": "9534de6e-57e6-4f69-9b7a-93c018d88c03", "comment": "Malware payload", "value": "cb3ee61b8062d2f1ee17617c9ccdb9ce529916b6e661a419853679f4453b8bcd37d4bb3199b5ba27eab6baa6ad272218", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437011, "uuid": "f7137257-eba9-4518-9338-24a0adbe5762", "value": "T1DAA27E7621F04A33AAD055C4B3772BA14F72D65784A321A8B4FE1B359F59B0370FBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437011, "uuid": "0f3f4df0-edbd-4e76-87cd-35b4c18126d7", "value": "192:cCu2g6p4hvZ5m5FoKNpivFDFCrxIT+10DUwoKmjLaeOWO+8TRiQ:Bbp4hvZ5m5FoKNpivFDQrxIT+10DUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437011, "uuid": "8f1e0bf3-058a-47fc-8a4d-26c2e565bf0c", "value": 21422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437011, "uuid": "ad220c0e-e8b0-40d9-a5e2-ae13e51dc8c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437011, "uuid": "f0662ab6-5bdb-474c-94ef-10462436dd71", "value": "2122aff7c0fe08dfd973c421f4fd6211406f6b9f2f9526837bdc947ad5c342a4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a41d37-1ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773398093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398093, "uuid": "229a0db0-46bb-44f4-9744-b9a2063739fb", "comment": "Malware payload", "value": "4d9dc904bbefd9983bac70c6592b54fd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398093, "uuid": "09dcd9f2-e8e0-4c82-857b-c2fdc20837a7", "comment": "Malware payload", "value": "21b896dc7fa7383cbc6db0f661522c7a5f0d409e1eb94447df02fb5d1cbfd822", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398093, "uuid": "47b10439-fa10-4c98-8727-5d2649e9df0e", "comment": "Malware payload", "value": "a380e7a258753cb3c9bf2aab91d6c792cdc626f9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398093, "uuid": "3175821c-4c0d-4693-a061-141079de38d3", "comment": "Malware payload", "value": "0d5ee141b32de3182e6f081f0fc32aca1b5706c86af7134b403d29dc15ede5476a279a45423d28516d3357039c28edac", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398093, "uuid": "9c52c30f-da34-449e-8a9c-20aab196e8a5", "value": "T1E84144707789579646735387A506D658F03CA1AB307E0E40B1DED1C44F77CA8EF28AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398093, "uuid": "e4f18873-26fb-47e1-9a6e-c1a1259a5b11", "value": "48:cft9o3XYTG6HoVmWKKA3BvxDlEO7FupBzhVCji:uiqGWb37DlEOABzXCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398093, "uuid": "b11d38c9-5faa-4e31-aeca-87f0713b82be", "value": 2435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398093, "uuid": "00b0d652-0a32-4c60-b846-76516073abe6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398093, "uuid": "5b9c63c9-7535-4f8f-8f81-d709db3e64f2", "value": "kyZ7PbSQ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555c1e43-1eeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773413152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413152, "uuid": "5304dae0-9b7d-48aa-b268-6774c2b2f273", "comment": "Malware payload", "value": "92f3fb560023c4617d7cf2e19f779051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413152, "uuid": "772c4594-7c37-4089-aa52-7014608b0c9d", "comment": "Malware payload", "value": "2405e493badb72b08eafafedd7a47255a3fa119df71a11a7a907cfd217841404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413152, "uuid": "e395cd3d-861c-42c6-9f4b-cd5674af54d9", "comment": "Malware payload", "value": "a54c3ab0ca9a477b62f7efa0c424cee651bc00a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413152, "uuid": "8c6402e6-41d7-4e96-a814-ba521f97b135", "comment": "Malware payload", "value": "ef01f5a46b32e39163107852a331bf1e16557e0e74b8f658745fd288378762c3a4dac706929027b6c4a2976b9d8bef37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413152, "uuid": "dc237cb8-5a33-40c8-8550-ebf39749f982", "value": "T18EF57CCAE3ACE0D1DA95E0798407462FC3B3FD714131979B4067A7896F732720E6A369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413152, "uuid": "1ea2d6ce-0c76-47a5-9bfe-f28359ff3254", "value": "e8f285ff2151390bd5f405e8c68a8886", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413152, "uuid": "328121d0-0ad7-42c2-9d0c-4b17219549df", "value": "49152:N25rCZxmzvjToshXH9KOjLxpCIPgreE7s4UyPdXaXao1pjfglglH3QWvRfZLFrSX:GZl91pjfglSH3NRtFrBEHB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773413152, "uuid": "b95cfd6f-debb-43cb-8eee-0563ee62dad9", "value": 3404800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773413152, "uuid": "cdf6f142-ee4f-4582-b56b-57102a730d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413152, "uuid": "a79e98e8-36c2-482c-95f5-78848b171a31", "value": "\u7535\u6c47\u9632\u6b62\u94f6\u884c\u70b9\u9192\uff1a\u94f6\u884c\u65b9\u9762\u8bdd\u672f r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a5cae7-1f2b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773440563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440563, "uuid": "a6dd67a2-c661-44be-906e-933740c45bf7", "comment": "Malware payload (QuasarRAT)", "value": "16fbf7e446efe4478ccca57545a5c446", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440563, "uuid": "66187f63-c9b9-4f3e-84ad-5e868002590e", "comment": "Malware payload (QuasarRAT)", "value": "2593c1b9b0ae1bb691ba61e9e6c067e1fa947547ce082459d8ecfcceafae8e67", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440563, "uuid": "775e3a25-fabe-4bc8-a776-bc0cd488e70b", "comment": "Malware payload (QuasarRAT)", "value": "8c828dce1385aead22a94ea85bced6086defc59d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440563, "uuid": "197e9f0f-8df1-4667-bb3a-01ea2218c879", "comment": "Malware payload (QuasarRAT)", "value": "91266013bd5c89ab8ec08c1288ccad02eba19ff4f79eeafcd71d771aa86fc6cc7b7acfb7594ebcec81593b3ef43d0a32", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440563, "uuid": "4144b568-f389-4dd3-8791-23fa0954540d", "value": "T131E55A0477F85E62E56BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440563, "uuid": "65c1b5a0-9913-4c3a-936b-4fd4957257d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440563, "uuid": "9121540f-3553-4671-9c24-f26342a6e83a", "value": "49152:KvyI22SsaNYfdPBldt698dBcjHmc2Bmz/LoGdpTHHB72eh2NT:Kvf22SsaNYfdPBldt6+dBcjHmc26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773440563, "uuid": "ad63db9a-cbb2-4b89-af58-ee1a074ddb4e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773440563, "uuid": "3d846843-8ed9-4f95-8789-7cd765b3d562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440563, "uuid": "9d0b1e4c-482c-42b9-b1f2-37f3af421bb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450d50f7-1f19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773432881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432881, "uuid": "233a5580-628a-44d4-bd09-d211f1ce8b14", "comment": "Malware payload (Mirai)", "value": "b21e040fcb6bb1dceffb278de79fcf84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432881, "uuid": "e7d96233-e302-4e89-aafd-01183ec70fbf", "comment": "Malware payload (Mirai)", "value": "26134974a506574aa70bb0cb67c51908a8375316fff622a615e62e245fa98ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432881, "uuid": "7e43187d-ba93-4a8e-be5f-e77623120015", "comment": "Malware payload (Mirai)", "value": "afd4958abea0de26fc77ad2e6ca4af0c5910afd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432881, "uuid": "8dddbfb4-3f26-4ebd-8e02-21b3ed1fd9e3", "comment": "Malware payload (Mirai)", "value": "4c032de57acac1d938f6e18f417ec037cb47ab3877a08f9df82e7b6671d6c7c3379d927a6751acaaaf5cc1740dd859f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432881, "uuid": "181920ae-bd16-4f75-971f-a89d22fbcdb6", "value": "T156B36CC4F743D4F2EC4705B05876EB369B32F479192ADA82F3649B3DAC62501DA0A65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432881, "uuid": "fff1c65f-40f2-4e68-99c2-c29894006cbc", "value": "1536:dw7whN/occ/tCogPZ0EZBNhTIJDSYXUwl0jSNhqMClNhsEM:dw7whFc/MogPZdthTQDNXiuGHhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773432881, "uuid": "bf48eb19-e087-4e64-b291-e1902af9db39", "value": 116780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773432881, "uuid": "323bf779-28ee-49fe-9049-d6615a17a36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432881, "uuid": "2ad49e73-d62d-45ec-9d4a-668f14663559", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403b4cb9-1f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773426431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "f74d9844-076b-4a5e-9c73-648a7d15f94b", "comment": "Malware payload", "value": "62e5b0545c85861a63e1007d16b763c2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "2d4f6a4f-86d6-498c-88f5-ebd40823a9ee", "comment": "Malware payload", "value": "26b9a758edd5692febe05d1d4e04db8e2b8de7a5cc4e54a382cd26cd96f90718", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "90afed64-1d8d-42c0-acb0-8d2e4bf6252c", "comment": "Malware payload", "value": "9bb177a0b100180638de5eac22ac317e4464aac3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "3eea1646-a739-48bd-be79-26bdf8f38c05", "comment": "Malware payload", "value": "773f031514676a6851811f0ea28fa4b2c373bdbfbd5bf24a3a3d70bf850a3b11a47dcdfc88fb3278344455ffda41e2b8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426431, "uuid": "bafc00fc-7697-4a3d-911d-1b227a89274a", "value": "T1D5B77132CD450E67CAF2627C69658AE3FA60AF2F1380591BBDBCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426431, "uuid": "c71f6122-9779-4661-bcec-9cb7415827ff", "value": "98304:TYnuQVTPeYEYruf7SezvBQ7fIj7y2iwWUT5cEw2WgIf7DbIjv8m:TOqTS+THF7w2cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773426431, "uuid": "ac973ebb-0d16-4b92-a44b-1725399ceed1", "value": 49389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773426431, "uuid": "66e879bd-b6ba-4ead-88d6-eeed9a358a65", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426431, "uuid": "75e84a1e-ed23-4419-8df1-0c8557393b80", "value": "FlowUs_Launcher_14.47.7606_x64_en-US.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b327a0-1f20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773435892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435892, "uuid": "77bfea89-98ff-4352-b76a-5770cbe7e2c1", "comment": "Malware payload", "value": "b4a787ac6969cb12e593ca515a5404f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435892, "uuid": "23252d27-d581-4112-9b77-3b0db5e98218", "comment": "Malware payload", "value": "26dddc0a4215e4b47eb8180eae48627e5278c0897c9bd44018adeeb2532af003", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435892, "uuid": "2be6422a-39e9-4eb9-b5a6-560a0d4bb90d", "comment": "Malware payload", "value": "f575ced1f0d8423a22d08c84f516575c3800ae24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435892, "uuid": "af1f5bfc-52c7-4c1c-b638-336b04096380", "comment": "Malware payload", "value": "8f284c006b09ea8b080b11d8e2d0069ae88a5b9969ae280890d4563f61a18656b3b98e39d2ac83a8f9f5f028a2ee27d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435892, "uuid": "b179eb1d-770e-4850-a412-e6c509dd487b", "value": "T136B31589DA8EC8E99B5F2028491F5C07CB4D5743052EC5F0BAAF7E553F22CA471AE6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435892, "uuid": "b76592d2-3ac2-4446-888a-6f04323de002", "value": "768:IIJQE3DGLGEsqupnXY9WhyUg75YAXQgqb+MlBlBwB55isVdYMYiv/grdVYG+Cjtd:IcyRupSxaRs+Pa/LKKu3Z3a2x5hi4Qsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773435892, "uuid": "94cc00d7-519e-442e-a5a3-11357caed02f", "value": 113628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773435892, "uuid": "af8e3803-6a8b-4ee5-b2be-519138980c10", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435892, "uuid": "0b6d6e09-88d5-4e1a-908c-d66210487df8", "value": "DevOps_Audio_Alpha_7570.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0de5b35-1ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773411185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411185, "uuid": "fcee4775-a38f-4b48-9636-538b0154adbd", "comment": "Malware payload (QuasarRAT)", "value": "73c802a90f917e01f7841acceeb45b80", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411185, "uuid": "a2a5e907-51ec-44c6-be1b-8b3c1dbd6dee", "comment": "Malware payload (QuasarRAT)", "value": "274d223db26edfa2cbf6195e8ab4c46eaa3e31e97c770382a868da6d202caa8f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411185, "uuid": "856aae05-77d6-4a3f-9914-a0ef220f8e35", "comment": "Malware payload (QuasarRAT)", "value": "0d1bfd6eadff86a2cccf4b5e5d8d182a61c0db70", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411185, "uuid": "357a654d-27d9-4282-986e-ff1bd40e9e51", "comment": "Malware payload (QuasarRAT)", "value": "bc28b14e5b2cec2650036ccc83257a0980d38bbe7d5b7c496517647441a95e91e5070d2e183aac030e800c22b46d5154", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411185, "uuid": "47845dfa-d32f-4106-a079-0a446390d78c", "value": "T10585021077E88106E1FF2BB9A8B216494737F916E83AD74F5D48909C1EA7780DE907B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411185, "uuid": "6ff0578a-04da-4805-a1eb-985e236bc74a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411185, "uuid": "9fc92193-79eb-4c67-9c56-7ccb134be2cf", "value": "24576:Yg0icfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8tUSk34:Yg0LSGOGqnXpyWWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773411185, "uuid": "1f5729cd-257d-4df5-99ea-9a367c43d2ce", "value": 1868800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773411185, "uuid": "3ed89da0-dc07-4e94-b1a4-30efa59a7fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411185, "uuid": "b88a5f15-7123-425a-9a68-a2b947fde6df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bf93e9-1ec7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773397766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397766, "uuid": "10023230-5afa-4585-b741-214d5d3aadb4", "comment": "Malware payload", "value": "c0ab801078c0925a5f287ab898a8745d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397766, "uuid": "f4538699-dbf8-4bc2-a268-a3e12f5af3e5", "comment": "Malware payload", "value": "28b8a883b1279ba105855d743268045c464784e04192aaf37cd6bcf5ea8c12b0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397766, "uuid": "cc4fd142-cb39-43d5-a7bd-e371e3fc21b9", "comment": "Malware payload", "value": "0dfa87c8f73e49cce97aede6a1811f218a06e930", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397766, "uuid": "638f449d-5428-469a-b8f4-8b4651a260ee", "comment": "Malware payload", "value": "5128b1278ac694622c917ac8bac363cc7a0d9ae776d5966adb5da96ee066817438eb630449f05fd6440fc926b8e0d7d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397766, "uuid": "4a77b8a3-b076-4a9d-8f58-175d8fd8bb83", "value": "T148A52807BCA108E9C4AE92728E7665927B71BC450F3163D72EA0B3382FB6BD05D75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397766, "uuid": "47d0e537-f183-46d1-b3d7-ff3148aadab2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397766, "uuid": "908d5610-4190-4f0e-9e9a-48a8ed6ab5c1", "value": "24576:HAbCKpquAs8rDZnWyponLjc+sIJPcYIV5dJ+6eleX3KDn5ZFoyfLr:HAbjouAsCWFnLjc4PrIVnatL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773397766, "uuid": "c2a9016a-797b-4f2f-8abd-609d9d3e0984", "value": 2120192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773397766, "uuid": "e942d9f5-01f0-4dc9-bf73-b3fdd4a6e140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397766, "uuid": "d6b4ebdb-47fa-42e1-84a8-ca4ff70391d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5de168-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773412063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412063, "uuid": "b8eddf24-e4d4-4985-ab52-c94aaeccd358", "comment": "Malware payload (RemcosRAT)", "value": "1e82a463c20b05f92b1d42b37a34d551", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412063, "uuid": "b28271f2-7bd7-4f9e-a563-6aa61e12c12c", "comment": "Malware payload (RemcosRAT)", "value": "2d00f9db923b61dca9542aee2298ef87639480b770b1af48c86b156e33388425", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412063, "uuid": "ea928891-666a-44f5-8440-1a280c78059d", "comment": "Malware payload (RemcosRAT)", "value": "c84d3731e5c857ad6198652b20b3c009a6fec82a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412063, "uuid": "5bf74a6f-0a56-4b85-ae38-9cefd945d594", "comment": "Malware payload (RemcosRAT)", "value": "8f67d937755f13abb238182452568148af756196e32aecadc3a95afbc5e8ab1c380593d8562d62bb87ac08b9867a09a7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412063, "uuid": "4024bb9c-e25e-4a95-be88-246325d45d93", "value": "T17FA402153455D957C16D2E3030808E560D23FC919A5CFC8BE1A873FE2E386F1AA97BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412063, "uuid": "e942634a-ab26-42f7-bcf3-85c8bdab856a", "value": "6144:sgza5QOaqiyn13vcipOgza5QOaqiyn13vcip2xzWicq4DtnZog+AoHL:sgurb13vTpOgurb13vTp61CtnOgwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412063, "uuid": "123a5287-c8dd-43fd-a99c-2f50f924ec3d", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412063, "uuid": "f8f0e858-18a1-4c75-b047-70ea13a6280c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412063, "uuid": "b8170b72-45f3-43e7-ae11-7848d9a535c9", "value": "Ordem_Nr_61590.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a905b8e6-1ece-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1773400837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400837, "uuid": "e1438998-5474-4518-914d-15c36a678330", "comment": "Malware payload (CobaltStrike)", "value": "3bda4d693accb639bbc8485585e3f8c0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400837, "uuid": "1ffd49ab-721a-4111-80b6-aa3c086d2e35", "comment": "Malware payload (CobaltStrike)", "value": "2f47a4be84b4e4d165c1f4024402896404f6dcfa61eb47df2d999d749aba072b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400837, "uuid": "b4142cc2-e758-42bf-95a1-ed4262e39a39", "comment": "Malware payload (CobaltStrike)", "value": "b2f4acc247149b3389a40e23a94869258d082ef5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400837, "uuid": "ce54ac4a-0326-4bc4-a69f-be161f4410d4", "comment": "Malware payload (CobaltStrike)", "value": "3f66964f79767aa0fe89f4acc6aa9d317283e2c58ee72f58864942259eb329ce2a430d1073f8607d5ebf2a2c3df03216", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400837, "uuid": "8fa45678-6f48-4be1-bcf6-9bab8384b53a", "value": "T197B55A47FCA119F6D5AEA132896269827B71BC481F3257DB2F50B6382F72BD06D74B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400837, "uuid": "2341bba3-595e-4bc6-946f-cb7c07eae14a", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400837, "uuid": "d13f7ffd-23d7-4548-8972-f6cd36e2c363", "value": "49152:nQimDnXG+8yfnOJGuMVFTrEJGrjaTThKHAf7JPfi:nQiCXdptHq7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773400837, "uuid": "8c97498e-747c-46c8-84bb-5fdb1d1fc2de", "value": 2380288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773400837, "uuid": "b2bebe6d-e139-4414-8e72-09c8d7b39def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400837, "uuid": "450fb098-6eb3-4fee-ab1c-47cae6a1f3a1", "value": "2f47a4be84b4e4d165c1f4024402896404f6dcfa61eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de0575b-1e75-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773362593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362593, "uuid": "39130087-30e2-4bcc-82ef-f3b22955a22c", "comment": "Malware payload (CoinMiner)", "value": "117efd7d1a1c07d32b02e9cd08aa15d0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362593, "uuid": "e45e2335-69c5-4ad7-bc75-66cdf9eaa059", "comment": "Malware payload (CoinMiner)", "value": "2f480c7c373f82f813bd2fa70e5b537934b67c340bee700f532aecc0641f887d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362593, "uuid": "9ad64017-65e0-4c7f-ad7f-b1fdc172c3ba", "comment": "Malware payload (CoinMiner)", "value": "69d2dbbf7b05a5479b597ba3fba4f92f20a395f2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362593, "uuid": "1acd26ac-7d68-440f-8841-9d5d2322b097", "comment": "Malware payload (CoinMiner)", "value": "c08f1803bf92070708fb7c30cafd953b2262f73d778f2a4bdf4006f472b98a0a8c478b2a55119e5b6662d64a55c3bbc2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362593, "uuid": "f8d439f0-228e-4ae9-a835-d2560295ff73", "value": "T1CF56BE7AB8002CE6D16E5277CAA6A8D933713C124F9767CB5860B7D61E737E0ED31A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362593, "uuid": "5558074c-d731-4361-a537-cded7d75d46b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362593, "uuid": "ee856ad8-6ced-4d1e-a5cb-4acf333f6a83", "value": "24576:KiDJG5D423h2Rzy1Rlr0QyyaJp1ss2NtdMxIRN1CknXt7gV3MEUCVP48bQ0B5TUD:KiFg82RSzcj0Q0XM/US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773362593, "uuid": "70435084-29cb-44bd-bf00-128079b34f11", "value": 6180352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773362593, "uuid": "df2f9385-3115-46a0-998c-c941ae950834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362593, "uuid": "fe3ff239-aa7f-4c67-8c5b-f78982334168", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba9ea75-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412491, "uuid": "5e8aac78-e217-45c0-a20d-e9e140ec2ae4", "comment": "Malware payload (Mirai)", "value": "c439f52e4c7f80a5818c264b0c765ee2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412491, "uuid": "a0906fb0-1104-4936-836f-f7367c8a5521", "comment": "Malware payload (Mirai)", "value": "2ff8195d7c0da1be32c58f9bcb878ff7fb08c61ce0c2ee899e0812ee11dd2502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412491, "uuid": "241448b2-194c-41d9-8665-d6df07a3fc4a", "comment": "Malware payload (Mirai)", "value": "b182c40d09c0187586023b2e4e01e21d9e8dcfea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412491, "uuid": "e0f695fc-e5c9-4777-80ec-499a4b1d5478", "comment": "Malware payload (Mirai)", "value": "1370a58046794da4280c9e62cf9f2aae6a7cba25f4e84d5df137f0d9ea580e53bf488c1c4bb124e581689ab01e3dd4e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412491, "uuid": "5e04b42d-d499-405b-ac27-eca06f0b62ab", "value": "T1E7B3A61E6E318F6CFBA8923547F78B20A75833D626E1C684D15CE6011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412491, "uuid": "f7727d78-ff14-4217-8b27-7b368453a494", "value": "3072:qih0m8mudZUNcqJuj1JnhZAHn5/Nmh3NYtF7yYfX:v0m8muVznhZAHnNu9Yv7yYfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412491, "uuid": "3029185f-06b1-4a76-8f37-8f0807c48c51", "value": 113760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412491, "uuid": "72f1c27d-94af-4225-83c7-e396c8ebe74e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412491, "uuid": "5a570cf7-6d6e-499e-a187-affcb40980b5", "value": "SecuriteInfo.com.Linux.Mirai.9774.5027.2562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d7350d-1e82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773368061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368061, "uuid": "a81d5a9c-272a-48f9-bc0f-62468d48a9a1", "comment": "Malware payload", "value": "563f30c26c32db6a6575a1413cda9855", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368061, "uuid": "5c47e772-53ec-49aa-935b-d2034ba0e71c", "comment": "Malware payload", "value": "30f9e479b385be8e6db7474797eee4bd22d286eaa99c14c78cc13d3f3503da04", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368061, "uuid": "b9a7796b-5c98-40b9-b938-9b7fbe2b15bb", "comment": "Malware payload", "value": "a1bcc0879e770542ebe2124dda098d070a44f88c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368061, "uuid": "3e79e68f-d454-4941-ac5e-911ef4e9c4af", "comment": "Malware payload", "value": "cd86e7dbcce37f38101576be2b23fac819dc6aee3cb02ecaf2e599294b8615a8390ea9ddfc12962a41a21043ce1a8f05", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773368061, "uuid": "68985f78-240b-4438-bc40-990ed6258322", "value": "T17BB34589068E94BC5F4F3478411E5E67C58D56034B1ED948BBDEAE9A3F1387032EB4E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773368061, "uuid": "ab9a5c68-1d0b-47b0-b321-1106694e7d28", "value": "768:MhN/w5DzLZgYIyyR8l24XeAXrnK6+oMSK7yeGM74sJsVhfO6x+Z+JPZcIzTuMfGt:MfsfnbzTuMfflI5yXL5XeUAzTjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773368061, "uuid": "a8548a15-438e-4c5b-a8e8-d8508458255d", "value": 117688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773368061, "uuid": "02b997fe-8885-4136-8035-bdf1a2becb52", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773368061, "uuid": "bd3b0226-42dc-43de-9c73-485da5a4859e", "value": "Config_NewYork__76.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c58a9af-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773412707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412707, "uuid": "a6477f50-77db-402e-8e37-b83198541912", "comment": "Malware payload (Gafgyt)", "value": "84a77f7e7970787a9d0a2fe5a884aa7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412707, "uuid": "a5d8043e-ea72-470e-8995-680b7bcb40cb", "comment": "Malware payload (Gafgyt)", "value": "314d38af536dfe3357a8288eda13062c2f452208b55fa6c290fa9fa1b27bab52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412707, "uuid": "ef6d9c16-6856-45df-88db-fcc994c47413", "comment": "Malware payload (Gafgyt)", "value": "153d6e2f2a5b0c8f3978a0d24101d46dda549c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412707, "uuid": "ae1856b0-05e8-4910-bbfd-05b4c6ccb67a", "comment": "Malware payload (Gafgyt)", "value": "029149f237dc2924c20e564a6cdfc97df89a518563803783c030f56d09e2cc9ffafe1425ea6604f75eb770e8ea7d2974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412707, "uuid": "4720bf02-8be0-4b77-8150-74518ef0cf6e", "value": "T18DC30286DAE2C1B1E093857240DEE3E79F39CD160019CFDBE39C7E64B4D22A6585F648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412707, "uuid": "2f36bce8-69c0-4382-8393-1dfebabf4fa5", "value": "3072:rOlNTZa+Ef6j8eAZaEyHpSG/l3PaBqX94wvHP7a8Az0:aPGfc8eyytl3Pa1qDa9z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412707, "uuid": "27f8ed53-806f-4ed2-ae57-c15efe696a5d", "value": 126966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412707, "uuid": "8778b054-b693-4bee-9814-1d1047f4fa18", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412707, "uuid": "e805cb07-a4ea-4ae1-a999-d4477fb40ad2", "value": "qjzu1ipbfu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff881c0-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402056, "uuid": "a0d7eb4d-9331-4cf8-9940-ad7474e76a89", "comment": "Malware payload (Mirai)", "value": "691ff4c624c71d7a022ada46c07b8a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402056, "uuid": "5fbd4f53-a799-4d0c-bb3a-8dbf2aedfcfd", "comment": "Malware payload (Mirai)", "value": "31523d704bdebe4be4a6bed20ae517721328f9605d63be633e9c2b68750b7aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402056, "uuid": "c40371fe-387c-4a9c-943d-e9a2ce592ad7", "comment": "Malware payload (Mirai)", "value": "4911399ec75db9f85325939af75b6c404478c38b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402056, "uuid": "ad139cd1-d479-413b-8b3b-ea1a6fb37587", "comment": "Malware payload (Mirai)", "value": "50c1a10fc5c6052f0b68b8d7a770401c3e80d39cb261a8d02982adea4354721ba9f0c156f197878e45630c38ddacd256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402056, "uuid": "9ea9611c-01c9-471d-8c9c-42c07d567dec", "value": "T157B3A61E6E318F6CFBA8923547F74F20A69933D627E1C684D19CD6011E6034E746FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402056, "uuid": "8415e7dc-8f67-4a46-b90b-4067df1c4129", "value": "3072:FzySSvodcHTgnM1sCPSJ8epvrzTXE7yAmv:cSSvyNM1sCPSiCvTU7yAmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402056, "uuid": "9ea3b243-0563-485a-a502-9b84ad95c8ab", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402056, "uuid": "d6a6fc46-3259-447c-ad09-4210be2e4007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402056, "uuid": "4d140a8a-1da2-43d0-9fe4-9f7628e6ba68", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c690d4-1eba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773392000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773392000, "uuid": "2d03f548-fc45-441f-a46f-da3f40e6f5b9", "comment": "Malware payload", "value": "19189f293d566f6f342a00ff4c04863f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773392000, "uuid": "1c458b0c-f31c-4fc9-b4a9-c0f45acf9de2", "comment": "Malware payload", "value": "326927065e6b91030bd0cea3c75cb3ab949f2a7ea7d6207e12d3cbe93ed5895d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773392000, "uuid": "f48f1675-fd4b-422a-add2-1a8004de28fd", "comment": "Malware payload", "value": "a11f27fe5c3cea51a1f042d4ac7261ec0354104e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773392000, "uuid": "b4e3de48-5a4b-4ee8-9f63-a7bf6a585131", "comment": "Malware payload", "value": "70438219cc8af73956454f8624047c969ebc92f7290b5f9187862c8b88d959efa5c1057f6f35d2876f23988e83387a40", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773392000, "uuid": "6a868b1d-ea88-4c43-963c-47438a507091", "value": "T1AA925CA916496C79BBC0DE7D9F3C7F0CADE8C1C02118A39CBE4F39615A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773392000, "uuid": "3a89bdb9-d1b9-4c18-a44c-ba235942fe30", "value": "384:ip0M3vgRjGlsaq7CzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ipmjf+zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773392000, "uuid": "33f1745c-0c13-4718-90c7-12380bc4f40b", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773392000, "uuid": "84a78bac-8495-46e4-bb7a-aaf51154ec6c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773392000, "uuid": "bfaef3f2-071b-4af0-900f-352fc75b8344", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f751a5b5-1ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773411276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411276, "uuid": "82278d94-d925-475e-8a9f-53b965c2627a", "comment": "Malware payload (Mirai)", "value": "8dc7cf66ae7209f4991e827662a97de5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411276, "uuid": "0d506011-65a1-4f47-ac40-950f72c50c3d", "comment": "Malware payload (Mirai)", "value": "327265f8d359f8c76ad271b25d3e7f07c847be3837dd17e86c0682000aa35309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411276, "uuid": "55aa564e-494b-48f2-966a-05861ef69740", "comment": "Malware payload (Mirai)", "value": "329eb7c5bb91f17942ace3155e6dee5ae2a0af8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411276, "uuid": "f3a9dcb7-0d3a-4fcb-bfa8-c02b7fccff38", "comment": "Malware payload (Mirai)", "value": "1847550b6ee86f5404c9ba46502b99cc3dd95699518c589721b07be6e2c52745371a54ae385041c4b8819b533b274e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411276, "uuid": "3949065b-f284-42a6-bccc-dd1e51e4a944", "value": "T13973AD32C42A5EA4C1844674B4A48F794773F808C6872EF6999AC7EA9443FDCF5583F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411276, "uuid": "7aba8148-a2b2-474f-9bde-6899000dd4cf", "value": "1536:LA0EF5DngNLmwj6H37R8PO6uvKtkTq7ppgNCt4B/H7ytgw:LmkdaWPO6uytZfgNFP7yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773411276, "uuid": "140df373-3372-42f6-9f70-2717bf47dfea", "value": 79556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773411276, "uuid": "98db41d4-7974-4f48-8084-faf522aafc2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411276, "uuid": "686adc52-be57-4539-b537-1948d5464f25", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4667da2f-1ee3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773409691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409691, "uuid": "cad58174-a331-44ef-9b85-08cd0a7c9999", "comment": "Malware payload (ConnectWise)", "value": "67ff4a85d25b8ec10869827d9b5b8f23", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409691, "uuid": "a521c1ae-0f2c-40d0-8b30-d86e35317fac", "comment": "Malware payload (ConnectWise)", "value": "329b604591e3f504e932fed0f75dcada34cdc748c69d09c1e85dd420609173ad", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409691, "uuid": "578d230f-ca1d-4a83-95ec-0155d61c2897", "comment": "Malware payload (ConnectWise)", "value": "d5660ce888e4d5a6e8c4a2314ac34013889384c5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409691, "uuid": "01671f45-2cfd-45c6-91d6-8ebf81f35b2c", "comment": "Malware payload (ConnectWise)", "value": "8573bc2585a9e294996f3c5e172d67f816716c37c5d9a620442f388343422be4b1fe5a0e36be40b05ef4a0c5c7fc0a30", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409691, "uuid": "4cbdf7f1-0e55-4cbf-afe3-438b6699804a", "value": "T195E61201B3E69574D0BB0A38D87A9256AA31BD004716C7AF5794B92E2D73FC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409691, "uuid": "722805dd-6cf4-4d3d-aae0-f102812351c8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409691, "uuid": "0bac5d07-4912-49e5-92dc-c1d4eae5bac8", "value": "393216:AgdEEijRDGDgdEEij0gdEEijLgdEEijigdEEij5:FuEPkuEOuEnuESuEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773409691, "uuid": "3dea5dd3-e6a3-475d-9011-fd5e18bfc2eb", "value": 14750776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773409691, "uuid": "fadd6ad9-0282-4c87-9213-9b8d5522327a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409691, "uuid": "ed5dcbad-9837-401f-9d93-dc00e948a4ce", "value": "Recibo_52bc2b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886aef28-1f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773438148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438148, "uuid": "fc81e3e7-3ef4-45aa-a391-22313e6464cc", "comment": "Malware payload", "value": "ad04b9bb9c70162826210d902e224cd9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438148, "uuid": "164c31f2-99df-44f6-b9ea-fe1cfd3435f8", "comment": "Malware payload", "value": "332a3d6662de38e51e92e03acef13a61ebbdea7f5cca32951831081654b1ce8f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438148, "uuid": "421aab8a-499d-46ce-975b-b0c53db78688", "comment": "Malware payload", "value": "892dcf2af0553c02e942a171639ced6d4a77210f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438148, "uuid": "00fdd9f5-694c-48a6-8e06-6dc232886d45", "comment": "Malware payload", "value": "096fb39bf3e1350eef6ff81b8ffc2f6905bbccd726d5dfe24141912b4e8b96102c50111c4e3c792e3747dcdf8d2158b3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438148, "uuid": "9887f1ec-eec9-488c-9125-db704971c70f", "value": "T1B883B59FF6638423C0AFED76F5D2A14B29B07333E951D1450ECA21D22941EA78DC98F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438148, "uuid": "1adb1298-9c42-4e2f-956d-b109f6bddc12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438148, "uuid": "b517e45c-2f5f-47a3-9313-7bce35f0ca69", "value": "1536:p3iVJTLxnEUDukPgLZ1kv1mBB9bBpW16RsY87STzQ36yZ:1iHTLxnpukPgl1kv1mBB9bBpw+XIoUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773438148, "uuid": "fce2a6a4-b389-432b-90bc-b75a96b10d9a", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773438148, "uuid": "a7b9e30d-9538-45bf-8b88-5c3060fb79cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438148, "uuid": "0073754a-2258-4768-8fb7-6fa3cece5b76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40957432-1f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773426431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "054c2837-7cdf-4193-951e-8cc050c8bf60", "comment": "Malware payload", "value": "479539c511f290a318dfd14c5bbf206e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "a327037a-3a18-408f-8a2f-5f2918f190dc", "comment": "Malware payload", "value": "35b08367feecd8fa2de58fda88019e7307e7b3da070feaa32465b6e372091001", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "98efb855-be76-4295-b2c0-11e9987cbce1", "comment": "Malware payload", "value": "c580ba27010a4599c4560c47c61de44493681524", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426431, "uuid": "2d6f7bea-304d-48a6-a704-2597f7483935", "comment": "Malware payload", "value": "5c81d12dc9acdbaa876f698b6d6005c85e0e4fd3ed2ae389f6c962dbaf23ce0e33e83563106203b25045ac6f462b38a0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426431, "uuid": "33c2eae2-7e2a-438d-9cf2-5588b8bdc8f2", "value": "T173C78332CD450E678AF2627C69658AE3FA60AF2F1380591BBDFCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426431, "uuid": "06765756-9428-430e-900f-3f3d360a2ebe", "value": "98304:piNKK/hc4swePALQ83To7fBJubKC8BdZ5GjPHwM5v3IOufxpsLTTv8ml:peUALVqt7U15vZkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773426431, "uuid": "d6a38046-347f-47ea-b53a-4389ffe6fe87", "value": 53858304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773426431, "uuid": "264c2793-2727-4b43-83c2-8f1d7f00713a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426431, "uuid": "cbc2fe45-3342-4680-964a-0fc210fee88d", "value": "Wax_Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236c4618-1ea6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773383433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383433, "uuid": "88254b32-d4ce-4896-bf51-e7e4e064f02d", "comment": "Malware payload (Mirai)", "value": "c67db186df28a82585b9224d6fd7c2a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383433, "uuid": "2c72ec36-263d-430f-8998-3efc969480a4", "comment": "Malware payload (Mirai)", "value": "35cb900f84a5edc38fd710fbd1461554e1628fb19514755b5e0252c036a3c1b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383433, "uuid": "2092f6fe-54b6-4df3-9ed6-3f11a564cdeb", "comment": "Malware payload (Mirai)", "value": "b174583144ec6093e69de46fd034569c623f92dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383433, "uuid": "1b2f15e7-44c7-465a-84e3-990cf5dd5406", "comment": "Malware payload (Mirai)", "value": "7498c5323450df2aa12bb92a94bfaba076cb483783acac6d6098c52c987f6bd9134bf7292414dd23b075e313f06f4b67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383433, "uuid": "3883e1f6-94e2-461a-aaed-4d91cc3d3391", "value": "T15174E45B6A328F2EF279C63187F74924E75933D712E1C685D5ACE9101E2028F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383433, "uuid": "bd26b5b9-1825-423b-a949-6d6b36e272e2", "value": "6144:Z1frXSo9oNcTPGTh7h6c2sSpp/9gJdhExaf/Uwd8xAaYfX:ZRnMwpM/hExfiiYfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773383433, "uuid": "f33f3751-8160-403e-a359-98b35cd83dd3", "value": 352076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773383433, "uuid": "b6cb38ba-3fa8-4fbc-80b4-04c23b728fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383433, "uuid": "6b5f53e7-c09a-4a01-a929-5424104b8d79", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb603363-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773412115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412115, "uuid": "8c515fa6-178a-4007-9479-51e63488c29c", "comment": "Malware payload", "value": "51785f196fcabd37789703a3f04a3e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412115, "uuid": "0d467248-988b-4c44-afc8-c27774732730", "comment": "Malware payload", "value": "35ea95eb29e53c86df2513604ede64d9d8831a8e9846a02ebc699929d8d5cd64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412115, "uuid": "f6478f26-49b2-449f-854b-e0c7b68b35a7", "comment": "Malware payload", "value": "b7c549372bf4348a8ddc0f97fe2d3215207206db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412115, "uuid": "23073e96-771d-45fe-ad46-05244ec49cad", "comment": "Malware payload", "value": "851f71cdf422a1660af01a71d375abebfb23d1409751b1765c1950a19f43ceb6c116ae3ce6d516c347e41703a6e3c851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412115, "uuid": "9e171653-b55e-400c-a448-0639a365ef89", "value": "T1CCD59E06B3C48DAAD196D634C7279B36C3B2B8124B75C29F1796D70A6E33B804F3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412115, "uuid": "9dd90544-073a-41f9-ba7f-98cafb233651", "value": "76947002d9d3bc3afbbc0ccd326a228b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412115, "uuid": "3d171ff8-0ab3-41f0-a5ad-d6a18e45d646", "value": "49152:FKo16/OhrNG6ZrCAKizg8IqU5V/HNMaED3J6BztDvJhTes3e3teEsleJx3EgY3XM:3fhrYMMNg3J6BztDvJhTes3e3teEsle/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412115, "uuid": "f5c0ec7b-cf4e-4479-94ad-51e3c5749d84", "value": 2876416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412115, "uuid": "a5954104-4a2c-40dd-9e4f-8425f37d80e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412115, "uuid": "a660e26f-cd17-4f8a-a830-dd75101081a4", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28306bea-1ef5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773417371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417371, "uuid": "09b100a9-5cbc-4479-acba-f94ebdaeb834", "comment": "Malware payload (AsyncRAT)", "value": "46ec0e726253180d01acd57946844c06", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417371, "uuid": "f84dc398-e051-4923-a2ae-184d63917be3", "comment": "Malware payload (AsyncRAT)", "value": "35f2b6cf64cfe6e60064d9569a8c7ff37d232cdc982c8916531d44bb09319e96", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417371, "uuid": "89c4f86e-ad39-487b-b6ce-745223ff4e3e", "comment": "Malware payload (AsyncRAT)", "value": "09a7e710b4af69ef212ec812250ca72e9972e928", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417371, "uuid": "03309e56-65ee-4cb5-8ecc-4401841c4d6b", "comment": "Malware payload (AsyncRAT)", "value": "6439adce08376d175e91bb416f021505a227656101c1b3bc79c5995929f6a3069f6de049c17b5e182239b7d07da178df", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417371, "uuid": "9b8d9175-1176-4383-84d9-0d5fe77ad7b5", "value": "T182F54A41AFE4CE1AE1BF2775A8F201001BB1F449A732D74B56A4E9792C637416D0A3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417371, "uuid": "166cfcfd-bcb5-48cd-892f-8b3ff50c2933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417371, "uuid": "22abd4ec-df2f-426f-baf9-8cfe281041bf", "value": "49152:TGHHBF+azKPKwmPpAdzWMAzU0rdBdo+6WuDayP5r/NxJ:TraOPjmPpAiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773417371, "uuid": "f2ed7f8f-00a7-4f08-b2d9-f719a1d6f0f7", "value": 3369984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773417371, "uuid": "2de80301-2e09-440c-9863-f8e14924e78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417371, "uuid": "2c7e71e8-15ab-44e2-b094-ff37d169d44f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bd5239-1f1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773434243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434243, "uuid": "ba89e25f-364d-4335-bef0-90fff31cc350", "comment": "Malware payload (Mirai)", "value": "d12a91aae054dd90b2339fb71324b837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434243, "uuid": "ddea9aea-03b5-4c5b-b34d-497e41ce83bb", "comment": "Malware payload (Mirai)", "value": "35fe1ff9934068d4ba7a49724c3ab2a538fec7c0921deb22e9735d6474e9371d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434243, "uuid": "afb6d053-0987-4053-8175-10b88ced9b5e", "comment": "Malware payload (Mirai)", "value": "a79148a22007970470565973f5f908d7b32defaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434243, "uuid": "274f3217-5098-4908-ab9e-bffe1bde045a", "comment": "Malware payload (Mirai)", "value": "3c27249eef251dc8bd10723400d2fff39c94523c691bfff142060b0c1f341cd0d4b1f01e5e9672294646dd08b0b46010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434243, "uuid": "1b8b22f7-f0ff-4cde-b18f-2c289cb7d06e", "value": "T1D8834C02771C0A47E1A61EF03A3F17E193EEE9D121F4B688290FDB468175E72558AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434243, "uuid": "06ff3119-8e08-4569-b5ba-8f16d72346c3", "value": "1536:/Yq2OWY2JrAu+OjPNTelsB42/57PfV9VUBDB2w7ypcc8w:JacOjFTuuZR7VcBFb7yEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773434243, "uuid": "94be7104-8a45-4ae1-accb-3d22adeeb96f", "value": 87280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773434243, "uuid": "6730abf5-b7d3-4cfa-89bb-f13e151ed1da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434243, "uuid": "b66dec1c-ffed-4007-b263-5ec36f291c8a", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98785b39-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773407251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407251, "uuid": "a5e60817-6542-4416-8a3f-c3d577e01722", "comment": "Malware payload (Mirai)", "value": "006cc428088ea3766c094b421bf8e77f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407251, "uuid": "128847b0-236a-47cd-834d-d9224ba90e3a", "comment": "Malware payload (Mirai)", "value": "37c78c8a8f1d4b260dfff9aa11a429e779927222fed922c0cb071768ba15d346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407251, "uuid": "1fe00dac-d40a-4c21-83b0-23e244e5056f", "comment": "Malware payload (Mirai)", "value": "7db53d14c3639206eaf7f7a54dc2a6d5bd454596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407251, "uuid": "b250e7fd-832e-4781-bb6a-d06335d8b295", "comment": "Malware payload (Mirai)", "value": "d7768cde640b9a8194e018b08709c17aabd9d6a7d21d5a34e2cb359074cfae87de60c03c8e16eceefd4cebcc06d3ba0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407251, "uuid": "b76da831-5ec8-4b80-abba-ecab1c93bdc3", "value": "T1E683A65D6E228FEDF368833447B34A31E7A873D526E18684E2ACD5141F7438D245FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407251, "uuid": "6beec10d-16d9-45c2-95d2-5fd64b60e447", "value": "1536:cLB+QUOlp/a2T+6F0GbnXb0R08zlzuBXVNyrxeeflmR6:Cu2K0bg0lNyrxWR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407251, "uuid": "c50195f6-9368-4f74-92e8-57dd1c210a0e", "value": 80728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407251, "uuid": "471d364e-5414-4044-a73c-b6d7ea00fe5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407251, "uuid": "cbbfb7bf-687d-4e9d-bd1b-67d545a5e564", "value": "fmw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3a277a-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412489, "uuid": "212f3b07-1713-487a-bd51-afbe9295264a", "comment": "Malware payload (Mirai)", "value": "99f84f68b5ac06f21df5938d8506e65e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412489, "uuid": "dc39e925-8a59-45e1-ac33-ec638e6e5373", "comment": "Malware payload (Mirai)", "value": "384a4f26a9427e99646011fc3128455b82b518979efeb334a17afba4be5a1f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412489, "uuid": "1280f4ba-3200-4974-a6ee-0a990c26a4a4", "comment": "Malware payload (Mirai)", "value": "7cc0810ab44ab86a07965646a5b680ebf324691f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412489, "uuid": "a6549217-95bf-4429-bca1-498e5dd339c3", "comment": "Malware payload (Mirai)", "value": "faad0e8329d165f8442cc7c758d2282d52cb7846d828ccd1ef89a0ea466cede7e79bdbe16a35ea540f58aa4150bf7cca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412489, "uuid": "fa4db75a-ed10-4157-828d-ea35dcaa142b", "value": "T169B3B509AF651FF7EC6FDD370AE91706288C951A22A83B797934D418F24B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412489, "uuid": "135a91f4-26dd-4f98-b36f-4d04ff2eac29", "value": "1536:b8blhmkR2s+E988K7c6zQ8UT/ev9n2+acJ+CmCADoXNakg7ypTMu1r:eTfR2s7Hsc6/RacJKDPJ7yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412489, "uuid": "48a9ff7f-895d-4d7f-bbd5-c57768df9a1d", "value": 117664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412489, "uuid": "b46f3b6d-a309-45f5-adef-0bd44abf0667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412489, "uuid": "fcb0dd0c-76c5-4692-b575-37eff5e6eb15", "value": "SecuriteInfo.com.Linux.Mirai.9774.23674.13400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7066479-1ef8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773418872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418872, "uuid": "04bd3126-5419-44da-a5f5-7acfe459f6e4", "comment": "Malware payload", "value": "59238b0148bdd2e89a7d0f6585f2d442", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418872, "uuid": "85f53dc8-3fed-4709-bb9a-d94d747c09ba", "comment": "Malware payload", "value": "393c38626cfc87137e608d53a9d5334d86b9ee941bd90bb17ec7083ba19b1a21", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418872, "uuid": "eb445c7d-ae25-4508-8bce-a3ebe182c968", "comment": "Malware payload", "value": "c24af8d5c176f696e2a3f2811fe6a61de1fa7563", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418872, "uuid": "c6a0929b-d2a9-405b-b2f1-cd7223000196", "comment": "Malware payload", "value": "48b3b15ef081ce07a3096502ef9c00829b0150b7d4540ace6a2b53e86819eb72670715fa5480b83cdff26d94cfd6303b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418872, "uuid": "dbc2b632-65ef-4f97-ac7b-b924ea274645", "value": "T14A267C07E19223ECC46AC1FCC7D7A232B6357C454534ADBB5170F6312E72E9C6A69E28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418872, "uuid": "bc95edb1-ec4f-4ebd-a71f-ac55c1d4e17b", "value": "6ea70062ad183fad959af98c29f55101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418872, "uuid": "06d61719-6f74-44ed-8a70-a203376c8126", "value": "49152:VgmnbwUuzhQb2ZktsQeaE81uXjxmCg9RmO+EQRVun25yPpO011VZvc1VOlsz0VgC:Owb2dQehXjcfIQpOG7ZE78CpjqjQsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773418872, "uuid": "80d302af-9604-4bb0-a3ad-953b7256ea36", "value": 4518912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773418872, "uuid": "5b8e5e95-986f-4681-b1bd-10793010073a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418872, "uuid": "0d42211e-ff52-4e47-a8eb-b16dfc0a4493", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7212e8c5-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773402033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402033, "uuid": "8cb26ee5-d29d-44b6-b6b2-b1f17e68b3d2", "comment": "Malware payload", "value": "0a2a1be38b967c1e8d724539b227c628", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402033, "uuid": "0e16136d-2781-47bb-8c05-ef27fdec2bf8", "comment": "Malware payload", "value": "399b4fb4ea821746e67e38b985186417e647b2574e12279553b3014538bdba92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402033, "uuid": "544f115e-f8a9-4f4d-9199-5068932fb818", "comment": "Malware payload", "value": "235fea403a67393e11a39e0fb50f992970bc5919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402033, "uuid": "56496627-0af0-49a2-83af-7f19d6e25c4d", "comment": "Malware payload", "value": "eaff5aded90b6ee916adffa2414107e38116047c14a824c8b6c65cc062e6ef43c6cb712ac875dcad062c49eaa11cfec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402033, "uuid": "32313629-4c79-42eb-a355-f8cdd68189ec", "value": "T1FA46123BF28BB53EE06A1A393972E114543BBA6064164C5396ECF88CDF751701E3E687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402033, "uuid": "c6f4d3c3-0b68-464e-a5dc-70a4600f708b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402033, "uuid": "65d6f479-30fb-447b-a8e4-bfd88582b952", "value": "98304:R5OyFBqv7x5rSsBx+OvXyGbP2D8ty7wGX/gL7kBO5WIw0XDR6Pktm:Lj+7fzBh8D8tMXI3kG9t6Pktm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402033, "uuid": "14b1b290-b20c-463a-9d56-ca5736563cdd", "value": 5745429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402033, "uuid": "0ee55d72-df7f-4efc-b796-c2ab4f814529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402033, "uuid": "4aa43e4e-b898-4814-a8a6-2b2d494496c5", "value": "pardufrigi_installer_1.0.p1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e60241b-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1773407932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407932, "uuid": "28b8aa4d-6a4a-4000-ac14-1b91042d6581", "comment": "Malware payload (CaminhoLoader)", "value": "ee7e98bbedc112d10c7d0a2f522a661a", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "documentos-microsoft-waresystems-com", "colour": "#EF7AEE", "exportable": true, "hide_tag": false }, { "name": "javascriptupdate-com", "colour": "#F431C6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407932, "uuid": "106e2283-8633-4867-a8a8-4c43010ba758", "comment": "Malware payload (CaminhoLoader)", "value": "39bcfbf64ce9bf5b6971e51fa93492a1527385b4987bded6df6bea22e23d7e27", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "documentos-microsoft-waresystems-com", "colour": "#EF7AEE", "exportable": true, "hide_tag": false }, { "name": "javascriptupdate-com", "colour": "#F431C6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407932, "uuid": "d6f76cf3-04f0-457c-a65a-4d74c9f806a3", "comment": "Malware payload (CaminhoLoader)", "value": "9dd579b47bc24058db4aa4af74c2941c97bf6766", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "documentos-microsoft-waresystems-com", "colour": "#EF7AEE", "exportable": true, "hide_tag": false }, { "name": "javascriptupdate-com", "colour": "#F431C6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407932, "uuid": "2474cde4-9ce5-4120-92e1-f2aa2be1920c", "comment": "Malware payload (CaminhoLoader)", "value": "dca192d8bde2bc88e909d533703176d3d5c0b3ce128de419253a28cb587667617495f72fdb6b2844f3cf38e67c259920", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "documentos-microsoft-waresystems-com", "colour": "#EF7AEE", "exportable": true, "hide_tag": false }, { "name": "javascriptupdate-com", "colour": "#F431C6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407932, "uuid": "4ce68469-7cf8-49ab-a6d1-3b6cab94b051", "value": "T13BD501FAE447A5441E255A7C10036CE9DE7E02C0BE5FC21650974BCD67C9ABF70ACAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407932, "uuid": "be93473b-bcdd-497c-9831-cf719b5580d4", "value": "192:KExHjWiqEK4fX571dyWgM25P9X2mE4sOh:a7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407932, "uuid": "5d940497-3c01-47a5-800c-29abd3075ca3", "value": 2816248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407932, "uuid": "b724c33e-cd65-445a-9463-929b0d30ba3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407932, "uuid": "2f34021c-746d-42b5-9e6d-3bbad3215810", "value": "update_system32_windows-6kjcrwnqngu3n5e9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb6bde4-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773407262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407262, "uuid": "eb29035c-0637-4213-884c-40e151328660", "comment": "Malware payload (Mirai)", "value": "3ed1a6d57f00c1643cc85e049c82d1b4", "object_relation": "md5", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407262, "uuid": "1c503141-aa4c-4ce5-a4bc-4a61fcdaf8d1", "comment": "Malware payload (Mirai)", "value": "3d43f5b3b2c9142ca0c5cdc4a82f9088e090d077ef61c2297c51b4ccd3085d78", "object_relation": "sha256", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407262, "uuid": "d1a6963d-f7c7-4b58-98f5-eb3f9f005baf", "comment": "Malware payload (Mirai)", "value": "e2856999ebac2af79ae812f1b8315754afdaa818", "object_relation": "sha1", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407262, "uuid": "670ffb13-24f1-4d9c-b65e-c2bf0f0d9231", "comment": "Malware payload (Mirai)", "value": "43fcfac5155a844205b7dc9f55c28fb6ca9e3fcaebaf9d73b145c37b69cc68f3edd7ade314cd0930344028a61d32775c", "object_relation": "sha3-384", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407262, "uuid": "b3932f31-77f8-46c7-8ab2-e7b0dc423aa4", "value": "T122632A89BDD29A12CAD15273FF1E428D371713A8D2EA32039E196F2437CB9670E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407262, "uuid": "d66a7e83-db22-47a6-810c-3e6d0dd6cbdd", "value": "1536:vywQGvKvyoojKboPTLHG5ipk0zlxPxva:vyuCLUvHG5kzHJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407262, "uuid": "9fc257fc-100e-498c-bbee-2c5667c17687", "value": 70776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407262, "uuid": "3aedee7f-d38e-405d-9131-d3a762402baa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407262, "uuid": "af3fbcd1-0e23-4054-a173-9fff70153a24", "value": "3ed1a6d57f00c1643cc85e049c82d1b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4478c4-1f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773426429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426429, "uuid": "706dd6ca-7038-46fb-ab9d-53dd943dd2e3", "comment": "Malware payload", "value": "8c5b0e9794cbe9b27f47d2390c8ccbf9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426429, "uuid": "a9fb9aa9-c58c-450d-a950-9fe2fe6b8a48", "comment": "Malware payload", "value": "3ff40fd3d3397fbcb3a8bed9657e877412d5323b2eaa7748166e53040a4dc343", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426429, "uuid": "34a79268-bf0f-4e83-ab21-77a1d4494744", "comment": "Malware payload", "value": "ae8e465f0d79e32de441d28242bf3f12ee13fad1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426429, "uuid": "d8129b00-2dfe-41e1-9266-7deae3399f78", "comment": "Malware payload", "value": "67048b2a9df1a0b2ad60963de1acf76bcb1be513ac7490701ce4c5c501c1e08216dfd43a8b8df945f707efa224a5007b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426429, "uuid": "8f055abe-b4b8-4524-bdbf-ce6115b04836", "value": "T137B79432CE450D678AF2627C69658AE3FA60AF2F1380591BBDFCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426429, "uuid": "429c1abf-36fc-45fd-b437-d09169bc3ed9", "value": "98304:KYxO/QBHzOUZ3N3dmcKt/rqfx4l+jqul3VTVagLxlU8eyy/lFA1MVDbefv8m:KuZd3dmcKUUukOleykJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773426429, "uuid": "0a070d18-12a1-4012-89cf-99a0c662ec53", "value": 50237440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773426429, "uuid": "93121696-34e0-4455-a0dd-dca96888245f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426429, "uuid": "45a2d604-aa2c-45eb-bd5f-bde2f4b9e6fd", "value": "Google_Certificate_Launcher_11.24.8694_x64_en-US.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5818b2-1ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773416551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416551, "uuid": "a6251ae7-6002-4658-9c21-c45dea3e7f75", "comment": "Malware payload", "value": "26a77368793738f9b2afb2a18866654d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416551, "uuid": "64b942ef-7d7e-436f-b49d-fb130d35e692", "comment": "Malware payload", "value": "42d33186168e9f554793939d2cf79625c02da87edcfe9bda99e5d02253636ad8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416551, "uuid": "43a099bb-a313-4166-812a-d0694663e4d9", "comment": "Malware payload", "value": "17fea45209b6f9cb3cfc4fa4ddf9a5b8a64c2d26", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416551, "uuid": "ff3cdb7a-7d62-41fd-a7f2-63183d61504f", "comment": "Malware payload", "value": "fa3a76b4a7e405d8938fcea8622537bdf979f6e27feb9c8237050efe6137c6c317fa53b32b238b533680b0cd6c7d3c83", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416551, "uuid": "6a63b52f-86e1-44a0-be69-c02b4f88abd8", "value": "T19362473721F14A33A6E054C8A2771BA15F72D607856720B8F4BE26369F5DE0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416551, "uuid": "bbd5e628-7fe9-4788-9368-fe3cb821d24b", "value": "96:cCuhmB6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6Ml6fz7+kxBhx:cCuhK6p4hvZ5m5FG4j4HKNphvIjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773416551, "uuid": "5637b26f-ec25-4edb-a605-48d6ca91bf68", "value": 15321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773416551, "uuid": "de1d9f40-a465-483b-8bf9-e88785848812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416551, "uuid": "c62f1775-d34f-4024-b942-bf9738a3b0d8", "value": "42d33186168e9f554793939d2cf79625c02da87edcfe9bda99e5d02253636ad8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dce9db5-1ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (Braodo)", "timestamp": 1773396308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396308, "uuid": "c7f82158-e4ad-4a5b-a44e-db310d09c0f6", "comment": "Malware payload (Braodo)", "value": "4c98c3a83a09a80a540d75a78b1aa591", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396308, "uuid": "020e310c-33db-4c6f-bcc9-1efc8d67a118", "comment": "Malware payload (Braodo)", "value": "42d34a7da8744c9c543dfa15f559eecd7ca6208cd9ce657363ae4de3fef1098c", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396308, "uuid": "074be280-a8d5-40f5-b9e8-e471ce3569c0", "comment": "Malware payload (Braodo)", "value": "83711659cefcbf87d78560f3567f969f6995e0c3", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396308, "uuid": "3b7073bf-8046-435f-bb3a-98268a6fdf84", "comment": "Malware payload (Braodo)", "value": "566d9c3f35404496cabddb78ad27b8b7c691f289781d9ff86c3cc3914891052105564e1cdb072a6b03f559886958633b", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396308, "uuid": "369ec29b-3117-4fce-89dc-3e12f4a7b585", "value": "T1CD5502968F272FDA6C392A8D04BE6B85C89C5D333C23C4F6DDDA150FC13859A1592E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396308, "uuid": "e5a027c3-acdc-4682-b0eb-550f84a61af6", "value": "24576:uNs2GhZwiNs2GhZwiNs2GhZwiNs2GhZwuNs2GhZwiNs2GhZwiNs2GhZwiNs2GhZ1:u4hj4hj4hj4hz4hj4hj4hj4hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773396308, "uuid": "4cba3c13-f247-44a4-8db0-a970f4df8da7", "value": 1351217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773396308, "uuid": "eba671b6-fe18-4933-a117-b0559428371c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396308, "uuid": "c8f8dbde-4323-4a01-812c-bab2bda8053b", "value": "ud.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c7f238-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408166, "uuid": "e24a50c5-9709-4d4f-9cbd-9047a9ae7f55", "comment": "Malware payload (Mirai)", "value": "35f3629d2df992366f2cc4cb2ce872c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408166, "uuid": "44d53922-f1ed-4f6e-bab0-8e2c2f3f963e", "comment": "Malware payload (Mirai)", "value": "42da0862a113531ed2a8a3a51c0c51c22639e30780c2243a6200295aaabccde1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408166, "uuid": "ed61a76e-0b16-4768-9713-5e911fee2c7d", "comment": "Malware payload (Mirai)", "value": "1092a8b50f5c7f8b4bf86c09e79fab4191d5e9c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408166, "uuid": "a14a49b2-9de0-4c8b-afc6-bb203fe08199", "comment": "Malware payload (Mirai)", "value": "f588d82f0031062357da1803768243cb253d42cb8f45ed83465096040b76576d7630a1cd79f462bd9f83180bfcdb0daa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408166, "uuid": "d5007bc6-de58-42f3-b7c9-31c58cd13ff1", "value": "T17193F756BC829B11C5C412BAFE2E018E331317B8E2DE72269D245F2477CB92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408166, "uuid": "dd5878f3-db55-42d9-98a1-9d8b6f7582f5", "value": "1536:Sln8qYIuRHxGsnpl9o+Bp7loIx13wkz7DdzasP9OKoCDdxirnuk95qY47ypsBZ:GYIuRHxjnxHgkPDdzasPSnuk9oB7ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408166, "uuid": "8c52ee91-d70e-4a3f-9a51-2831caacb318", "value": 96432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408166, "uuid": "5975316f-ef78-4635-aa28-f2afb50954c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408166, "uuid": "a83346b1-d443-4cbd-8601-e5d9f8904663", "value": "SecuriteInfo.com.Linux.Mirai.9774.20974.6148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3fb31a-1eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773413219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413219, "uuid": "446758ea-89fb-445e-bf38-90ed800a79f7", "comment": "Malware payload (ValleyRAT)", "value": "cccb3fc5f563efa516289b98590ffcd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413219, "uuid": "a640aea3-751c-4b1f-8a13-90a7b40f36bb", "comment": "Malware payload (ValleyRAT)", "value": "43b3eb69729a82c9babd44da03348659ba8c8f55afd6e8cb23ccae78eb09c890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413219, "uuid": "fc67ea3b-83a0-49bf-b068-e33680b7e9cb", "comment": "Malware payload (ValleyRAT)", "value": "e20abf6021fa99f41da19b5b1507bd8c0d39ab72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413219, "uuid": "db6836c5-70aa-4828-a0a7-0cd4f5cd32f5", "comment": "Malware payload (ValleyRAT)", "value": "85b58acb51e4ece66fe942c33ae0b7448280fef63f3b436a0a5d23b17895edc67fd61532cc0bae009751e0b06a3d2625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413219, "uuid": "2f2ff3a8-3edd-4c2f-bf08-ad95535bd577", "value": "T1FBB5F116E2E748FFF5F26DFF85523411F2B8F8CC216AD18B275142B61FA66805E25B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413219, "uuid": "3253ae1c-1b08-4ddf-a38d-4f1ba0c0a7cb", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413219, "uuid": "40b43526-e839-4805-af7e-b1ba4126a2f1", "value": "49152:bZB1G8YTj+rQQZfxjuD/UDjgS9D+X6WjDOGTxpRt0viqbp9Z:V3GBCNfVuDUDMS9D+KclRthup9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773413219, "uuid": "842461c2-b59d-43c7-ace5-700d87dfab42", "value": 2331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773413219, "uuid": "2c519696-d4ef-496e-8f7c-1105612c3420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413219, "uuid": "d46c80f2-aa3f-47b8-b1f7-4db132a19446", "value": "\u9ed1\u56ed\u533a\u53ca\u6b7b\u8005\u8eab\u4efd\u4fe1\u606f\u8be6\u60c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d38dc8-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408269, "uuid": "bf914dcd-d323-42a7-8860-88ad5a473b7d", "comment": "Malware payload (Mirai)", "value": "fdc2954570319c0abc05536c9c26c189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408269, "uuid": "20c3100e-e00a-4141-9fdf-6efb21236299", "comment": "Malware payload (Mirai)", "value": "43d010ff884f5d011402f9cb44d9349f89ca4daccdcc6cde3cd3ea8fb468658c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408269, "uuid": "8b963a97-f80b-464c-ae41-417538f0224c", "comment": "Malware payload (Mirai)", "value": "db3f3e8a7f98ee8fa52c2ab2a2fb65842a628f50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408269, "uuid": "7b017670-5a71-4164-844a-e63e17616e73", "comment": "Malware payload (Mirai)", "value": "9096fa5f878488ac4f83fe45876ef9c2d46d426f20307485476ceabcbafebe2bfd300b2c3f8a3601f9cd92c1432e8ee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408269, "uuid": "82e0604f-b498-4c74-ab4a-98b67a07f63c", "value": "T17AD3E1A8F490DF23C7D1697EFB0D1609731303B8D3EA73128D24CE216BA59674E36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408269, "uuid": "71106870-79fd-43af-ac71-e6c4513380bf", "value": "3072:foTTImvmBwVu0eI6hNWCIqcsHvCtOOpuJwPrU:fgIwWwA9Wn1sSzpke4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408269, "uuid": "0c7011c4-127f-4e68-b990-651fc112a207", "value": 142204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408269, "uuid": "2027301b-4b69-4bdd-9036-55037f626984", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408269, "uuid": "9682f0ae-f90f-4260-b7db-9b388d92f3ac", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef06bc0-1f1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773434455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434455, "uuid": "35d90e2b-67dd-4756-b3f9-f01116309fd1", "comment": "Malware payload", "value": "6356af9fef03e1b783f85679c597703d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434455, "uuid": "78a4741e-5a15-4a06-878b-3924aa2ceec2", "comment": "Malware payload", "value": "457e5ba4226277b1aa89b065a5e109295cf2f26a8d2053239f0c8548218e219d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434455, "uuid": "97739a16-15b4-4249-aba2-9ee75feb2792", "comment": "Malware payload", "value": "38bfc3858311c56093c1512c5486d4129fa22a36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434455, "uuid": "3bd206b9-0d44-43b8-a1c9-23c0315a0a9f", "comment": "Malware payload", "value": "ec5edac113757e7f0dd4bdcad6a42f283893ea0552d2cbe629893f9905a603283f8649ccd0b0847bc9e5c44d092b6949", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434455, "uuid": "3afa2caf-5673-43d7-b457-f6228d08e117", "value": "T1FA81A4B035F04D732E616A80F3372BA6ABB6991345A3318C35DD2E395F86B12A5FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434455, "uuid": "2b4c5166-f299-452a-9930-97804610d8b3", "value": "48:cniRxuGRy/+DdvnSfr7lwnYJ/dl/B4Tilwn8Gs7wnizLI7wnE/+ol3+L+ol3Mt+a:cWu47kQMaXv+R1mhm/IBRIBAybC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773434455, "uuid": "b0590982-e47f-405d-b4a9-bde2bd02dd94", "value": 4023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773434455, "uuid": "c0163d52-a5e4-4958-a8ed-a7c58d3e02f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434455, "uuid": "79bdf3ed-73a2-4452-822a-ecdcb19a5bdf", "value": "457e5ba4226277b1aa89b065a5e109295cf2f26a8d2053239f0c8548218e219d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef46b53-1f11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773429596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429596, "uuid": "83cd5c32-4d08-4949-92a6-b92b81f3946b", "comment": "Malware payload (Mirai)", "value": "073349fbecfd8384d834e2a6039f5319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429596, "uuid": "e7991ea8-b630-4ea5-a401-e10708640993", "comment": "Malware payload (Mirai)", "value": "4641db7fcc6016646eabbec769d67a4d52eb3c2803272045ba9aeb10d83878dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429596, "uuid": "dbef2217-6df1-4413-8902-01e0e7846428", "comment": "Malware payload (Mirai)", "value": "0c5a4a7bd67a6efb7f0bc6ab27c4bd7c0899446b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429596, "uuid": "4ff06dce-07e1-424a-be93-54d36bbdb987", "comment": "Malware payload (Mirai)", "value": "9ff1a95dafea6849f3506636067d50f44c6ed1dbdd8a8b6f9b3e4192920a45e9f3ccfc707f2a83022e6f0c03952469a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429596, "uuid": "8151d59d-04d0-4982-84a1-e29bc1480b5f", "value": "T14F14965E7E22CF7DF668873047B78A20976933D626E1D644F1ACD3181E2025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429596, "uuid": "5278d878-27a5-4c73-87f8-3eaad570825b", "value": "3072:CVaQY6iDYe6g9sZW2ViQ676iw/3PJr+9e50Z8hKVxnh:CVaQYHbpac6T35+9eiISnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773429596, "uuid": "f853b44d-335f-42c4-97ab-060227872cb1", "value": 208116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773429596, "uuid": "f2b4cf82-2101-425c-8c50-1e31952b0bd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429596, "uuid": "989d7342-0abe-438b-be05-1582a955d2f5", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e32dde6-1f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773438104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438104, "uuid": "d18bf107-91fa-4724-9cea-73d101fb4e0c", "comment": "Malware payload (Mirai)", "value": "02ec29fc9dfb605163effcb7ed42370a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438104, "uuid": "d8b6b831-998b-471d-a037-4f8666f9ad4f", "comment": "Malware payload (Mirai)", "value": "46bf209aa5c943566643639ac09c1ef82ef6cc0a9f82560824bd2c9d1a899ee0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438104, "uuid": "3a3e065e-f706-4dd1-b7d4-3c22f396ece5", "comment": "Malware payload (Mirai)", "value": "d102ddd83d1ba261fd336483a88f395d4885ad2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773438104, "uuid": "f613cbeb-e4a3-4602-b479-e990697a15ff", "comment": "Malware payload (Mirai)", "value": "cc6c760b3d3f3737e953dab982d88fe83bb8e78aa618fce29131ff1960af62919003c46a6e89788e5ecdc73ba58151fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438104, "uuid": "70f136c6-0326-4340-b4a8-9ecfc283777f", "value": "T134B3A71E6E318F6CFBA9923547F74A20975833D626E1C684E25CE6011F7034E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438104, "uuid": "a085c78a-5ad7-4dfb-a135-b68640e37e35", "value": "3072:x2Rkm2rPYWuclcGopElZIxp4nTWOtuBX8Y1C7yR4:+km2rPYmrIxp4nT/GMY07yR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773438104, "uuid": "14119fe0-f417-4fc0-a876-77ddff2b21bb", "value": 113808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773438104, "uuid": "61d1f746-3e4e-492d-8cbe-ce1d6372f2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773438104, "uuid": "02cf31bc-9b8b-447e-845d-cd9208e1681c", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bd62b8-1edb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773406492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773406492, "uuid": "7b6254c0-554a-4afc-83bd-d1eb0c1efb91", "comment": "Malware payload (njrat)", "value": "3791eb9a8df472c1ca23c57b82d11089", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773406492, "uuid": "970f9eed-480e-41a9-9d61-1b4fccbad53b", "comment": "Malware payload (njrat)", "value": "47b1c3b084272a4cf8cb1781707396c18c7e8c6713cbab3ad3ffc036b806884c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773406492, "uuid": "a5052264-a3c9-4b8c-9e23-4e2181f6bf62", "comment": "Malware payload (njrat)", "value": "5993e0e4dc334f9596318484033f1a71b18316d7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773406492, "uuid": "66ab4bfa-516b-435b-aca6-543bf34a542b", "comment": "Malware payload (njrat)", "value": "83e5d8e08e73789369d907110bc13a422ec50329166f19754007fdd6bdae19c2658ff2a933d130685b00a2447360ff91", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773406492, "uuid": "c6f6e078-0a63-4ffc-a0dd-e0767ee37ba4", "value": "T143E519376FA64440E9CB4571A9F87F843DBA77F381C8558D826BE1804792AF2E64DC2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773406492, "uuid": "48d738d3-a1f5-4d75-b1a8-65ee949f5531", "value": "24576:IOh2+qw476X7FygIXfUvQfCvMWist7EC9B0GiI7yoyaKgIhsi4t19syISu6vUZc:IOh2bw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773406492, "uuid": "67e86554-ca14-4f67-baaf-ad552cfe3d3b", "value": 3137536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773406492, "uuid": "d90e7925-b7f3-49d2-8a12-259e23c4a1a3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773406492, "uuid": "7b305139-7b0a-456d-8965-b60765ad3283", "value": "omnetrixfn.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da6f5f6-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (AmosStealer)", "timestamp": 1773390778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390778, "uuid": "7f7a516f-6cfb-46e9-bf42-91bb6fa1b24c", "comment": "Malware payload (AmosStealer)", "value": "bee11bc2a40eb149a0b2644abca41f17", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390778, "uuid": "1d7667d1-7ed3-46e8-88b0-3ff87f53d07c", "comment": "Malware payload (AmosStealer)", "value": "47cd98c6ae435a1a6aa518e29f9e407ca42c82c9f4b86ceee93cc85d7feeae98", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390778, "uuid": "b9bc919c-32a5-4465-a715-87d523ddfb5b", "comment": "Malware payload (AmosStealer)", "value": "aad9524ce1ab797d35670422f35eb6958d04cf12", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390778, "uuid": "aef311ac-21f4-42a6-8e57-2f15a06c0b74", "comment": "Malware payload (AmosStealer)", "value": "6a20185469e7384df067a09c099d20a88e923a4393524d1a507e9115e46b0e29c8f64acc18d910be728d91f948a4e790", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390778, "uuid": "9bf77537-acbe-4609-aa03-5a1add9ecd68", "value": "T1F0639E9263FA5108F2F76F586EB556780E3BBE616D38C28C449D184E0FF3A9584247B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390778, "uuid": "7b33dbac-0c5c-4448-bedc-2784e8a1ce6b", "value": "1536:RlFat4E7tLdEZpruhVaiDkFzE2+CCKP8rFIbY1c/7nCPkX3rL8bDI:JeEZpruhVaiDkFzE2+CCKP8rFIbY1c/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390778, "uuid": "df459f19-d06d-474d-ad81-0733b8236bc3", "value": 71602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390778, "uuid": "d45227de-0193-43b0-9c30-c4f4189f686e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390778, "uuid": "a241d3bc-0b77-49d4-a6bc-afb378a3a4fc", "value": "47cd98c6ae435a1a6aa518e29f9e407ca42c82c9f4b86ceee93cc85d7feeae98.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750ddf7e-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773407192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407192, "uuid": "bd33c37f-e236-40df-acf7-7aee0df349a5", "comment": "Malware payload (Mirai)", "value": "8fc84a03b66ceccd394c6a754bb513a6", "object_relation": "md5", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407192, "uuid": "e689a8b9-cefb-4d93-945e-053dedfcfa86", "comment": "Malware payload (Mirai)", "value": "48cc6040c15e556bb5827417dcaab74f6059b62ff2ba4800ee2f9c261d2fd993", "object_relation": "sha256", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407192, "uuid": "66c1dcfb-b6d0-4805-b7df-077c10b6925c", "comment": "Malware payload (Mirai)", "value": "e05ba7880981b24039b239da4d685e7f4cc6373d", "object_relation": "sha1", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407192, "uuid": "131e26a4-3a5b-495c-9610-9789a7556735", "comment": "Malware payload (Mirai)", "value": "7e665afc569bad7ec1b318ddfbfdf22ac686abe0bee186aa3a2e2e53951569b04540e7cda26a67fd5d4ba8a0ac51e95c", "object_relation": "sha3-384", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407192, "uuid": "f3723bcc-0ab0-4c59-a124-174ae71a2d22", "value": "T1B903F18301F9D3FCADD2CD7A982D5818365CD290939F0D672E9C4E83AE980B85635F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407192, "uuid": "854aa0e4-a8a7-4cb7-a030-5cd1529d00f1", "value": "768:CLWnc4TdpRmk7nQ3OKskPKCpXj+0H1V0EGwtqBizZNNrxvOUmG2:6WcYpM+KxP7pz+cVcwtqB6dr8UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407192, "uuid": "fd763069-8484-4221-8466-915ba2b434ad", "value": 37928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407192, "uuid": "8737c19b-09c3-4f15-8f69-23f1a60da941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407192, "uuid": "879984ec-0a00-4484-915e-a7af52fbcd98", "value": "fmw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2874d9fe-1e77-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomStealer)", "timestamp": 1773363255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363255, "uuid": "aa8bf041-69cf-4227-b733-b8d712f883be", "comment": "Malware payload (VenomStealer)", "value": "f5617974e5d6655102c3d47076efd3aa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363255, "uuid": "08d3a3f8-ed7e-4b1b-9078-706a3708fe64", "comment": "Malware payload (VenomStealer)", "value": "49604c66c0f237e8a0a8c464cc448c8a7bce59f5d6de2a57653d08614b2cada4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363255, "uuid": "d3e1ae83-95c6-4026-a513-9e838dca88e7", "comment": "Malware payload (VenomStealer)", "value": "757ae2fd8a9029830da2a9c237f404b29fe8a56a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363255, "uuid": "8188869f-db9a-4edc-90eb-b2858fded1c0", "comment": "Malware payload (VenomStealer)", "value": "45a2143c77c72ac23dd4871f36df15b8769285935d96204ec1dcf0a0b0ad6b948550c86b3accb9a082d383afb084ecab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363255, "uuid": "f82cf3d4-c4be-425b-82dc-547990cc61d9", "value": "T13286F14A6C620AE1C45E56789CF341DE77B1B8091B3323CB1FA9B9342E76BD09D79B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363255, "uuid": "20feb0ac-c74c-4585-b099-b84025954ab5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363255, "uuid": "ee0c0125-7e12-4839-947b-f7db5f7385cb", "value": "196608:m+9VkJzRlCLI9d3VOmp1zlXypsDvo1MZkzMJJaER3sCtG8:mkszTCLI9d3VOmp1zlXypsDt6zMJJapw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773363255, "uuid": "6f500359-7ecc-4eef-989a-c9f2cb1d1f08", "value": 7924736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773363255, "uuid": "6938417a-4b52-471c-8fb5-8f03cf54dc48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363255, "uuid": "60e3f77f-f720-4c75-a8a5-1a53678e5001", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b370dec-1f37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773445696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445696, "uuid": "66c4cf72-706b-4e8e-b9ca-cc977f874429", "comment": "Malware payload", "value": "313df9e860e1bd94bef940f9721c3e3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445696, "uuid": "2e78e4ed-f0da-4237-a554-88c8cb500b58", "comment": "Malware payload", "value": "4a76c14fc1b203dd017272f414a41e8790303c22bf24e6a22e08ae2b658799e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445696, "uuid": "d6b41e45-eeb0-48c0-b6ba-501b23b38c54", "comment": "Malware payload", "value": "3f75bd58e736102e17496ae84a05f933ffed9b14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445696, "uuid": "30352aca-3663-4d6d-aff0-c5c7b1d6a0ce", "comment": "Malware payload", "value": "39322de37d8522bff7436e17169a8a4e331bf69836c6eaaa8fb266c2e117aeed9e1ea5d8e85899c6f260bf37d0ff9900", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445696, "uuid": "b0b50ac1-34ef-4ea9-a46d-5bfbaecab6d8", "value": "T1B4C3FFAD58DF04875717B9991727A88FDB62970F0A8CCCC2373CCED05FA16A852EA5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445696, "uuid": "7c417357-2f5b-4760-ba74-0c379963f97d", "value": "1536:+Tv5Lyb4J++wvtOGmCh/eR40SbE+CwW/1:Zh5CwWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773445696, "uuid": "86853808-d8bb-43c2-be25-f6a346a33f8c", "value": 122570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773445696, "uuid": "09e41f4a-2286-4426-a4e0-5b919d2bab71", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445696, "uuid": "26d01ae2-a096-43cd-bff6-b76c7a9b50ac", "value": "Beta_Dataset_Sydney_4868.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed4f31e-1eab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773385599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385599, "uuid": "6649dad1-76f5-429f-917f-da38d95ca60b", "comment": "Malware payload", "value": "11eb0617ab7a4f01d4fcef5158f906be", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385599, "uuid": "1a8d43b6-7a99-453a-8e79-422d86001afb", "comment": "Malware payload", "value": "4b98604bc283291e7573925c9f5656b2713c7840b6d0daa8cec029b25c04af4c", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385599, "uuid": "7728f54f-645c-4fec-896c-39ea3bc1f088", "comment": "Malware payload", "value": "3cf5f940f5ec1022b31dc6ba399c2107d36cbe0e", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385599, "uuid": "da2f0d4f-253e-43a9-99ac-a4dcc5f19bf5", "comment": "Malware payload", "value": "654c53b870b94a5ae350cedcc10431fdfebefec52054399ddfbe8df4fdf723786b5fee1f647285035c5723627882bce0", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385599, "uuid": "b058fa9c-9781-4f37-8959-e99cd5b9d4ac", "value": "T17A331AD6CCDDD19687BFE511B0CF5C928153CA486E3AA75188F20A8DD51D2E36082EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385599, "uuid": "def6d76b-a938-4685-85a3-751a5455d072", "value": "1536:hAAV57GZmKxgfikw4rbsGYppK4U+4IFLc0TCXK0hyejIK:hAArGZZxgOpK+HhB0KSIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773385599, "uuid": "0dfe14bf-420d-4f41-a88a-af790723e5c1", "value": 54151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773385599, "uuid": "b3966d9d-8d74-4461-b783-1ce94fe711c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385599, "uuid": "7cda2472-a434-447a-8572-ae81899e78df", "value": "yuwibkqnaq.com.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0312c7af-1ea2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773381661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381661, "uuid": "ca1427a4-d9ce-4e41-99c9-87dc6657fb93", "comment": "Malware payload (ValleyRAT)", "value": "baaeffbf305f692dfabca34dcb461441", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tedy.SXJ!MTB", "colour": "#9D5CDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381661, "uuid": "7efda214-4b97-4170-98e8-c231cde7d225", "comment": "Malware payload (ValleyRAT)", "value": "4bbb0a2ffafe6043860e41c12ba1c0e1dd9f1486cc6f1487d7053043233f8a72", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tedy.SXJ!MTB", "colour": "#9D5CDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381661, "uuid": "b957cff0-fc5f-43bf-ab93-d7ddfa883f4c", "comment": "Malware payload (ValleyRAT)", "value": "9e26831ca6914f223c230890f38855ee5c5771e5", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tedy.SXJ!MTB", "colour": "#9D5CDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381661, "uuid": "e0bf39dd-ad6d-4f8c-a064-44ad144185b3", "comment": "Malware payload (ValleyRAT)", "value": "e735d01c30ae8d1b01d3b336e2be9e26e3c89a3669440b1f406994c041138b4556d5f6b9e21b8954f7fb51650b47468c", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Tedy.SXJ!MTB", "colour": "#9D5CDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381661, "uuid": "15a39a23-e6f5-4e27-8e77-f2455a917d45", "value": "T1E0C53381F3AF2E14F23E9068256704D4C277603AC58DB6D630512DEDD6EB1CE6B7A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381661, "uuid": "01a15733-4db9-4c71-a9d5-5ac056309b76", "value": "49152:OlR6CPZSUDFNjAmzIuvi94r4+1kNFKrcn9WN67X7Zwdi7zotXiG76iNsGHHBM:K6UdDFNjAWvdv1kN0I9JD7ZwdifiKBG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773381661, "uuid": "c4df90b9-4873-4f0e-9b22-40e7e8527618", "value": 2679861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773381661, "uuid": "dab8fee4-a97a-4eca-8107-7dc1c1c4827a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381661, "uuid": "d29d4a2f-9090-462d-a5ef-cee5c87057eb", "value": "\u3010\u4eba\u4e8b\u7570\u52d5\u30fb\u7d66\u4e0e\u6539\u5b9a\u306b\u3064\u3044\u3066\u3011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7719a070-1f2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773440267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440267, "uuid": "21991230-9d3d-4dbf-be42-6dd492a0ce98", "comment": "Malware payload", "value": "f88ba37121cb487fd8a7cc248d530fc2", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440267, "uuid": "804abe60-e495-4d14-9712-250b49b5a146", "comment": "Malware payload", "value": "4c21836bcf4cdfd6d4810edcbfa2ea5f4ac9f8b3ce8c24aa74085f4bc4c22339", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440267, "uuid": "a10a5cc4-a828-4189-91f9-db48f5b42be5", "comment": "Malware payload", "value": "224f6a3d884908922bd55bb09fce428d16cb8366", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440267, "uuid": "ebb4d1f4-caee-4c8b-aae6-7c9610144849", "comment": "Malware payload", "value": "9d60e6278d1c354ff2e3258fa44da6703dded9c84705347713fb8e7e0603a2f197ed14ac8eae015e7f97578d89a87b7d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440267, "uuid": "f70fca16-dc25-4547-84fb-14ae939a3ae7", "value": "T17752D37E79C34BB06C0698EB102D371919B429BB3C19B5C4B2E5457A9FEC0FC8A32476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440267, "uuid": "476c4697-a813-4f07-9615-aed76464be40", "value": "384:p4JujKyEv1+lDm9BgDUXjnRIGYKsgBZZDsjiJYNkqLEpSr:W1TEpmbguCIJYj6U5EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773440267, "uuid": "0fed8294-ae87-4ad2-824f-342a12b620d4", "value": 14345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773440267, "uuid": "53ccfcb1-20b3-4a0e-9869-dced5ce6f348", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440267, "uuid": "49274353-bf6e-4f9f-ba18-c0083bfb342a", "value": "road-to-hell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f852dbb-1f1c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773434107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434107, "uuid": "97990430-18d8-45c7-9037-8f0a68b6e6f0", "comment": "Malware payload (RemcosRAT)", "value": "72ecd967be4dcc2dc6cf357a7b8baea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434107, "uuid": "b0d2d396-43cf-4fab-a7c8-7021c7d47a2d", "comment": "Malware payload (RemcosRAT)", "value": "4c3d4ecf06d4926f395adc857b333eb49ab7b21ab412512eed50ce7c4e1ba6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434107, "uuid": "59bb272f-06e0-4fb9-aab0-bab53b5c2dab", "comment": "Malware payload (RemcosRAT)", "value": "40d6af7c887f9011605dff9e0463850dd9203e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434107, "uuid": "32c88d62-fe76-46e8-bda0-8c6220e6ab23", "comment": "Malware payload (RemcosRAT)", "value": "12ecef0ad744575adb8548844745dbbc5eb992524143a7f99e3f1efa3f23fe3ba0ca0a35c9542069c175bfb8367809ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434107, "uuid": "84172d49-86bd-410c-b08a-49fa219a3818", "value": "T10DB49E01F6C2C1B2E1B615300425EB75CFBDBD2128359A3B93D61D97FE70252E639BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434107, "uuid": "6d52a026-c3dc-4acb-9afb-ea9a866adace", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434107, "uuid": "cbb9532a-8f6a-4411-8280-c4b70df72f48", "value": "6144:QAylnqi6jMR9u0EGyDzWo8bAvQn3I1HXxrJCSKVZ168HH4jsAORZJCXp28c/FXmT:vBlXGI8AvO41HXynVnKsPZJ9mPFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773434107, "uuid": "55a11c6b-fe82-4d8a-a097-14f25613448c", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773434107, "uuid": "3d7927e3-fdd0-4c14-ab43-8088bc4d9876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434107, "uuid": "6d880d1c-ecb1-4b12-aa9f-ec29b86a6a76", "value": "4c3d4ecf06d4926f395adc857b333eb49ab7b21ab4125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ade6c0-1e84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773368971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368971, "uuid": "6b3858c0-59f5-488f-b4e3-b08b6e20b177", "comment": "Malware payload (Mirai)", "value": "daf84ea940ee9757231eedf5e3480bdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368971, "uuid": "8adb6fb6-0530-420f-98bd-cc540cfc1c0b", "comment": "Malware payload (Mirai)", "value": "4cfe5a6aab1af5b76b2eb47e48fe3ee3e690b0e35fd2936d312acc7cef1b1d47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368971, "uuid": "55f67cec-1aff-4d0a-aeae-9e76664efb6d", "comment": "Malware payload (Mirai)", "value": "619a9acbda8ea81f828fad026f52f15eb4acdd0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773368971, "uuid": "3925b3f6-a9b9-432b-b14e-7c54c8911ff9", "comment": "Malware payload (Mirai)", "value": "92eff3ae4fc49fd6914570509c369fddad68f5ae492fb7fcea0a72595028e2fade3e3bcb56c3e6813bc54886057b234d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773368971, "uuid": "c49f84dd-92ec-42ea-809f-7c6ac0f7752a", "value": "T119330951B8C6A557C5C497F2B75A4265330243A8C3DF3303E8288FB6324DA9E9F7AD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773368971, "uuid": "d0702e7b-13a0-4a3b-93c3-b1de58c9ee1e", "value": "1536:0KQayOJfi0k3bf1RqnDvK3IN96gn3XORtWe7O:XsrfGDvK3IN96gn3eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773368971, "uuid": "790e12ad-8797-4f83-a06c-5fe9b611a3b3", "value": 52448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773368971, "uuid": "9c71dc9b-4233-4cf5-b4f1-5b6594a4d953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773368971, "uuid": "27dfb498-c7e6-417c-bdcc-5b455a898460", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa76dd8a-1ec3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773396249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396249, "uuid": "17aa2d27-52d8-4103-a814-143407376c61", "comment": "Malware payload", "value": "032eb7585e81f4b1bba6702e733ea150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396249, "uuid": "b32566f8-44b5-4227-ab35-72a6ed53f017", "comment": "Malware payload", "value": "4ef898d0d5611c920bd3d8922e4298c35363734d933c3280bfef30a7ee1407fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396249, "uuid": "0437e965-c3eb-41a6-a169-ad8e34617886", "comment": "Malware payload", "value": "7a1729bd99def8ea59a3b337f70c2ca604b38f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396249, "uuid": "35bff65c-b628-4550-ac30-867c38c87467", "comment": "Malware payload", "value": "fc5a9dad84594e34a0784ec58142f76bbc021a7cc5f1422b9400a1601b2d810ba7cbe4cb78d5f9c4ab5c068ed3353bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396249, "uuid": "09d0854d-d927-4397-8f0a-c8125327200b", "value": "T11975F10BCB399CDCE8A0163014E87DAF6271AC047C503BA6E58533B97A33594DF6D9B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396249, "uuid": "86a8dc1c-88d8-43a2-a82e-100917ac9173", "value": "eb2615f0e48cd3c9b850ae72c84aa2c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396249, "uuid": "3225485b-a631-4a06-9ae1-1b1a501987ef", "value": "24576:lUYJKrEHcHwJ/QcIB7CqgK7/JV6YrCY5/pUdzzBlLyfb4l4z3w9D7PnSZge4:lUlQVKhz6YeYAysqC/AgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773396249, "uuid": "50bfd466-c4fc-4185-87d7-84f0824c9a78", "value": 1662464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773396249, "uuid": "002e5c01-79c2-44f1-993b-5effc05fb1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396249, "uuid": "3f7955e7-4f1a-4a2f-aff8-85e96501e3e0", "value": "2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ea157e-1e8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773372238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372238, "uuid": "1279f0e1-46e1-44d2-bd60-1072797961d5", "comment": "Malware payload", "value": "71a642b19b5c54c7b72eeeac967baaf8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372238, "uuid": "f22598a4-6396-4957-b12f-13cfd4ce61f8", "comment": "Malware payload", "value": "4fb880109987bf2e51892088767948635938d6cbefce6fe3dcd1beea5990ef51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372238, "uuid": "65846476-3993-4e40-b4fc-eb4884cf1bfa", "comment": "Malware payload", "value": "7ce486bababcd01a19c5a1469d8bfa2253a79188", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372238, "uuid": "267e239b-888c-4cef-88aa-907592073526", "comment": "Malware payload", "value": "f68e8f4bd46945839f0350612b9e407e26050b7bc197a90fd1ae4c8bcd5da88c77f224c132c86497164fee3328fe13f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372238, "uuid": "4fe7b3a3-da9d-45c8-9061-b2f3ccd414cb", "value": "T1A0056C87B25304B2FA73843089AFE66BA32A95546B73CEC3435C5A9BED337D04937650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372238, "uuid": "bebcd5c0-2cd2-4ff6-a21a-05cddd6c0453", "value": "245805c3ee4980d632302322336229de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372238, "uuid": "a6b25d81-3947-40ae-9c71-e4c1518cec84", "value": "12288:oW0cvDy0Qzzhi2bB/jlGlonktix87Y6qLs467qh/w/amLSUG076sXnSR3ek7FncY:oDpzYYxmiBm/amQvsXnSR3r7xcAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773372238, "uuid": "222e6aa5-3864-47c6-93f7-18425d72f868", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773372238, "uuid": "7fc36a27-3dd3-424b-922a-cf231830e24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372238, "uuid": "e8d9817c-6a38-4c48-be60-0a4e8f4dd3b4", "value": "SecuriteInfo.com.Win32.MalwareX-gen.95221847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18ecc84-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412018, "uuid": "64632f08-7bfa-47ad-a0f9-b4c2cbc0df2e", "comment": "Malware payload (Mirai)", "value": "70f58ea8e179e3633fdb7360aea1e03d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412018, "uuid": "7e037df7-02a9-46bb-b356-246c556037c8", "comment": "Malware payload (Mirai)", "value": "517b4ced7d7d4db24e39f158995a20f1f640749e725cac7d7f3f9ba5f788e917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412018, "uuid": "96087179-6d8c-4c47-8d56-c29034524ed6", "comment": "Malware payload (Mirai)", "value": "9372113fd1415b31d2c578943b9ec7a17f84eee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412018, "uuid": "af10cf09-ea54-49f8-a213-fde230b2a78f", "comment": "Malware payload (Mirai)", "value": "f8f1740f6f3699df58a2de13e1d9bcced81119dff6151f3a9f9b092109157df8b130a15b0fd9d2689691105e1091e8fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412018, "uuid": "cc738e0e-46d4-482a-866f-249d39a878b4", "value": "T1F9935BDAF400ED7CF84ADB7B4463490AB530A3514B930F3AA367BD57AC320A95D17E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412018, "uuid": "d1ac554e-48b2-451d-af7d-b2371e5db709", "value": "1536:5GdaU6JztMzAkN8ihKpqWjjAFOubvsC9cjpq8itLfl8vscyIneDCq8szTxwDDrzs:OatqN8ihSq4AFfbvszjpvitLf+yIneCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412018, "uuid": "11ef2745-bf47-489b-8d58-ee3b43c2a0fa", "value": 92856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412018, "uuid": "a19ef1db-5b03-43e2-9c3b-19da6cd2efdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412018, "uuid": "531064e3-34a5-4961-9a82-a2b5ddb7e0ed", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee168bf5-1ee7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773411690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411690, "uuid": "357aee3e-2d1b-405f-bbb0-23ddd5068f3b", "comment": "Malware payload", "value": "3c02dc988369b983e7bd55ea1a8678fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411690, "uuid": "9264fbf0-ecf6-4526-93e8-7ace5ce328a0", "comment": "Malware payload", "value": "523acd0e37faf5898ba397001cab4658de45d8742760c6eb23797e222deaafef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411690, "uuid": "8eaa5b9b-dfa4-4992-9a3c-f57d85868f48", "comment": "Malware payload", "value": "3812a05f51ac5ca3509b8fdef67b52913e00ec17", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411690, "uuid": "2dd77a85-2b34-4d5c-b5fe-2a937adb5fd9", "comment": "Malware payload", "value": "8c303878c600dced2d8c300a57bb514048b4242dbd100f232bda188680fbf6f081d9c81beeff523a29e6e691e77300d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411690, "uuid": "dc561008-8279-4549-a63e-6037d4d93253", "value": "T103924CB512896C79FBD1CE399F3C7F4CADE8C2C42124A3ACBA4F39205A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411690, "uuid": "df761623-3e69-485e-94c9-31a1b3ab8b71", "value": "384:sDcuQpWx+BL0SWL0gRzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:sD8i+BL0SI0WzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773411690, "uuid": "580aa8ef-46b6-4eb6-aca8-b6846938a78d", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773411690, "uuid": "1381ef89-3417-4047-9eb6-70d4a0e04de6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411690, "uuid": "4ab457a0-1cef-4c04-aa23-a610ee92fa93", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f3273-1e8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773372307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372307, "uuid": "90189fe4-3e1f-4ddf-b590-3e35fd2a71ce", "comment": "Malware payload (Stealc)", "value": "20d35681bf6271bfbc5e9ebd58be5c15", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372307, "uuid": "e9ca5fa1-eaba-46f5-b1eb-f7bafe013182", "comment": "Malware payload (Stealc)", "value": "5273fc9f5c5c754bf37c58a391fe9ea7d98de470f042d2478d3beb0b71838b77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372307, "uuid": "d457087d-c94d-46e0-b9eb-8fe4fe8532ab", "comment": "Malware payload (Stealc)", "value": "e6edbf519c314805ac107bee190195fcf1902f18", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372307, "uuid": "d502df87-625c-46ad-aece-4e65b1537273", "comment": "Malware payload (Stealc)", "value": "7047adf89325d44262453b12823d20cefa77a35ffddaa518658d3f2126e99ba0c219678da8f81248ae9aa0287918626f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372307, "uuid": "0084795b-0bd6-4a54-be5f-2328bfda1b34", "value": "T170862313F14E633EE46A5A3A49729A00953FBA50641A8CA3D6EC3E4CCE3E4501D7FE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372307, "uuid": "2b37c11b-4e26-4745-ba49-f15997fc4ef8", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372307, "uuid": "3733d6ad-713e-4287-af3d-ea3a49082e48", "value": "196608:rDbt814oKAoPjEb7ztQZao5h1Qw0ppKSca8:rD5XjAXqZaoepp98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773372307, "uuid": "cd8c4b33-84c6-44b5-8ece-5b8ff9636bb9", "value": 8301436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773372307, "uuid": "288375de-347e-4d80-b37a-ced81102e60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372307, "uuid": "97892667-0272-4e75-8ffb-b8f52f4b0b2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb471e38-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773433966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433966, "uuid": "8732a0d9-f839-417a-95b3-afd7f1b45179", "comment": "Malware payload", "value": "29836818f0c920124b363a259b1fce40", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433966, "uuid": "5415d98b-3452-4d6c-a46c-bfe87620cb0f", "comment": "Malware payload", "value": "5282265bf01bd8c550a8c68e5584fd132989898b4967bed1a5172527f6d7254a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433966, "uuid": "2c74e1cb-77e9-46da-a407-a157d50109f6", "comment": "Malware payload", "value": "107bad50ad43fee25af8acedb8ee62ad17792763", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433966, "uuid": "dd8996a4-5d4e-48c6-bf4f-ac87c87c865a", "comment": "Malware payload", "value": "07c2f41640da7c820f64f9a326ef58c3a54b7b638c1d882299c13736f71dfa3927e52009e18599dd7cbbbb8bcac45304", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433966, "uuid": "0d54c2ac-1351-49be-a790-4d16db0d0a1d", "value": "T1FB925DB512896C79FBD1CE39AF3C6F4DADE882C42124E3ACBA0F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433966, "uuid": "9b44e291-78a0-4a1c-b9b3-e58eda0ad74d", "value": "384:+FcuQpWx+BL0SWL0gxzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:+F8i+BL0SI0CzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433966, "uuid": "eebd62c5-538b-4824-bf90-f1b1638053e0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433966, "uuid": "a9f0bd6a-8c7d-4f86-ba06-346c2301996c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433966, "uuid": "63c340a2-ef3f-488a-b08f-3fd47430fe4b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d5bac8-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412715, "uuid": "eef27748-f85b-4358-8dd0-0c771174840b", "comment": "Malware payload (Mirai)", "value": "09b7902d66c8fed36a56f45120ccf7ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412715, "uuid": "326fca97-b504-473d-8af6-58c52088002c", "comment": "Malware payload (Mirai)", "value": "5397707f5b2b05ba801fb4cd6c7a272a79460c644947a40a666cbab5f89f5414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412715, "uuid": "bdfe1cbe-f0da-4ce1-951a-e22a88995426", "comment": "Malware payload (Mirai)", "value": "ddbdaf9a47f0876ca628f9fbfbf4d52c24b03934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412715, "uuid": "c9d2f55b-0f8c-4d49-ab07-d5bc6930c05b", "comment": "Malware payload (Mirai)", "value": "d3655127b7ac2df633692da89bdefd5acf82cafbd83b77a365a2e7f99b969f15e0c1eb278e82b8637545a4bebacb501a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412715, "uuid": "053b0d0f-64b7-4b42-a2ba-cfbfc70aabe0", "value": "T12EB3F14BB06124BFD1CFC3788597EA72A7B7714117A47B2F2640EA711F66F10269CB88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412715, "uuid": "74c7d3d9-2ca3-40f0-8d36-23267b414024", "value": "3072:Nov4QV8UV+srUi7rddDgfGIPeBJQmlqvYsmyOdG:Nov3OUJXDu1GBJQzYsudG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412715, "uuid": "d84c58b2-abc3-41ed-bc26-0c518100f335", "value": 115529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412715, "uuid": "0048941c-fbd3-4039-8248-a7949e76c1c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412715, "uuid": "e9644793-7ffb-422c-8117-c8e4992749cb", "value": "a7nuhf01jq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99dfee6-1e85-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773369538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369538, "uuid": "ead1f27d-d145-4885-9c89-09726c46e15e", "comment": "Malware payload (Mirai)", "value": "90e877e2dae7caf58c30aa9d78710b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369538, "uuid": "a54d1414-f431-4e4c-b603-cbf4400ac0d4", "comment": "Malware payload (Mirai)", "value": "55568b86b516b9ffca31a3164ab40d816d0959fa19e1974420ba4ce8fb8bb099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369538, "uuid": "58ddd6ff-c0b6-434f-ba70-46ed9a715ef6", "comment": "Malware payload (Mirai)", "value": "321040ec2d843da71afa0ece9a70a283de5acf65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369538, "uuid": "19520c3f-e7fb-4a59-a4be-2a258e8719b7", "comment": "Malware payload (Mirai)", "value": "119eefd71e4a73013da483ed20df84bdfe0d5271f34a3cd72dfe4cf905ebcd5ef3e829472956d6c2344de986c271ca85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369538, "uuid": "d4dad294-4a44-414b-8987-86f8464adece", "value": "T1C6C32859F881AB02D5C625BAFF4E418933531B6CE3EA7202DD248B3533CEA5B0F76515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369538, "uuid": "621a0a58-83a6-47cc-ad80-a4d98333ed87", "value": "3072:JIok718WYA9azbeK+c3Oep5af/cRLMprMan:A1b9azbeK+yOeXscRMprj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773369538, "uuid": "868eacc4-22a4-4550-baab-a98572be86bf", "value": 120292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773369538, "uuid": "563f85a5-485f-4332-ba75-69a2e98b0079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369538, "uuid": "546ea8cb-62d6-4ed7-b218-221027338008", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6724f98-1ee1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773409073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409073, "uuid": "bd8db97b-1496-4cac-8db9-95b3ed60fe9a", "comment": "Malware payload (Mirai)", "value": "bc9fe25037eb9b947d9c490af5d2e55e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409073, "uuid": "53bf93f2-989a-4c28-a46f-5081b3146a71", "comment": "Malware payload (Mirai)", "value": "5ae953a82d6da451c07952561fe9592d537ac0fea4f1109564ed67ecd9c0e0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409073, "uuid": "5b4041de-c12c-478a-8d25-6be8c8d05c89", "comment": "Malware payload (Mirai)", "value": "e2bde8fc3f832a634de6cc210bc7b04de2d7831a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409073, "uuid": "038dd7c3-db36-45a0-b0f5-f85ffc76f4c4", "comment": "Malware payload (Mirai)", "value": "0d68ccee52b7c41c70689a9c0307967723ba55d512b6f1dafe36d893a2c7a32e94338aeb6ee4ed6108c908dd6604380f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409073, "uuid": "a323166b-1303-45d2-aee1-236d1bbfb0f8", "value": "T18173AEA2C0652DA0C2684138A5E6AD381B13F50196732EF04E568BE2650FEECF55E7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409073, "uuid": "44d4e48b-a1ef-4004-8456-e1abaf30fe34", "value": "1536:E/jnwcbjq+ZwJaFwtO/WlP1Y1NO6XQCUJy5MFaHMrBG0NMxCSJOP:ErnwmqiwJCJu5i1I6l+FaHMFGkMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773409073, "uuid": "be71684e-cf67-40ab-9aed-5dff8f25eb03", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773409073, "uuid": "6fbddc5a-851c-4f28-b240-4335325a9390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409073, "uuid": "9237cd0c-952b-4211-98e2-8ab76c26f9f4", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bc1bb3-1e9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773380348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380348, "uuid": "3de423ae-3f87-4bb7-8621-8bb9b1d1a215", "comment": "Malware payload", "value": "bd360798e91b501cf6575afdb4bb4b7a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380348, "uuid": "e774db6e-0bc9-44ec-8bd4-2469bb3adfce", "comment": "Malware payload", "value": "5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380348, "uuid": "f9339c57-b974-4d0b-8fab-f88cf4df1f78", "comment": "Malware payload", "value": "c7fb8d2296414705256d6d2936c88452de8fe8bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380348, "uuid": "daefc8db-05dc-4834-945e-3ca210e86eb4", "comment": "Malware payload", "value": "0a7e6928b9188d81f75115e5ca243aab51cb1690fb83aa164961b55a5302a56a2f12989a3ae1f19a773161aac4110d18", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380348, "uuid": "a41f199d-d1b6-4794-8d7e-8bf45a9fe122", "value": "T177924DB512896C79FBD0CE399F3C6F4DADE4C2C42124A3ACBA4F39215A1166DC605359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380348, "uuid": "7ce304ac-57ea-4255-a934-d7d7bd9113d1", "value": "384:4FcuQpWx+BL0SWL0gOzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:4F8i+BL0SI05zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773380348, "uuid": "d4dd11ce-f0ea-4f20-9d26-e2b584bed4ca", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773380348, "uuid": "f24af69e-a47a-4d2a-91ef-20fb3f5c50a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380348, "uuid": "2cd7cad6-4dd3-4645-af93-1cf2880bce69", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac663f0-1ee5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773410772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410772, "uuid": "98a5ed08-6152-4d5e-a35d-ba94c7d23510", "comment": "Malware payload", "value": "ee80444dd649320a753e3a0e4538ec9f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410772, "uuid": "abbda412-089c-4803-854e-4644a4497154", "comment": "Malware payload", "value": "5b990804c7a2f585856f106fc15a8b490a6572da515cb9ed42eebb0747886ded", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410772, "uuid": "a530353e-7639-422e-9908-c505aff7635c", "comment": "Malware payload", "value": "04b4f5e64da7f4aee569e0fc3d2bf0921e743ef7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410772, "uuid": "d07f3ebb-7fa5-4f35-b67b-a78940c5f945", "comment": "Malware payload", "value": "032995a72ecfb5e596b341c694aafbe59e8a763188eba87ac12205cfe55b76a11efc61671eb34544b0dfac1de1eccf96", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773410772, "uuid": "91592fd7-e90c-45e4-99b4-51dbbb582d7b", "value": "T1DEB3ED894ACB84619B1FB025821F5C47AF9C911B461DC5C0BEDEBF6C3F199F0B2AA5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773410772, "uuid": "a35175e5-9309-45b8-8279-346a4f6068d4", "value": "768:Wygccv9LqbYXPaUzpQsqL6b6m6a6j6T8hZaQlomqxuKA/zAT65ckwi6E7MvF8WVo:WJ3rpa/G0S4Dg/mKin2KA8yrU6GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773410772, "uuid": "33a15d40-d37e-408e-a0f7-0b010b91fa18", "value": 115183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773410772, "uuid": "4c449d87-0c43-47f6-a243-9cda68becef2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773410772, "uuid": "333418e9-149b-41cd-9edc-3894595816b5", "value": "Meeting_X_Record_912.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80b4267-1e8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773373025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373025, "uuid": "65b28584-5cd0-4a30-a5b8-90495c985a30", "comment": "Malware payload", "value": "9a9010d8667acdd2631e6f6e850ea984", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373025, "uuid": "34205e38-fd7c-4f2b-a3fe-c600cd59ef6c", "comment": "Malware payload", "value": "5ba03db11c6bdba3e96e60a3e237e9f112ed02c43e745fbd5fb3b066e2f4b32b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373025, "uuid": "90330609-79af-4b9b-9b3a-b89b77d606d2", "comment": "Malware payload", "value": "e80ee1b25b1c4ac89a8fe309ff8b0fef8482f7cd", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373025, "uuid": "3aca97ca-3c4d-4b26-a9c0-78530de939a3", "comment": "Malware payload", "value": "9017a906c721100d2a4e56d0731232ff40b328df933bfc9c290eedfd67112ba4b72c9c8eefa9248da5eaa4e632f3ac22", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373025, "uuid": "7cd0ca35-7e42-46f4-bc1e-833de5ae13bd", "value": "T1E2C3AA8F9A9E88EE4B5B3418449F9C07CA4F111225DEC590FADEEF952F36C24B0D5AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373025, "uuid": "c13686f6-4005-4a8c-8da7-819d4a8422c9", "value": "1536:MBF3K8LEZHdDyAcZNKOvajfoJLgY3wI7nIMobKr7vwkbe:tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773373025, "uuid": "6732bb52-90b3-485f-81da-d5e43e69048c", "value": 120197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773373025, "uuid": "59fd3aea-45f9-4a68-8b78-b47015288eaa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373025, "uuid": "5f22a703-ebe0-4098-ba77-b05eabc0ec3c", "value": "Marketing_Images_Monthly_7293.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f9f894-1e8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773372748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372748, "uuid": "9d03c14a-2101-4f07-948d-7aebb62cec5c", "comment": "Malware payload (Mirai)", "value": "dfba49d4412093dc8f5e0a9ca98cc7fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372748, "uuid": "59075f75-021e-4f3f-888e-b396db5b6e59", "comment": "Malware payload (Mirai)", "value": "5bad52bd6d594cdb9f4c2921c2d23b27cca71b8b9d05b95ae38020b66654adbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372748, "uuid": "7648d69e-307b-4f68-bb5b-0a8426321130", "comment": "Malware payload (Mirai)", "value": "d0b5e14ceae7e067a5cfa909e16c4fb0f4cd5d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372748, "uuid": "9acb9496-cad6-4ac4-95a6-cb854572c489", "comment": "Malware payload (Mirai)", "value": "2111d13f4e6832f9f18094b624d5a42cd0d5c8a1783b660c51b7f020233385fe5d642f0bc98980a69cb06686a59137c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372748, "uuid": "94847767-0721-4452-934a-bf0484eed516", "value": "T1F3C31A09AF620EFBD86FCD3742AD0B0624DC5A5213B97B3A7674D828F54958B0BD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372748, "uuid": "6d10c968-8c4d-4939-aeec-ba30fff6fe6c", "value": "1536:aAdJsfhqiYfbXW6GS3/hFC+Ep4O1VsUF4DFzUfFZpg/sjchCH6zzSBn8p8We7QBH:a9fhbo/GS3/C1VBF4DFzuFtcmHt+SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773372748, "uuid": "915f7889-6daa-494a-b18f-2058844be700", "value": 120308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773372748, "uuid": "a93dd07b-c0aa-4285-89ae-c54483b34c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372748, "uuid": "05a40cf1-81a2-4529-a781-b24ad237255e", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4e7352-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (XFilesStealer)", "timestamp": 1773402027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402027, "uuid": "2b98943f-9172-4806-85a9-d647bd5323f8", "comment": "Malware payload (XFilesStealer)", "value": "41cc88d4ea79b915748b152877b9afcb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402027, "uuid": "0612bed6-2ead-49fe-ae2d-162f657a6505", "comment": "Malware payload (XFilesStealer)", "value": "5c11770699da40d9757528892574a0e149086ef296884996d581de10ec9abe90", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402027, "uuid": "f905ec1c-e6c2-4f85-a984-429ecadf526b", "comment": "Malware payload (XFilesStealer)", "value": "ef4e76b37888dcdb03366881aca9927eccd93400", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402027, "uuid": "e0a69601-82b2-4727-ae0d-177c6968384a", "comment": "Malware payload (XFilesStealer)", "value": "ad24f05008d1e6f89ced47e937a947ede480f50cf0d399da85b0bcdf01b8a11be3687b7284ef59881d3f50fa521f60a0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402027, "uuid": "f05ffcec-60ec-4c57-ba16-026a2b4f2591", "value": "T15817338ADE027F76F263DB3F47F1171D58A12D575453C0DBA3263A2C0A36B816BEA085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402027, "uuid": "33b647fa-28dd-4c39-ba99-e7fa529cb572", "value": "393216:vyM9mCjkFXI5zZM92F29mCWF0kbaAHbEeN1tn0d6pvmgRG/l:eCj8Xye2QRWFlbaAHbZ3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402027, "uuid": "dfb69ac5-f89b-42a4-a5db-18528148add3", "value": 18873344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402027, "uuid": "491ed3b2-8c81-46f1-8bb6-3390fe48ca10", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402027, "uuid": "accc65a0-b4ec-4755-840f-96bb0715a2ec", "value": "Doc_902838.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b693e722-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773412026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412026, "uuid": "18746c01-0ef2-4ed5-8229-688625280291", "comment": "Malware payload (AsyncRAT)", "value": "30a82aa9ce4fe793ae80e2e948210473", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412026, "uuid": "300de0c3-cdab-4ae7-9724-842a8395b35f", "comment": "Malware payload (AsyncRAT)", "value": "5c1db764ce845b58a7694b86ef6be0f95614779798ef80546aa9cb984ab79fa2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412026, "uuid": "3712ad77-e60c-4d62-9df9-a0d6230227a9", "comment": "Malware payload (AsyncRAT)", "value": "3303aab0238df20cb7c51929036376fdd75a8ec0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412026, "uuid": "aca8304d-1a6d-4cae-bde7-41e12adff25c", "comment": "Malware payload (AsyncRAT)", "value": "6fbce9baebf1e056c22a86785f7117757454a701b6fa1c7c25aa5131692279a04250fa6d6a75d56ba8c0ef6a5b06a0d3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412026, "uuid": "c47ad95a-b920-41ff-98fb-bf6f63ceaa30", "value": "T18FB2A6CD3BD6FC24032160773D1BB1AAA67D0C84794C80D5D3A7E995B8AC338E5B56AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412026, "uuid": "87863477-9f1b-4d85-bc22-8a30291d42e2", "value": "384:XmtNvZ4mskZBr+W2NV1EsWhALcU5ABdF25RA/Ctj/udjH/udo57W5rE:Xmt1B6W2NVjwAQUOzbqx/sjN7W5rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412026, "uuid": "19d42fa3-49f0-415d-b85d-fa1851daf436", "value": 23652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412026, "uuid": "4ca7a5fb-0140-44a2-a695-15161fc9346e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412026, "uuid": "64b0175a-a55a-4d0f-918f-a0fd3cc45037", "value": "HKJH9876567890000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444ff1cc-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390789, "uuid": "327ca83b-db1f-4c52-ba6d-7b0a54712a97", "comment": "Malware payload", "value": "68d5e19da108b5542daa7226e11d80eb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390789, "uuid": "03cd32b9-b208-45cb-b196-4da148432b09", "comment": "Malware payload", "value": "5cbdf43b0eeb6b7506141c18457937fc1e2e847b3457c30b4e89a42376d7c35c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390789, "uuid": "8d7f9f8b-bd45-4d71-b15d-d5cb06382481", "comment": "Malware payload", "value": "35fdadc61fa775addf2958119d0fb403901f68d0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390789, "uuid": "8964cef7-46a5-47ce-b193-c02a239d5905", "comment": "Malware payload", "value": "8ab2d5b3ad68021d32540e605b33dd50677d4780da2a9867e6de73b9be2f980b3a18014ad24073e8b42cf42799be698d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390789, "uuid": "e5bd8f3e-2fa1-4216-86fb-e51a4db1c2de", "value": "T140D4BFB95394AC9F0F1D0E66F50C174A1C6948C7E6BCC2B87A82B4F845661A48FFCDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390789, "uuid": "5fa4eb9b-a1fe-42e8-8b76-4a30929d0657", "value": "12288:CCfYJ8cdHKMkerLQSK4UQkEF++c+3gv8H7lZEmW1Xlxb:GSYHKfELQSKMkU++c+wiJZEmW9Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390789, "uuid": "71e2a277-1a1f-4bab-b1f0-007ebb04e889", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390789, "uuid": "6aae48ca-a343-4af6-96fb-906c84be29ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390789, "uuid": "b7f97771-0fc9-41db-bf15-3883f38e8633", "value": "5cbdf43b0eeb6b7506141c18457937fc1e2e847b3457c30b4e89a42376d7c35c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e6e655-1e98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773377739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773377739, "uuid": "4f6ec4df-f6b7-4f2e-a23d-0915a06f5e89", "comment": "Malware payload", "value": "137bbf73c3dbdd47f5e5743dfe7983d2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773377739, "uuid": "10f4e576-4cf6-4c23-a74d-049d6943f521", "comment": "Malware payload", "value": "5dddf76fad199f05a4a3de5048e549116de00f588978b202af65010d57124247", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773377739, "uuid": "b0a6b6de-c266-43dc-b46d-94bb046e70ed", "comment": "Malware payload", "value": "c6b51e98aa603b50ed8ef7150903d70a0cc80720", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773377739, "uuid": "84613fc7-fb32-4f2c-ba38-eeccc70755bf", "comment": "Malware payload", "value": "9ff2663324e55ada40cceb1539fc415bd2c6ae5a65ebeac0f8ac1502361311bdba4c67c451de3167dc068565fd265171", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773377739, "uuid": "010e0f36-c79e-4815-958d-2b771c1961e2", "value": "T1A11833248F2D0836C0C3DB35907B4A7CD5925D75ABE66B27A737BD406D33A2B608D60B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773377739, "uuid": "00be56ad-2610-4233-9300-befdda5930b9", "value": "1572864:l0z6teWeuZo+nywouEOGpXBV2GSk8nmHVivCyBvZShzjQr+kaaJJs1TG8B7zlPKq:l0AehLwodOGBnam1ivCyBgRjVMsfhACz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773377739, "uuid": "b52dbec2-b86d-41d1-95ff-7a31fb7c78cc", "value": 86474752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773377739, "uuid": "51f87719-1cc4-4a03-a397-0211870f465a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773377739, "uuid": "bf6fadd2-7daf-4cc8-bf09-553968426170", "value": "Pinkcraft_Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276e87d5-1ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (Braodo)", "timestamp": 1773396324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396324, "uuid": "c0c564be-726e-473b-9c7f-6a817eb42962", "comment": "Malware payload (Braodo)", "value": "957241489f86d914674cfca00c6a176d", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396324, "uuid": "e070fbba-d5f1-4a53-acc4-9f019ed6c7f0", "comment": "Malware payload (Braodo)", "value": "5fd2fdd8fbd15f341a227daf935e5cc2ff606a9043ae5f69752b91614ab620fd", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396324, "uuid": "21f072fc-7faa-430a-bd0c-5e2e9d623a6d", "comment": "Malware payload (Braodo)", "value": "bd1275496502da392b524260b32089b1225e54c6", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396324, "uuid": "9ac316c5-3a81-4248-b81d-18b40bb2bcc3", "comment": "Malware payload (Braodo)", "value": "7ad2e408ceee05bdc722f201513e59cc05c7e33ac7ae667d7d11a7d7609376e3a7b63d5c046d60d4efce1b844077ff80", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396324, "uuid": "a8a189c0-8ab6-4ce0-aa89-1ceea9cc95a9", "value": "T106961CDEEE0BCD59E5C27A76D6733CF2103198A2B8A381853E11BD9B09313B5F43A165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396324, "uuid": "90125c55-5e42-4713-9896-c3aa1ee3d6fe", "value": "49152:icE06/m6l+9fEZPw5H2ASzwB20g39VY/CadyImySg0gf6Mi+z5wUtV4QW:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773396324, "uuid": "c0bfa764-7d13-442f-b055-37b935caafd9", "value": 8628638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773396324, "uuid": "3c86f457-2226-4e0f-a9aa-75b2fa9baa1d", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396324, "uuid": "45968ac4-0129-40c8-b4f2-34410674f9fc", "value": "sim.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90d1914-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408165, "uuid": "727096b5-69b3-46f0-a2f3-6cb11a8d9b23", "comment": "Malware payload (Mirai)", "value": "5af5196922e8ca807cbb1f7ba30a20e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408165, "uuid": "dd2a2a11-4ba6-42ed-8454-c53b10a98fa7", "comment": "Malware payload (Mirai)", "value": "606780686323f40cf6b199b55401f6a3e67d34b3284743ffb1724e67ddf5836f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408165, "uuid": "0eb0676e-e8ca-424b-ba46-3d24d34193b8", "comment": "Malware payload (Mirai)", "value": "ca7959f12d892ddf550c7aee2586a5ac59ee9e5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408165, "uuid": "62a9803a-44b5-4c30-9c95-11e0ad0a4e42", "comment": "Malware payload (Mirai)", "value": "a083602dbcbb703c0d9678badde502366790f575b09451f89f9b5cf096823146c4a3032add318ead909b853f3f58d254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408165, "uuid": "53957d53-f55b-4125-acc3-957878f5e5f1", "value": "T1C7934A55BC829A12C6C012BBFA6E428D3B1213E8D2EF3217DD255F2537CA86F0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408165, "uuid": "bc41a613-503d-4267-9c51-13b2fb19c89e", "value": "1536:Fs12H4tmCatUiPFqHid6fLxfO+nmHq5kpC8l9g8Vx11kuT8zmosOVyTSEBfv97yA:Fs0Ytmbsist7Xxc9g8Vn1zT8CIq97ySZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408165, "uuid": "aa0e34de-6369-465f-97f1-904e8fdc5be9", "value": 91728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408165, "uuid": "ea0011dc-ba56-4ef0-ad95-e00b417addb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408165, "uuid": "064856f1-2652-49a3-bed2-b86cdc69cc91", "value": "SecuriteInfo.com.Linux.Mirai.9774.17669.22392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d32f7ed-1eb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773391636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391636, "uuid": "15d6f3c4-3e35-4133-a740-ec82bc5f5ce9", "comment": "Malware payload (Formbook)", "value": "9c7b0fce784e6f5bbce757eaca2c0b45", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391636, "uuid": "dd59287d-d2e3-481f-aa78-e9d88cb6ef7d", "comment": "Malware payload (Formbook)", "value": "6100d5b684095bd7ffe9496f31e0376c4543822ef21e6e6b383fae25604e9a3f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391636, "uuid": "2733ad05-856b-462a-bdf5-bdae787a00b9", "comment": "Malware payload (Formbook)", "value": "b9eee2e92352785359c16f07dbb803818d3887d7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391636, "uuid": "f25b0b06-d176-49d8-a099-932d17e24338", "comment": "Malware payload (Formbook)", "value": "fd3250fd00f20bd7795c53aa83274edc8a1f6dc679ebf97e5e74e1fb8945277bb3ab0828e82f66ab666a6123b05f2749", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391636, "uuid": "e9a41277-cfc3-4325-bfaf-582d474ec2a8", "value": "T14495C0F58F047AF0476CDE30C0AB7909FFE949689945B84F0B2AA8C1DB7758135BE846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391636, "uuid": "bd47c07b-7fcc-4ec8-b7ff-8d866f7487ce", "value": "24576:mF8ElIvc8YGvkPTBXTKZoLyd9tV++D5ue1dOlVZxqGLxSV+M6M/L93rCeMj:fElWwtNOdMhXyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773391636, "uuid": "18d4bf23-0e77-45dd-9a59-a0487b7c9a0e", "value": 2040051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773391636, "uuid": "62b3771a-b576-4eb9-9514-62eec2b672b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391636, "uuid": "26d9e52c-1ae9-414d-b143-5becd800aa70", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7246b6-1f22-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773436788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436788, "uuid": "1bdfaf60-f87b-4541-8a65-1cd9f2b8f582", "comment": "Malware payload (Mirai)", "value": "01569468cfc4679e03f2bf9f9b24f1bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436788, "uuid": "6fa4d257-b01d-4335-b780-437a3213fa66", "comment": "Malware payload (Mirai)", "value": "61a73f4fc4379b7c9d4ff915ee59b13b4fe74cf2d3593614ff86e8ca3c5479ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436788, "uuid": "86a95cef-93d3-4258-8ee9-f9b32d5cf19c", "comment": "Malware payload (Mirai)", "value": "a94c36997d328a281e1b06cdba238b5ba2fe91e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436788, "uuid": "3ea98b71-5dc7-40e3-bdda-a79198ec7ae6", "comment": "Malware payload (Mirai)", "value": "23d5a350693566ecd31aa335630425522e3d17e3c7fc0258eddeb2018599b9e4bb217fbef190d86ad72608e6b8711b10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436788, "uuid": "79bc5a38-d360-4f28-8156-5d2c5e2a1505", "value": "T160F32806B30C4947D2632EB03E3FABE193EFAAD129A4B644391F9B8D9171D321545ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436788, "uuid": "a48a7429-e827-4fe6-b84a-08ae42c51078", "value": "1536:m3RkFHmUESH+dO/RLSTcKZsxc4MJcqKrOTlQNZLBEHbYWvAwKMuZVOavGcluqD1y:m3yons+3ZsxGnihNRBp/wg4g8i2E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773436788, "uuid": "35ac6d8b-8920-44c7-b200-d472d7f747e4", "value": 160476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773436788, "uuid": "d1ff78c7-6f9b-4245-9353-d4967bc21579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436788, "uuid": "146c107b-71c4-4de8-bb0d-38a357381f48", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d515b818-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773427540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427540, "uuid": "e1396406-f0ee-4f3f-bd8d-99d5e850c76d", "comment": "Malware payload", "value": "01a131c75832c0b0ac1d9d81a9b37731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427540, "uuid": "878e4d1b-bf61-4c36-9c98-d3ee608106f6", "comment": "Malware payload", "value": "623e505e7c215318f697eeb8bb93a96c681c84cb9a20e0752d4066a16caa7604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427540, "uuid": "4b3615a7-ac5a-41ba-a6ca-ad99c97e6bfb", "comment": "Malware payload", "value": "fb95cf733667d8589523114106ef30cf218a98ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427540, "uuid": "f339bfea-36f8-48c3-918b-b823743b534e", "comment": "Malware payload", "value": "cf4829e70a2ee7e132a75ee81227552a4fbfbe7f76c0ecdc3446f57a11f19a13fc164a9fa1cfe72aa6ba27fd0ad37ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427540, "uuid": "a673edfb-1a53-402b-9d4c-2e1dcfa0ae5a", "value": "T12017D012F7C284B5D59302349867936A8B36BA214B76C9D7B3D42ECC9E353907E3B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427540, "uuid": "09a6b365-4f1b-46c8-aab1-9e6ad5b92038", "value": "3b4fdda4c1ff98b952839d52cf80adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427540, "uuid": "898489a4-62b9-4830-8800-3c3154b17d7c", "value": "393216:Mxbse1rfOiw5XHUQchJsv6tWKFdu9CLU10O:MdseFxU1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427540, "uuid": "81b4de44-2f58-4e68-af2d-05348dd2ad10", "value": 19333120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427540, "uuid": "e0a82ced-6702-475a-a912-364e7ba99c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427540, "uuid": "a0e0d744-44ba-472d-a317-5e4a2f8f1202", "value": "623e505e7c215318f697eeb8bb93a96c681c84cb9a20e0752d4066a16caa7604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de89140f-1f1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773435716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435716, "uuid": "3450a585-3051-40e0-98c8-8c2bd6153334", "comment": "Malware payload", "value": "21a9ee16b36ba83f547c6cd0b56764cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435716, "uuid": "13f5cdbf-d959-4f90-a340-c417950b207b", "comment": "Malware payload", "value": "628b0d7e2efe6a29dcb3ab66405a79571bde8a2b2b38499dbe5f17e392b6efad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435716, "uuid": "934d6683-f0b7-42f2-8afd-01a7611d05e6", "comment": "Malware payload", "value": "2043a1bd56b905bf8acf09e074120c059fd02c46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435716, "uuid": "af8cec4b-aecb-4d91-847d-22bcc9250947", "comment": "Malware payload", "value": "706312713bfeb84ac768231ff3c4ec93737d56cccb6a111d67d43ff24bc71a3d5d3ebad871e8c4e08b51147099d50ec7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435716, "uuid": "c71c1db5-e0d8-43fd-adcf-61769118016d", "value": "T1CF613A7025F00C736E201944F3772BA6ABB7E8574A97618C388E2E396F97F42A5DF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435716, "uuid": "ac7fa51d-04af-4c4f-b873-e7a18ca970da", "value": "48:csRu9+J9nB6gHrJilrmAE69lr8z6E69lriFE69lrElEHlEzl/+hUm0l/w:cCuIB66Si6fA6fv6fiEFEl3Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773435716, "uuid": "46c6f679-3cf6-4f04-914f-4db0b497f7fb", "value": 3334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773435716, "uuid": "dbee94fa-89a2-4e43-bee9-62fecd1d4e8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435716, "uuid": "ca445951-4b3b-4a7f-88ed-3c565dcb5e69", "value": "628b0d7e2efe6a29dcb3ab66405a79571bde8a2b2b38499dbe5f17e392b6efad.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7827f896-1f01-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773422659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422659, "uuid": "f6c19775-c54e-44fd-ae96-71f9cda6a044", "comment": "Malware payload (DattoRMM)", "value": "33322b98c07553eb5c34e55714f32f56", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422659, "uuid": "6e47bad6-db9e-4904-8758-facce94d8c3d", "comment": "Malware payload (DattoRMM)", "value": "62e944ff83ea367605a8b0b8f040aa8a88dab5397dd5b5bd358f56a43374995f", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422659, "uuid": "050fc762-7c52-4cc3-837d-b609f1593a0b", "comment": "Malware payload (DattoRMM)", "value": "f7837475e486a2c1aa2c08e63697e7d5a9ec5974", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422659, "uuid": "fcfc4f62-2edc-4b6d-8348-67725874b1f2", "comment": "Malware payload (DattoRMM)", "value": "1afb8fdfd69d98d62ac1ee9e7e9fb57489bf9a58ab1063a3b87b3e667e6ec00ea5fa6eecaad7cfa1a362ede128f69273", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422659, "uuid": "e75cd744-3140-4a80-b97a-f066d12319b8", "value": "T133B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422659, "uuid": "703d4eba-921f-47e6-9307-8b87f0f9194f", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422659, "uuid": "95595488-b213-4a9e-9796-936bbc06b56c", "value": "196608:aaZk+wcP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:wnTmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773422659, "uuid": "5774a2f8-fa0a-458d-9bf0-1e2a89f56acf", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773422659, "uuid": "63409fcf-7cef-44a2-8699-414367db00b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422659, "uuid": "a0c3927b-871b-4fa7-bd05-f5efef7d78e4", "value": "ECARD_INVITATION_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6645bda9-1e9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773380109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380109, "uuid": "1f716ee3-74c4-472c-9d7a-f5396d26222d", "comment": "Malware payload", "value": "c5cf5233f037b2510ae98e2d8e4c05a4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380109, "uuid": "8ffc2152-bbb1-40d9-b310-d2005974e613", "comment": "Malware payload", "value": "6426a945dcc0fad558177a7dc43c64b88aeda014fa35a17924f026d95d5d1c97", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380109, "uuid": "ba601516-2894-4942-87c0-e8e2af7d92c0", "comment": "Malware payload", "value": "9b874ae4d79841fa67f1f4a302d84b05a1de8bfb", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380109, "uuid": "d8738801-d0b7-4f6f-a709-7a0b003d8036", "comment": "Malware payload", "value": "bb545f2a4a26d856df2e6e261884f8faad57275ec9e9124cd8020c8db9361f8992c0800f6d6720c6718461d73170edcb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380109, "uuid": "166214c1-c558-4e77-82b6-839ed0f3a9f8", "value": "T154B3108E8D9F89FCD71F2495490E4D07CA4E5157093DC8907ADEBE8C7F22CA931A96E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380109, "uuid": "6c4f2427-c384-491a-8b38-fde5a0bbfd21", "value": "768:/sIMBp8m2WJnW1hoFKVtMv5Yt/BXUrw3w1YXaHgIWIzIeIlIbI3ILInI1IizIiI5:/AchUQx904/Muk5//LguQ+QGexB5Ynjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773380109, "uuid": "7d0fdb4a-e5fd-4910-a739-b33ec688f59a", "value": 113911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773380109, "uuid": "04eba43a-8734-40e5-a680-548cd126009b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380109, "uuid": "85d045cb-6d30-4bf2-8695-0afcdf209d73", "value": "Session_London__84.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ac0aa5-1efe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773421497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773421497, "uuid": "4cf9e29e-0307-481d-ac73-0f2f0b4f1cee", "comment": "Malware payload", "value": "e66e72da967b0ee2225bdc57c4c36a76", "object_relation": "md5", "Tag": [ { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go-lang", "colour": "#83A8A6", "exportable": true, "hide_tag": false }, { "name": "pam-backdoor", "colour": "#A0526B", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "ssh-worm", "colour": "#D146FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773421497, "uuid": "0075ad11-3607-4b41-85da-2340a1bcf869", "comment": "Malware payload", "value": "6463e3a87acbf6cb38a31a3fa0a79e1dbe24451d36a9cb9bed279ee434a565e6", "object_relation": "sha256", "Tag": [ { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go-lang", "colour": "#83A8A6", "exportable": true, "hide_tag": false }, { "name": "pam-backdoor", "colour": "#A0526B", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "ssh-worm", "colour": "#D146FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773421497, "uuid": "84aade95-fc84-4375-bad7-359402937afa", "comment": "Malware payload", "value": "f603f096d99c8a981c3bfe81bbdeba7d7ed243d5", "object_relation": "sha1", "Tag": [ { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go-lang", "colour": "#83A8A6", "exportable": true, "hide_tag": false }, { "name": "pam-backdoor", "colour": "#A0526B", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "ssh-worm", "colour": "#D146FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773421497, "uuid": "cc3ab7aa-c767-4b19-98ae-ba5ab04eb5b0", "comment": "Malware payload", "value": "f0fac8b940640aa96cdfcb9bb108e0bda05f491b160111f078c8e6b96a81a33a69c2ab8c59f94a72bd681960e48da75c", "object_relation": "sha3-384", "Tag": [ { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go-lang", "colour": "#83A8A6", "exportable": true, "hide_tag": false }, { "name": "pam-backdoor", "colour": "#A0526B", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "ssh-worm", "colour": "#D146FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773421497, "uuid": "6ebe74d5-5c59-48b9-991e-00718ea5f8a0", "value": "T17457CF7792467CEDE9B98CB4D01025816DA878874778E3C7BAC870E666EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773421497, "uuid": "42010ad0-5ed8-41a1-b382-3cb0449c8e41", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQj:cqYUQuVDt0TZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773421497, "uuid": "197cdda8-16f4-46e7-975a-f9bb6b2e4eea", "value": 28475392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773421497, "uuid": "3f343ecb-4e40-4182-826c-4ceb66114f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773421497, "uuid": "6e3ef661-5983-46d3-9f0b-e6147fbbcc36", "value": "pam_backdoor_full_x86_64.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa675807-1f31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773443494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443494, "uuid": "8d12b978-8e36-44de-8b0c-252ee004c1bb", "comment": "Malware payload", "value": "db88a045401fe10184472140d4b0da75", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443494, "uuid": "89d6b561-cde6-4148-9365-6f9c39cebaaf", "comment": "Malware payload", "value": "6529cae1566c486d083972d72d93727ac1aed9a652c857819ceccd9951ff1cf8", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443494, "uuid": "00101231-46f0-4508-8238-e8b94e8d6bf9", "comment": "Malware payload", "value": "8888978362883e9af9700e9bddfa7cac860f3d58", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443494, "uuid": "65fabd26-341e-4abd-9163-b90f59a75ad9", "comment": "Malware payload", "value": "8460ddc1b42eb93b4425a3f14b8b3baab6b08f827acf77d1cf319e93860135f37866b79899e60d16e9c0fd09d3f4d703", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773443494, "uuid": "37038c3d-caa2-4608-8ba9-c620982ab3dc", "value": "T1B986334CE7BBA40CE61F833A308A416AFE644F15E9E9671B039C10691DEE0D71E67397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773443494, "uuid": "f2becfd7-5011-4820-bef0-1feb7db2b444", "value": "196608:8xLFUUDA6Can7uUHzM5uh9d8ugzQramS6WMTOp:kJUGAHYuj5uhkux3S6TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773443494, "uuid": "aa85c1b5-38ae-4249-b864-b6c1232aee33", "value": 8048505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773443494, "uuid": "4190b84d-8ac1-4f29-b4d9-ec99415f0b56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773443494, "uuid": "8ad92c81-efa3-43af-ad07-1961accc6354", "value": "Launcher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f9524a-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773412158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412158, "uuid": "af443e7f-f8e8-4827-939d-2ad6bdf557e5", "comment": "Malware payload (GuLoader)", "value": "71c86f68a27efe37fbc7a4a6159bceef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412158, "uuid": "bfa79165-0a52-46af-b772-49738824b83e", "comment": "Malware payload (GuLoader)", "value": "65335eacd393170f0a1117926a19f3404c9a67e09d9ccf8a752fdae5c3c2aa77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412158, "uuid": "770242ee-1f2e-42b8-86fc-3d78948ee237", "comment": "Malware payload (GuLoader)", "value": "2800e1f451f0113b2cfad9aa242b9b0cc54e40cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412158, "uuid": "68ff047c-1bd0-4d8d-886a-de5c76fbde8b", "comment": "Malware payload (GuLoader)", "value": "27244eacd183d7f9ce3096f96be4d46d20b098397a70ca75adcf4b6b60fcf87fa420a0234bd1ca538445a6fa207fec74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412158, "uuid": "533d351b-5354-4837-8a5b-ad15633996d9", "value": "T157A4F102F980D0C2EC785571C957C53E22579E3C98E41E8B276CB73A69773826D2E27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412158, "uuid": "1c82fac2-3d27-4e86-b349-6ab457780506", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412158, "uuid": "36f31be3-08c9-47da-8a7c-52c26fa4fb3e", "value": "6144:25lz/Zgm8JjEt/XO4JnQt1IKvwDjVTxiDPbOFF/EcHMxmGAmSpE6Gztka:OFo8/XHJnawDjjqzk/tHMxCmgotka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412158, "uuid": "ebf6acfd-5677-434c-b488-b4f2167a6df0", "value": 454288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412158, "uuid": "77779607-b5ed-442c-80a4-c8012f1cc180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412158, "uuid": "e62f8faf-21a0-4dc1-b3fd-04944ae34b0f", "value": "12032026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375339cf-1f28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773439301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439301, "uuid": "6768043e-0a34-4f95-8e14-11f7e68e5788", "comment": "Malware payload", "value": "91ab33c63704d90171fcc0f9a351df8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439301, "uuid": "0342734e-366e-4cf6-b316-4b7bb5b47eba", "comment": "Malware payload", "value": "6767484ac5803ec636b4137eeaee43632a06cab40acde5c40a246a72c0dbff7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439301, "uuid": "f251be73-b84e-45ac-b161-b1c6f713c802", "comment": "Malware payload", "value": "860c7cdcb424ed5b0d88e7e401a50e62ff7b2082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439301, "uuid": "9af66b64-e0d9-4350-bb20-819f55bf5edf", "comment": "Malware payload", "value": "edea5c3569c44239a97e6f12a6569d3b01bca13f855e8cfc662ce074a56763d7702fd10a20b33ae8dbdd94417a644ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439301, "uuid": "732c5e08-f1a1-4d58-9ce0-4f305f981fd2", "value": "T1C777335887B044ABED57613B957E8273A37278251B70CA4F0FC493192BBB2CA5D3FA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439301, "uuid": "f2db3cad-fb4c-4007-8f5d-79ae86860c1e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439301, "uuid": "50bc24bd-e2c3-44ab-ad22-1498048bd57d", "value": "786432:zznxv2JLW+0HrxD51GtLlu2mddTqnnM9lPcrLX6VEEUSCb6/U:3nd7HrD1GadunnM9l8PEU/b2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773439301, "uuid": "a4bbdaa1-ad3f-4c5e-a8b6-8d8f31cebb86", "value": 33527517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773439301, "uuid": "cb4e2cf1-a055-4297-919f-c7e0f2d2650a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439301, "uuid": "0b7fdc98-617b-4181-b01f-957dc3a134d7", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc030407-1e86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773369972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369972, "uuid": "0ad132e0-2d60-4b4c-a53b-9cfce509a6a3", "comment": "Malware payload", "value": "c56b5254d4c64d2fb10e2430264039b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369972, "uuid": "e26bea30-4cc3-4319-b6db-6386efb2ad3d", "comment": "Malware payload", "value": "681d8656473457de4648e22393de8d05a6ecf2c2213895015b05970732801334", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369972, "uuid": "0f0959ea-5e59-4d9d-b1c5-2da44151b0e5", "comment": "Malware payload", "value": "3b75b9a0b3c9d575d5be856fdee29d9a6c0acc1a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369972, "uuid": "9a37d30b-88a6-4405-b355-423777ed3800", "comment": "Malware payload", "value": "989bc9d3b6f312a9453a8b8b4837a68f501a0b752d4379d0c4f145224dcaf62197c392d28e5b608a8ab5b1e8560ae0d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369972, "uuid": "ff7972fa-17cc-463a-99e9-7ebcffe9bfce", "value": "T1BC32453B21F08B32D7C410C9A3A61B654E72A70B452614B5F4FE6736AF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369972, "uuid": "9f3d47a7-1376-4207-bf2a-aa7b5722bb12", "value": "96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6y7OJgaqvlAA8Kb:cCul4hvZ5m5FG4j4HKNphvW/qd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773369972, "uuid": "0539a1b7-ab0e-4b95-b226-314381c80400", "value": 10985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773369972, "uuid": "dbc79b63-ca7c-4621-8b61-3d51d2ddd956", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369972, "uuid": "a93a48f7-ee40-4340-b45d-7efa3f2cb8b8", "value": "681d8656473457de4648e22393de8d05a6ecf2c2213895015b05970732801334.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f0304f-1ef5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773417693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417693, "uuid": "8dc5aad8-9b35-4a47-9ffb-257f49fea40e", "comment": "Malware payload", "value": "73f88a748322e4ccc1de0c0f56115ddd", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417693, "uuid": "a60b20b0-e6fa-45bc-b37d-bed976525f66", "comment": "Malware payload", "value": "699fd7a8d69c2a7fa84786794e318cf1ef41631ac4b3181e65cbbaf06b0ec17b", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417693, "uuid": "468fcc93-e477-4d27-b214-3f36cb001b27", "comment": "Malware payload", "value": "673cab4ce995f5780384a0293edcfc2747cdd67d", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417693, "uuid": "0505bb1b-37ca-48d9-ad21-cceb0eaf35bf", "comment": "Malware payload", "value": "c104d8b29e56e85a9e4b7c11900a92dfbc6023d51a9c1da2012ddc8397db53acb2bdaee4af02f550b5972f23984af2f8", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417693, "uuid": "d69aad8e-c209-4224-84c8-f7cd139a4dd0", "value": "T18C46189EF68407F85688ABCD430B359E53A281372EFB105985E0954F792EF637A30C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417693, "uuid": "694e7446-8f11-4b32-99cb-b6ce32e88a1d", "value": "12288:pGVGGG/GAGdGVGkGvG/GOsfUYGBG/GBGfGWGEGZGNGcGKGQG+GIGrGUG4GJGlGPS:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773417693, "uuid": "02fccbfb-2493-43db-ae5e-415281fe74e0", "value": 5502514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773417693, "uuid": "d340ed9e-3b9f-41f1-9057-b2053964df7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417693, "uuid": "c48542de-89e1-4740-ae78-55c620a01292", "value": "customers", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43adb693-1e9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773378762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378762, "uuid": "7c4c2ab2-dfb4-450b-9b42-1a8773631e13", "comment": "Malware payload (Mirai)", "value": "516f0c20790b4cb8f2e72da6245dc09d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378762, "uuid": "afb063b9-dcb9-4043-bf2e-b3008b632aa3", "comment": "Malware payload (Mirai)", "value": "69eee08b587bbe58f552dcd0971ce52f65cd89bf311a102d3019f32bd9f49304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378762, "uuid": "edd2f081-d810-4e02-9aab-2d8203def1ff", "comment": "Malware payload (Mirai)", "value": "89f9569ec8dc3e9aaf7bb92a453faa155791abe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378762, "uuid": "8b7378f5-dbb0-4825-b034-b1609fdc1efb", "comment": "Malware payload (Mirai)", "value": "f0a256f116b9e10d4b656d76524bf21997fab882e8398ed3559882f0b3e70000a833a86b6be1b7baaec8752802ce4bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378762, "uuid": "ce7dfc04-ad52-4577-80ee-4e6c75afd360", "value": "T1DCA31859F9829B12C9C106BAFF0E518D3313176CE3EE33169D248B74378A66B0F7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378762, "uuid": "0ef9275d-7a93-468d-9957-52ca9577c596", "value": "1536:8qn9Kw+ku6wH+FDB73DYiRsNpaLqIOXMXiZtH4uKCq07Wa5ZUfj/We7Gx:R+kpDB7TRsNpaLEtHHKC3ya0fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773378762, "uuid": "2839be17-3046-40ff-8fb6-1db4dcd393f5", "value": 104724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773378762, "uuid": "795b95b5-3c16-4509-93f6-5c2d9d7fd5dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378762, "uuid": "f3e4f210-a907-44dd-850c-0a13a3711201", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cbed31-1ea4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773382516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773382516, "uuid": "8ddc6eb8-85b0-44ff-8da7-6331a0b0943c", "comment": "Malware payload (ValleyRAT)", "value": "07c2439004d3dffa5d4d34a0d65db917", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773382516, "uuid": "ed1f88a7-10ba-472b-ad00-3254bfde580b", "comment": "Malware payload (ValleyRAT)", "value": "6b51a17dca3211a3d72e7534977db4bb57c97940a22e8fa7e609a2350ca3c5b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773382516, "uuid": "46a00a32-fe07-4e0b-ac0b-a9463daf53e2", "comment": "Malware payload (ValleyRAT)", "value": "48805c68184ac265f3f00b1d7dc9119fdb842f4f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773382516, "uuid": "e3855632-90e5-4250-b307-48ec73341613", "comment": "Malware payload (ValleyRAT)", "value": "8d169e4623e75f28e53870f815c459b0c9ef6a53eb1c07f37a97d7be5abd350139fd65c69aca014341f70f696b9fde88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773382516, "uuid": "67bf5dad-a3f3-4493-8969-4bdee82bdb25", "value": "T16C0513177917E272FBC90D30A0229BB586266C53CFD47647DB82FE4E4D35AC2A33560A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773382516, "uuid": "6199dfca-1cb8-4127-872c-67bd9a1b5d23", "value": "b15035de0874191bbda1e93d484ec77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773382516, "uuid": "e37d76a1-ad57-47ec-9ac7-ae8342d2b85c", "value": "24576:N8dr/GJwYHWgwq432222B4ay5pl1pQozRBC8s:4rawqQ22YaSpl1pQ4RQ8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773382516, "uuid": "88652252-fc62-497f-a379-3ef91cd8b1a8", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773382516, "uuid": "9d0c26c5-50cd-4cc4-9ef6-6d2f9d373aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773382516, "uuid": "095e4b31-b8b6-4f79-903f-e751cb5ef2f9", "value": "%E3%80%90%E4%BA%BA%E4%BA%8B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794a7a6b-1eb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390019, "uuid": "c92396b5-7bc2-4051-8be7-3a5aa6b75833", "comment": "Malware payload", "value": "60eb9de860db2e4983ec23993cf7a4b9", "object_relation": "md5", "Tag": [ { "name": "138-226-236-149", "colour": "#E7D9B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390019, "uuid": "4e6ad294-b05e-4029-87b4-2309a98b6a38", "comment": "Malware payload", "value": "6c0f610a18c0bfb0bf351fe37e58fc0a478f3c408e02c65bccb7f29d42b48db8", "object_relation": "sha256", "Tag": [ { "name": "138-226-236-149", "colour": "#E7D9B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390019, "uuid": "d6f3538e-16f6-4f34-93f1-72aa0fb943bc", "comment": "Malware payload", "value": "a5278d1a55ecd3ed699960b62f635ed9e776c83e", "object_relation": "sha1", "Tag": [ { "name": "138-226-236-149", "colour": "#E7D9B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390019, "uuid": "fdb85fc7-99d3-4c91-9a3f-905a8ff666d4", "comment": "Malware payload", "value": "db677441703c3acd49a8563125dff257d776292feca66e7de4d62708b0e9540f137efdc5d382bd4fbb7fff624585acc8", "object_relation": "sha3-384", "Tag": [ { "name": "138-226-236-149", "colour": "#E7D9B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390019, "uuid": "28104023-712c-4384-ac21-2294a36bc517", "value": "T118F73395B298089EF0C95671B2E3C702DBA3B45A4751C6CB6BF009034AD36E5E63FF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390019, "uuid": "b112822c-26e0-4f7a-8145-b706554243a6", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390019, "uuid": "1bc087c1-6cc9-4d69-8432-2e7983502fd5", "value": "1572864:B9z/vxgXGMI4XR3b9CHSCU/+vyglzaAKmWl3viIroe163o5YDYJeBr:B9Tu+YRSSC++vywzJeH8e163o5Yjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390019, "uuid": "4cefc701-9dfc-4af9-92d7-12bca5d8940c", "value": 76849336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390019, "uuid": "0b1de157-74d0-4f6e-816f-995db058a17f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390019, "uuid": "9ff6052d-b657-401c-9889-1b55a8963f7d", "value": "6c0f610a18c0bfb0bf351fe37e58fc0a478f3c408e02c65bccb7f29d42b48db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4870abd2-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390796, "uuid": "82f50068-c4e6-4bac-b585-78d49398f963", "comment": "Malware payload", "value": "4e40f86e2c513f56ef9cab88dc81293b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390796, "uuid": "d800e781-d3f9-43e0-8c09-54cf8e00f847", "comment": "Malware payload", "value": "6e4f7605266e5b384c7649f419c87aaea680869ee8f64a6e539a2d916f7fd587", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390796, "uuid": "e8912f15-e155-45da-b14d-9af94bb5e28a", "comment": "Malware payload", "value": "0ac402accd95c5c2bed343734416b38206eac63f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390796, "uuid": "de31a9ed-efa3-4130-b092-9f6fdb4105cf", "comment": "Malware payload", "value": "af3c0d00b3b48c1654ed06d550efcb3ad01802f4570fe946aa92df0773da94305d35981996ce1e40bfac0cf4e254569d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390796, "uuid": "ad060c6d-4a62-40c0-ae5f-37b89330271c", "value": "T152173334CAAFA503CDF6FAE572391A820B321FA4E51484CF105E5F851DBE9A35B4DC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390796, "uuid": "2ff3d03f-8976-499f-89d1-a364db920084", "value": "393216:unZc9pwEGe8HuFF38yIPfz48l8rU2JIdngP3/ChckuoVIMionB0sChledxGQ8:y+geBFfofJlyJinUPCh5q90B/6lKQQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390796, "uuid": "196da18f-5c3b-46c1-8b1a-6ece0a1ede09", "value": 19994057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390796, "uuid": "3875078b-c534-4a0b-8c33-3ce798abc07a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390796, "uuid": "71e946e6-7f87-402b-b231-df07d670f151", "value": "plugins.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937d1b24-1f24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773437737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437737, "uuid": "5121045b-c417-4a79-923a-2ffaaaa70619", "comment": "Malware payload", "value": "dfa735d0db6a9620e326cd412dfca27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437737, "uuid": "8b0acd74-8cb1-4fa1-99fa-4c0b271ab629", "comment": "Malware payload", "value": "6fb2f891e4cb6bec2ad8a35d4c191c49b800145bc98ac0b71ae5ed0b0f3973e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437737, "uuid": "c41ebb01-d07e-40c6-81e5-7ef4ea914618", "comment": "Malware payload", "value": "d974285c52cd5222d9e51d0fb285ba2a7e5fc716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437737, "uuid": "5b026690-a08b-414b-80b1-43f20697a185", "comment": "Malware payload", "value": "80701a8f59d0705cb335f129c30049c66b1dc59f9b3d1e9bc6c83fb6717cc8ec7f5ed691475f5631dc43b745ce753cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437737, "uuid": "5e37ad00-6ef5-4a10-8426-d1adad115f46", "value": "T128F733A6BBCF518AE842E63D95B21319B5B8E147C39067D3871127258C737BDDC3A2C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437737, "uuid": "d92b48bc-a79c-4d90-a7cd-9174e26f0614", "value": "824a6fae4291beb0d1f4843fe368cc44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437737, "uuid": "6273ae0e-9b14-4181-a905-d14b0ce6ee1f", "value": "1572864:t0oMreh9QRC5lZH1/5sfyNnaYoGWdy6APw60GjHy/bH:t0o+kQU3/ikFoG0yS60GzUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437737, "uuid": "f9091078-c6a6-4358-a9db-01cb562090ca", "value": 71870464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437737, "uuid": "46fdd4f1-057d-4b7a-abdc-f6ed8083b97b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437737, "uuid": "7f425483-268c-43a5-b7ca-aed465787be8", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0044973-1ea8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773384501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384501, "uuid": "b99fc5f8-381b-471e-82d8-c7256c8ff7cf", "comment": "Malware payload (Gafgyt)", "value": "08c97b61abbe8168c62b0c42809504bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384501, "uuid": "f606b205-05eb-4808-a760-9b19aee5fdbe", "comment": "Malware payload (Gafgyt)", "value": "7033d65fa55d6b8092d4ab9f36efd7a3bff7d70b2cdbd25b7fcf86588cc47395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384501, "uuid": "d7d669b8-4062-4f8f-97d0-d85ce9d23ebf", "comment": "Malware payload (Gafgyt)", "value": "13562db12bc61020daec323b9612a3cb2f0d7a9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384501, "uuid": "f3b5493c-2831-46fc-b833-17944fe3d92c", "comment": "Malware payload (Gafgyt)", "value": "05f1466a31e77d784b038effe2b0682f66959de2a868d7b1a9c2c984bf256234b38e5d12d1cdb3a6d155421b0ed2c852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773384501, "uuid": "23a2deae-edfe-4548-9b6b-7da49b052a89", "value": "T148442841BE405E37CBC1667BFFAE42CD332617FCD2EA3202EE055B25369A51A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773384501, "uuid": "2f4a7b87-ffb5-4282-9a7d-b030f92e823f", "value": "6144:MIJad/myD7lRZhmOle/ZxWZag4XXGN5Erp2kQrvLaMJqYTTjoA4nA4Q2CF2ra2KP:ZJad/miRRnmOle/ZxWZag4XXGNmrp2kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773384501, "uuid": "2bdf2d5c-a3f6-4de2-a216-c0d9fb846647", "value": 254232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773384501, "uuid": "7c3816ca-fb64-48ff-b704-54f072cb3d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773384501, "uuid": "def6495f-62d5-4f78-a8bf-6ba4dc5a576c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dc31c9-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412482, "uuid": "a85f43bc-63ff-41e2-8199-2b62b7fc07a7", "comment": "Malware payload (Mirai)", "value": "493877f78f36894d8eb61798980a183c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412482, "uuid": "2dcbc26b-d45a-4306-8923-36416fc10cb2", "comment": "Malware payload (Mirai)", "value": "7100455b16c755055d1f6c1ab747c2939715d538a6de3ea4103bc4db480f3032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412482, "uuid": "7369f0ee-c5cd-427d-9d09-4cf878d88a47", "comment": "Malware payload (Mirai)", "value": "a83ab7a3d7f65096a85f6d203decbf000c4f9a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412482, "uuid": "6b4f6589-0641-452e-9f34-5854f62933ef", "comment": "Malware payload (Mirai)", "value": "9b6c4838ffa230aed0bc77449c22c7315ce03aaebffbcc7a44c9b57ceaec05df70c9ecf20f3c48e8053c8ff67d2b4faa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412482, "uuid": "8e554581-ee6c-49aa-90c1-9648ac404749", "value": "T18AF33A46EA818B13C4D61776FAAF42493323A764D3DB73068D28AFB43F8275E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412482, "uuid": "f0057f42-a572-41b8-ba7d-590c0cf039b1", "value": "3072:o6pSnRNdqvRTaHB1eKMUMSkiFni6D7yzhCWtvM/9ybjjpS:xpKdGTaHB1eKMUDk/c7yzhCWpM/9yb/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412482, "uuid": "075272af-3159-4287-8c8c-d6f92c20dfd3", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412482, "uuid": "3df4bcae-b600-4636-ab10-f10785349110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412482, "uuid": "8e4dcb86-e967-417e-b124-e47a2734481a", "value": "SecuriteInfo.com.Linux.Mirai.9774.29956.28559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d664d1-1ecd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773400424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400424, "uuid": "f65e6ae6-f872-4731-a253-e75d77472b5a", "comment": "Malware payload", "value": "90944696b4d16df4faeff0308baa281a", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-0866", "colour": "#6EF6DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400424, "uuid": "6c4d4d56-efd7-48f1-a667-d9269580c5d4", "comment": "Malware payload", "value": "7316a4c3cd1cf183925ab4b7e77dbf52b38180ee1faf0156d7ea410f42cb5e76", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-0866", "colour": "#6EF6DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400424, "uuid": "724e29c5-60cd-4eb8-8279-1c1c9b6e4924", "comment": "Malware payload", "value": "d0de3bfce3294584db3a86411f59b593cc1fe2ed", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-0866", "colour": "#6EF6DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400424, "uuid": "61d9777d-bab9-4f7f-8ea0-1d42d0221b2a", "comment": "Malware payload", "value": "db06acbee26c5bba8a3216094c2c4be91b6887081189a5ce53749be6e88cc913039cf32a1d59a5d7d58e23545f9febb2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-0866", "colour": "#6EF6DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400424, "uuid": "a220a7a9-901e-459c-9562-0365f308efca", "value": "T14BC02B1A0E5E0240E15E9938762E0E835E083042C224DDF9B00CBDE40C431C02E4FFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400424, "uuid": "5564ed7f-d863-4d5e-ac45-79f10815af80", "value": "3:vhj00jptCTpueMrEINTZorAbpWsoUoVW8Zt2knxxtm0jptiGEpIh/+lOltln:5j0umTpubrv2g4sJR8Z0uxx0uCpW+lO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773400424, "uuid": "70fe1d6e-3183-4ef2-9a8f-2908d5b7d6e5", "value": 186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773400424, "uuid": "938fc99e-f7c7-4d59-b36e-e180aa507ec4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400424, "uuid": "8c9d1669-be4a-4c07-9f5a-ac184ba53219", "value": "method_mismatch.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e4e62-1e76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773362905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362905, "uuid": "5eabb27b-d2a1-4e97-9667-81e3cf40eaf5", "comment": "Malware payload", "value": "e9656b8e476278bf27cba88c8c8ca452", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362905, "uuid": "d087426a-3bc9-423d-9408-54cf2b62aff4", "comment": "Malware payload", "value": "7422eaa9f0310c4eb2d34bbe425204b0906fc3b06abcf0e6f7ffd0ac94cc8034", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362905, "uuid": "ea984eb9-5d22-41f3-a79b-ba613187d52f", "comment": "Malware payload", "value": "c3bddc75300713bbe95d0162d00cab7dae89e897", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773362905, "uuid": "c4e3dd45-c02b-401b-92e8-0794461fcbf2", "comment": "Malware payload", "value": "2ca65bff4815335ffb86a7865feb41bb5a78f0e9b08d262b4bb6cceef373a66de00148a9df6bc1edb9c3d5c030455418", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362905, "uuid": "19238b1f-f81a-4705-b521-6033e05c94e5", "value": "T19932567B21F08B32D7D410C963B61A614E72A70B496614B9F4FE5739AF2DA0370E7B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362905, "uuid": "d7bc7a21-604f-484a-b2a1-4575e4fae079", "value": "96:cCuolB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjKlWXaEXHArCAr8yQzW:cCua6p4hvZ5mN9oKNpivAwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773362905, "uuid": "e8a1c4fb-ea33-4b36-b035-23996209de4d", "value": 11969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773362905, "uuid": "e9ceff2f-1010-430a-9368-27a098a901a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773362905, "uuid": "e74fb864-3109-484e-96ef-7100a1f86ca3", "value": "7422eaa9f0310c4eb2d34bbe425204b0906fc3b06abcf0e6f7ffd0ac94cc8034.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5161e78c-1e88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773370625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370625, "uuid": "ce0e0a17-6ea7-4b82-99bd-7e76ed3c8ccd", "comment": "Malware payload (Mirai)", "value": "086f97465333690d3e9b80b0080cc437", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370625, "uuid": "fc0b53db-15ed-4e2b-b3f6-8d3ebc9371a7", "comment": "Malware payload (Mirai)", "value": "75e28b8b2fdbe2328d2b9ba16d69e3ebe27f70a4f7b2ec304302096d16c98ee1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370625, "uuid": "b4e237de-0770-48e3-b4b0-d3b0ff07cb25", "comment": "Malware payload (Mirai)", "value": "648e2722fb4f73ab1e7fbd7980bcdaaf5503620d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370625, "uuid": "4a037d66-926b-4672-a608-52a3113d07b7", "comment": "Malware payload (Mirai)", "value": "2e1cb87ed0501b8420354940718257b6f2b765d5ca918462d07e60360d5091cb98f827bfbd4ee96859f2d0bd41f0d287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370625, "uuid": "b39de2e7-557d-4014-9e47-c8c2007dc5fe", "value": "T12DA34A337E324C2BC5C0657636E74326E5FA439F50B8951AFD701E8CBB6A6103217BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370625, "uuid": "f85ea789-11cf-4abd-936b-93fcc7271ec8", "value": "1536:oAMc70WFJ5gwn9JjJw3z1EPQIzZn9tgytDo75QtTv0IlEtSNrEGe7jW:oeUw/jJAz1EPxpJoVgyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773370625, "uuid": "7c85ba3a-a656-42b0-a509-7e9f388fb4ca", "value": 100580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773370625, "uuid": "1efc6666-a3f2-448a-8ded-1b754fc8bfd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370625, "uuid": "6b5cc9ff-6782-4109-a391-e60dd8df9781", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8a8f4f-1e8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773372687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372687, "uuid": "4c869801-a678-4e90-8ae9-ac6d1f739fd4", "comment": "Malware payload (Gafgyt)", "value": "56353297694c7b6944e72a1d2f35b834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372687, "uuid": "ef6693aa-f401-42ca-9b39-5f0c426d0808", "comment": "Malware payload (Gafgyt)", "value": "76847058eeedd24ced98caf9803b6f5eb68ce7476b89d05c54c630fe60c65c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372687, "uuid": "0107d63e-75c3-4984-8fc9-766421ca81ce", "comment": "Malware payload (Gafgyt)", "value": "e5a34206aea2c7568c667babd960b36c6ee05732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372687, "uuid": "ba5dc3c2-b4f0-4f96-b5a7-b9e3030f772d", "comment": "Malware payload (Gafgyt)", "value": "fd8edfc333995d2f9766312c7cad4c4ec8fd3ddda395cc0f49ecbd033e22e8c71e502af2940e5b89c6bbf20c95837996", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372687, "uuid": "760509b9-93ca-4df4-9d0d-7782646474de", "value": "T1B9B3C717BB61DEB7C85FCE7306AA4601208DE04612E96B6FB2B4C95CE74B94F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372687, "uuid": "1261d9b1-f577-4e69-bfd0-709f5c715a84", "value": "1536:ATPeTMM73bOYAz2Z9JsqpT2ff6ewXhh89ddEceZpPBf0mW+XFBSf1syui:CJlCxsvf6ey8f6nPBf0mW+XFBSNsyui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773372687, "uuid": "208b2a59-13bb-42c9-ab29-16d518df32ba", "value": 113591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773372687, "uuid": "d5c70ba7-7b79-4279-bf4e-348eac5b54fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372687, "uuid": "d33049f4-c9ea-49b4-9ee0-9c77d9e334b8", "value": "rebirth.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5b440d-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773412712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412712, "uuid": "906bc1c4-fb86-411c-83fa-ed47d35824d9", "comment": "Malware payload (Gafgyt)", "value": "6262d3ded8843614cb1937c5aecc6500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412712, "uuid": "37249c4f-795b-407b-ad79-c05a40dbba0b", "comment": "Malware payload (Gafgyt)", "value": "76a4ec58fd4740d58e976f21687f941b514d1951f75fd3bb07774c2a546d46e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412712, "uuid": "2b1a1e00-d2fb-4e99-99c4-c412fbde3362", "comment": "Malware payload (Gafgyt)", "value": "cb8d7fde086316fc92f868f4b10ceb262b9cb0b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412712, "uuid": "80c52bab-0434-4ee4-842e-c180310576ff", "comment": "Malware payload (Gafgyt)", "value": "2f8782fab4f86935724aed16ef7b84439144b9801ace89b5281e9348e5e87afbeac1e224f8f849031e0de3085f2333b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412712, "uuid": "cb8c16d5-592d-4ecd-af2d-6791e767f020", "value": "T141C302D6F682C1F2E653147322AB97A7A731DB764490CB61E3173E68FDA1352205E32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412712, "uuid": "843f843f-618a-48b4-a427-40eac65cc697", "value": "3072:qa3z5a9yc6DtQ7hhCgCcLPtrHopTbuAUMIU3Vp/j6UDB4:qqm10tQ764LPtrZAUsVp/GUV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412712, "uuid": "4cef5aff-62ba-4176-9d75-a3892a8ec39f", "value": 127076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412712, "uuid": "55cf4a12-5bc0-4658-8ce9-c097841594aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412712, "uuid": "40a3a712-7fd8-4002-b127-d44901410cfc", "value": "kcd5v195q5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49b8159-1f0e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773428317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773428317, "uuid": "8231ca7b-11b2-4ae4-a909-657965364ba3", "comment": "Malware payload (ValleyRAT)", "value": "45c5b4a45fb0d9c2b4187d3b16686c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773428317, "uuid": "902a4403-9292-4ce7-944c-372137deb4a7", "comment": "Malware payload (ValleyRAT)", "value": "76ae74bd4defb26ce9347111371516a02e2c0d559e41d6add65c6076a8bdc349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773428317, "uuid": "b6224652-3f2f-46d6-8aa7-fdadd8116590", "comment": "Malware payload (ValleyRAT)", "value": "b00a04d1d9c6322c86a7cd80d34815c2ccae0697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773428317, "uuid": "87daa113-3baf-4285-ae09-5b075aa4c8ce", "comment": "Malware payload (ValleyRAT)", "value": "943f81c13d716deef71255f4a007a82ff2c65a68568aaf220f25fb1118f5460412c020ab1a64e3781a50b7166aa15159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773428317, "uuid": "55740c32-c7a7-425a-91ab-7544ff5f0435", "value": "T1B337E112B9E45034E4B73231A53DA73E89357EA16B3A46CB93843CD82F743D1653A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773428317, "uuid": "b291ccad-732c-4b0a-9e15-010ae645c980", "value": "d7858f0b4b09d2dcf3fce3cb88ce732b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773428317, "uuid": "d693e3ef-c237-48cd-8d34-4b158795c062", "value": "393216:OAk7J/DSG3uZwu+ZJcfW1dsOyzHJzqemJ5fyE1Swg23hXwjfKNOFgH4W03Bfm2iN:OAk7J/DSG34+Z2MvJ4E1SZ+0Jm2EMNuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773428317, "uuid": "7b903fc4-6986-450f-b729-4859ce831c73", "value": 23853040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773428317, "uuid": "430ea72a-7393-436a-972b-072cfd695563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773428317, "uuid": "5f142b14-2c4f-43ed-bebf-16c7af33bd02", "value": "Goge_64x_GGSETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f276919-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390808, "uuid": "7d2914d1-906c-4dce-a3c2-97a683bc96bd", "comment": "Malware payload", "value": "51cd9e6b4cfc89999276391053b688bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390808, "uuid": "b8833a9d-3909-4e41-a47d-7f0dbd221d94", "comment": "Malware payload", "value": "78f5cbf768c05018c4103f593858ae4de34bb6af35180ded47fda0617d1eb31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390808, "uuid": "220d0f35-33c9-4238-bd06-c1206fb212d2", "comment": "Malware payload", "value": "2ab6c48db328887a2ae6e0db9bad3125fcfe50f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390808, "uuid": "00702639-f99f-4802-b079-dfcc916a890c", "comment": "Malware payload", "value": "4a25a995d315bf3a66b5863658bebf08fa27e4c09ab06b87c5bd9360e9d512736ce91c535fab22d8db8cb6d910c629d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390808, "uuid": "b06b4145-5421-4abc-8f5d-a15f5b938d3d", "value": "T1B215CC9D762071DFC857C576DAA81C64EA607CBB931B9203A42735ED9A3C897CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390808, "uuid": "8c05d28c-fed5-44c9-8962-ecb377dafc72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390808, "uuid": "a0992343-2a2a-4c77-ad61-d2eb74f0c067", "value": "12288:lHaK7000AVRT8xO3mrxIkjYYOU9oyWNtC0t+gvBGSG77YOqJrwhe4GfggkqzQvrN:Z00RLDuxIkjDHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390808, "uuid": "0bd6a7e4-d523-4f83-aae5-cdfb0ca6a5c8", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390808, "uuid": "219ae32e-8631-4b39-9e5a-ab72f528ea96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390808, "uuid": "e18c5ac5-a702-4ee5-94f9-cc93adf01e2d", "value": "zensware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1e810e-1eab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773385627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385627, "uuid": "94b44ca4-3bd9-4b5c-9699-c1ec6d9ac458", "comment": "Malware payload", "value": "c0f1c499443b6e57a74d435543e5a0af", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385627, "uuid": "e8213195-eeb3-4c2b-a2de-4ee3e8910c9f", "comment": "Malware payload", "value": "7c60cf6ee45edd4ad9f2c76959676e54187b8d981cf45e1bab3e9a85bedc5c1e", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385627, "uuid": "b1021f85-3f98-4648-83d9-c20846208327", "comment": "Malware payload", "value": "98997ec5c649cd7f2e4f761170decad6e0201f30", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385627, "uuid": "d542083a-58ee-48bb-897f-4670a0e33566", "comment": "Malware payload", "value": "5aa55a8a8a735bb72359eda29c1e573fee2dc5966fdcdc012b3eeb269387ac5cd1fbd0714829eefe0743bf4a3da6f035", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385627, "uuid": "8a366b96-6f76-4959-8761-97b43cc24531", "value": "T1C067AE1993E905B2D42BC638C656C333CAB1BD938636C50F385DE6821F779528F6FA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385627, "uuid": "ca391fe5-7360-4ee8-bb8f-1b3f7986fe16", "value": "29adfac45afd49d83cd3fa81acdd8a7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385627, "uuid": "69a0055e-8d48-4090-8159-b37c3b33f904", "value": "393216:5fmmq98h+3uGjwmuvDeip68WzAj0t+RTjdXdbJYc/S8mf1g//4GzOr6:l+3/AN6IZXh7SO//T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773385627, "uuid": "e6b41466-bed0-4e98-8f22-6f1c7d83d5c6", "value": 30983168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773385627, "uuid": "9a2307d7-9ad2-40d0-8247-0bf1cbdfda2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385627, "uuid": "d2a5b505-2c0d-4927-851c-6f4ee4655b97", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254abc8a-1f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773426386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426386, "uuid": "5f49d621-9b27-4a46-bbb2-ce455cf49c69", "comment": "Malware payload", "value": "9fa603b8992991a0c0640c772bc7e854", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426386, "uuid": "82897af4-c79e-4cd6-8811-53cf0f3bd30d", "comment": "Malware payload", "value": "7cad5b4883bbe410c2587a9b1d669952538ea7f6d186702cb8ae5774987bcc02", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426386, "uuid": "6f5fb480-e59a-4810-8b15-2f2bf9fa8735", "comment": "Malware payload", "value": "9348659f5bb1b0fb490f61116b333d8d65ef14c7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426386, "uuid": "f0b105ae-6257-4ee2-98bb-ce980f93eb57", "comment": "Malware payload", "value": "04bbc81c92242c3d0bceb84d2c5095421b8f39414f2f3ac3d562184e480bc7aed48fdf52a689e708bb08a665ae4993da", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426386, "uuid": "0f9dd3d0-f027-467b-9c05-88190221ae37", "value": "T1D2C79332CD450E678AF2627C69648AE3FA60AF2F1380591BBDFCBA4C1F76D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426386, "uuid": "0bc0421e-54eb-4559-815f-0493539f6c0a", "value": "98304:SpArco4S/iVzOLCBCjhB7aS6JxW163dntcC3OkS4/IPBeJ8bv8mK:STaLCmNStz3Rpk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773426386, "uuid": "668ccfa2-bcb0-42a5-8d79-2faff7419073", "value": 54247424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773426386, "uuid": "c2c20a3d-e253-4832-a7f6-4c5ed99eab38", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426386, "uuid": "474c07f2-4eb5-4f41-9826-d852af4fae56", "value": "HearUp_Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463b6898-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773427300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427300, "uuid": "48e57df5-809f-4a62-a529-7b0d51302060", "comment": "Malware payload", "value": "1c98129020acad01933d4c50a8483177", "object_relation": "md5", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "ETW-bypass", "colour": "#2622D9", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427300, "uuid": "8928134b-d7a6-4701-9c46-6d12267c57f8", "comment": "Malware payload", "value": "7cc930cb85fe3253b5501186e0a6d15818fce76f421244566987f13d90b414ba", "object_relation": "sha256", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "ETW-bypass", "colour": "#2622D9", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427300, "uuid": "bebf0ec0-5857-473d-a4cc-2a9a7139f847", "comment": "Malware payload", "value": "e27d281b9f268e6d906be96306989dafd8b1c225", "object_relation": "sha1", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "ETW-bypass", "colour": "#2622D9", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427300, "uuid": "29c5c3a7-2447-48a4-ac45-6c48f432ef0f", "comment": "Malware payload", "value": "e5fb47ddeae6bc8db488fa8853f651005dcf35b057635568f6b98733b095d4c01908a8bb167a4940c26875b411f24782", "object_relation": "sha3-384", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "ETW-bypass", "colour": "#2622D9", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427300, "uuid": "8732e8ee-6e38-48d4-a463-0faae78f61ef", "value": "T11224EEE6AF0A0F7513F5D8A752E881918E9188E4FE7E4706F4CFC861585C885F2936CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427300, "uuid": "cb5c873d-e1cb-4fe4-8f00-39f0e4951d66", "value": "1536:LEDAZIIA+xbveUCkKn7m7udG4g2KOtlQqNAP:wDAZIZgvfCkK7dZg2KqNAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427300, "uuid": "5b6746fd-4e5c-4ab4-b2aa-d9fd7a74f195", "value": 213478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427300, "uuid": "ca63117d-3eb2-4add-8906-9dc6932d8026", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427300, "uuid": "9ab0ec8d-57c2-4db5-8b7e-793f6131c5a4", "value": "stage2_decrypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf258ae-1ef8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773418990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418990, "uuid": "303dd222-5150-4330-9730-3207ca7e18e7", "comment": "Malware payload", "value": "4c622164e5971d7b82ba9879ca5ccdc1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418990, "uuid": "ca36d67c-f598-497f-af96-2d3f9ff44bad", "comment": "Malware payload", "value": "7deeb48016fe4210bda6bcafcd5bc2bb9117b89b86febacca6f257975d7be0f9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418990, "uuid": "85901f2d-b6ef-438b-acf3-8c5e2ab970ab", "comment": "Malware payload", "value": "769071a76aeb1a88951aa1da13dfb3001309521e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418990, "uuid": "f810195a-e820-4e1e-a321-2fdba668a783", "comment": "Malware payload", "value": "3c95a3409252867e18bd02877ea6cd3baf65b7021d95c6e8b76b93ae742dfa781da997df359a447653480b910298ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418990, "uuid": "def61924-6286-43dc-97fb-55149d5e26fc", "value": "T16796658FB674861348E263B5B2063573BE2BD43547998336BCEEE435319F07E4A628D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418990, "uuid": "cba23c1a-e1a7-4ecd-8437-418e49d50f3c", "value": "49152:e06VSxH5gfoPDUwz/5MtIEPweKT9pQ0YDZC/ZM8QFKQ1+rcs5yWaGuzxC3wDmcjX:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773418990, "uuid": "da1492ed-3751-4cc7-ba27-44780e35b818", "value": 8776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773418990, "uuid": "69a4891d-71fb-4b37-bca2-f9b469e419c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418990, "uuid": "1bc87e46-1195-44c4-b108-5b62a4db73fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a01d9bf-1eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773413079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413079, "uuid": "b05604fc-e149-4e83-992e-2b1f5e8e48d7", "comment": "Malware payload (ValleyRAT)", "value": "35bfc71147450d37f3ae12065838bbff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413079, "uuid": "df75436b-e54c-444b-8908-a70dc0ed0ee8", "comment": "Malware payload (ValleyRAT)", "value": "7f6357d56682e097160491de0b58cc5ae32b3e549bcb979551c60dad843b7ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413079, "uuid": "8ce5ea0c-2203-4fc7-9654-8ce40852d702", "comment": "Malware payload (ValleyRAT)", "value": "ab314aae2c4258b2babf79f3e0403f2e40354e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413079, "uuid": "a10efa68-fb56-4465-ad70-058011dc13b9", "comment": "Malware payload (ValleyRAT)", "value": "30e8c8042bed3e5e5f0e787a321ded7039f423d05c8dec56a5fbcd25bea1bc7788646e2084982bffd2ce165b4b6dd75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413079, "uuid": "c4628e8c-070c-437a-8dfc-267af6dda303", "value": "T1754733D304491DA7DEA88FBC9293321E5A3179376641756F7B8AC5113C2310EA63FEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413079, "uuid": "45c4e390-f908-4222-acf0-59dd7d42cb25", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413079, "uuid": "ecec9a8e-8525-4fa0-a127-41ce15ae4065", "value": "786432:7bHHU5XB/icS0MIIbBJLAXqAzRpz5QXRNPV5AU:P05XVEsEBlM3KXRBVCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773413079, "uuid": "06ce5a0f-1522-40c1-ae0c-e5a7f1e37e73", "value": 26383607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773413079, "uuid": "3e507009-8957-44f8-a614-2cbb8ccc4e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413079, "uuid": "45316f74-2f2a-47bb-a46e-205ffc029b6e", "value": "Chrome0155-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a33c78-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773407144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407144, "uuid": "e5c10da0-fc36-4101-90c5-65ad4c21583f", "comment": "Malware payload", "value": "276a171e0169177141c096137e2fdb62", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407144, "uuid": "d625e3bf-dd17-4e17-844d-3517d84ceff8", "comment": "Malware payload", "value": "80cbe4c8347c817fa7a855e82925ef5134ec08c6b8afdb9e01d3b96abb84d287", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407144, "uuid": "dd5a5f46-0791-4283-8d72-f32c50a3dffe", "comment": "Malware payload", "value": "3d0c3b8d4afd10943dbd969f3d81c32e48ef16a9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407144, "uuid": "a93ba4f0-d113-4268-96d5-2d71e5a89b32", "comment": "Malware payload", "value": "634bc6e281aebbf9f04e11b96f1ea387905134bd922dfd13d7ca7cf51ad9d5baddab21a4963d668a4091f8314b70d9b2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407144, "uuid": "15e8866b-a45c-4bc5-bb00-950c1ae7b08b", "value": "T1212433D91B4A84E0C75F747A411F1C07CAAE5926060DD9C07EDEAE963F239B870BB1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407144, "uuid": "dc5b2b93-b0dd-42df-bc30-0ccddadb2d45", "value": "6144:43I3n4u3EarDoSKbQWbrNLUdNRtqaFyKljmuJtwNtSBNnxUjJE0wdsJ4Y/jh74GE:NfB/odQajU9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407144, "uuid": "0eeb9cf2-4101-46f4-ae07-9a74faac55ee", "value": 224357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407144, "uuid": "074d9c91-5dd7-4712-a5ef-150e59cf5f27", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407144, "uuid": "3d681cde-638e-4dc5-a211-eb91abb48fa5", "value": "Notes_Updated_v5.5.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867921e9-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402067, "uuid": "c4cebd22-1aef-4cba-898c-21b0a0fd586e", "comment": "Malware payload (Mirai)", "value": "77e229da21f65cefaca083e5640bb6b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402067, "uuid": "8e76c151-8223-4287-959c-6ed9903a6507", "comment": "Malware payload (Mirai)", "value": "8159667020e7e7aab5799edfefdc63c62592aacea5731f32c6429d7a253cd9a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402067, "uuid": "459a44be-5be9-4410-9c86-8c36a85a6e46", "comment": "Malware payload (Mirai)", "value": "5a0dd113da7a9e9b64f78a703f6b5a32425ab722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402067, "uuid": "e59673a0-acb0-48b6-ab94-6c354353ed7c", "comment": "Malware payload (Mirai)", "value": "8df36df6720fa3127756b95f1b68aff15217317a9affba0b2505d892fccc90cf4349ee737db5dc31513a5e0fc1511cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402067, "uuid": "028c9b9e-193d-4c44-a8b1-0597e82d64e8", "value": "T1C8736BC1EAC3D8F5EC130A35243BEB338A77E5791159DB87C7A4A932AC42A41E55339C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402067, "uuid": "a5994a5c-01f3-4ed1-8edd-ed9256bb17f1", "value": "1536:lFhwb76JL9rui3z0ljpjeyZ+GtsBIFItFXBW6OzgkdKBJZ4Su7Sk3:lDkOL9rui3QxFeyZ+GtsB8It3W6ogtnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402067, "uuid": "7435a38b-4859-4df1-8538-4420f41cbc56", "value": 75280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402067, "uuid": "16d35786-6208-48bc-b60d-42bce69ef568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402067, "uuid": "e8015c7d-628c-4248-9cdb-a43e56c8ab67", "value": "tux.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bbd940-1eeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773413251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413251, "uuid": "43edffd5-5b3f-4e7e-830c-422c8fa0fb62", "comment": "Malware payload", "value": "0bd76c76a87703d224d9606e0938c019", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413251, "uuid": "60ad266c-687b-4715-8d2c-5bc8c7c66bc3", "comment": "Malware payload", "value": "82a7c5a759f2acd409532260718dc03d5ce86fa2e056a8dc5628076c4f88574b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413251, "uuid": "68a07288-92a1-43d5-a26c-a155ae229869", "comment": "Malware payload", "value": "9212e3f234fa48c8ea0001898610fc9eb62b94aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773413251, "uuid": "a1e89dea-7894-40fa-9735-0c49f5463025", "comment": "Malware payload", "value": "32a620febad1c16e0ecac9076f29b26d1c3ef76ed3e1a4371f38664e8a8a6a3f4776a6af808f07787f27f7cb9b3d6a9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413251, "uuid": "1948c030-5b6d-433e-b921-6804f45b3e8b", "value": "T1E832567B21F08B32D7D410C963B61A614E72A70B496614B9F4FE5739AF2DA0370E7B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413251, "uuid": "23d9bffb-914f-4db9-8c05-959020acfbf6", "value": "96:cCuolB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjKlWXaEXHArCAr8yqzW:cCua6p4hvZ5mN9oKNpivAwRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773413251, "uuid": "bd7113b6-6f70-46ad-b14e-f3db323ee25c", "value": 11969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773413251, "uuid": "c6d01694-a0ed-40d6-9531-0d59a8533383", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773413251, "uuid": "c543677f-3b2d-4fcb-bb1f-78bb3a451436", "value": "82a7c5a759f2acd409532260718dc03d5ce86fa2e056a8dc5628076c4f88574b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3840fa-1e8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773372608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372608, "uuid": "e676f5aa-9caf-44ce-95ff-60f0132052d0", "comment": "Malware payload", "value": "8ab49e0a3f8ff4faf757c441d2dc3337", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372608, "uuid": "047062ea-cb20-4db0-b7bb-8e8b885db3c1", "comment": "Malware payload", "value": "8396df5f579975c16810f0efca097e72145de7c3ad403ffc112e39d8668cf07a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372608, "uuid": "d39e28d5-7571-4388-8d89-5a8cfbc2f9b8", "comment": "Malware payload", "value": "efe28b3e7510dbb3526bc640a951352541d77ee5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773372608, "uuid": "c872a781-a84b-4b4d-b50c-0715e64ea455", "comment": "Malware payload", "value": "d48aa7ed66b4f26b6ffe5bc291ae0739fb070c6c98258ccddd47d2c485b8ed2f813aa59459af4add582694af9869e82d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372608, "uuid": "610cfac6-8276-4563-a991-13e06ce292d9", "value": "T13B613A7025F00C736E201944F3772BA6ABB7E8574A97618C388E2E396F97F42A5DF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372608, "uuid": "d62953e1-dc2d-4978-a134-4169fd3c9cb1", "value": "48:csRu9+J9nB6gHrJilrmAE69lr8z6E69lriFE69lrElEHlEzl/+yUm0l/w:cCuIB66Si6fA6fv6fiEFElaNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773372608, "uuid": "4818e0d7-3e21-4527-88dc-6e91d9d86bcb", "value": 3334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773372608, "uuid": "46a32ce3-3310-42e5-a67c-cb4be06a343f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773372608, "uuid": "0efd9b04-8dc5-4b44-b131-e7ce73d307b5", "value": "8396df5f579975c16810f0efca097e72145de7c3ad403ffc112e39d8668cf07a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412221e8-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390784, "uuid": "2f12fd54-c585-477e-8e4d-7078bef3ab87", "comment": "Malware payload", "value": "c88ad90f942125a2e7f90ead8d5d0173", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390784, "uuid": "78012292-c1e2-446a-a6ac-3536b072935f", "comment": "Malware payload", "value": "8657a9d36d9432f2a0d2cedc4abb3d34e63cdca83e59f1fa1104483e54457a6a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390784, "uuid": "485ceb8a-76a0-4702-9397-b45b293d7f82", "comment": "Malware payload", "value": "cf5ae84bc7b9e5df815b8903f157793a57479b0e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390784, "uuid": "70e19e42-0c9c-4b76-bcd8-0cb10877c3c7", "comment": "Malware payload", "value": "448f20ff61af7ab54c3b8a584b3228c3931cb94e5b4917e028809a87dc7e77e5b50f5aeb73f1d03187ca5dfe6333ee72", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390784, "uuid": "4b5fa5ac-5595-46e3-a583-a8fd00928718", "value": "T1E3222D028E4B2F409B60455260DD54E70C5FBFAF66F90AEA420FEF894B9F07165F54C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390784, "uuid": "d6ab6793-9eed-4292-bb5d-ad528e5e2534", "value": "96:2iEgnRNgmKGEtKA/9B+6sM2P7FXi5m0JeMe/cSolrlu2YfDBKOeQaNpzFCD5AsAi:GSTyFgjMZs5/xrmbFCD5nAKCsXBYdoOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390784, "uuid": "99cc8842-370e-470c-9a93-3c532f7880d3", "value": 10192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390784, "uuid": "cbcb8353-eff4-4363-a60a-dea3a79f018b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390784, "uuid": "e4c77892-7e56-4e91-bc2b-f31b66ea1b35", "value": "8657a9d36d9432f2a0d2cedc4abb3d34e63cdca83e59f1fa1104483e54457a6a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a82cc6-1f24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773437598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437598, "uuid": "6586bd9a-c440-4e3c-8535-4d314bc33ca9", "comment": "Malware payload", "value": "a93356d7f2a6261bc415dacbd5f52f6e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437598, "uuid": "aa8c2248-ff54-4a20-9a86-24663195cf66", "comment": "Malware payload", "value": "8704128a9afb32c25bf0a3a34088482cd3eddd599b06eba2eb24a6640cdfdae1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437598, "uuid": "2e7b2262-ca62-4ec0-a681-a093c3625b2f", "comment": "Malware payload", "value": "6cd26565877099fe176888464c55fb4ac9ba624b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437598, "uuid": "a387c294-9c93-411f-83e0-58119b07725d", "comment": "Malware payload", "value": "303d336e4ac5f70a569faf76545ce9e7cae689072a8597cc984c8e0869d9d23aa7f609f521edfc97cc4f00cbd81f3abf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437598, "uuid": "f5d71d9f-967e-4da4-8347-b3236704dee9", "value": "T16132453B21F08B32D7C410C9A3A61B654E72A70B452614B5F4FE6736AF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437598, "uuid": "6bf12bc1-0e97-4d37-8d22-187bccfb548b", "value": "96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6y7OJgaqvlAAbKb:cCul4hvZ5m5FG4j4HKNphvW/qd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437598, "uuid": "8d4579bb-03ab-4e57-a5d9-58ad8f0e8a1c", "value": 10985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437598, "uuid": "85c461be-ddaa-4bd2-b289-d0452d03cc78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437598, "uuid": "fd6f311c-8143-40ea-9f35-988998ab5935", "value": "8704128a9afb32c25bf0a3a34088482cd3eddd599b06eba2eb24a6640cdfdae1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ad0c8e-1e9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773378927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378927, "uuid": "5319832e-e2a0-4ded-887c-3ff44654151e", "comment": "Malware payload (Mirai)", "value": "6632b3e4061c7b711446737c68b9249d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378927, "uuid": "a45ee1da-093c-441d-b2a1-d2da74271e10", "comment": "Malware payload (Mirai)", "value": "875cf3b5e80093585f132e9729e320e048e3740f3167974e9a3d80704c71628c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378927, "uuid": "e2edb97e-c765-44fa-afcc-108e94011d61", "comment": "Malware payload (Mirai)", "value": "bc490cc50bde5ab820c281a041bcef9f1454838c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773378927, "uuid": "c6e5795a-b099-4fa6-8c3d-beca0a4e3420", "comment": "Malware payload (Mirai)", "value": "d6ef899a0ccb7cffc42ebb097a72a2ffb13267d2827eda17435255aba3ad79ea2ab81d506c8b93c59fd0b00f264470f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378927, "uuid": "2a237517-0293-4a5d-ad42-bcc0b74a9a9b", "value": "T193737DCAE643E5B1E8130531813EE7269275DA391024DB4FD7B49A37AC36904FA1B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378927, "uuid": "c8f8b66e-7096-4736-bfd5-b5716dc946b6", "value": "1536:m8DA8DccdWkytllnwplWUB7W0AJYbb8etLjSWedXauc:RrccAkynlwLWkXWEFpMVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773378927, "uuid": "6d59d7d7-abcf-4ec1-b56c-b79f870b6bd8", "value": 80008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773378927, "uuid": "7206cbdf-ccd5-47da-9af4-7f1846529c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773378927, "uuid": "f57f2a4d-71e4-471d-b033-4f46591a3ae2", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c20526-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402036, "uuid": "8bddadff-aa11-4a28-940a-3e710c1c224b", "comment": "Malware payload (Mirai)", "value": "d0a794daa3a3137059322f956791d700", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402036, "uuid": "34b89f13-f096-4cdc-9387-e9e078ffb006", "comment": "Malware payload (Mirai)", "value": "87962f5746b0bdafa17d4c9abfbb3fc95b61766e742c80782624e2d9f0be545a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402036, "uuid": "586ca70f-148e-4da0-9369-993e66910e5f", "comment": "Malware payload (Mirai)", "value": "f20585459e287b0cb698ef580d7c3172888621d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402036, "uuid": "cf289f09-faa9-4156-85ec-a7d9be6a5339", "comment": "Malware payload (Mirai)", "value": "5f267aad2b0c0df6abfcdf8e90dca142a2a2ce3f13813daeae6bde1612c370b43982834aa024574e39452a339de1eb1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402036, "uuid": "504347c4-579a-42fd-8fd6-eb6cc6cf73b7", "value": "T129413ED4C83094378C868A0BF561E29A99DC93E59AF4C12857A4DE3710A2F3E7C9E643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402036, "uuid": "88e0f04e-be8b-4828-b022-47eb6ac7f988", "value": "48:mGeLzXb17xnPI+75sYFs4az/hxxFRQn0YKQDO+1:/Wzpe1JNzFTAOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402036, "uuid": "907eaebf-83c7-41e6-942f-531a8cf35fb9", "value": 2303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402036, "uuid": "cdce0699-bbca-4490-8a5c-46bbb756224f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402036, "uuid": "59f1b826-4fa4-4585-99e6-93608e271947", "value": "sshbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d541a6-1f01-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773422654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422654, "uuid": "753f2e11-c4d6-4cd8-bc87-9a03331ee755", "comment": "Malware payload (DattoRMM)", "value": "a0e7b27dd2357e5d266a7502904b7af6", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422654, "uuid": "6db4185a-aff1-49f0-bd8e-bfe651b80e8c", "comment": "Malware payload (DattoRMM)", "value": "89ba7c3f6f35c9c515c34f5995c825091e3361645511302cbb0748f29cefc5ec", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422654, "uuid": "90399e21-9e10-4ff7-b22a-2aa6951488c6", "comment": "Malware payload (DattoRMM)", "value": "bd765d1f69ea508814da1e2fce95de3b2054d9bd", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422654, "uuid": "7d10ae14-82b5-4315-b703-5eee69e73fb4", "comment": "Malware payload (DattoRMM)", "value": "4809ded1800e48379643bc0e114cef76536e024c872e05e0bf07c2727db5966bf41d54b85cd72dbbb6a846b9ab4651f9", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422654, "uuid": "a1a3c447-3f33-410d-ad80-578da5a90051", "value": "T12FB63347D9778DF0CA330B3890D2196B3305980E485AF4C9E609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422654, "uuid": "a0c32b7b-c92e-4cb9-aba0-525b01f20bea", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422654, "uuid": "26beeef3-819d-41c3-831c-eb1f3b5da956", "value": "196608:maZk+wlP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:UnImzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773422654, "uuid": "e9fc3b39-6b27-4c47-b0ec-3db874c7cb7b", "value": 11056120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773422654, "uuid": "df9d899d-5feb-4310-bb23-3460fdab5c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422654, "uuid": "86baddda-023f-4a66-a15f-2398a044b2b8", "value": "amrexchemical.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a3c098-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408270, "uuid": "ceee5ecb-3917-4c82-b8aa-9678c6b208e5", "comment": "Malware payload (Mirai)", "value": "60018fe94b922b38c09f33fe7e0ba967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408270, "uuid": "813a5087-99e4-4050-be87-1a56bbda9c32", "comment": "Malware payload (Mirai)", "value": "89c19a0fb0e501dba3b284cd494468d9e947ceb2e9817515dc5200a00f0942bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408270, "uuid": "bdd3e575-b276-442f-a0b0-4968898cca93", "comment": "Malware payload (Mirai)", "value": "33e1828739f867d8aea57c67d30cd95b8388c614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408270, "uuid": "18624e9d-8b8b-4a64-a242-f89bf011da0e", "comment": "Malware payload (Mirai)", "value": "1c74e21a429fdd9dcfc584859b8dea73aed9402281d7dfa06b0737f42070d95df826776f6cc97dc9568aed7c65db860f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408270, "uuid": "cf3b3440-6689-4a0f-95c8-714cff9c59a2", "value": "T156D3E165F4809E23C6C4207AF76E5688331307B8D7EA7202CE199E2137E6A574F3A985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408270, "uuid": "c47cf83e-6646-4631-b4fa-374fb238d342", "value": "3072:7D0ownSrawgGlO7xTcUMZditdPAyMqGYqgiauL8cHZd6:7xwSuwgx9/YWPPMJznbd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408270, "uuid": "73b67c06-1b9b-42de-93cb-d84b659eab1d", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408270, "uuid": "c0c382ca-70d3-4161-a473-79759187795c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408270, "uuid": "bb60c304-8f2a-450f-838b-41a7ea49e2df", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce22e8f-1e96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773376711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376711, "uuid": "df7c1bfe-7b94-4567-b7d2-23fb59de7395", "comment": "Malware payload (Mirai)", "value": "c74c811ef271e4effc9113ad75638db1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376711, "uuid": "102a8ff6-f3f3-45c3-b04e-93f1161ba3a0", "comment": "Malware payload (Mirai)", "value": "8a03988c30292d8f652dcfe268e6c8754c2921dc64195cc305ef560c80f315c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376711, "uuid": "eab64160-e035-4416-8fa6-ed4e22d84e3c", "comment": "Malware payload (Mirai)", "value": "29787bd42e3fa1a3bc5700df353e5661ade8e66d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376711, "uuid": "d60cbfad-71c6-456a-a0b4-f57d897f6dfd", "comment": "Malware payload (Mirai)", "value": "fc67527b1158159d7f0470f3f2fee158fe735794d4cf86ea6fedee3079509a332433337412f28991888cee399cf59c8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376711, "uuid": "42a5faf7-e0a3-48e7-9395-425526319306", "value": "T13C43A40AFF511FB7D8ABCD3705A91B0539CCA58A12F53B363674C538B95A10B4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376711, "uuid": "b05ae63d-a15a-4773-adf5-43c3de23cb35", "value": "1536:jvEzgReoKCZK/X/jfUDCffV1GZ41oD/+WzBM+i:agReoKCZ5DCffV1G8ory+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773376711, "uuid": "358ed92b-1833-4eb5-82af-b7d325f13682", "value": 60236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773376711, "uuid": "1153785c-cedf-4a11-8e9e-a81b52b42931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376711, "uuid": "35e53394-afc8-4432-a045-843510978d65", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e36c019-1f1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773433246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433246, "uuid": "0141cf39-9ffb-4c41-8f16-f1a675f67129", "comment": "Malware payload (Mirai)", "value": "970c9661a662a4de4d3391bd580c7ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433246, "uuid": "eb122f45-07d2-46c8-9d90-2c46393682fd", "comment": "Malware payload (Mirai)", "value": "8d0ae4fbbf5efaca662e2d17358e4a68af132c2a962557c1f90536367f9c6e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433246, "uuid": "6fe2c2cb-595b-4e5c-9fa6-8da75628fa45", "comment": "Malware payload (Mirai)", "value": "76f368fa03230e0635adcd9aa8dff0e3bc5ea194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433246, "uuid": "4a422863-a142-49aa-8cdb-38d7c1bea007", "comment": "Malware payload (Mirai)", "value": "f815010cdf47d7237760d501f216ef89e368bbf7f63d0b991a1a619e309ed1b9c56056fbed503c33f8977ba5469072ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433246, "uuid": "64f7e060-82c6-4ae9-8a57-2dcf3fc00b0e", "value": "T1F8834A51BC929A12C6C422BBFB6E028D371213A8D2EF3217DD256F2477C691F1EB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433246, "uuid": "c0ec607b-2bce-484e-a5ed-c7de60c56876", "value": "1536:pokSr0hSwpk2RvJd/MpxX+xHAn1RNLKC6splAOexM1FVjFs2osOm9sx9jPS7yptR:pokSQh9pF/MTggw1glAOeq1zjF5s9u7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433246, "uuid": "6445187b-55c5-41df-a8f9-ccfd93042bdd", "value": 88708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433246, "uuid": "becbcb35-75a9-4466-aa14-4f3ba4f79f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433246, "uuid": "20b16613-4d44-4d29-8f03-bc08aa8433d6", "value": "tux.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5552c1c5-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773433768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433768, "uuid": "8a5c6fd1-10dd-47ab-9b4d-228bb75cc55b", "comment": "Malware payload (Mirai)", "value": "7c710f627b5c5cdc06e6cc3a69706327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433768, "uuid": "42db706c-16a9-49a2-bbf2-7d565fa16cf2", "comment": "Malware payload (Mirai)", "value": "900f430db2f41c1131968127792a9589b756b51b610b354493c45b5ceb48fad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433768, "uuid": "76ef94d7-47fc-430c-89af-d30a00b28878", "comment": "Malware payload (Mirai)", "value": "485491368658423900da7667ae129931a65db828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433768, "uuid": "89115db4-fa80-498c-8ae2-339a964eb3fc", "comment": "Malware payload (Mirai)", "value": "0405a6bc5f212f7daed50edf9f71cdd134873d1a2cb087920746dc826c019f3db75d53b7185ca2780f0811bb90702360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433768, "uuid": "c107b9cb-dd2f-47b7-8540-216aec925bb3", "value": "T1F8F34A06B8C1D4FDC49AC1744FAEE536D931F09C1638B26B37D4AF2E2E5DE205A2DA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433768, "uuid": "fe2d0839-d92e-49b4-99b7-73131774ae77", "value": "3072:8J8KTjsCFn14+fj1k5alHliey5cWPMrjYxHisfxJh/kNWS9QLymWrRsz:8J8KTICU+fu5Fg4lvSXZrRsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433768, "uuid": "6558af98-aae3-45f1-9a8b-0740f6ed173c", "value": 165128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433768, "uuid": "b8f63cfa-ee22-4768-a703-9dfd010d6579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433768, "uuid": "e0f05725-f756-47ab-ae58-2cf4691d0661", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a897a6-1ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773398098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398098, "uuid": "dfcba1dd-601b-48ac-80e4-e0554acf4761", "comment": "Malware payload", "value": "7219b5185275264905d6d420b7b0b66f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398098, "uuid": "4621c4f2-984c-4271-85bd-558942f0b4fb", "comment": "Malware payload", "value": "93a11699fd8f9604de936e6f2cf8fd086016997a3a0d653276308103073bb284", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398098, "uuid": "abac0b0e-895e-450a-be81-a24c959df4d6", "comment": "Malware payload", "value": "7d958a4c186c9b4fd96a0d1efa221d061c7d885b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398098, "uuid": "aed0b1b3-d201-410f-bf56-4f960e09b0b9", "comment": "Malware payload", "value": "b6a68540ae4816b4dadb07c15361760a62c687d99444c8e7228dd04257bf47ca525479f53213829688c4ac8ad1a79ad6", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398098, "uuid": "ebc1f010-2b46-4ba2-8693-a5dc5f3b394d", "value": "T1EF413170778947A54672A34BA515D758F43CA0AF302E0E4471DDD2C44F76C64EF28AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398098, "uuid": "214ac173-8dbb-49e5-b23b-93221f599868", "value": "48:4389A4XnsoVmWKKA3BvxDlEO7FupBzhVyjb:9NnKb37DlEOABzXyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398098, "uuid": "27030b5c-f586-4a36-97fb-7981ae8725dc", "value": 2418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398098, "uuid": "2c4a27cd-c3d5-42ae-86e1-94a557575453", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398098, "uuid": "86ca58a3-688e-4eda-b026-ad703d4b6e36", "value": "xgWysJ8V.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0971cf69-1ebe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773393697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393697, "uuid": "d6ed5119-c23f-488a-8c71-1844c8cec60d", "comment": "Malware payload", "value": "918e66512daa368a97a3da74a0844e22", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393697, "uuid": "7e9168fc-11b9-427b-ac33-2d0f101461e0", "comment": "Malware payload", "value": "9411feea844aec90968320faa4e1f0b888ce42a56ad78d5fe6da9956ec8e4d1f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393697, "uuid": "25b93f1e-da46-4a62-b4fd-29bf10d45bc4", "comment": "Malware payload", "value": "e66f241dbcd38bc7aa0a72607d443e5d419081e9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393697, "uuid": "8b76f86e-9bad-4530-b7f5-4121f4ea7516", "comment": "Malware payload", "value": "d0a343059393be5900742c8aaf28dc514b3e8d49c3201744117404d11f53a598b00bdca85bbbad00c3f55e734929e20e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773393697, "uuid": "c2619bc4-85c4-47d5-9b35-649ea7af67a9", "value": "T1E6B3428B9D9E8276C7FAE0B5866F8C07DAD2860E140CC5613A5F9F54FF2216861B47F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773393697, "uuid": "c36eda82-f067-406e-a07c-2097d7870abc", "value": "1536:EmXo7AQND7AMTspjAHw6uXk3d1E3yHgWOgtqtp:EmXoBHjkW/kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773393697, "uuid": "852fac44-f89c-4c87-9163-0aa609f85bc6", "value": 111369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773393697, "uuid": "a9d96e75-f1e2-4900-8245-5d164578ddf9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773393697, "uuid": "acf5623f-f34c-41d8-b0ab-2bba99d6b1a2", "value": "Asia_Release_Backup_396.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7760b5bb-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402042, "uuid": "77df46fd-a74d-483c-b742-4bf58ffc66b0", "comment": "Malware payload (Mirai)", "value": "8db4d62061c121fffb4fb9c5c6ec9d59", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402042, "uuid": "1ce26478-85d8-49b0-b839-6b2f7698edcd", "comment": "Malware payload (Mirai)", "value": "94cc5e0bfd7922991d6000a9d9b614990445611c15f8149778472f5b298501f0", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402042, "uuid": "2a7c1bb9-56fc-4246-9dae-630b5e27374c", "comment": "Malware payload (Mirai)", "value": "f886df4f1c215945c81003caf4532d7b6a2b1dfc", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402042, "uuid": "96645d79-d632-4efe-a239-e5f16827cf49", "comment": "Malware payload (Mirai)", "value": "d9af407568532c8bce86d44cd0e782dba3915e20b7753d8636d470e6a3b28d4563ea6ec2071d5e8d92960576a076ca86", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402042, "uuid": "09042dc6-2fce-41da-b0d2-d21d818074e6", "value": "T1E6934B51BC819A12C6D412B7FB6E418E371213A8D2EF3207DD256F2137CA96F0E7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402042, "uuid": "478fc055-d08f-44bb-91ed-14b1c570bfd9", "value": "1536:XEtSWodBICEyNQabFwHodMf9x6Wn40mCBdSa4oILUUsEH95CoYHbHOp4yj+67n6v:XEQW0BIlOmoSP57dF43UULHbCoU/6EJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402042, "uuid": "5c41a210-49e2-4f82-8c56-b31e3d3743cd", "value": 91276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402042, "uuid": "d36eed3a-a970-4e12-9cfb-b4059879700e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402042, "uuid": "7519cbf6-978f-4a4d-bf18-11e7c792f976", "value": "tux.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5071c78f-1ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773394246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773394246, "uuid": "5902bf1a-a9e3-4c74-8eea-bed70b6ca9cd", "comment": "Malware payload", "value": "0acf3ae99ecdcba438c3afa8827a1e09", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773394246, "uuid": "afb2d3d6-e485-4cec-8db8-c70393b285d9", "comment": "Malware payload", "value": "94f54ed4006c8ab5a2c8fcfeba313a99ea376d8a7f352ac3503f30f7d0cf433a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773394246, "uuid": "5244669f-af0b-45ca-9560-3c6b89d68429", "comment": "Malware payload", "value": "75dd10b07ab66fa33d7d691dd208f77dde9a6024", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773394246, "uuid": "b93b26d4-8d25-457b-a819-16cdbc82f8a7", "comment": "Malware payload", "value": "2830dd4bde3c7a7205a153b2ca153500fd3def629a80df199d3d4824784a69677d2c3a6c7014f43cc633e76f626b78e7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773394246, "uuid": "1431fd48-2e1d-4de6-bf34-fcdc66b5e65f", "value": "T171C3DDA40A4B4EBE738B611C845F1406EBF06676139EE6C0FB8DE7D52F14A01D0D6ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773394246, "uuid": "99a130be-6375-45b8-a621-702e77359622", "value": "768:XymWitjle2hZWypAKB3QDLlWTSVVVwcxnseWrTI80IM+ocgnbYdhmyciFfngruOS:oV9IM+mCi6NZZfVhuo3WI7SVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773394246, "uuid": "5162106c-2865-44fa-ac75-1197b0de06b7", "value": 129216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773394246, "uuid": "ae9e0e23-986a-4844-9059-952d91adfa11", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773394246, "uuid": "648bb1ba-ffc8-42fc-9c22-7a246c244ed1", "value": "Marketing_Fusion_Dataset_549.cfg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cac34a9-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402051, "uuid": "7598e0f0-347b-4f38-8f6e-ec50b8eaaf35", "comment": "Malware payload (Mirai)", "value": "839b596fb6b8e1735642167562c36748", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402051, "uuid": "6166d0a8-6edb-48c5-9ce9-a8d1897f8811", "comment": "Malware payload (Mirai)", "value": "96c220fae443d4594ab8237909bc51bb56822b929cb6f75b198f267b6d0b0d72", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402051, "uuid": "269c0324-cc3b-40e1-aaeb-59c4aca711a2", "comment": "Malware payload (Mirai)", "value": "c857018922edb35d65aed30e58636de0653fc620", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402051, "uuid": "85999720-4c2f-4a32-8e71-e15f07dd1089", "comment": "Malware payload (Mirai)", "value": "acb203b507f60bb374870a02ef6f6e2554ca23fe1156e6b40b2847898f2e0c17af17adeef2ff482f45f95962d3afa8cd", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402051, "uuid": "d841a2bb-890f-46ad-94f3-585c80fb4ef4", "value": "T136F33C46EA818B13C0D62776FAAF42493323A754D3DB73068D18AFB43F8675E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402051, "uuid": "2facf03d-f27d-4721-8246-af41e274bbd1", "value": "3072:6/9Zt9IlsDXsvavtSr7VXlRWcC0nPDUH7y1JLnSYlM/9yPBfuqS:q9ZAl6cvavtSr7V1RbC+67y1RnSGM/9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402051, "uuid": "ba549708-7cfc-4498-9568-76a488906ce6", "value": 169176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402051, "uuid": "21064065-6681-4182-8df6-b8c090fc0f79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402051, "uuid": "959f49d3-1983-4e08-89b8-f564018a283e", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e377ad64-1f22-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773437013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437013, "uuid": "e01442a9-da0b-48fb-93ad-2e214caeb104", "comment": "Malware payload (Mirai)", "value": "adaffaa7709de454015a2f8675a09a5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437013, "uuid": "5e3bdbdd-ed3f-4db8-98ac-23bd8d6b358b", "comment": "Malware payload (Mirai)", "value": "9802431934ffbab1b76936ca12d7b230ff1857dd5041bebe1bd0afb80f9c2d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437013, "uuid": "4046d37a-9aa6-4636-9de3-89c46556124b", "comment": "Malware payload (Mirai)", "value": "977ed906590072a5ee4ec45926137d64b9be788b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437013, "uuid": "ceb4f16f-c214-4b21-87b6-4ed9249b23e2", "comment": "Malware payload (Mirai)", "value": "c6f57f197fc924d1e29cfe104766dda1aaff97373f406d29902661350d9d8e351f14311a5fbb073168a7e4cb7e450f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437013, "uuid": "72b00ae7-e2e8-462f-bd5e-fe6e7e21f2f4", "value": "T1EC736DC1A683D8F5DC124A7121BBEB339B77E03A1029EFC7D764A976AD42641E10735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437013, "uuid": "961e84e8-9564-43c2-81ee-8d7b0e50dedd", "value": "1536:vatH1z6f5ZPPaxmEOGJ3av28zB5fOBls3mh1l2OaP0O5w3eGT3EV4SX7S43:v+gHPPaxvOSqv28zB5fmlwmh1l2hPr5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437013, "uuid": "d9de6ddf-630c-4dc0-aa64-ffa4211c89b5", "value": 78736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437013, "uuid": "a59aeb95-727e-4fa7-bfff-a46547f1a6a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437013, "uuid": "7fac774d-2190-42e3-8a79-bfe3d8300b47", "value": "tux.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82047ff-1f18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773432645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432645, "uuid": "aa80f7bc-84d0-45ed-8855-11cea31611fb", "comment": "Malware payload", "value": "b1123bf3fe9cdc9576a2c29f8a8d4149", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432645, "uuid": "0e8c8273-543c-4ec9-adfd-1a27eeac0bf9", "comment": "Malware payload", "value": "986917280909709d749795627272f5d18fac15b21684793d13902e709ea84086", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432645, "uuid": "bf5fedc6-6009-4c8e-b976-f47e03f99ead", "comment": "Malware payload", "value": "e81790b16c852380bca43d83936ee78606760843", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432645, "uuid": "fd295e49-6dc6-49c7-8fe7-0a4d7742b405", "comment": "Malware payload", "value": "694fe736243f46175efb4a2c58bff008e0116bed9e79edd2e80f5d159d8018e9ca16e02bd41602dae711fa8bf73b4705", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432645, "uuid": "4734cd64-dae9-46e8-b54a-ebcc8e47f70e", "value": "T1F7C3BC4E4DAF00C003956C201B8B19739B6AA4264758C68BFFEDD3E6AF5CCB505FB984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432645, "uuid": "097d20cd-ade6-4680-a201-73a6940aea38", "value": "768:3jAmhApxXI5Cqs3FqPJPSXqPSpuedK3qPqYloAucrjBu507B9K2/n3anxp3dpe10:3jAdpM0GaH8eQYljucPs37JZDUb8ZOmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773432645, "uuid": "e9a9f74f-a3d3-4941-b170-5cd9fad6092d", "value": 121896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773432645, "uuid": "843887b1-35b7-4e71-930e-fb2de6b9bce8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432645, "uuid": "61cfae03-c1e6-45df-9e6d-6dc5ae0e6249", "value": "Production_Report_Backup_1031.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec60eb03-1ecc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773400091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400091, "uuid": "909c21b0-ed51-4a70-90d6-f25620cad9ca", "comment": "Malware payload (Gh0stRAT)", "value": "4f02289a47ee0cb2237a92cb61edadb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400091, "uuid": "9f9414bc-344f-4f4d-bd8c-3f8a7605740e", "comment": "Malware payload (Gh0stRAT)", "value": "98a34bd5670ce59926d308cb1dd7d183fe23bfcf5266df023fca4963374624e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400091, "uuid": "e8179e6b-c177-4389-a25b-2963fdbe28e6", "comment": "Malware payload (Gh0stRAT)", "value": "54523c2154aace521c9308f69a2635b2ec5645ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400091, "uuid": "de6be069-8a21-4453-bdd1-2502a0621bad", "comment": "Malware payload (Gh0stRAT)", "value": "659d24eda01916068baa9b10933928e451d15b2a053bb66bab69961414606c3607d20bef3b30b5fba3400a6a6a31184a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400091, "uuid": "24c04cea-9f16-4e4f-97a9-2d97467bb97a", "value": "T1C7973337E2CB633DE41A5A3B44F1C255AD7B3160A61F8C46AAE4488CDF5D1A02DBF346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400091, "uuid": "b6d71976-43ce-4910-97f2-1263205d62c3", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400091, "uuid": "e00ea5fa-2643-4a35-a937-48dd17b8eabf", "value": "786432:ySRfCHgUEDOkjwBzcKPx6UGXIFbEjlUkfwrGApGOjLIpfJGElGjJgY5bWmPuXWcO:D9CHKMRcKZ7GXWEj6kojQOKGjJgY5bWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773400091, "uuid": "cf31f91c-9d48-400f-aefd-4dbb00710beb", "value": 43484957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773400091, "uuid": "8e2d7ebb-0de0-4a06-8742-c49700b78a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400091, "uuid": "2eb0cf76-0732-4989-a63d-42a12e8cab05", "value": "openclawAI 7beAolenc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e7d1f1-1f1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773434846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434846, "uuid": "eea4ca42-3854-4959-bf94-7ac93b6269d8", "comment": "Malware payload (Mirai)", "value": "66a78efa297ad724aa6262fa56b0d102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434846, "uuid": "84895d59-6fad-4120-a7d0-1ba0c904875c", "comment": "Malware payload (Mirai)", "value": "99e33959d3a3f0ff84103355553b9f369c21f8b3da17090528423223423d2042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434846, "uuid": "983bd802-9a70-4c6f-9530-cfa04be64bb7", "comment": "Malware payload (Mirai)", "value": "3b0acf1a3e0f44217d7259324369e4caf38407b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773434846, "uuid": "ed803794-588b-4996-83ad-34bae94797b7", "comment": "Malware payload (Mirai)", "value": "18bde5de8ade0bcc0accd271e74f1d1ecb23927ea648c22bf9e677002be00b0fdc714dcdaa196bb573cdc5dd6c82d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434846, "uuid": "e148a4c5-8d4e-47a2-9310-4752fd1d0ff5", "value": "T11F241A45BA418F13C0C627B9BA9F42453323A764D7E77306B528ABBC3F8779E4E12505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434846, "uuid": "20ccc0c1-5eb5-46c2-9c45-ce5c82ac898d", "value": "6144:sa6gjvyvu8aYWsNWYA8ykiAn6zXxFUM/Rrc9ad:gKym8atsNWYAVV19Fp/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773434846, "uuid": "8d51fec4-d1f1-4c10-96f6-68b3075ccd18", "value": 214601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773434846, "uuid": "d363d8c5-bc0d-435f-9340-16f0ed8c440b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773434846, "uuid": "dfea7c58-7dd1-409b-a8da-56fa260a6c08", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdf7d5c-1e77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773363343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363343, "uuid": "3cbab401-64a5-4ce5-bf8a-6db29571ed83", "comment": "Malware payload", "value": "e949e3e3100161a5a1ece03782e3d26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363343, "uuid": "906c8ce1-c569-4a36-bddd-aa54f43e77e5", "comment": "Malware payload", "value": "9a12c24cc51158300d451e3ae97c37eb76fd4743827c18d64112ebf6208c63cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363343, "uuid": "0fbbcd84-eae7-4462-bd36-eaacbf5d797b", "comment": "Malware payload", "value": "f3a6d263b6957b2eae065621cead84371306f153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363343, "uuid": "07102131-ea11-4e62-8bbe-2caaa20c46ae", "comment": "Malware payload", "value": "2f52672abf5bc42e1071d0262fb31269f99da230256c3966d6ece0ab189ad9d26926022ff433599008eaf82cec29465e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363343, "uuid": "98a9832e-d94c-4290-821b-38a452d8922f", "value": "T198938E13DB82C0B7EF69A0711C4E3A7CDAF8B7685877DE43C7E10CA6F57041A951A2A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363343, "uuid": "b5e2aad7-739f-439e-8729-45730702d87b", "value": "1536:faXCq3AMtvv6A7xlZX1KVoH3oNAmmIrJX+4PuyAU27oKE6Y1xsFXvWtQEy:iXCMAMtHtlbAJOUAU27oKmxgvGQEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773363343, "uuid": "8846327c-2646-4794-b526-60df337bce09", "value": 89007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773363343, "uuid": "b48ff225-8b82-4e78-a5a5-1ead29344a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363343, "uuid": "1bfbc448-34d6-4fe7-9ae9-6420c0a8aa77", "value": "SecuriteInfo.com.BackDoor.Remcos.630.31574.17596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d760e31a-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773427543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427543, "uuid": "0f2ca70b-dc79-42b2-9cda-cbaebe3decbb", "comment": "Malware payload", "value": "62e9226c72a28635e35d8b50d62b68c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427543, "uuid": "362d7b45-8985-4756-b666-b40a59109a2c", "comment": "Malware payload", "value": "9aa98a3074bed7d0b9aa5ea1ab3522a84017e29961ae67dd7489b9744d2a2050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427543, "uuid": "53382a13-37dc-48f9-822f-9b123583c346", "comment": "Malware payload", "value": "4281f914b688de374d73e2594fcc282e5b3a169e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427543, "uuid": "27010a0b-25cd-47de-9ae5-46356e994ccb", "comment": "Malware payload", "value": "46e02cea490843294b9500039fed612abafb31605ea1c4634b74fc6caf4fcc5a72cdcaddc26008945323288dbc561648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427543, "uuid": "416c018a-3a61-4c4b-9341-601699c8b12e", "value": "T1CE44336BF121C054E59240B8742CEA8AF45C7E7305446972FB81BB5939B27EFA0F6B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427543, "uuid": "06c86761-0f77-4dee-bd53-2db7c89433ac", "value": "fb691caab6941b1a672a2276ba2100ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427543, "uuid": "d92a27de-de37-482f-84b6-909829970a68", "value": "3072:uVMKsWKxlGxE07ABigCFHdLYyBvzyBHNGqXgvnHZyzi0zslLFU/FzKsR:a3sWKxQ52CFHdLYKvzyZNGX/IupI2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427543, "uuid": "7cc0ae0f-1134-433a-9a11-0f3e5d27ec3f", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427543, "uuid": "3737bc34-df61-4f10-ad75-6b71e9a313f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427543, "uuid": "55e109d9-ef9b-4ae2-9b61-74243540eb0d", "value": "9aa98a3074bed7d0b9aa5ea1ab3522a84017e29961ae67dd7489b9744d2a2050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a50a22-1e84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773369067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369067, "uuid": "72714af9-58c3-4bf6-b249-346619152f98", "comment": "Malware payload", "value": "56fac2dc990757766624840bc7b43c41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369067, "uuid": "5d2a1097-6f67-4ea2-8de7-cfaad0322c5a", "comment": "Malware payload", "value": "9abfe6ee07ef31aed70add49e76ef1820c62a580775783ffb385c4b49d92161c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369067, "uuid": "23ed8818-ca3c-4c2c-bf99-8823b1dc90a1", "comment": "Malware payload", "value": "8c92c6be76018ffe7d0a33b67fb7a4b6f988e157", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369067, "uuid": "c0f4062e-1a3f-4fcd-b5aa-c7536970d056", "comment": "Malware payload", "value": "b8263dfd0e323b4e65c62b89bdb2cfd618a607ed47e0fa8f852764953e7be3d3c3f87516f0e46bd2f995712014d71159", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369067, "uuid": "741f060c-1cd9-4d31-95b5-556b62fa7552", "value": "T1B5925BB916496C79BBC0DE7D9F3C7F0CADE481C02218A3ACBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369067, "uuid": "d3e12128-e030-420c-a756-604714ee1a74", "value": "384:2c0M3vgRjGlsaq7HzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:2GmjfjzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773369067, "uuid": "6c731305-5621-43d1-b02e-12ac2e4a30c4", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773369067, "uuid": "e6c8ce83-75b1-4621-a7fc-3535b2346207", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369067, "uuid": "3074cc1d-1971-44bd-bac7-b31556b1dbf5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abf5b5f-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402048, "uuid": "29bf30ac-80a4-40c9-9a86-ca11f52b9dc2", "comment": "Malware payload (Mirai)", "value": "c04a3f6050a1d006b00c56722de7758e", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402048, "uuid": "8bf893fe-871f-4fca-a49c-2c43648851ae", "comment": "Malware payload (Mirai)", "value": "9c24a1d146159605c44a22ba16a188d7efc1f88d0d3e16124a66e1a96b34d022", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402048, "uuid": "96e23a10-0fd5-4298-9fe5-22002bcebd39", "comment": "Malware payload (Mirai)", "value": "ef1394299c42a05ea97e5976c728fd3df17af1c0", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402048, "uuid": "14379d35-75f0-4e89-bd3c-b99ca270fa00", "comment": "Malware payload (Mirai)", "value": "064799762ddd50fe93b43c4b1f204b45122700af8cbdd4bc6eba1f0b3741888ad6d312dc224b1a4743cf795261f0e98d", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402048, "uuid": "c6650ff6-f1dc-426e-b7b0-55700620f63f", "value": "T170931956B9819B11C6C412BAFE2E018E331327B8E2DE7223DD146F2477C692F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402048, "uuid": "cac058fc-c95d-4ecf-8d75-383f224a7de7", "value": "1536:SNnZrVk4F6Hev7BF5uH27zoAwD3ir1ZejaGZoTK5CDd8iXvR4qa5YYV7ypQLZ6:uVk4F8ernwQ1ZgaGYvR4qaio7yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402048, "uuid": "8d8d6d8f-3608-4db6-a486-21ec214587c7", "value": 95376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402048, "uuid": "05bb074b-4b1b-43aa-96b0-9821366cf7e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402048, "uuid": "b1fbbeb1-4360-4c11-b283-01806cb735a2", "value": "tux.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d110b485-1e94-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773375993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375993, "uuid": "e0c368ec-65bf-4a30-8add-5c7f29e3e03b", "comment": "Malware payload (ValleyRAT)", "value": "1f711fd0600f268dffe5a19e8a4dcfba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/PoolInject.FO!MTB", "colour": "#30097E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375993, "uuid": "b197d8d7-b3ab-4026-ab2c-890c68add6bb", "comment": "Malware payload (ValleyRAT)", "value": "9eb046674e605fed5a99e6300c4a4e0bfc9470c4f31b2efebb57932b19e90886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/PoolInject.FO!MTB", "colour": "#30097E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375993, "uuid": "d1e9298a-64dd-4416-841d-07cb5f5b07cd", "comment": "Malware payload (ValleyRAT)", "value": "1b59a12c8c44d02dd998c4dbd1e0184865e80ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/PoolInject.FO!MTB", "colour": "#30097E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375993, "uuid": "53620431-b7e3-4511-a68f-cf95168f6064", "comment": "Malware payload (ValleyRAT)", "value": "8d686187ef9cb5e609eadf3f19b6df563fa94725ce97ddd5f64eb4df951b93dbf9fbd86522d11ccec8224914c96534f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/PoolInject.FO!MTB", "colour": "#30097E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375993, "uuid": "8620fb66-b422-47a1-bd55-4ce29ecfc879", "value": "T147B31806A67D61F9D87A81788AA35B52F7313C194B3C538F8B6446651FA3BD0EF39320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375993, "uuid": "353d5428-41b6-44b3-9485-543c62169451", "value": "5d3c0b627d0f2032f4e6d13576e621b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375993, "uuid": "7c0cdf38-26f9-4363-aefb-11b56aedf3a6", "value": "3072:375GNDUaunHmshiTBiuJqJnuLLPWpfLTsIih+jhnKIsnT6ss:3o+ILPwDTBih+jUhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773375993, "uuid": "09d76f78-7496-4680-82b8-f0182d9ecaae", "value": 109952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773375993, "uuid": "ec2fffe7-7bae-4fb2-b9d7-d911c7cbc07d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375993, "uuid": "978255d1-1dd0-4458-a284-c36a8850269f", "value": "11.13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d92f703-1e77-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773363344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363344, "uuid": "4fb8a574-fdd6-47ae-8728-eab4eec80655", "comment": "Malware payload (GCleaner)", "value": "d9442e34b14efc8f768ef74b8d2864f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363344, "uuid": "d2332ed5-7c59-4c42-9a27-7d5bc1e376fc", "comment": "Malware payload (GCleaner)", "value": "a0ec7d96fc897e03b7532ce30fee6d1455929b11d29f62fc0795eb8f75288fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363344, "uuid": "0d4265bc-3b76-4cd0-b0fa-342ba74e98b0", "comment": "Malware payload (GCleaner)", "value": "826d9db17e042b0c0ac48f004a72a2b89c47bd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773363344, "uuid": "b37f50aa-c226-4daa-baa1-3f477857e90a", "comment": "Malware payload (GCleaner)", "value": "3f2cbb873089a6be9cd4482aeb6d09bcd9b9f624df74fb221032a87eb41d12f071fc9bd43d02fc5e6152a76acc9aa19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363344, "uuid": "6e50b0a6-04fd-439d-a393-4075098bc072", "value": "T1E505AE26A1F10537D2A3177C9D6B536D983AFE002E246876EBE51CCC5F39E85342628F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363344, "uuid": "2eee55f2-7f73-4184-af2b-601e3bc1780d", "value": "42078fc2d57cfdad066ee3f20b547df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363344, "uuid": "551613de-a055-44f2-8f2c-7a93474228c5", "value": "12288:QdRlwg4+yTosCmxqLBXL46MVS/piPcp2gwxcLlfmDDVJ:wTD4FosPql7Ac08NYYlfmDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773363344, "uuid": "1cbdfbfb-9a25-4605-88ec-ae57188850a2", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773363344, "uuid": "646273bb-8102-4e86-91ee-c7133558c209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773363344, "uuid": "4f187813-397e-4145-8a1b-fd1620471db7", "value": "SecuriteInfo.com.W32.Injector.ETZT.tr.19698.4539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e319cd-1ec2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773395656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773395656, "uuid": "9fca20ed-c04c-4de3-bd1b-ef26bad785f9", "comment": "Malware payload", "value": "06aa085fa33cdf8d80d3429834f8babb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773395656, "uuid": "9f0f01ee-a2ed-4aaa-9342-99f3bdb96599", "comment": "Malware payload", "value": "a2859cb6ae25bb671243b8534e8972c75ff12186a4b0bb3c4d0843264924b0d3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773395656, "uuid": "1e3b757c-bd83-41a6-88bd-8a9d40f526c1", "comment": "Malware payload", "value": "6a5bd79367ecadf1dd8f5da4ad026f18caea2a86", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773395656, "uuid": "96855ab7-b487-4835-b80a-cdf79ca4de0f", "comment": "Malware payload", "value": "2fb84b306f1ce49087eb2db1a079001849a7af306ba6d56e3b1ddb450f701a50cb5856b6818a785b5b505740f6b55ded", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773395656, "uuid": "cb50bd5b-9cd7-418e-a66b-4ae6d3f47604", "value": "T16C0141F728CB702819671A45C73841D8E753AA4C8B0179CEA6D080B44A2D3A4A7FFC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773395656, "uuid": "8a017009-8c70-49cf-91b5-d9a2b5046929", "value": "24:w4rOUu9rU9dVGD5HQhYvy/oEg8F0khKoCo:sUNVGDxGYvy/QZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773395656, "uuid": "592de7c5-5249-4fb2-9662-b4398352926e", "value": 780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773395656, "uuid": "2cd9fc2a-a246-4a0a-94f4-e271121426dd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773395656, "uuid": "e2559497-5b13-4861-825f-6c3efa026db6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979ff0eb-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773408109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408109, "uuid": "dcad9234-8c76-4d45-abb2-2afd8ea8b4cd", "comment": "Malware payload", "value": "45f0a898d07b3dd41ac84834279e2250", "object_relation": "md5", "Tag": [ { "name": "dayzcheatcheck-online", "colour": "#83559B", "exportable": true, "hide_tag": false }, { "name": "estudarebomai-com", "colour": "#8F41E7", "exportable": true, "hide_tag": false }, { "name": "jholycf100-ddns-com-br", "colour": "#8FF4CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408109, "uuid": "6d37ff4c-8117-4c5e-9c10-810c7f8ed9f0", "comment": "Malware payload", "value": "a488b5a66a919e96297311a9a08dcbf6be3ae5a338d8cff135db3c7a39b2f001", "object_relation": "sha256", "Tag": [ { "name": "dayzcheatcheck-online", "colour": "#83559B", "exportable": true, "hide_tag": false }, { "name": "estudarebomai-com", "colour": "#8F41E7", "exportable": true, "hide_tag": false }, { "name": "jholycf100-ddns-com-br", "colour": "#8FF4CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408109, "uuid": "fce480f5-8c25-4747-aed8-c53f8ec9f23e", "comment": "Malware payload", "value": "acc71c3d094cc2af056694200150b4012c724477", "object_relation": "sha1", "Tag": [ { "name": "dayzcheatcheck-online", "colour": "#83559B", "exportable": true, "hide_tag": false }, { "name": "estudarebomai-com", "colour": "#8F41E7", "exportable": true, "hide_tag": false }, { "name": "jholycf100-ddns-com-br", "colour": "#8FF4CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408109, "uuid": "f9c9be9e-57cd-4408-bc1b-effd4a2e6e98", "comment": "Malware payload", "value": "57ddb5465abf21b8c7dfd218ff3b177cee0730934d3c40932416709d2712c980f6afe43a182831888fd1f7130e45274e", "object_relation": "sha3-384", "Tag": [ { "name": "dayzcheatcheck-online", "colour": "#83559B", "exportable": true, "hide_tag": false }, { "name": "estudarebomai-com", "colour": "#8F41E7", "exportable": true, "hide_tag": false }, { "name": "jholycf100-ddns-com-br", "colour": "#8FF4CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408109, "uuid": "23976185-8605-4fd0-8893-e63edc96a843", "value": "T1984513FA6F41E0966009676D0BEA36F6ADB6C192E51B50C4FF30A0EF511A90CD64CD3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408109, "uuid": "d5d9e865-7318-40f1-be0a-30d4b584ba9a", "value": "384:SIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIf:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408109, "uuid": "63da9d18-ec82-4414-99f0-6b766c434270", "value": 1197015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408109, "uuid": "3304b6e7-5fb4-49cf-bc24-5ec53f094b15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408109, "uuid": "b486c12f-7fb6-48d7-9a1f-e83dbc6e3fb4", "value": "a488b5a66a919e96297311a9a08dcbf6be3ae5a338d8cff135db3c7a39b2f001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80e9bb7-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412485, "uuid": "ac386693-51f3-4a24-a314-501acdabeeb7", "comment": "Malware payload (Mirai)", "value": "69b7aa7cbeac90f657477c4e2dd19d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412485, "uuid": "ca3b55a6-59cf-4c85-a7fc-1e8bce41994c", "comment": "Malware payload (Mirai)", "value": "a4aaa14525fe034b5951da298e225689f019d8f9b3003703bb1f5957402f707f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412485, "uuid": "658dc6ab-07a9-4a2a-981b-2e6da95452fe", "comment": "Malware payload (Mirai)", "value": "c46ae95d2401cfc9cb6ac4295852d4f9c084b560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412485, "uuid": "4a310438-763f-4ea4-9eb3-7ef5ec65edcf", "comment": "Malware payload (Mirai)", "value": "977ed58af6c824f65b2284574c6aee6ce5535d5a6fd581b1452bde829c9a07999bca48d2b446f15afde353f897c5268d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412485, "uuid": "736ba21a-1ba1-4492-adeb-071fc196649c", "value": "T1D5834B02771C0A47D1A61EF03E3F17E193EEE9D121F4BA88290FDB468175E72558AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412485, "uuid": "af420bd4-dcb8-4b83-858d-125af2546413", "value": "1536:k2Gk2kAQXqQznRMYv9MMN9KiMs/3y9jHfV8UBzd2l7ypND8I:p0QV9lM29KfoILVdBJi7yII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412485, "uuid": "ae8f0b84-262c-46d7-9240-3aa4fa0f34e5", "value": 87280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412485, "uuid": "fd9834d9-e693-4ff3-a0ca-82e099b43843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412485, "uuid": "4b8e1480-8982-415a-b964-4da8ffbf8972", "value": "SecuriteInfo.com.Linux.Mirai.9774.27737.4201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e21537-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773412483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412483, "uuid": "d2a0c814-e38a-45e2-80ce-9478623fd804", "comment": "Malware payload (Formbook)", "value": "bdbfbf3300f26365c40dabac077d77cf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412483, "uuid": "0aaf04b2-f9b7-4bdc-8d42-b51942589fc5", "comment": "Malware payload (Formbook)", "value": "a542fbfadf53e5a6d3a3e7216fc0d9a24384c0bee039aab151c3c1a1e06e52dc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412483, "uuid": "f2b11652-b619-4339-912e-45a7178a3ff2", "comment": "Malware payload (Formbook)", "value": "95636c17f51171781b8b5506df302cc2a31fa467", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412483, "uuid": "e406408d-d76f-4a63-bfae-0d2adba4782e", "comment": "Malware payload (Formbook)", "value": "34f416c41eeabb5c46a1d25d00a066bd280988302f52f394bcdd9a91c0c28f409ec50d7859cfcf775b9bc5b9af6a5194", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412483, "uuid": "b715061f-891c-4718-866f-a66a0938a559", "value": "T1124656F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412483, "uuid": "c467298f-b756-4873-8fc6-d7f12715b3aa", "value": "24576:9tZem+Np/m+KXkYR5UwyI9pg5Y2q38CzAW7wsQejK2ZXK+K3O1b8uQpcQW70qSoo:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412483, "uuid": "a91b04ed-a1df-4768-a0d9-e450fd527c26", "value": 5602099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412483, "uuid": "57348efc-5260-4158-a728-9b479509aab3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412483, "uuid": "6b0a5158-3938-487c-a571-27490ee44ac4", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.21123.6318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4c9288-1ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (Braodo)", "timestamp": 1773396302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396302, "uuid": "84e91182-cbec-4dd6-a7fb-46d14a4c3b6b", "comment": "Malware payload (Braodo)", "value": "10a0e172b606d94d36c28cdd0978f11e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396302, "uuid": "88882d80-5d14-4188-83c9-0a351c2196b4", "comment": "Malware payload (Braodo)", "value": "a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396302, "uuid": "c24637b2-dc62-4f16-bacc-a95b617ccddf", "comment": "Malware payload (Braodo)", "value": "096b3dd958f8ad8617d7b22a349e28c92fe318b6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396302, "uuid": "9f336f74-0e29-4e38-aca3-0bdc807a992a", "comment": "Malware payload (Braodo)", "value": "bcecea0c59d788ec1526098c57b5eb69a57028624897b1e1fd353d78bb510685581c22ae3cd5297caaf781a8dc5ebbdd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396302, "uuid": "80c65691-0fa8-43ec-a631-af54a92b24a4", "value": "T10E55F125DB6A2FCD2D390E8D046E3D574D9A6D313D22C8B0CADF280F8125BF65662D1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396302, "uuid": "ae48f88d-766c-4a65-9da5-8575e0f9610f", "value": "24576:lgX4VtgX4VtgX4VtgX4VMgX4VtgX4VtgX4VtgX4V0:S4A4A4A4R4A4A4A4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773396302, "uuid": "344d66d5-3a6b-4604-aa88-7db2b577b64a", "value": 1351204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773396302, "uuid": "dbcf59fc-57ba-4261-af5e-28a1b9894d27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396302, "uuid": "2ea4d889-04ac-4a01-9b25-a88cd994654a", "value": "up.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e25ef4-1ef8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773418820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418820, "uuid": "ab59fcb3-5e07-42d8-b4ce-120e26192da9", "comment": "Malware payload (ValleyRAT)", "value": "de830943ef92ad7d8f8f0fc6bf9aee25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418820, "uuid": "58e71b65-00d0-46bf-89c5-5a618b637cdd", "comment": "Malware payload (ValleyRAT)", "value": "a9d9ede3047a68fe8b043e9689fa71e721a39136b7600fe327c4b076ffc336a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418820, "uuid": "0643a41c-b09d-44b6-b161-d68d8910dc36", "comment": "Malware payload (ValleyRAT)", "value": "f17a72fac27a7915f46387d8521da99099f1099b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418820, "uuid": "ea85e7e9-a0a3-4c3a-a9eb-33811f5e87e2", "comment": "Malware payload (ValleyRAT)", "value": "3f73c43b5c5e4c5ce7986e5c7ad08bd5950782415517186b8c3e64c913b01b9fcc511a19d1c0e3f9d6ad14752ac9b0b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418820, "uuid": "106b45b0-eaa1-46af-ac88-12dc20772691", "value": "T19FD48D49D7A404F8E8A7AE7899524902E376BC4D3F61F68F0FA476521F332E09D39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418820, "uuid": "0573fd54-95c2-4e9a-a8eb-a5d590de7a7a", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418820, "uuid": "ba1047c8-d25b-4db4-b1ed-05eb85e364e3", "value": "12288:JngM8K8P4ElXddah8kyDIZJwVeZp2GlTcyi:JngHKYfXTkXy0ZJwVU2wVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773418820, "uuid": "dfc25361-3cba-4fb5-84f7-7ea7f311c19e", "value": 618561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773418820, "uuid": "9b910a95-e636-458b-a568-e60e690c935c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418820, "uuid": "fc4e97c3-fa74-42c2-b15c-2b41ec96ae63", "value": "a9d9ede3047a68fe8b043e9689fa71e721a39136b7600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd392a39-1f1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773433539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433539, "uuid": "fe148a71-4500-4671-b2b3-e41a5d623abf", "comment": "Malware payload (Mirai)", "value": "8f47fbc7e332de0579dad6e6875284fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433539, "uuid": "e17c6289-2f9b-4211-81c2-9459fb447b21", "comment": "Malware payload (Mirai)", "value": "aa050e06f2c3d7a93938e3fe475767915a6cf8c9781914342e6410efddd24f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433539, "uuid": "c99d4e5b-2f43-467d-adcb-f749a7db824c", "comment": "Malware payload (Mirai)", "value": "7f4b49b7fe9509d66bbb1f67929e28c5696b1f9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433539, "uuid": "0ca1cb3f-ea0d-4202-b61c-9c77a136253c", "comment": "Malware payload (Mirai)", "value": "51b602e77fdaa93bf2bebc465a36f2657b6f8c36f07ba2498c49a1d1d66c0e8d7971f2f755126bfd8496a62df57cc692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433539, "uuid": "76a38aa8-abab-4f85-864d-5db1b40b05ac", "value": "T1C4F33B46EA818B13C4D61776FAAF42493323A764D3DB73068D286FB43F82B5E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433539, "uuid": "3c1bf8a4-71fe-457f-aaa6-2cf5eea62c1c", "value": "3072:vTApm7Xg2YegCGda4dd2KcUpbc/QdHQar7yuDCxa5nM/9P5QLpS:rApmDY9fda4dd2KcURc/nE7yuDCgVM/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433539, "uuid": "864adf28-eb8a-45d8-8fee-5be5814890b2", "value": 170552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433539, "uuid": "36254be9-3c1e-4b69-9db7-6275c81a65d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433539, "uuid": "bd62b7c5-38e9-474e-b759-bd25372a45c9", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50156349-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773412713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412713, "uuid": "4ae88ad0-4743-42c3-a80f-076781bb32f4", "comment": "Malware payload (Gafgyt)", "value": "59ba3724b1a6731380d311262d4b4191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412713, "uuid": "9626c2e2-730d-4f10-825d-6b52305fc6b9", "comment": "Malware payload (Gafgyt)", "value": "aa3e10f66f4876aae7e859e4442a545ccd7fd19f42ae7812dee2afd3484ea17b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412713, "uuid": "534fd7c3-dfa1-451c-844f-9fb9636304aa", "comment": "Malware payload (Gafgyt)", "value": "9c2391c3e143f0903af593c3f02ab30b8d703978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412713, "uuid": "d8f2c061-0fda-4039-9ae0-26ad24808394", "comment": "Malware payload (Gafgyt)", "value": "c70e99fea1c72d6948794d3ac3087ce1e4e32dd4a250a9abd67370de949b463e9b2c54136f377f012d7a6b96f5f0e244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412713, "uuid": "fc8d2ba0-065a-4fb5-9316-3c5f058b3e4b", "value": "T13BC3F144E8E185F1E1838AB320E71BEECB30AE670091D767E30A7B119DA1FD2941F599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412713, "uuid": "beb2a6aa-506a-4182-a50b-26676c26cb53", "value": "3072:qa3z5a9yc6DLi8BbN0mru0Nk/xl6dRc9FbYSD:qqm10Li8BphChxl6Di6SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412713, "uuid": "44784284-9ee8-4e65-81c4-4f6f7420fec8", "value": 127076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412713, "uuid": "05900d8b-e9f7-494e-9ab6-f271b6b0d849", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412713, "uuid": "5a055895-ae91-4a7f-a71f-538cbd76e697", "value": "0twxt1rqmy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e9b26e-1efa-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773419483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773419483, "uuid": "1142a668-4941-4512-aebd-f6926b168610", "comment": "Malware payload (QuasarRAT)", "value": "ce0d96827a622f67ab639663cccb1a46", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773419483, "uuid": "f4813275-f79f-4e40-959b-84396dbe8a8c", "comment": "Malware payload (QuasarRAT)", "value": "aa8f99ec127ee46baa2d8221a417b8818caee1a8ee25a9200066a92e6eb9f9ae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773419483, "uuid": "4cdb53b5-798c-457b-b722-c8f8254764f3", "comment": "Malware payload (QuasarRAT)", "value": "42cbd5a8006f9d862ebed14335f9a8c9c1c7b8c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773419483, "uuid": "5f35b75f-30b6-4676-90fc-a8e7697a4640", "comment": "Malware payload (QuasarRAT)", "value": "6b1542d6218c06e3254071f1fa89d20da155b9fc6301f93830746274f5737d54ee5bedf5191a1b46f84cb240c6d05538", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773419483, "uuid": "472a85ad-24cc-45f3-a1e6-f3615f8bde65", "value": "T1D4363306BD54397FFB7406785E12FAE14F1D8EA5F9AA0AC624E5EE7CA390CB04311670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773419483, "uuid": "fe00c030-bf04-4c75-bd30-30b0a46ec445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773419483, "uuid": "19658d24-0678-4f47-aa4e-6eebc1302331", "value": "98304:72afhmf758yxBSDnOWAYEacCAGxwxscaLLyqZhfLnpL9kLgYqt3E:yafh9qBS65wKeHy8TpLukYqt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773419483, "uuid": "56029674-fd27-4240-93de-9545779f3522", "value": 4923392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773419483, "uuid": "d47672dd-e6f6-4134-9bc5-e69bb4524f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773419483, "uuid": "e1543efa-a644-4fc0-8a8a-c1500beebeef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da76a5a9-1f35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773445158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445158, "uuid": "e1c21591-6aea-40e1-ab9d-6a533bc275d9", "comment": "Malware payload", "value": "9576f125455247b433c2624d19dc8f28", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "crypto-key", "colour": "#FB038A", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445158, "uuid": "9044cb06-99a6-4a5c-9d23-ae10053f7571", "comment": "Malware payload", "value": "ab8a6f07d5d426e5f4ffc790b230c61b346fb694a8687302b97176d32b0f8f8b", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "crypto-key", "colour": "#FB038A", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445158, "uuid": "74905474-73bb-4474-b41e-36938182a3f3", "comment": "Malware payload", "value": "677a6db153ed27492ffa31af211b842ac11a4834", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "crypto-key", "colour": "#FB038A", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445158, "uuid": "380569cc-3a9d-4264-a81f-51f9613d6042", "comment": "Malware payload", "value": "c7ade46ffeb86c94138619878b955355357dd30d3263b44f43e31d7f3ab30ced21ce7d07c345e11b3d09dd899834222a", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "crypto-key", "colour": "#FB038A", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445158, "uuid": "9049ec01-9b7e-4c07-9ad4-530da32bb3ec", "value": "T1EDC2F93167DD1E4EF122BE3BCD81B5738E55BEAA1D52C1E5B542072B8028C91E960F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445158, "uuid": "e41fa318-9338-487f-b3c7-5ed529b07e85", "value": "384:MGGg/SkPTcL7I4yv8drcNFuigwpro4qSzuHvinTAl25O0HP/41y81amMrCB121VL:5LPTcnI4b2AwW47EU0s5P/iyjr/xPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773445158, "uuid": "50d90850-8ef8-46d7-85a6-165bdcb613ba", "value": 26660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773445158, "uuid": "ade158f5-ccad-409f-9c65-36cbdf0757c7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445158, "uuid": "6e1573ad-ad09-4ac0-b1d4-eb84f35383d5", "value": "ROSPM1v9KBlb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1dcfba-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773412709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412709, "uuid": "dcbab7b1-7905-46f4-aa68-2b480724710f", "comment": "Malware payload", "value": "6e7e85c20616200b77d8c3a4d9fa4f40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412709, "uuid": "180b6823-bf3e-4b51-b011-013fe4e98132", "comment": "Malware payload", "value": "abc0a24d0fe1b0789ddaf3e190f9052266f40e2c83b7ae3108d16a644b53d3db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412709, "uuid": "44eadc8b-1143-455a-92a0-28c40ebfca35", "comment": "Malware payload", "value": "cd715551a3c4ae3f5c0d22b0f020a75f79d86a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412709, "uuid": "9a2ed5b2-d2de-46d7-be67-9a219444d38d", "comment": "Malware payload", "value": "4cc055f0d126158dead79cdc814629eb4fb0ac5995da84a67b20e26400783334e9102182062623329ecb2618649773e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412709, "uuid": "3c796d96-8c09-4db6-8e92-2ec80cb3ca04", "value": "T1E004F14273009F71C72A807109F7D796FBE72AE616C39146A66CC900AF91B5D6C2FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412709, "uuid": "b1c0abf0-95e4-4296-8809-0502231af974", "value": "3072:kgfKVeEOH4lcgjVKamPl3UExyo6Y2Jg20v4CG+OCQwexGPDXwrFkxTbNL9gV3mlH:kbNR1VDGgo6Y2C20v4CQC46zxYV3m4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412709, "uuid": "6f0abfb5-f0c1-4e7b-acf0-f2202ecb7359", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412709, "uuid": "7bcf4112-a459-4e06-bb03-309677743d79", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412709, "uuid": "9f23c0bd-2341-4b32-aade-4c62381f4819", "value": "d8o7xu71em", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c6bb15-1f21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773436322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436322, "uuid": "ee693ace-5ea8-4d3a-b28d-c82f942c5b82", "comment": "Malware payload", "value": "098a2cccd2269fe96280cb8cdc83bd55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436322, "uuid": "40e3737f-22d0-4657-8510-28002a380fa7", "comment": "Malware payload", "value": "ae9f97ff1fe90836cd1eeccc56e1cc35dd28e1ab5c268845f3774d817ea0579f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436322, "uuid": "da751275-aeaf-46fe-a3bf-45c11d3a3e41", "comment": "Malware payload", "value": "4b84d46260fab8a809ed2179b0b6189d517be2fb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436322, "uuid": "e8b453ae-faf2-415f-85e5-589b5aa51b29", "comment": "Malware payload", "value": "bba9f6f74f2b5e0a8b21a8b75f40f4d290e247b27fc82ac0664d351b797f215f69955320a64e7285f4a73b45753d3df5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436322, "uuid": "d03372dd-70f9-4ac4-9e8b-81ca1298468b", "value": "T199D427D611CCE0D3EB3C069D63D57F6FB04D23801A62705B3F83AA5D2D965B2AFA015A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436322, "uuid": "2861f260-bd8a-49f4-ab5d-e6e30e8a2e08", "value": "12288:BM7erHKW2C/ywnG1ksD06L+HXpi2/dgcXHrenpJJrjz:S7erT2+5nG1ksQ6LKXpilure5Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773436322, "uuid": "49100a26-0a0d-46ee-ade8-d37d85c628fd", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773436322, "uuid": "e055b204-3447-4296-be6a-5edfe618959e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436322, "uuid": "880f2bdf-b826-461d-ac30-ffeafe198add", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de686af-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773412710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412710, "uuid": "d7455222-a15b-4911-bb0e-d80e6e26e015", "comment": "Malware payload", "value": "31ea930cccf51cf174ac20f27d44100c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412710, "uuid": "09953630-0256-40c2-9bd2-c04614a66496", "comment": "Malware payload", "value": "aeb482dfc7762c5a5a8355929698ff702686c70d436f972cf0d5e8f36fdb353a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412710, "uuid": "84bed3d5-922c-45a7-8b61-5cfbd0959883", "comment": "Malware payload", "value": "afadf030ac56ea66b153b38c753d611a5446d415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412710, "uuid": "e55afc4d-56cb-4524-959e-3b8d56966e18", "comment": "Malware payload", "value": "0917ad1b52b3d49b76eedb050668220822b95fb0874965376ac3007c79bd8ea917ba5f4f8cc50a05e191bd27f9f69f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412710, "uuid": "65ef1dab-2cc2-4844-a20b-df498fe9e40c", "value": "T10F04F151EB182427D5821EF44A7F0776833D6C621CB9D0289609BF960AB3EBA57CB7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412710, "uuid": "81cbad4a-1b8a-4601-935f-c7eb81b2d3d6", "value": "3072:ozdurayQy5HEcMf3oRuZIbOSOFFe5/Zdp0bZwX74/ZPyXF/aQs4yVJ:ozdurafekcMwRe7hFU1H2bZwH84yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412710, "uuid": "208d338a-2d82-4113-9a56-9cca9c1247da", "value": 186176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412710, "uuid": "a07b566e-2a30-484b-b11c-c81f547eaaa8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412710, "uuid": "03e2fb34-79da-4fd6-acf3-fec40a0de08e", "value": "nfrqbh0ttz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f41d430-1ea8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773384500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384500, "uuid": "72b64aba-85d9-476b-bbc9-1210912eddb2", "comment": "Malware payload", "value": "d5dd55f024b865e689c556224c4f0107", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384500, "uuid": "9ec6573c-cb6a-40f0-a72f-c03dea75cf1c", "comment": "Malware payload", "value": "aff025d7e83737ddf72629e9cff7f320f89754b84cbccedea4458384171479a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384500, "uuid": "14a28b5a-cff7-4a76-987f-73f34e648eab", "comment": "Malware payload", "value": "ff49bd78516430ba628ac62d6a7e4a00c5003c6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773384500, "uuid": "613ba518-1e1b-49a5-82ec-ea8a5524ca9b", "comment": "Malware payload", "value": "74e890c6582955c7f71acb86b698c9dcd11bb80a0d4a460518b67b7002cad672ea0e49e03e019c166bb3c27baa5725e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773384500, "uuid": "8450d393-47e2-49b9-8070-ea14c2daa5fe", "value": "T187F433C37B8517B8C5ACA0A95F5CE86569ECA03C4FB25C48CE9144CB7A21F75CC8A1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773384500, "uuid": "0a52dc00-5229-4178-96a1-2f3b1be85c84", "value": "12288:j+ajEJnjwVvPZ9YqLbWq6258q1ilZT8pTUUa6qgOJuWByGFgwGt7u8nIFZYclnb:yaOwVvvYm3CwpbTqfb2tEZYclb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773384500, "uuid": "b6c08e3b-03bd-495f-940a-96c7f15c2159", "value": 786172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773384500, "uuid": "a7f9d6ff-7b1e-4934-bf9c-40a73f5e96a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773384500, "uuid": "f28a128a-7747-47e1-9037-40aebbf35dd3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befb6d5e-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773427502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427502, "uuid": "eafb604a-0a15-4ed5-93c5-4511643b8187", "comment": "Malware payload (Gh0stRAT)", "value": "0113f8d769333e9cf69871ee2cb339f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427502, "uuid": "61648cc6-ac0b-415b-a1c4-5bd128be8a15", "comment": "Malware payload (Gh0stRAT)", "value": "b07741be8853bf69e3da74a3bb66bc3242473ec399ac96e524f971467bea9284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427502, "uuid": "668b1e9d-7516-4c14-8110-f30c18415b02", "comment": "Malware payload (Gh0stRAT)", "value": "3b4bcfe906eeb7207f71a2b3d63e9d192cd223f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427502, "uuid": "9665f086-873b-4a85-a50a-d063e663dc9d", "comment": "Malware payload (Gh0stRAT)", "value": "ba6e66b3fcf60a26db32e414dc8750280255e8dee6e7a59c7a42b87afb402417dee4e2cd6e06359af2fa0bdb24b02eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427502, "uuid": "c8375591-f8c6-488c-aa7f-8b6cca442a04", "value": "T1D4771221369EC43BE16A05B1552CAEAB913C6E360FB054C7B3EC7D6A17750C21637E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427502, "uuid": "412c50b3-9b52-4e5d-991a-776d36050876", "value": "6d5e13c0269946a5a10390c178d8e9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427502, "uuid": "4b32c52f-b26f-42f2-bb33-27d348903024", "value": "786432:qJqHlyDSs9JrQAS3zjCEiO+OeveTW+CE08NdCTlukz6QlQOuyFFcLs94B:qJqHlyDSsL0BPpN+Oe5j8aUW/l2yFFcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427502, "uuid": "2b9ba3fa-cde7-45d5-bce0-fe34e92419ec", "value": 35829468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427502, "uuid": "30f6ee02-6cfb-4f28-b7a8-88f7a40a48bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427502, "uuid": "249542ef-e809-4112-bf9d-e6cb455fa1f0", "value": "WpsSetup_office.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e3f6a5-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773427296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427296, "uuid": "9ad3ad47-b02f-414e-aedf-6c6bca25ef90", "comment": "Malware payload", "value": "be0cf3b338808b283383601065efbbd8", "object_relation": "md5", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "obfuscated-loader", "colour": "#2F7439", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427296, "uuid": "36688ce8-32b1-4de5-922f-0bd14d1e5a1f", "comment": "Malware payload", "value": "b0b02c6340af746f8453e8c6e43ed28f039b6ea3eb198432c8bf8e982c279b04", "object_relation": "sha256", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "obfuscated-loader", "colour": "#2F7439", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427296, "uuid": "81540abb-92e5-4a2f-973f-22b0720e0473", "comment": "Malware payload", "value": "8bcd72536b7d83319d464d975a2f771ce6a3ebcc", "object_relation": "sha1", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "obfuscated-loader", "colour": "#2F7439", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427296, "uuid": "f261ea6e-3e94-45df-9d1d-e56ee9ee9fae", "comment": "Malware payload", "value": "874cbdd0ac51243e78589bc774b60ce11286f5b2e08c723d1013c42fdb7f377c6f3bbb017ead97d5091533693b0967d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "obfuscated-loader", "colour": "#2F7439", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427296, "uuid": "96ef3e4a-d07c-4d2d-8061-2c4a1dddf1ca", "value": "T17A46199EFA8417F89644AADC4347768E93A280772EB7214895D1810F7C2EF537A35E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427296, "uuid": "a4977187-312f-4e2c-baa4-9677f4277aca", "value": "12288:iy5DBeUnw5DBeUnnj5DBeUnnx5DBeUnn85DBeUnnv5DBeUnnR5DBeUnngo5DBeUd:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427296, "uuid": "7c5f4374-d605-4068-9cd9-4b873c8a288c", "value": 5528714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427296, "uuid": "78eca3a5-5a81-4a3a-bc5d-2bd9bb25ad12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427296, "uuid": "79de5865-0a12-49bc-a3a1-4a48b9964c6a", "value": "stage1_raw.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2f432c-1e95-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773376389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376389, "uuid": "cfe38e78-c856-426f-9b0b-f058afd1faf1", "comment": "Malware payload (Gh0stRAT)", "value": "8c7e88b3d6b7562b05be92730fe1a328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376389, "uuid": "74aa9206-20b2-493c-8ba4-d28c739da79c", "comment": "Malware payload (Gh0stRAT)", "value": "b0c955322c34a907f94ebe451d696f8b2a87d2638516791387c1e931324a3177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376389, "uuid": "368e14d6-57a5-4341-8676-36829af1fee1", "comment": "Malware payload (Gh0stRAT)", "value": "b06cea9149b74dfb070a50f7efc1d663ff1ef9d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376389, "uuid": "8d30928d-57d1-4b67-bc90-616e7575159c", "comment": "Malware payload (Gh0stRAT)", "value": "20afb53486eccb7e4d1fcfd9fcab7596eb7905ec795b84713b42afd06debc4ebc41965014552b5559f3ebf22a87fc68d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376389, "uuid": "f31f7893-6411-413f-ab07-5385b1cc0c4d", "value": "T132A73337E2DA533EE02F5B3B54F1D2645E3B7260A61E4C46AAE44888CFAD1601D7F706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376389, "uuid": "8c355e1d-b60d-4d94-92db-d31c0ee4355c", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376389, "uuid": "5fb8becc-6b14-4ab7-b8f8-32fa6daec369", "value": "786432:aGOcLIpfJGElGjJgY5bWmPuXWcT4OZLmE5gM3dpenRmCjVMPmjjhVXMrGAZY:LO/GjJgY5bWmGXKOMYdwnRmeNjcjZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773376389, "uuid": "535d6e06-2e01-4fba-ae08-bafe3e73af6f", "value": 44533587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773376389, "uuid": "eca8d56e-aaf6-4c0d-9d06-065b98842bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376389, "uuid": "8de508ea-ecc9-4da1-a483-872c1c466003", "value": "openclawAI 7beAolenc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48aa7733-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773427304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427304, "uuid": "861d8380-a2f2-45d4-8037-5333a2f9de9e", "comment": "Malware payload", "value": "1a2ab538a43fef313f9446f444fddd50", "object_relation": "md5", "Tag": [ { "name": "C2-response", "colour": "#2DDD8B", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427304, "uuid": "80fa711d-4bdd-4d17-870c-94021a62f8d8", "comment": "Malware payload", "value": "b1ca1ce60e4b62fe2770d40aae943c1a3b7d1963ecaf5010e2e88e5ad1aaf822", "object_relation": "sha256", "Tag": [ { "name": "C2-response", "colour": "#2DDD8B", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427304, "uuid": "5b0399f7-a2e6-427c-ae41-1d7ea6dfd1fb", "comment": "Malware payload", "value": "fe3d4db1512f75fa8f9423651beabab78721d6fa", "object_relation": "sha1", "Tag": [ { "name": "C2-response", "colour": "#2DDD8B", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427304, "uuid": "e74d5923-788d-4fd6-b8b4-89edd663a1a2", "comment": "Malware payload", "value": "78a0f525c8ae26597eeb60b03c696a5d2b9c1a1f36e29f0b3948239a817f88d019262a1ab79b286cc7090194463f34d0", "object_relation": "sha3-384", "Tag": [ { "name": "C2-response", "colour": "#2DDD8B", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427304, "uuid": "1eaa891f-bc05-4181-90dc-541f4330e7dc", "value": "T17F46068AF64007F89544ABCD4347769E63A685BB2EBB210899D2C50FBC2EF137570D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427304, "uuid": "ca1b7d7f-b4f4-4fd3-a8de-ddb4fc023b88", "value": "12288:B4slbmnMQZK7j7s7/7/7x7e7g7q7N777N7L7k7T7f707hn7h77hJ7hc7ht7hULDx:UwnuTTxUCQd/dPGXzWh7h/hpheh9hmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427304, "uuid": "91d61762-1241-4d69-ad5c-bfc8c9dc8a77", "value": 5510964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427304, "uuid": "41079ffe-4e87-45d8-8105-3b2d9c3996ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427304, "uuid": "00ffe6ee-e82c-478d-b7bf-8b81f1e04008", "value": "stage3_raw.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01940371-1ec9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773398408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398408, "uuid": "14a77c42-8cfe-42d4-b3f1-d8caa1e8bc52", "comment": "Malware payload", "value": "b0a31c23a00fa446dc00995b4424062b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398408, "uuid": "43634399-5b76-482b-b1d0-2ea664331160", "comment": "Malware payload", "value": "b33be75f5e836e40f39fe19968c31c0a8102f0644a6d90c2a15467a83752737e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398408, "uuid": "6b49652b-3fa8-486d-b66a-a1fba58e8fdf", "comment": "Malware payload", "value": "41f5f3cc2ad8d8138b0c5ffb3b975c2b93d54196", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398408, "uuid": "bdfbfe41-e3ed-488d-946b-943a7dff1cf8", "comment": "Malware payload", "value": "bf6e80ff6f143f8746b47077c84f16b4e2803910e71b5218840ca0dbc5856419c1c4a625ab1dcad7ec029123582ae57b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398408, "uuid": "37cad18d-deb6-44b7-9341-83df7fa7f998", "value": "T1AFD07208F389BBAE0D404283C101C484B2A410051209B8C223CDC8CC096EAC8B0004EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398408, "uuid": "6650f4f0-407e-4b08-922b-07cae1055e38", "value": "6:EnRwmouq+nxRmzp3YabIpHKAnyg+mgQ49XZoAPoA3V:EOmouDnXim7pHbny7q49XZ3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398408, "uuid": "56f79fad-aaa3-48f8-8092-122485f94e5c", "value": 283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398408, "uuid": "3c9116dc-5abb-44e1-8e7a-8fc254bc023a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398408, "uuid": "8cdfcc32-2dc4-4a41-af55-b694883eebfa", "value": "LH5Gz7Vx.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160f3adc-1f35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773444828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444828, "uuid": "10db2ad5-049b-452d-8ad4-4031b78de073", "comment": "Malware payload", "value": "9f78f1fa6a450daced003e488f96866f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444828, "uuid": "0e88e227-3ee5-46ce-a0d2-86f4d01ac262", "comment": "Malware payload", "value": "b5565d3cf61743d6b73098ae9fe44ec5d8629f7d9e3511dd387bf4c1eccf7600", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444828, "uuid": "d0fd526e-a4c6-430d-b2e8-af39f04fb277", "comment": "Malware payload", "value": "290f17a235ccd4ddb0a4835a4d4bf4ae358193e5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773444828, "uuid": "2e66fe40-d48b-4bca-b59c-a05219a66580", "comment": "Malware payload", "value": "66bfd16b649ceb66320300393f27a07960579e92892c55fd25eb07d8ab3bbe9329fee4877418d8c070021045c2033ccf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444828, "uuid": "aadfdaa7-cf80-4c59-b8cd-87d103641c3b", "value": "T1BB6733ABC4B51B1BE4F15139CF64AA59828DBC395A57DA3B70A4B36023F37E0B076407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444828, "uuid": "8ab317a8-71eb-4127-922b-4eb374ad52e5", "value": "393216:hghEzzSn96Pd+eo1YqIDBOSv/Jby7VPKcJBbktqER8hh3IKfuYfBUGL00qPVQKWN:hghCewDouqoRu5Rxktch2eBbYNQKZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773444828, "uuid": "d1b38354-bccf-4759-b15a-552827fe7e05", "value": 29773824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773444828, "uuid": "f00b81db-9d90-42a3-97b1-57a03dd25af1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773444828, "uuid": "05f7d274-90c6-4095-849f-e90c01b9173c", "value": "Silent V4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff08611-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773433651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433651, "uuid": "f5c881f6-0177-4215-b009-912ea127d453", "comment": "Malware payload (Mirai)", "value": "44d85363d57f5773612579a2164c4504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433651, "uuid": "024118b5-04f3-495a-9aae-1acd7bb3deaf", "comment": "Malware payload (Mirai)", "value": "b5825512f2a5be278a08969b7ef569cd24b60687b34c090a640eab1653b095aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433651, "uuid": "4b49deff-8833-42f8-bd34-c065ad6372e5", "comment": "Malware payload (Mirai)", "value": "39eecfc5bb71bb1608ab114adf74c27aaab6447c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433651, "uuid": "9180be22-91e2-4590-95f8-d4e3dc49fe3f", "comment": "Malware payload (Mirai)", "value": "4de30547265a5ac53535142e343405899492c291e2512064da26ee9fa6a54a62ed0ae6843fb1606d6fd7dc9da0f018d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433651, "uuid": "49fc8120-284f-4b11-815c-7898f23ad2fe", "value": "T1BEB3B509AF651FF7EC6FDC374AE91706248CA51A22A83B797934D418F24B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433651, "uuid": "370fb104-cb8f-4558-92db-c2fe20dfebbe", "value": "1536:r8LcdGkR2s+E9do2xe8qzmETjUufyN2fRjJOy8SpjqO9Ckw7ypLjOM:eS/R2s7Or8qiIRjJ1jip7yYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433651, "uuid": "d6f1cb32-c568-4b3d-b441-bda009d3d4b2", "value": 117664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433651, "uuid": "f0eef511-c601-455c-92fe-652850ca40d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433651, "uuid": "375b117f-5415-4e43-ab4c-e42a761397e5", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89188146-1ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773416675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416675, "uuid": "1c887c71-1ecd-4a0e-b0e9-3dd1f917d1e4", "comment": "Malware payload", "value": "0dc18efe6c481fcce5c287c18c84da57", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416675, "uuid": "92a93db9-f415-4e53-ab27-54564340d8d1", "comment": "Malware payload", "value": "b583e88fa3fd971a809fb4ecca121cc24f3324b325b231b0c57f1bfa10b24a77", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416675, "uuid": "2ecebe29-4c66-4dfe-bcb7-6089cd70bd2b", "comment": "Malware payload", "value": "e0536e0f06286184bdca3af8bc278473c7c78a50", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416675, "uuid": "f16d8086-6153-485f-9d90-a88b817d2bd4", "comment": "Malware payload", "value": "5b85cd637518f900defedb4ff13fabc0588f5b8ee1533e4bfd89370e45dd14e76b054334d90c3f59c6464b4c45db1a01", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416675, "uuid": "1a4f0f75-9671-4874-a820-5eda5b51fad7", "value": "T19EB3310A20FF44D60F732895A1175283CEF5871D2984C2B9362EBF616F0D6A5C6ED7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416675, "uuid": "7c02c7c9-1316-4c8e-aab3-44687f726227", "value": "1536:p9ewI38w0UOX+nquc+neTMfQacOzMrNlr+NsbIgsrQ:p9C38gOXSqucSeTM+rNlr+NsbIgsrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773416675, "uuid": "5e1f6283-62fb-46a3-b4b4-a475365a7aa8", "value": 117409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773416675, "uuid": "25aaf5f9-548f-44c7-891f-ae17e32cb524", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416675, "uuid": "b93fcc2e-d1a3-4a1c-b4be-bae2cb690ce1", "value": "Testing_Dataset_Archive_4538.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f3417-1ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773399795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773399795, "uuid": "dafe41dc-f006-45bb-87c3-feff0362a7c7", "comment": "Malware payload", "value": "ae0ba63ba8290f6d48c31cd1d38c0786", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773399795, "uuid": "a5d6d339-7982-4189-a5cf-d7b4e8f7db3a", "comment": "Malware payload", "value": "b6b7c10d2f3fd9edc51862b4ff5beb326a41a8df010bff37dc7809b523c9321b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773399795, "uuid": "1262f6be-db49-4d33-8fde-df341826787e", "comment": "Malware payload", "value": "b07521c9efea72151bb68b807f722058cd9a6adf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773399795, "uuid": "5fdaef5a-55b5-48f5-8337-45ac07bc6f15", "comment": "Malware payload", "value": "6ec997e4f7f1c3a2c95e06292b114d285a74480b527a1cd4df09cfa97dd7669d7dd57f46a2b362b5f3e18bc4157b4b25", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773399795, "uuid": "7f1d1498-23ed-4edd-914b-685f1bbff207", "value": "T106756B43BCC020B9E5A9D23289B211A17B71F85A0B3177C72E55A7B92FB63D41F39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773399795, "uuid": "c0c97019-f63a-4ce8-8df3-9bb63e056996", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773399795, "uuid": "95c212a0-fc33-47f0-8724-f945727d9765", "value": "24576:sPrkuq7yHj7uUcZCZjxZbKvLk+OcsYgtarDNK1E:sDkuqOH92vRMYgt2NK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773399795, "uuid": "47fb505a-6231-4912-ab48-03c9643262c1", "value": 1640448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773399795, "uuid": "aa86a5bf-e9b1-4511-b943-4a3342307e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773399795, "uuid": "3641501e-2c33-40d0-8da2-d977adbf29d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1e9e33-1eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390772, "uuid": "f65521ed-97e3-4fec-be59-dfcabd043c16", "comment": "Malware payload", "value": "700e1158c214798e129d3a9f7494f497", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390772, "uuid": "21770039-3ea7-4278-9f10-f17d063f6e6d", "comment": "Malware payload", "value": "b8f713be3f9cce6d03fb60a233c4e08181015a5a8c8486b83683589d70d4c213", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390772, "uuid": "01a14f77-2343-4992-9474-44f0c94fca6c", "comment": "Malware payload", "value": "5ec0748aa8de74ed8a82170e5b970d2b4ac1cd04", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390772, "uuid": "9f7bf029-29c1-4e3e-aed5-1cf470de8226", "comment": "Malware payload", "value": "232fa66093b65d27affb4b63a5b7e418d39b1053655a69313a5da6be0d5621da55438981eeb4841323fd3545dbe52459", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390772, "uuid": "6ef55b14-966a-4be4-8b4e-3e404e8a753d", "value": "T167740174E71EA87BFC2464B5722868678C896EF77951C959A0DB301F2363F306E70D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390772, "uuid": "b21ad560-31a4-48de-87b5-aa815d6349a8", "value": "6144:KSyIkzR5er3TtrEXsikzWEXx3HraXI2S+pe2skbOEDSkBymwIfnl2z:c5kOsik1hAU+zaEDxymwIfl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390772, "uuid": "9859cc2a-5ad1-4447-aadf-fcac183b402e", "value": 343557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390772, "uuid": "873e9663-b74c-4690-a614-220e6b47e99d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390772, "uuid": "8bc53758-b616-43c3-a6bd-d203dfd6e660", "value": "GAPI_Update.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6092c973-1ebd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773393414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393414, "uuid": "e8556b02-302a-4351-934e-749a54bfd109", "comment": "Malware payload", "value": "170202a7884209ae815bf17e46c3c1ff", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393414, "uuid": "11a20e99-2b6c-4516-b0a8-7087b5106f18", "comment": "Malware payload", "value": "b8fb3957d39cf0fc092bf066683d6bac33343e99b5ac9f198f5378e4e6056a7c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393414, "uuid": "18dd8e80-5847-49ce-94f5-eb32f7a88bea", "comment": "Malware payload", "value": "e3d7d3b0d0d88a1b4b364f70a74de640fb8da725", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773393414, "uuid": "bcace1b0-0c20-42bb-b01f-8bdfe3dd4aeb", "comment": "Malware payload", "value": "8e0e813a0ff0df5b1367c4caf4de77479cddeee3c0c1ac5652c813fec7285070c94e54f7abd4feb7c467f0214e399d89", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773393414, "uuid": "954304d5-a7e2-486b-a6da-c648a6e2ee02", "value": "T1EBC3F09A098D84D8C74FA034076F2E07C9DE6623495ED5E079DFAF843F12DA470ADAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773393414, "uuid": "3bd78275-ceb4-4587-ba10-2f8186300af6", "value": "1536:sn1BGFczg1qRfZmeX73NpyzDjba2ZSkcQJCjKmPzsmw3F:ufZmeX73NpeZSkcQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773393414, "uuid": "0f9e4aab-ec01-4cb1-ad63-4f8fb2f74aa8", "value": 118615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773393414, "uuid": "a0373130-bb47-40b0-a8fd-4f796d496970", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773393414, "uuid": "d2893b30-1c45-4450-bee7-9d63037ef7c3", "value": "Beta_Logs_Sydney_8884.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f62ff7-1f35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773445155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445155, "uuid": "12c49def-5ca8-42d5-9fb8-d06378a3aec1", "comment": "Malware payload", "value": "f31e21bda7b188691b4175f042b819e3", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "encrypted-payload", "colour": "#724DC4", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "steganography", "colour": "#CC90A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445155, "uuid": "d1125dbb-108d-4fef-aa2b-09f7793fc4e2", "comment": "Malware payload", "value": "b9991feabb87534bed7298bffa6ded0de511a3d6980af40123a891174cbfd92c", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "encrypted-payload", "colour": "#724DC4", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "steganography", "colour": "#CC90A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445155, "uuid": "994a75e2-8ea4-4481-a70d-066f52a66612", "comment": "Malware payload", "value": "388583faba5e56d0c6d7e49726a724cbc387cc3c", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "encrypted-payload", "colour": "#724DC4", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "steganography", "colour": "#CC90A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773445155, "uuid": "323c4fbe-2876-42a2-aef6-0f571fbbb2b9", "comment": "Malware payload", "value": "e24bc42588470628cf421bbb3544bc0d8ab86a1620921a7a23ba65c27b3fd5e80868bab04894d0501d9824b401adc7ac", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "encrypted-payload", "colour": "#724DC4", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "steganography", "colour": "#CC90A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445155, "uuid": "300e51f7-a892-40d0-a610-c69921683a7f", "value": "T1C3F5334428C3A934F09276342906A9BD4B4DDEE63D18CEA4B7D8D4F7162A71CEE1C72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445155, "uuid": "cdc3478d-3750-497e-aa66-dd2494e5a145", "value": "98304:/08LXUCClhu3ToLFJCxDpR9t1EpS4mj6oef:/pN0IToLFo1tTEpuZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773445155, "uuid": "80e787b0-6f95-49c0-83f9-fd8e689bea95", "value": 3411962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773445155, "uuid": "db7e4514-9d13-4f92-ab13-47e7390f910c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773445155, "uuid": "0fbd3a41-39a2-4ad8-b70a-00b40adf2d7a", "value": "qwGVwVf1rAsf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e882610-1f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773426079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426079, "uuid": "883c52e6-04e9-42e0-abb3-0526d91f2583", "comment": "Malware payload", "value": "bacd436b177a7976a1276ceaafce39ea", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426079, "uuid": "51c655f1-b6dd-4887-a40d-67f2bbee9e9f", "comment": "Malware payload", "value": "bba07e615664530a55d45151d2ddb194d85d165eff17f723b2ca7fd0ae350c9d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426079, "uuid": "7180993c-0124-49d8-924b-e1098bcfd61f", "comment": "Malware payload", "value": "433f7ee53be8ecc96b5c489229c6400c10f35b81", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773426079, "uuid": "75e19288-8983-4cfa-b32f-1cf7d7eaa811", "comment": "Malware payload", "value": "4e099c69c1c2277c03a49ea2f5e9e08186c936896fb4c6e338aa39ae93751b9597b2cb91af859027fda7d362160e920f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426079, "uuid": "a20400c2-31e9-4082-8a03-aeca836affa6", "value": "T127B79332CD450D678AF262BC69658AE3FA60AF2F1380591BBDFCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426079, "uuid": "758745a8-2136-441d-9fa1-1c71e541a2e2", "value": "98304:sqj4AXxFZBb7kmBRrCar65p7C0NeU9Yaor1iDz0D9tv1abj40qdv8m9:sX+BCf3WUf0DDvgb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773426079, "uuid": "c52e045e-afa5-4ae1-a5f2-5acdba89e2cf", "value": 50323456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773426079, "uuid": "0deda4e8-e845-4f82-bfd7-da7d433fa513", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773426079, "uuid": "429a16c4-9b4d-4b45-9d50-c5092471f84a", "value": "Lunela_Launcher_23.51.4600_x64_en-US.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8587883c-1e85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773369424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369424, "uuid": "9a4bc7c7-7c50-4ba5-a8ec-cc47a08b26c5", "comment": "Malware payload", "value": "2285dc7be15bce8c942be083c06266bb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369424, "uuid": "201bbf08-9d30-48fa-936e-ff97bd4bcbd9", "comment": "Malware payload", "value": "bba7b05c4f559109356ed5f7e2b90a9adff97bb161fd437513d101114a3952d0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369424, "uuid": "ae847d3e-1bdc-48fe-a28e-7465a5b916b1", "comment": "Malware payload", "value": "9069a2b63511a808fb06e6214a0f068c95e6f402", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773369424, "uuid": "d7e8daf7-7b59-4cf1-a99c-bd4cd38a2dab", "comment": "Malware payload", "value": "04f486110d35fa1f51d1b0cfd94bbc0234dfe4d38156d342901e57b5df9e64a15018d8b41688319921b94eeadecce62c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369424, "uuid": "54878f08-0cb8-470b-80d8-bc9b67375a4c", "value": "T104C3E08B0A8BC8ECC71FA054491E9D06CA4F851B166DC9E07EDFFE597F26CA470A56C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369424, "uuid": "48681dc2-d7cf-4cd8-afb9-f62fec9c4cd9", "value": "1536:lRhqnIA35NGVLzaFXwENQM7ETs/Zh3dwZZQ6g:gFKLFARwZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773369424, "uuid": "d889d968-8df0-41bc-be08-7801445193fd", "value": 119945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773369424, "uuid": "673ef967-ef2f-4a8b-896f-24414bcf4800", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773369424, "uuid": "a68407d4-df65-40b6-9172-6bc2fd410b5d", "value": "Design_Notes_Archive_7999.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac04c0e1-1f11-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773429618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429618, "uuid": "28d1cd27-647d-4062-afae-c9bd9ff5e3e4", "comment": "Malware payload (ValleyRAT)", "value": "83d510e6a734444fb719bfe8df6a8f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429618, "uuid": "ecb8fe75-b75c-47a8-9a4c-c2dee659dbda", "comment": "Malware payload (ValleyRAT)", "value": "bed7b3ab1567dbeaf67f7ef84fdfa422185ebe23e39ea1eebcaf10e6c946f69d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429618, "uuid": "f8c6fa52-6223-4df1-b033-ccbfc562b017", "comment": "Malware payload (ValleyRAT)", "value": "091840abc42d2950aff3e3f56b2612e1423399cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429618, "uuid": "815d0767-843a-4d12-be44-2a7cdc91663b", "comment": "Malware payload (ValleyRAT)", "value": "f28d038a49bc8bad7426e8fa029a20b319825f26946fb148810e988cc88be1256d448e95c89840f1ba5f07ddc82e4b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429618, "uuid": "c392d520-b2e8-424e-9e24-f264daa3aafa", "value": "T119347A4C76A724E4F063C63044D23507E626B6503621BF5F227C4E3E8FA3E995CAEB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429618, "uuid": "8c66ab0f-5a05-42e8-a2f1-1cc935b38582", "value": "1acd380f12f0b1481623b8551da2562c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429618, "uuid": "1edf66e8-09dc-4bd6-82af-42e157de5c78", "value": "6144:3BlU7z8pfbyLhnQJ6J8y+Xo6aCQqgdKv2ojss:xlU0RUhqc+Xo/qOKcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773429618, "uuid": "bd5b3eb7-316c-42fa-9986-be3b84c04136", "value": 252424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773429618, "uuid": "793073b3-0934-4732-9aa1-788bf9c3a557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429618, "uuid": "acbc6acb-e68e-4c7e-ad1c-70eebf91ce81", "value": "bed7b3ab1567dbeaf67f7ef84fdfa422185ebe23e39ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfd4948-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773433967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433967, "uuid": "632e584e-46d4-49fe-a3ca-7e563d5ff894", "comment": "Malware payload (Mirai)", "value": "44c4105743f610311ee09ca103f6e837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433967, "uuid": "992cc6c8-cf50-4559-aaf6-615174e071e9", "comment": "Malware payload (Mirai)", "value": "bf423f04d604c9d3e487a3ee785c7d9f437df66c2af74876b6cd4f94a5c069a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433967, "uuid": "2f7291b1-c6d7-4c37-9d6a-a709b581883a", "comment": "Malware payload (Mirai)", "value": "1896a8008cd01e0880ed09e7815c4892668116ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433967, "uuid": "24611e37-7714-4655-9f6f-d99216de18b1", "comment": "Malware payload (Mirai)", "value": "8b1e2ddd4fd511b666038d3696465657fa52f89793759a8ab4caca0d854799d659dc686f7c7c5bc28fed7f4e108a10c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433967, "uuid": "a9a6af51-95d4-4315-8532-cb67f2144c41", "value": "T1D0935BD9F400DD7CF84EDB7B4463490AB631A3504A930B3A6767BD93AC320A95D27F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433967, "uuid": "7c84754e-90f5-42ba-84b0-5ffd7cb6d171", "value": "1536:NfDTwJXJCW9FifSkeKt+6XYQ/EpjzrBAEt/Ks73MSC8HsJy4XejT+p8MDWRwDDLJ:9Y9FifAKs8YQ/0zrB3hKs73MS0y4XeXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433967, "uuid": "3c52dd1c-cdac-4b42-86e1-79890f7da613", "value": 92904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433967, "uuid": "0027d945-9392-439e-8995-7ce6f029468e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433967, "uuid": "5d371223-ba5f-4299-9b30-82c1afaefe48", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43f9014-1eb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390118, "uuid": "f111cf91-b7d0-4a98-9196-978ae3fe1a3c", "comment": "Malware payload", "value": "16a6c28a72ea93faaecc75bc6a62669f", "object_relation": "md5", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390118, "uuid": "5fe0d3d4-15fa-4d8e-bc2c-966afe69defb", "comment": "Malware payload", "value": "c2af3e786d95b4a35273afe64c9de291a526203d8aca4c70171e8c4c834e9928", "object_relation": "sha256", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390118, "uuid": "bc7c9a03-130a-41b6-b7ed-a3acef0429aa", "comment": "Malware payload", "value": "1bc142496d0b91ed8882eff73e70f7d3bbe006d6", "object_relation": "sha1", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390118, "uuid": "93def0d7-84a6-4e8a-86d5-b47239e8fe01", "comment": "Malware payload", "value": "34c963839a4a243dbe84173bdc9694222a84deca9732c1a7327b326d518b243001377cc2a5caf27e9abb3adb4fd17bad", "object_relation": "sha3-384", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390118, "uuid": "25b5849b-a63b-406d-9df4-e5124c356a84", "value": "T118F0C0391A4EA6E31350059094368C83F5DB91571299D58A76ADC880950A6CCDBC6BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390118, "uuid": "8e000efd-a4a1-4e51-9628-f7f7b0debdce", "value": "12:woxReWeWzHSnZcCCs807hktaQZshp2ViHKNKVCRogch:wox4WeWz03jsipxy8CBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390118, "uuid": "a6a8a5f3-a22b-48c5-a4d5-5780ca2fbff2", "value": 515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390118, "uuid": "fb6daf4f-aa8c-4c86-a9f3-6e63ab73b181", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390118, "uuid": "82adb973-3796-4c86-a33b-ece155260edb", "value": "c2af3e786d95b4a35273afe64c9de291a526203d8aca4c70171e8c4c834e9928.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987a329d-1e8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773371603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371603, "uuid": "89b08092-4853-4057-8784-f5cf9c1792d3", "comment": "Malware payload (Mirai)", "value": "b808080731b1f98e4c1e67695c7182ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371603, "uuid": "70e0a841-d92d-40c9-8b54-d3e08a29fa41", "comment": "Malware payload (Mirai)", "value": "c2b1be8dd2eddbf70d86c5072f69a19b8347ad29d6f26f8811e3b9627391af01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371603, "uuid": "baca27d3-e5f7-4bd9-8cd4-fb32b8201250", "comment": "Malware payload (Mirai)", "value": "32d5dfa45e328502b814661bbecccd916bb35742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371603, "uuid": "43e9a739-7d4c-46e0-a748-f5a8152e2e53", "comment": "Malware payload (Mirai)", "value": "d123d245e994a3eb4f892e3aa50e74a07f874fef251280840ba7d8c5910224feb5c26cf1f0027c78f16486a9c18f7d2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773371603, "uuid": "c035edbc-8ca9-49c5-9fcb-a45f73f332c8", "value": "T125936C02B30D0A47E65B1FF03D3F67C9839ED6D051E4A589361F9B899271B321887EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773371603, "uuid": "93b1180f-4347-48c1-a28e-f95f2a81d26c", "value": "1536:dn3xpZbxSUsIBppBaUV9UXlRjtGmVRy/AVwNIRH357g+q6f4BWe7lK:dd9WIBppBFUXlhoyR3VwNU3NgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773371603, "uuid": "7a8ff177-8067-4784-858b-5747fa852da1", "value": 93924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773371603, "uuid": "35052cfe-3ced-434a-a2e0-cff53b499b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773371603, "uuid": "56559272-e0bc-46c5-86bf-64ae7c489e7d", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb36a5a-1ef7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773418457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418457, "uuid": "ecfc03f7-fc69-43ef-8af7-2b880375ece9", "comment": "Malware payload", "value": "7fb6b38efe17658dee7447619447fa13", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418457, "uuid": "438a3f7d-76a3-47d7-b5de-8c0ebf4dd4af", "comment": "Malware payload", "value": "c33e33de47c0ee8633fa386aee1f0994c871b4eb3c46596d0d75403533167682", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418457, "uuid": "b2e06b13-eba6-4739-bd3a-b07a138edf6b", "comment": "Malware payload", "value": "8357c0dbd0f559c95c5827fea8208ae7bbb35848", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773418457, "uuid": "5f64ecf1-8f1d-4fad-af77-797d80f3d8ef", "comment": "Malware payload", "value": "87a31a76375cdd2090c64a43448735e480afb138a2fc6cd5f78b50d8f87bd83d22ed3aa1ca9d9e3c5577375a15262813", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418457, "uuid": "b89110c9-093f-45f7-8d89-b63fd96a4311", "value": "T14C011090EE21CF6801B8021984F7D03AC28C30431B5FEC1CFA9CE02E527AF38265324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418457, "uuid": "b423a607-e0ba-4c97-9203-fab17de9e8d2", "value": "12:CYh1YLSJGnCU27FCV+EVThmOJJ53oypFbBaemdpOvsGROnsGROZkGSkT:ZLqSJG1249EYZ5aemdpetAt7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773418457, "uuid": "fa177d8c-ba3e-41c3-989c-13dbe6754003", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773418457, "uuid": "afe8d6a5-c8fb-40ba-a682-74f673992b9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773418457, "uuid": "b760b944-482a-4679-83aa-19c3cbc57b2b", "value": "STARTVIRUS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64c721e-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773411999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411999, "uuid": "71d699d3-a818-4658-920a-d81ee15166d7", "comment": "Malware payload (XWorm)", "value": "8890da2ee342fb4072bd102cd1f68c77", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411999, "uuid": "bfe5bf34-46b1-42d7-a5b4-8309b3debe1f", "comment": "Malware payload (XWorm)", "value": "c4af30b81abebcf7b3179412b8350171ad240f63bad8e00e7628ec9defd2472e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411999, "uuid": "5049013b-3be4-44e2-8e74-af74e9fc57f5", "comment": "Malware payload (XWorm)", "value": "62a2a22046a90d04cc02c30c2b6cdca3a82bd28e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411999, "uuid": "0a7c1b86-5455-4e11-bfe4-7e30f2d1347f", "comment": "Malware payload (XWorm)", "value": "71b8d685586aec08d2ab86cf9a84cea07960dbeede2681e8e26a886290da03ac05971b15b4fb66e9565ff31710bd7e2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411999, "uuid": "5b3a899a-8248-4b43-b30f-d06c4ae86f8c", "value": "T13D450220D4D85ADECD94F980FB7129355D3BC66D2036240DB3A4F8CEE957E6C0B9606E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411999, "uuid": "37a597f0-296f-4736-b6a3-81f4ee15f7dc", "value": "192:TYVD4tjVopql3jCqQAeS/Ep5bZzAyPP1exr6RY/bZjR0i74/PmKzxt8c99gkg6RZ:TY6vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773411999, "uuid": "50604fb4-1783-4379-aaae-066b798e6cac", "value": 1259099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773411999, "uuid": "af929fec-8b22-486a-b558-c41a716cad34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411999, "uuid": "99e43492-b977-48c7-be7f-dcd54886e712", "value": "comprovativo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c1e990-1f14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773430735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773430735, "uuid": "5420ee41-0e32-4c86-8eca-41ed18f5411c", "comment": "Malware payload", "value": "e2a58695dead850d9723a358ffa14bf0", "object_relation": "md5", "Tag": [ { "name": "discord-rat", "colour": "#5C1590", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773430735, "uuid": "c5c99095-b090-4c30-9a2a-7aa2a0e30359", "comment": "Malware payload", "value": "c546eba8f32aecb8bb074ea618bdcb7f5c6f89f89d1c8a14ba39f3176733bff7", "object_relation": "sha256", "Tag": [ { "name": "discord-rat", "colour": "#5C1590", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773430735, "uuid": "4822a2bd-f2c7-4ff5-94ff-5488db9da0b1", "comment": "Malware payload", "value": "a3565940be8f74be36471c3fc435400bd05b8ec3", "object_relation": "sha1", "Tag": [ { "name": "discord-rat", "colour": "#5C1590", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773430735, "uuid": "03f9aea4-2da8-414d-9fe5-70bf7e82f787", "comment": "Malware payload", "value": "04791238cb25eecbf107bbf86e0be5631585c45b23da974f2fca97b2fc2a876eca5848a2305850e0676715747da14577", "object_relation": "sha3-384", "Tag": [ { "name": "discord-rat", "colour": "#5C1590", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773430735, "uuid": "5ededb3b-7899-4b3f-863a-711cf917a7f9", "value": "T11B749D54B3A405F9F9B3923DC953C506E672B8220764C6CF03A4966A2F337E16D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773430735, "uuid": "b7435208-9174-44c0-8004-9a0e99111df8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773430735, "uuid": "8ea797ad-c4bb-4c9a-b9c6-cd9064619eb1", "value": "6144:Bu4GuvwnNBT+tWQbx8mkOcDWfkNGWLJa+13Zm5V0V3JXtiv:Bf3wnrT+tW4rkDWfU3VNU5WVZdiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773430735, "uuid": "2db2288e-0b66-46f1-95e9-eb19e0dfa3d0", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773430735, "uuid": "f1e20238-4b1c-403e-9cbb-bce4f1bf318c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773430735, "uuid": "f1ce92e7-707d-458c-a10d-c4a960c582f1", "value": "svchost_REAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cddc70-1f21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773436621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436621, "uuid": "01d6b1bb-9d68-489b-b667-0b7bc743a114", "comment": "Malware payload (Mirai)", "value": "467155a9319a53cf9e0df2ec038e154d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436621, "uuid": "0c3beb33-fcd1-4b0b-985e-c030d3675167", "comment": "Malware payload (Mirai)", "value": "c5c3709784f13a6ee6de0e69099f3bb53ce4d40ac5578e769da8adc76328ef8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436621, "uuid": "d3ea1ff2-659f-47db-8fb8-9b5ca82d96cc", "comment": "Malware payload (Mirai)", "value": "8c9617d30560866c8397f6eba082311fdac60c02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436621, "uuid": "f4541b6c-5065-4857-bf82-2ffaf43dbc53", "comment": "Malware payload (Mirai)", "value": "ddabf499a5b0cf94bb2cedf02dd9ae4ff93d47abc13c204d836cabbf2b7081bbcaf6f0ffacb69ca20b20f1efbd1250bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436621, "uuid": "8dacb18b-c45d-40f5-a27a-73b986b9ce10", "value": "T178F30A56F881CB11D5C111BAFE1E514E33132B78E2DE7212BD246F3C7B8A86B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436621, "uuid": "b8150d65-5a25-47a0-bec3-bb71eb0401b7", "value": "3072:SyhBCC9UsRtF+XzOFgHiaWqNZe67MFZ50I35CBg0f3x989:9BCC9fl+X6FgCaXDKZ50a4gy3xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773436621, "uuid": "4b9aded2-f5fa-496f-99ac-ab3811e6a8a8", "value": 169724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773436621, "uuid": "810e8e2c-c27a-4dcd-9e2d-cbc1dbd913ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436621, "uuid": "9d920da9-6768-4b0f-8af0-22350513002c", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0504be45-1ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773397985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397985, "uuid": "28fe7354-814a-4436-bb41-4a20eae55827", "comment": "Malware payload", "value": "a3f83e81e844490e42c2d4f5aa914fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397985, "uuid": "d9cd768f-0dea-484d-830d-61c686ef467e", "comment": "Malware payload", "value": "c6b41b9da8181b1829c5278cbae355ebcf3da06d252183a3037dd760594648aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397985, "uuid": "7e3687b6-3d0c-440f-838f-8593f8b532d5", "comment": "Malware payload", "value": "307688ba52240e4777e11e768af07870387e0027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773397985, "uuid": "966e2cd9-e1d1-4c74-a396-ec98a38167e4", "comment": "Malware payload", "value": "ffd798c4ae5381fa9c9e590c45612c74fa25356cdfaec2c121796d3f1a7bf817571cdab08dd98921d5fdb51fd0118fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397985, "uuid": "efb4944a-55cf-4ae1-bcd2-c161dea60bd4", "value": "T1F965120967A5EA03C5E65FF05970E37813E92E888511C313CFFAEDE77A39B066844297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397985, "uuid": "b614043e-729f-4bd4-8362-710151db9aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397985, "uuid": "e9c07f3e-ff35-436b-a841-40917c90a2f2", "value": "24576:6ciafl0s/IPb9v0wDY6EqPQqVvowenijef4dZmMm3g:6c/0s/ocwfQqVQw+iqs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773397985, "uuid": "d84bcce3-af87-4310-8f89-6d7340db7fae", "value": 1483776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773397985, "uuid": "4372b21e-0ba0-4211-89c7-9e74f0ad4065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773397985, "uuid": "1ae2475e-1ca0-408a-9686-318bdcdd3783", "value": "SecuriteInfo.com.Trojan.PackedNET.3474.1571.2220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5117b8d9-1ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773416581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416581, "uuid": "398511f4-7285-4a46-b0a2-1053cf7d172e", "comment": "Malware payload", "value": "fdc9fd2c825819663bccecf4713908cb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416581, "uuid": "92d981c2-b68a-4f00-869c-ee890229d70a", "comment": "Malware payload", "value": "c760f216d571e7378e5df349b5fb36c4bff67a17e27e275e8f3ce8a857fdb62c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416581, "uuid": "fee6d3ee-d56f-4901-bbfa-03266bc9b9e0", "comment": "Malware payload", "value": "f05da6b0f2d5c1fe7f4ff96c208c33309fe19c79", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773416581, "uuid": "f1dcd078-3c6f-4e86-a77c-01b7d21e8ad9", "comment": "Malware payload", "value": "e65d10333d065eab98f75563831e48797da0d7e85918667623e2ff06e08c58c78fff0f0e4d42ea87ece993c499bb56cd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416581, "uuid": "6e60ce92-0a0c-49e6-832b-970607b74e24", "value": "T1D996658FB674861348E263B5B2063573BE2BD43547998336BCEDE835319F07E4A628D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416581, "uuid": "eab318dc-145d-4888-acdb-22763bd7089b", "value": "49152:S3lqZzy1QoTvvoJR6X9Gv4R1jfjF5X2fZR78ZmZCH9rZ3ukILSejrgOkMBEIW7oz:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773416581, "uuid": "539d87c9-e2c4-477f-a117-586387e32790", "value": 8776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773416581, "uuid": "91264f7e-c29a-4524-8def-7101ea5d1324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773416581, "uuid": "3aa0090e-112d-48c1-8538-d5e08073211d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a90454-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402039, "uuid": "eeacf5e2-d89a-43a3-be52-2a9ef30e8037", "comment": "Malware payload (Mirai)", "value": "4925e922f4c149ccc12c8cecbab59202", "object_relation": "md5", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402039, "uuid": "c4cd8a48-588f-452d-9eba-cdaae313a4d2", "comment": "Malware payload (Mirai)", "value": "c79804b82a613ed49f32fc150e4a4a63e18ca1e9d1357d56be08f39d97829869", "object_relation": "sha256", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402039, "uuid": "bfb6960e-f516-40e0-9062-7cfcceabce73", "comment": "Malware payload (Mirai)", "value": "a544555356f74a89b27d2edea0a988bd5a7e9e32", "object_relation": "sha1", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402039, "uuid": "b7e089df-c1b2-4588-8d29-dcb14a064245", "comment": "Malware payload (Mirai)", "value": "1842fab1e99f73ec1c0e0732011dfc74122d9d7320f58c0a478260a7d877eb81dbb411ce1c7fe2de2a892b9393b1e075", "object_relation": "sha3-384", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402039, "uuid": "ed97f9f8-6077-4fbd-98ef-6f4e2451630c", "value": "T1BB431A791985F67CEFE10078F09320E62562471C3B8D95D36193643BFFB5A0873A9E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402039, "uuid": "0bb884a7-c432-4891-81b9-74bd9cc63b42", "value": "1536:aND9xxEYYxmeT/cuOosbYdRjklvZ6bzRWh:aNPxYmepOosbYdRwlhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402039, "uuid": "10940d3d-deb9-4411-90e1-9337ac644baf", "value": 58804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402039, "uuid": "d209c27c-e039-446f-9e2c-bfcb8b29bba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402039, "uuid": "11631ac1-385c-4b11-8323-a593be287a00", "value": "tux.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75703344-1f2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773440264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440264, "uuid": "c8ea9e25-f4b4-4384-ade6-616e0aa212e7", "comment": "Malware payload", "value": "4b833da974ef0320d9a4e99250ba1f2d", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440264, "uuid": "c697b264-6779-42b0-a968-e5940f67c852", "comment": "Malware payload", "value": "c83889fabd867d6fd1b145ac754d66598967e1fdf04692d0893a66e57d8d6f29", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440264, "uuid": "291f2c39-3458-478c-beac-44d6c11048d4", "comment": "Malware payload", "value": "03b18fcab7b0e09241e9f3e89d53f4e9bab6cea6", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773440264, "uuid": "78ff7f01-a700-4165-bcc6-bd38782d8b6f", "comment": "Malware payload", "value": "b6b2c74800926267baabba8d84f9e6ad83a2941b9ab4d7a2b31fb1edfbce15897d0716925b7fbc87fe7e3f51ebca1547", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440264, "uuid": "69977491-963f-49d9-851f-5965b4a7b935", "value": "T11752F851184F988908384FAB95248C79D788AF278C64471F397A1E97FFF6A2D846C934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440264, "uuid": "26ae57e8-f276-4ab5-a619-8e76f7e85a99", "value": "192:qBUboMPflI9yXgBGuSJICW+ZISBM+6r3/OUWU0Btyib69V+e2QE5gGr8MvW:roMP92yQBGvJNISBu3mUWnci6YemrPvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773440264, "uuid": "8f2f4613-88ca-4c88-aef7-78d242b91831", "value": 14084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773440264, "uuid": "937cc297-6dbb-4ba4-a5af-6090b344adc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773440264, "uuid": "73edb025-6a94-46d7-a066-9bb45c9ef8e3", "value": "heavens-gate.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e55205d-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402054, "uuid": "816e7939-e6d4-47c6-98a2-725effcca484", "comment": "Malware payload (Mirai)", "value": "2c44e13067d5fa1340e3587e2cf5f526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402054, "uuid": "5fe3211c-91f5-4545-beb6-3a64ec764e61", "comment": "Malware payload (Mirai)", "value": "c858f4cd15e8385d974960380042df0ab5b7a83f563934c77f10e28cd9b7c6b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402054, "uuid": "b6450d7e-2fc5-48c1-a2d3-0ffa1fce938f", "comment": "Malware payload (Mirai)", "value": "604feb0a1c6c597cab8cca3584b564f46bbda72a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402054, "uuid": "1bf68b26-674b-45e8-b7b3-14aedff2476b", "comment": "Malware payload (Mirai)", "value": "b780d04e6eef5dcc5a764cd208792c521b4a0a776ebe757668ecf6bc18e91410f3958c6365fb0b1a9154bc34aef8bd6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402054, "uuid": "ee2e44e9-3e4a-422a-82c4-e58b6c8c2407", "value": "T1A7935CDAF800ED7CF85BDB7A4463090AB63163918B930F367257BD67AC321A55C17E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402054, "uuid": "e05b241e-890d-42ad-af81-d405e99f4120", "value": "1536:XnMSpcZc+0aovXngRzbXGi505ZWe88paUfAAkX8YRxy3FTp9kdOSThSn2PAQ/S+M:i0aovgxyzWe7nfAAkvy3FTmOWhoB+7S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402054, "uuid": "52fe7cdc-f0f3-4a15-9851-0a96f6e086f0", "value": 91444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402054, "uuid": "3f446004-d874-4473-98b2-6baf99217041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402054, "uuid": "f8c663a8-7518-4a9a-bf66-901cd713936d", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bebc18a-1f28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773439255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439255, "uuid": "c7fd675d-9759-47f2-8b18-afb20ac1d1ea", "comment": "Malware payload", "value": "3d8877b4580e3b7169cb314428ecc10e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439255, "uuid": "acd7c3c5-3143-40da-9319-b2c78effc630", "comment": "Malware payload", "value": "caa66675f6574ba2295aff502850a0370450db602d3ff2bac2c059cdb265f2b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439255, "uuid": "baa62b8b-7545-43f7-a4e7-6f630bf86367", "comment": "Malware payload", "value": "a3095163eb20b1aa339eca3dd796b51da2f9d94a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773439255, "uuid": "c9c8be59-df6a-4cba-93e0-5d493ac956af", "comment": "Malware payload", "value": "9826b256f8998c3c84d6c88d51d8a2bd5d28d54a03b63cfadd37694b2f00bc61af515ff4c0efb91feee5133d672dcd7c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439255, "uuid": "fc76db2c-d117-4a7b-b449-ceae5f370a58", "value": "T182B17DB6821C346BD6323FB4700610A1B09B119E637E32A2DD1CE3C29FDB00A2F15D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439255, "uuid": "3baedf58-f1c8-4b71-8235-65a88bd63f23", "value": "96:Zb+XJkJp+5+4ELi6Y4em1Ns2aWOF59TMXt911E0lVvLIIhq5Ym:ZRk5+4p856P59TMLbvLsYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773439255, "uuid": "f452f67b-fc97-4fa1-a27e-b241a77e64a9", "value": 5343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773439255, "uuid": "879b69f5-1334-4cc5-a3e1-973cfe992cc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773439255, "uuid": "f2a246e7-9940-4d6b-a1db-a03a2b437857", "value": "SPL INT REPORT DATED -12 MAR 2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f9688b-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773407147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407147, "uuid": "4b1f9da4-7488-4412-a884-9026e6a851fa", "comment": "Malware payload", "value": "de1be3170badf77d91e5672caff08610", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407147, "uuid": "4dfa6f9e-2d80-4952-98f1-b06e7af0237d", "comment": "Malware payload", "value": "cad6c012d2dee271b3cd6c568b31fd041e77225845391faf3c0552931b326c94", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407147, "uuid": "6d4fa89d-e5c1-4d21-ba93-b9d304659408", "comment": "Malware payload", "value": "69b30fa2c14a5c4a12aaa44fcb21dd72a3851a06", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407147, "uuid": "65296c9e-f5f1-4c0c-9aa0-119de593df0c", "comment": "Malware payload", "value": "e4edaa8c306cda510df62b8f6428cdb72c7dee1354a8a7fcc92208d25bf3f2562a2cdb8e8cf841a40a0fe91492a677cc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407147, "uuid": "c33c51c1-3673-4fff-a532-1d221e10937e", "value": "T1D3B3B6807BC5605A12876FBFB31FB4C5F05A0CAD39860D6EC154FDA0D8A4A27E9F2671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407147, "uuid": "95ff9497-492a-4212-9f6b-920bd890f344", "value": "1536:dWWUFIW8WrTWrkBECuz9RjrI880ufhmbxSXffzYsFZj4jZalykmBWy2:YKI88R48TZjet2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407147, "uuid": "36bab664-ac3d-4c2f-9536-d9ae3e72e01f", "value": 112344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407147, "uuid": "b466d79a-eef3-4db4-804c-459981b1ee8f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407147, "uuid": "a4a8934b-9070-4c0e-9ef5-6c79d37a7e55", "value": "Photos_Winter__58.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855c180b-1e92-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773375007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375007, "uuid": "ae90a071-1a2e-4bd2-af04-bf0f794e4b8d", "comment": "Malware payload (QuasarRAT)", "value": "2010e044ac40927130d1f7f237815ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375007, "uuid": "a96a3230-71fe-4ae8-a532-f3d5db90cb83", "comment": "Malware payload (QuasarRAT)", "value": "cb36189885f26321e070ffef0be956476f40429410f1fd23f97dddac24b23c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375007, "uuid": "1afadcbc-08c2-4b3e-af72-40c77db4c3e5", "comment": "Malware payload (QuasarRAT)", "value": "2458e4bc6d50ddecaba4a5307ee4344f7c849d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375007, "uuid": "0e842b25-83b9-414f-b2c4-967366328e93", "comment": "Malware payload (QuasarRAT)", "value": "9187dcf102681670fe79dc529c2eadab555d6992ef3716d765e9d82776b3997311ecc02e135eb4355999027939d04e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375007, "uuid": "bf69c01e-f362-4096-8bee-0c61bad23add", "value": "T158E54A1537F85E22E16BD3B2D5F0541363F0F86AF3A3EB0B6191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375007, "uuid": "c44de2eb-f7af-44a3-b99f-2fa139ec5904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375007, "uuid": "0527a7e4-5b9c-4e5f-bd78-36d87c3a7967", "value": "49152:3vwhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkap6U2mzdL9Gd2THHB72eh2NT:3vit2d5aKCuVPzlEmVQ0wvwfp6UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773375007, "uuid": "021549d1-2822-4883-8712-b3508a6db9fe", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773375007, "uuid": "1254e700-f9f6-479f-be3d-0dd980ddd11a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375007, "uuid": "b317b0b2-9d0e-44c3-9298-bd9545863c95", "value": "2010e044ac40927130d1f7f237815ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b786d6d9-1f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773423195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773423195, "uuid": "1b17cb27-b5bb-4b19-8b59-c257ce741835", "comment": "Malware payload", "value": "6e23b166fcf4dcd33e740c0062cef3ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773423195, "uuid": "806833e5-9a84-4d97-9c54-944b5c83a443", "comment": "Malware payload", "value": "cbd018a884e5314f5fb1cebf973012d7c420c6d0f633aeda37dfeff3cd739e61", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773423195, "uuid": "ac304649-7ec1-401a-9ced-33e7ba6b5e44", "comment": "Malware payload", "value": "b4324e29c31eb0b2a90649817b9f5399d829de03", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773423195, "uuid": "3946f594-0ce1-4c1c-a36c-df72db1b98b4", "comment": "Malware payload", "value": "70196140da3e0d6f0a5223e3dae21f96fe38c33c6a490dbd5b32ffca63e051ffb23c6b3da7ad26e332d62976f03cef5c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773423195, "uuid": "2dce216d-8abe-4bb3-9233-0f47504396ba", "value": "T18A926C43BA11C22AC05CAF794E77CBA807763C44DD9A10137AF6738D1EB61E479993E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773423195, "uuid": "832e4f1d-36c7-4d58-83d7-37141eb3c3ef", "value": "384:/F/wV9MhwQ7tp+mve/OB1oIRmH3an/a4aFbs:/F/sOwQnDsYRKCyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773423195, "uuid": "22c86458-361d-4779-b52e-f4048d8f2f7b", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773423195, "uuid": "5a974f24-6726-426b-b0ba-d5b8473ec90b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773423195, "uuid": "e28fd6ca-5832-4632-907d-c34bae75aa9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd63d0c-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773407151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407151, "uuid": "d8a8d76c-bbcd-4744-8de3-e6affdd61269", "comment": "Malware payload", "value": "fca86bd634e08e1f4c47073c0f715d80", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407151, "uuid": "d1d09079-05de-485c-b089-b79c4ea98542", "comment": "Malware payload", "value": "cc3ac1ecabff65608427c286bd78262c3677bdb4b3b5442e69b2d77dd7043301", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407151, "uuid": "f2b8ec4e-ab7a-41d0-8aac-d5069cff7248", "comment": "Malware payload", "value": "01aa877f186ae60344d3d4e4563f9a994fd12bf3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407151, "uuid": "ec35691a-1ddc-4600-8aaf-62c30d9c4c3e", "comment": "Malware payload", "value": "d27d4f9c9bfebd36771f309ca203e7ed7d3a0d65cc1685f4df72948327a98e699395fe1bbb545ff6ec1eefcdb7c08e72", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407151, "uuid": "69165e66-c4c1-4bd8-9b45-f777b23e24bb", "value": "T10534F08B5AAEC6E8874F2065402E1C47CECD5052120DECA07D9EEFCD6F95AF870B95E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407151, "uuid": "776c4d07-a318-4500-ae48-f56046b20537", "value": "3072:JuTyzSDjQr5Ng4EBBWLxQ3KdqiqQnhmhcsPR7W2nhBn1oK3ST6UKgLdOg:Ju4F/EBBWpGB1oK3ST6Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407151, "uuid": "babf8bc3-e5dc-4e49-a10d-197b5e305f08", "value": 238527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407151, "uuid": "88d69bb6-b14c-4c4e-b1d3-6c2d06f2b4a6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407151, "uuid": "59220af8-c627-4ef5-aa81-57c1e6937073", "value": "Travel_Release_Old_5924.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444df5a5-1f19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773432880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432880, "uuid": "48b35c50-9ab3-42bb-b376-0f9dfa358bb1", "comment": "Malware payload", "value": "a617d969a42a57df2b96efb693471755", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432880, "uuid": "2f0f1ae6-04fd-42f0-9ad4-80c8e07a6e30", "comment": "Malware payload", "value": "cc661f45d0ca1ad0f7e68143e936ebcb7bbf1bcf134bdce6bf1888909fb659b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432880, "uuid": "ae65524d-b9d3-4408-80b0-e37d3c19076a", "comment": "Malware payload", "value": "44a1629e9caef1c97636f2dc334078ebdcf1433b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432880, "uuid": "585597f7-06b8-4f9d-a254-d999ae2c174c", "comment": "Malware payload", "value": "11fc75761841244d28b2647418b51ed615660ed3525ea62ddbefe8b6737aa0a47bb223169d8ac3de75b2053a1a09d156", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432880, "uuid": "1c49af46-b915-44af-9fd6-c9a0f8959340", "value": "T120626B3721F08B3397D065C4A2771BA14F72960B456720B8F4FE1A269F6DA0370EBB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432880, "uuid": "82a1e130-8ccc-4066-a80e-f5bf1de8fcce", "value": "96:cCuRsht+O+v1fsn+h4+tIiKVC1ymyPuKNpUj4waYvjtVnkQFn+3+ZIBhIBrIBIIr:cCuo4hvZ5mu9bKNpivLkEEq2sPiEaGIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773432880, "uuid": "fbb66894-c3a5-484c-b7c3-d22c0b6ca330", "value": 14921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773432880, "uuid": "7966f66e-abe3-406c-82c4-2fcfa43e092e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432880, "uuid": "922edb04-88c3-40bf-a42f-b00b3436b80a", "value": "cc661f45d0ca1ad0f7e68143e936ebcb7bbf1bcf134bdce6bf1888909fb659b6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d55e725-1ef4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773417004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417004, "uuid": "be8128f5-3c20-4285-804f-e0292cccc194", "comment": "Malware payload", "value": "af458cbfc8c1a8bc2d6821b3ebb11bea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417004, "uuid": "89f82d1f-60d6-4dca-a084-9f2633132cf8", "comment": "Malware payload", "value": "ccaafcaadb06eea5842be23273ebffda66b4126ceae5869090733b2232aadb76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417004, "uuid": "12c394f1-5e3f-4ce6-999c-4ea82f919b10", "comment": "Malware payload", "value": "266d6ebe7d8c5e07bdfa8087af4fb559c675d075", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773417004, "uuid": "68ff2899-d135-43c5-bf03-d719b64cc6d6", "comment": "Malware payload", "value": "7b4a7648216fb0205073cfc2bba3c9d89d35fa170a287b6fad3e490bccb6f0b7adc061cc9f81aa563646c42c086167c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417004, "uuid": "c0a6ce85-5bf2-4c98-91a5-e63403745d84", "value": "T1B6925DB512896C79FBD1CE399F3C6F4CADE8C2C42124A3ACBA4F3D215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417004, "uuid": "81770315-0fbd-41f7-8cde-575b18deda9a", "value": "384:UWFcuQpWx+BL0SWL0gPzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:UWF8i+BL0SI04zsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773417004, "uuid": "70537a74-9590-4166-9b2d-6ff72921ba4c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773417004, "uuid": "5d0da86b-e9a2-4395-8a7a-3a21ca169628", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773417004, "uuid": "51e5893a-dae4-4dfa-8e11-83f250e2a5eb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f41f888-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773433650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433650, "uuid": "fc6e3a91-4ee0-4795-be60-6b6ff0c243ce", "comment": "Malware payload", "value": "3029442c647d115b440c5c3cc4f06f5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433650, "uuid": "a3fbfe83-99b7-45c5-b471-a034bb00609f", "comment": "Malware payload", "value": "ccd1493e6fb014dda6feb43af9b2dfae927c2d229489018ee5cd5c1757cdf42e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433650, "uuid": "c45d4521-eb6d-497f-b526-329e125e8598", "comment": "Malware payload", "value": "bfc43318c1239c2dc527941f76762e9f7288519d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433650, "uuid": "7d7b3082-4651-49b2-b58a-2e7205cb9b25", "comment": "Malware payload", "value": "0d56ccbe257861f245889c44bffad5dfcd0e66c6cfb413edf624c21fc4dc932736c8adad86d0417d14f0c2f2f36e27ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433650, "uuid": "b6d6bfa3-4922-4c7d-a1c7-83ba84b0a123", "value": "T12DF1C06B21F08B71D3D421C9526656A54E71A74B992A08B8F4BF973ADF2C90370E3F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433650, "uuid": "c107a6cd-75c0-48a9-92db-e43a8f6de558", "value": "96:cCusB6n7sht+O+v1fsn+h4+tIicqbA/GsGqZ4BPxfoF:cCuI6nC4hvZ5mzjHObK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433650, "uuid": "af93012b-96e0-43fe-a7b0-f90a8135ea8d", "value": 7505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433650, "uuid": "246037c1-ec9b-4e54-9b19-e5d4ece03fdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433650, "uuid": "32042eb2-6d45-47aa-9cfe-85e2d5b15844", "value": "ccd1493e6fb014dda6feb43af9b2dfae927c2d229489018ee5cd5c1757cdf42e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb06008-1e94-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773375909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375909, "uuid": "bc4dd507-f59b-4e19-bed7-9fd7c9c94f62", "comment": "Malware payload (DCRat)", "value": "20d647e1a49859565ea185c4594766ec", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375909, "uuid": "0afa2edf-ad63-42db-8921-e00754bca3bf", "comment": "Malware payload (DCRat)", "value": "cce9ad10af6cd5a666067c09d3292c9c7e1d82d3e18a970c4ed2b21a394dc9a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375909, "uuid": "fb4afe5e-75d0-428f-8be5-7b7a6a7fbdc2", "comment": "Malware payload (DCRat)", "value": "1746af6a48f5f76e7deeaf3529e253efc13c57fa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773375909, "uuid": "c961b948-e1a4-4ee1-935b-aac90664a915", "comment": "Malware payload (DCRat)", "value": "79254b13a06bf3bf2fe76a345da8cb97aaba6525a259e6a0c05421cef0de94f60f72f26c7c107c92ceeed8b370152091", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375909, "uuid": "080e010a-e137-4cf3-99bc-4935442bfb85", "value": "T10A658C017E55CE02F0092233C2EF494897B59D5166AAE32B7DBA377E55123A33C2D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375909, "uuid": "2b725e1a-2cfc-49ef-a9c3-aee6a7cb8377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375909, "uuid": "83b94b12-9efd-4220-8fd2-08946cdc8afe", "value": "24576:84HVO/qKZ3TfkMEdAXxa+jMPGSx8PsLimUzrC865dY8yB/Ruv4:7fQbSuxaWMPlxFimQAon/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773375909, "uuid": "165b3b5c-9eb8-43ce-b1ee-a7676281bc8a", "value": 1446400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773375909, "uuid": "c7294ec7-ff7d-46ae-952c-2d8673d69d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773375909, "uuid": "81ec6ad9-24b9-4a3d-b329-c9a7af92bc97", "value": "20d647e1a49859565ea185c4594766ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0511e735-1ec9-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773398414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398414, "uuid": "6ba7fe51-2fcf-4149-8828-afa053f6871f", "comment": "Malware payload (CoinMiner)", "value": "68eec7313abb4f69017aff8662b657d7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398414, "uuid": "5c6c46f0-f67d-42c9-82ee-db4c3edcf71d", "comment": "Malware payload (CoinMiner)", "value": "cd1251e2b55848eb45f6ae8edc1ef7b74b2721e8a8db7c6d95e67619cdca0572", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398414, "uuid": "d650c424-2cc0-45a2-ae09-1c080c811aa4", "comment": "Malware payload (CoinMiner)", "value": "8ba8c496b77d63bbc2177fcba1ab0a160a38cba6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398414, "uuid": "837903ba-95f8-48bc-a2d4-58f55b040b38", "comment": "Malware payload (CoinMiner)", "value": "0f252436408669f820ccd5295aa89efabfcf3b6781f48beac029a551c9ec7738af74af23ccb9b3b1a4901c561597912f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398414, "uuid": "5de587f1-5bf3-4bf6-9aaf-7adb30de1b54", "value": "T1BD313210092EE327C7E26A50FE5FDD07EB8F805B705B4B04B9C8325A2087C1C05BE9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398414, "uuid": "6ca901c8-f28e-449b-b294-3f16a09886a4", "value": "24:BdVKYdVKvBdV7DGdVbMpvV6UjPDHA81cT/XQ+V4HTGNrn4fph62i8zVvbK06W:HXIHVISpvlJeQ+GzGNkfSB8zVvbT6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398414, "uuid": "5735f935-b710-4cdd-8337-2b21cf59b38d", "value": 1659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398414, "uuid": "33d6844e-6502-491d-83dd-cf54d3b7b82c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398414, "uuid": "0616a67f-62ca-43fe-8f1d-0050e007de8f", "value": "1YAn6rSV.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bc9817-1e8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773373026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373026, "uuid": "72c85922-1927-48dc-a610-f02ea723d3f8", "comment": "Malware payload (Mirai)", "value": "3c146024891c2ab161da865c27d370f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373026, "uuid": "83c54c80-63dd-4dea-9522-4696b2bdb9c9", "comment": "Malware payload (Mirai)", "value": "cd6bd9bb87d1f14626a2cd8a2b94ba23ff51f2985cdf151f73d1c814a704a3fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373026, "uuid": "569db68a-027b-4761-833f-7d6292df060a", "comment": "Malware payload (Mirai)", "value": "d27140f9df0188d8a72e1f489bf51c8758b9c059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373026, "uuid": "585146d0-e648-4025-8683-0a27fca51cdf", "comment": "Malware payload (Mirai)", "value": "2a0434ed73db719a21b024af0200d58de3d26cf1ae4d88af92ece75ecbaba3dc6ddab9d59dc3c2b16268f3e6c2439acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373026, "uuid": "5e1ec452-b795-437e-8045-fc305d9fe924", "value": "T132A339D7F800DE7AF80AD37B44970906B230F7A50A8317B63313795BED391A95926F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373026, "uuid": "18ce1a5a-4316-481f-bdb0-f14497bc9374", "value": "3072:FcVHjckJ3lWhEwwdLkn57FjBeDDYJujycUSjRP:Fcxjq/cLknZFQDaujycZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773373026, "uuid": "c5fb8ea1-d712-41c5-acbe-2cd84ab69710", "value": 104176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773373026, "uuid": "29b8cd18-b5b0-4846-9986-0c262260c4cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373026, "uuid": "f7f2adfc-7158-4cb7-a7d8-1b7401723d48", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae13d2-1e7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773364515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773364515, "uuid": "5c6f92ef-fa0e-45bc-b48f-a2b42716cfdd", "comment": "Malware payload", "value": "65f773a204a4991f929a0e0c2e0a880d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773364515, "uuid": "1e5be902-c4b2-44ef-9c1b-cd93ad4d262b", "comment": "Malware payload", "value": "cf4cd720b311a42ee34ee8a33de6b2b26dc29598657e599b5b8d30b19eec3cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773364515, "uuid": "279ebf94-9a98-4904-b5b1-2a918bb098ef", "comment": "Malware payload", "value": "5c9a198f7c0b5828167c48ab61d0ba096a61412b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773364515, "uuid": "f6e2cedc-ca4a-42dc-974f-fbdc1532d101", "comment": "Malware payload", "value": "96e7cf3ec3cf432398af16b1c4d543330b8a4a43d10df5a83a9761da819e7e08a45027fd8c52a61acc4beb83ca2a88db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773364515, "uuid": "72c81a2b-709c-454d-aed5-8163b7fb6bd6", "value": "T1BBD7336F5BB4A41FF0234CF961E255A9A16B7AEB1B310E0B7784340BE8354816FDC792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773364515, "uuid": "0b94c6b1-5e71-47b5-b236-e91356473de3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773364515, "uuid": "37e66027-0075-4353-a90e-3814aae84b91", "value": "1572864:rnJkWNWeYUUexa223f7XjH0z+CLqVZSKuORz:rJPNWIfJ2v7AzEDSKrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773364515, "uuid": "15bce8c5-de2a-4e2a-a7a7-3a1d57fd1bba", "value": 60078362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773364515, "uuid": "65a67f8f-8973-411a-af11-c30aabb03a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773364515, "uuid": "2662ff20-df4e-4e2d-b13f-c9b323c980f2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8923b40a-1eb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773389616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389616, "uuid": "13041ddc-796a-46c6-8376-642182730d92", "comment": "Malware payload", "value": "2123cfa51a7e9bc68185da47006e6cd6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389616, "uuid": "d879ee1f-b955-4cf0-a368-735a63f61b10", "comment": "Malware payload", "value": "d05ead9c37bae18d150d0c693810d5c1651bfb326c007c4c89d88ba7b439b3ff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389616, "uuid": "6881f72e-c2e4-46c3-b7d3-e16019ea0478", "comment": "Malware payload", "value": "6ad232781130a8f434d4b21ef14e2c120f5b093a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773389616, "uuid": "c195152f-ffd5-47b3-9cfa-c3399af18398", "comment": "Malware payload", "value": "95403c4aff6639a3b2edc273c4d59880b015da126c8b94825b4cc58bdcd478f8ed4d0664d6182454ba1efb5c00618d46", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773389616, "uuid": "4f9ab2df-d8ae-429c-932c-81c47e793d8c", "value": "T184925CB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773389616, "uuid": "18b13ad1-040d-43f9-a8ba-3a0df3ec90a6", "value": "384:O4FcuQpWx+BL0SWL0g3OzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:O4F8i+BL0SI0iOzsP4cbddr7zsP4cbdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773389616, "uuid": "4bee4a4e-88f4-48d2-a4a2-0fa897dcd406", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773389616, "uuid": "67761f01-a805-437e-b3d0-5017d9b9c382", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773389616, "uuid": "3ac66239-3588-4d6a-8623-86a1733c444b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9575fa08-1f1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773433875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433875, "uuid": "bedb5e4b-4eb4-47d1-ba4d-9b226dad21a5", "comment": "Malware payload", "value": "b337c00fcc053e8599ab1dd5521e3ef9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433875, "uuid": "25647e3d-acf1-46bb-96b6-16361a00b3c4", "comment": "Malware payload", "value": "d1d932401646377082d7f91813c2aee9e93c726b1c9117343f84ce423c50125c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433875, "uuid": "44e1484b-fc00-45f5-939a-6e2fec6b5363", "comment": "Malware payload", "value": "9131150071607494cfce40645de6463d48106a4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773433875, "uuid": "a9b85d2d-8e87-414d-83ca-2eab51cc63e4", "comment": "Malware payload", "value": "bea5fd62083de1d1d22e242e394f7ca51a087ad355ba88887a9847a217688f082149204de05108a05e062480ba4f8b9f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433875, "uuid": "847d3f0f-d969-4141-96dd-b7a0839342c1", "value": "T1BFD1D67125F14C333E606980B3772BA6ABB6D95345E3218C35DE2E366F86F12B1AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433875, "uuid": "68ca221a-5cdc-4211-baab-9cbc100e632c", "value": "96:cLu7B69xiUSUOSCx2xkStgFIrOIB6IB8ls:cLul6CUChq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773433875, "uuid": "c8cecaae-23e6-4585-bdeb-b931f81acb3b", "value": 6390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773433875, "uuid": "8f896a96-2f7d-4f92-912f-16f1b434c2f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773433875, "uuid": "7977a5e7-e936-49b9-beea-207c699d32ca", "value": "d1d932401646377082d7f91813c2aee9e93c726b1c9117343f84ce423c50125c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0076bde6-1f19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773432766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432766, "uuid": "803558e6-bcb5-48cb-b5c0-0ba7591d6c31", "comment": "Malware payload (Mirai)", "value": "46e42c6aa2cd75620ebb3048db0d6d72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432766, "uuid": "79372f46-09c6-466c-826a-30d9ba40ae67", "comment": "Malware payload (Mirai)", "value": "d3618fb2f8f68cdc24f7187191b0581632af27dca527bf76e0deb806a164a8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432766, "uuid": "0952580d-bf35-4ed8-9ee7-17c9fcb876f6", "comment": "Malware payload (Mirai)", "value": "5a0e73f5c5e14cc78d9aa95a9f4fd582ed2616fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773432766, "uuid": "6193f90d-b0db-4c04-8c05-64ec0aafd99f", "comment": "Malware payload (Mirai)", "value": "33281c8229b5bc4c96dd001c264606c11fd7d1d9661792f9dddd2a912398d3afe187f596761b575f8eff06e3b0554449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432766, "uuid": "17912db4-4411-4a83-96a1-7817d0acf2b5", "value": "T1530428D7F802DDBAF80AE3374C538906B130B7A119825B3772577B6EED3A1951423E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432766, "uuid": "b65101c6-cc41-4bee-b623-7f8822628580", "value": "3072:ovO2uP8s3y7xCNs1jyzPfWRT5Nv2iCj0NStVwjbizLlXV7C8WZLe92:Y8mxyznWRtN+oNS5LlXdwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773432766, "uuid": "c07b7d1d-23b9-4c9c-8faa-d706643f1079", "value": 178528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773432766, "uuid": "11837607-2fe2-4928-bbf5-451c51203e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773432766, "uuid": "090b6196-ab53-42e2-8657-bb3452092bbb", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b0a67c-1f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773437370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437370, "uuid": "1e88527c-9360-454f-ab8b-8cafe4dc0fbf", "comment": "Malware payload", "value": "7ced10b3f81d449ceb97c261d4c6ba60", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437370, "uuid": "4ffa98a5-f105-43db-8bf2-45b7f83e98dc", "comment": "Malware payload", "value": "d4a35da9c140ecff4eb352c413a38a710182d4ce1df4c34deed107ceb1d0f61c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437370, "uuid": "3afb6ce4-c5da-43af-917a-897239f428f2", "comment": "Malware payload", "value": "656fc459fe1ccc4c06a658649ae804a2547e2c78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437370, "uuid": "766c4796-7c4e-4c63-aa2c-2ddd9abf4e3d", "comment": "Malware payload", "value": "ed971fd807d26821fec35a3efb1d352d233a9b0ac66718bd77f1e735f24074170e910fbd811c93fd61161fe5b15c0735", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437370, "uuid": "a1b3cb0a-d5c8-4894-b348-2ef3b357d636", "value": "T16942773B21F08B3297C461C962A71BA14F72970B456614F8F4FE57269F2DA0370EBB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437370, "uuid": "f657b219-0e69-4def-9ac1-2d2cfe32e0bb", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvj1XioV7+d+C6IB9IBCX:cCuYK6p4hvZ5m5FoKNpivdVGOyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437370, "uuid": "d2511332-856f-47c9-8c73-786fd389e0e1", "value": 12318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437370, "uuid": "a81cdcce-f40e-450d-9e6f-e9e3a2ea8150", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437370, "uuid": "ca18f86e-cab8-4a6c-a4c7-1f0e7ceeeb7b", "value": "d4a35da9c140ecff4eb352c413a38a710182d4ce1df4c34deed107ceb1d0f61c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49690127-1e95-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1773376195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376195, "uuid": "ba1aaab5-7dd0-423a-93ca-f07b7f08d50b", "comment": "Malware payload (SliverFox)", "value": "2b0862c9328cbb295143ae510cd56e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376195, "uuid": "eb56cd68-760b-48e2-bf19-dafb9ace79c7", "comment": "Malware payload (SliverFox)", "value": "d58d74c038f96715064d9f28ebb8a2e89c715e11fad04e3011fa76d693fdd296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376195, "uuid": "b6f51e47-bdec-4099-b1e8-4abe7765f6ee", "comment": "Malware payload (SliverFox)", "value": "e3fe94177eccecae553c5a5840a76b028302e8e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376195, "uuid": "ad97e200-803b-403d-a66a-a349557c3745", "comment": "Malware payload (SliverFox)", "value": "0da22bf91e7aec7008103e6ddefc67d3f500aa1b799dda7b65f75c2057305c231dc687842fffc67cb3377f5cb37215d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376195, "uuid": "e0c9180a-cc51-4238-8f54-9a7e0297ec06", "value": "T10865014BDBC5D8D2C4A1CB3041A66A1035BE3D9A9F22EBDF9348355C6C727F09E38499", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376195, "uuid": "ea0b0243-8343-410f-8697-4ada02bc9070", "value": "24587f39ebe7f0e9605e30bcc578e5dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376195, "uuid": "474404d6-2004-475c-a59b-cb8bc1bead36", "value": "24576:jerspjONiyNGc6QD8JffCbTSS6/NKXnP0oCF/6pvoSM:KrCwTNG/kCffCbT56/NiPhCF/6xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773376195, "uuid": "2e3ea309-dcfc-474c-bcc2-5fe6f0e8c53e", "value": 1538560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773376195, "uuid": "3842805b-0309-4df2-bc79-b8b1c79693c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376195, "uuid": "26ddfd77-6fc3-4029-90e7-7a93fe4e82e6", "value": "2026.03.11...\u4eba \u5458 \u4fe1 \u606f F @.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700d512b-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402030, "uuid": "298e4244-bb74-45f2-bc4c-820630583096", "comment": "Malware payload (Mirai)", "value": "8ee0ac78c9c2f25b0a9057dbfec923a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402030, "uuid": "721c1df7-7fcb-4d50-9966-2b42138c358b", "comment": "Malware payload (Mirai)", "value": "d6b350f7076a655db6bb326ea6b6e56e9700385d03132e39b5ee97486acdae3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402030, "uuid": "df86d3bb-bd38-46cc-8f43-c3548f4f9d2d", "comment": "Malware payload (Mirai)", "value": "6a04ae63072abe6c2c13006fd2b9256bd3144576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402030, "uuid": "f62be4ff-b9cc-47c7-a7a7-2e678c17b16d", "comment": "Malware payload (Mirai)", "value": "2acba4b1615ed3a8ac69f7911904de977633ca00adbea5942afe25c95656f539a5b61442899617a775a46c8950d503db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402030, "uuid": "8e46842d-ad7d-4291-99cd-eb0dbd811ebf", "value": "T1EAF3975E6E228F6EF269873047B78D259B6C23D622E1D644D2ACC1105F6039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402030, "uuid": "4aecc38c-19d3-446c-8d99-c8e6177f8268", "value": "1536:YC5eAeLLNzG+XkgLp37bR84yA3q0ov4ireVy8izofyTHHrBHuYg5gWlO/y6Ja:YC4hXk+B84yuqxvKy8N+du97lIy6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402030, "uuid": "f26a5ca1-a5c6-46bf-b9c2-9cd2b254587d", "value": 165276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402030, "uuid": "ed2be488-c094-472a-b583-2f50953876e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402030, "uuid": "43b5fde7-25c2-4b96-b3c0-8da2ecc89240", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004240b0-1eea-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773412580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412580, "uuid": "c1803391-9610-4ab3-8a35-acb5f83484f2", "comment": "Malware payload (QuasarRAT)", "value": "21e4e8d85bbd1b4a495a67b25c28b621", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412580, "uuid": "b8c00bca-c5ac-4347-9c35-2a91dcf8e41d", "comment": "Malware payload (QuasarRAT)", "value": "d71ebb253d47b4f626d03dafa65099191ab6d939c6c10be87b2ff9fdc73f867f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412580, "uuid": "e2aa51a0-f9f2-4650-a4a0-f68230e5d758", "comment": "Malware payload (QuasarRAT)", "value": "40119679656c380d56f506ac996169997edfc5e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412580, "uuid": "282d52d6-2cf2-4b1c-a600-831d0371d7a7", "comment": "Malware payload (QuasarRAT)", "value": "cedb6d1d4388f0891c5e047d8c7770b21266e2483de5608b66aa7d5591811b1ed48c5d86f6923c90c255bc480ce4ca4e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412580, "uuid": "8ecb853a-ba9a-4407-afe3-e158389310b0", "value": "T1C4D4022037FC860BE1BF66B998B125416676F663F623EB5C0C8462ED4533741A9C337A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412580, "uuid": "b6e92ae3-e2f8-4027-ace2-87402d36ea81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412580, "uuid": "8e05acf6-7b6a-498c-b569-2fa4fa6c0c50", "value": "12288:UPRb9zoSjkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+f7LfNEXQnYrQ:UJ9pjkqjVnlqud+/2P+AlUDcPt1aKFE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412580, "uuid": "dee4ae1d-5ff5-4b5a-af32-f3023a96f0df", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412580, "uuid": "f1c007e7-f8c6-42e9-9813-a3c8650df20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412580, "uuid": "bc6b5e5c-433a-479a-8c7b-520a15563d6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ea5070-1eab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773385605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385605, "uuid": "ec9625f1-5e72-4439-8b00-afcdcd5ec375", "comment": "Malware payload", "value": "bdb87f1b171a463cecca428d09259603", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385605, "uuid": "67414a6e-b9b4-4bc9-b79d-0ece3c514af3", "comment": "Malware payload", "value": "d7b7cc13e0994509efc054b12656499b29d78f1d97ccaf60aeadc15f9bf18985", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385605, "uuid": "2ed8a216-e9a8-4709-a3fb-6ffbd6fdff6b", "comment": "Malware payload", "value": "16032095d983b964c9afca51ea368a948069d68e", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385605, "uuid": "4132aa0d-c334-49ee-904b-3af64b38a4e0", "comment": "Malware payload", "value": "4b7fbaff4917caaf0b492683078ba8e6902e1d0e1b79e6de6fad933c7494c4984fc0c869994d6a4416b6cf09eb305012", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385605, "uuid": "aae889d8-e386-4d6c-9c97-a6446ce28f3c", "value": "T1D8173373725927F5D889EC38FD323A4882F2300DE19AF676447521EC79F5FCA2A06259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385605, "uuid": "8ef53086-1ff2-4a43-a8b9-63bb635c9921", "value": "393216:pBYLXtJaLbr7K7TCK6fX9RUL9jI6hqo9uMYbGvifxv8rU+h/PUEl0U8YYlbEm:YQnMOKWrUJfhZu8vifxvuhnUuDgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773385605, "uuid": "316e3245-ddcc-404b-bb93-5ef78aeb290c", "value": 19180486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773385605, "uuid": "aea2cad4-249a-42e3-b765-b7bf2c17b686", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385605, "uuid": "51f86f29-3eee-4df4-9db1-344536d1e29e", "value": "asfixsoftwaredev.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cfd7a0-1ea6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773383381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383381, "uuid": "66cd72ac-5cc2-40ab-b73c-8fec918528ee", "comment": "Malware payload (AsyncRAT)", "value": "f0b410ca0ba79d284cf7f88327818a62", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383381, "uuid": "b2fcb80c-d001-456c-8a1a-3807c3b4e83c", "comment": "Malware payload (AsyncRAT)", "value": "d90e46cbdba6a5fae2cf4cdddd1764470a804924e00912e24308c71f79ebc622", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383381, "uuid": "5d9158ee-8d3d-4d8a-a189-d135e0e93648", "comment": "Malware payload (AsyncRAT)", "value": "d92091352af70ee224c79d751dea42bcc6609731", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383381, "uuid": "152c0f3f-fbf4-48e6-94ac-c665708a328a", "comment": "Malware payload (AsyncRAT)", "value": "8df1c317677e446047e329dea701886aae57f500d7caac7a14512b009b87297ceed39d020ec37992e7ee075d7531fa25", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383381, "uuid": "871cea40-38d9-48e2-acc7-d68e1a7bb3c7", "value": "T1CE033A08B7F84965F2FE5B7D8DB182005335FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383381, "uuid": "a236271d-4924-4e33-9d4d-565dcb175013", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383381, "uuid": "985bf3e3-80a8-40b4-8636-0ce2de870b65", "value": "384:g7DC9cMCckEQS/1f2bnTn8QHmp2M7739393bayse6QxnC7O+WRl3uuhGfrNP7UU+:gnCIckED1ebTpwFRbJpB+WWP7L911j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773383381, "uuid": "78efd115-11de-4c83-9786-85187f25f875", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773383381, "uuid": "4ea4673c-6a8a-4bc0-913b-e753ac91f3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383381, "uuid": "219c0af4-9835-4017-b0fb-9c3d66403d3c", "value": "RAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7c302e-1eef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773415019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415019, "uuid": "f5818c4c-86aa-44f0-a73d-418b9c29c575", "comment": "Malware payload", "value": "2982edfd9082d1761f7b0c188e99d07d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415019, "uuid": "fd39c62e-3b87-43a4-abc7-76807f049e4a", "comment": "Malware payload", "value": "da8bbe667f0ae92fbe02aaf84cf9b6d646335277dd91130a0af80038c96830a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415019, "uuid": "f8c7efc2-93ea-4306-a883-f3a3e3d2a14a", "comment": "Malware payload", "value": "ae92ac688e8e804c1ceff03e4e1427796e1767dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773415019, "uuid": "2831dfe5-05c3-43c1-9e39-574dcce8ed0c", "comment": "Malware payload", "value": "a19badc2224375b87042c3a358929fe20e0455adfa3bf03c4593c70b695bac081116127529a1397a4a140764581162c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415019, "uuid": "b6eba797-c315-4534-8d1e-6ec4d80bc31b", "value": "T13142387621F08A3397D025C4A37717A55F72E60B44A724BCF4BE1A399F59B0370EBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415019, "uuid": "b5e7d152-8a1a-4d81-b52a-73b5e3b28888", "value": "96:cCu/mB6n7sht+O+v1fsn+h4+tIicqbA/GsGqNz2rJO11IB4IBq5rC2OJyJpJDDAz:cCu/K6nC4hvZ5mzjE+f1mSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773415019, "uuid": "0769d671-da96-469f-a60e-8c92104c7f0e", "value": 12732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773415019, "uuid": "90f2fe59-095b-4769-b87d-88cda406663d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773415019, "uuid": "6017a213-5c30-4e29-ba31-829c2f7b4b3a", "value": "da8bbe667f0ae92fbe02aaf84cf9b6d646335277dd91130a0af80038c96830a1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55189786-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773407138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407138, "uuid": "70af895b-974b-4605-bfd2-239478d35b35", "comment": "Malware payload (Mirai)", "value": "0c5e43e51d3c2a00f4ac1b517891872d", "object_relation": "md5", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407138, "uuid": "e6cd0408-15c4-40ff-b622-03aab5679fc3", "comment": "Malware payload (Mirai)", "value": "db3a48697e0dc96054a64e689f45f99a9f21e946c2c5e155b1efd292aecee3e2", "object_relation": "sha256", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407138, "uuid": "ce470301-c3cf-4619-81a5-7454d0f67148", "comment": "Malware payload (Mirai)", "value": "e181b0bced3353f229f902077042725a1504f771", "object_relation": "sha1", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407138, "uuid": "69e92cf9-5a36-4d76-a8ba-def451ac558e", "comment": "Malware payload (Mirai)", "value": "a4e7f6869bac2fcc7b7f00e8d631b0a9cd0a64156644e102249a5b946aa5478e064b8b7cae36e9bc195cdf27ff993d41", "object_relation": "sha3-384", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407138, "uuid": "52a8a77e-7611-4951-a98d-af6dfe04713f", "value": "T1A4314491BD90AA0FC9A14273AB5E9788B3126A46C9DEB313E75353300D2F32B6E27155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407138, "uuid": "14cf6d4b-a2e4-4edb-b5f0-db1457dc524a", "value": "48:WR+DZDbbYYpFLOMPlg0qQIUogF7HIYoijNj/:WRF+FLCNdSZRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407138, "uuid": "095aeaf5-2304-47ae-8a9e-de1f64324830", "value": 1808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407138, "uuid": "0e1aedb2-9688-4413-8aa4-a9229c6e21d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407138, "uuid": "5b02aba7-772a-4610-80c6-672245493fb0", "value": "dlrarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac9d28a-1ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773398397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398397, "uuid": "8c52a59c-24d0-4743-ae1d-2cefa8c488bd", "comment": "Malware payload", "value": "bb49fdb138172415017113cb88851380", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398397, "uuid": "55c7024d-676e-4212-976f-0ad8fef7ddb2", "comment": "Malware payload", "value": "dba42e61da701b6c4fed4506711523756e21000f1c541f25a03e51484f1dcb34", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398397, "uuid": "fe33287c-c453-4ff2-9e21-4b17671191aa", "comment": "Malware payload", "value": "bcbc5972ebadd3770abc1f39901db99a7cf02afb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398397, "uuid": "82cb857b-e138-4db1-9e49-ce714f8a4222", "comment": "Malware payload", "value": "619544bc1822b385f60518f160e7e2614a21beb2c8b41cb72d7069f55dca3cc04718ec904fffe980a3175de116fe18bb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398397, "uuid": "35b18b4c-d5c0-4842-828f-dd28dd97b258", "value": "T10D62340D01626AF096DC5F8AC111AC02E45F71B98628A20CE79EC779FFFAD4154B64EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398397, "uuid": "20905826-f498-4c9f-85d8-9a974db5be86", "value": "384:e3znkxVUnp4tj9/3PJXmcbfMN/gz+BYzTj8Kpqe3UVTOsVP2RWQTnez2c:DVgpOPtgN/7JlOslLCez2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398397, "uuid": "494ebb3f-a9de-4ff9-ae73-87ec42ef0eac", "value": 14912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398397, "uuid": "47d0408e-e11d-4545-ab35-d830d8363417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398397, "uuid": "34740682-e8b5-46f0-bebc-3cfe59750264", "value": "Q587VyxQ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8958fa11-1ea0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773381027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381027, "uuid": "4f41054f-33f5-4400-b4a4-210aec73937c", "comment": "Malware payload (Mirai)", "value": "e4eab9db8c36b4b76eec04e75797ebca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381027, "uuid": "9449bf04-c59a-43ec-afc0-ea19a0985972", "comment": "Malware payload (Mirai)", "value": "dc4c4501e56d73d40a8e5fb00f4e0ad74335e2aa8c588373509438af312b1450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381027, "uuid": "a7683ef2-3ce1-4040-8a50-54d400f75fe1", "comment": "Malware payload (Mirai)", "value": "441d28d6c8b9e0e9294f3b843a10cdf2a05cb556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381027, "uuid": "54b0aa29-5e41-43c7-928d-ca1802d0d639", "comment": "Malware payload (Mirai)", "value": "7b1a0c702d9f2f8dd441b76c2cd03e51d178974ee7272779816ceb9847d2b48030ca3d5f58af6defe21d116e930a5cbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381027, "uuid": "4138abb0-4d01-44cc-8192-b7878b08285e", "value": "T185C3FA5E6E329F6DF16DC33147F79A20D35823C623E1D685E2ACC6055E6038D681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381027, "uuid": "05024fa7-2173-4a2e-9ce8-8e6b3c6e0c5c", "value": "1536:DT/sAACw/FMdfdmrWLqYKDpG96O/aRX9Y1IfRA66OuJ11rpEzKdl3t1Ke7GD5s9b:DzzAf+AqLWRX9W7Ezilfcs9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773381027, "uuid": "434e0d3b-7e2e-4b37-85f3-b1349cf48646", "value": 119956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773381027, "uuid": "c089a119-ec67-4b2b-8ae1-10a86aaacb07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381027, "uuid": "0c03aa79-0f5c-48b6-83bc-9724049dd330", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec127cd-1f01-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773422670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422670, "uuid": "6c45af13-2679-4ee9-babd-2af303d9ae1f", "comment": "Malware payload (ConnectWise)", "value": "1dd1f7465f4c60c5cb9c6b437e4a8e9f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422670, "uuid": "55ed57ff-4d08-47af-a0b9-fd22928eb317", "comment": "Malware payload (ConnectWise)", "value": "dd94c6b2076036c2fcbcdacc46e99bba82341ddcabcd3f6469bdf30395dbbe22", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422670, "uuid": "f7639004-f04a-4ccf-b2f5-c3c4062b9296", "comment": "Malware payload (ConnectWise)", "value": "3544ec1c5c43e171cfad8693241572b384802f79", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773422670, "uuid": "76669518-4952-435f-b12e-55b0e3bed768", "comment": "Malware payload (ConnectWise)", "value": "0ea3fd5ddade084c772532d4ae08d3f93967b97be9d1aa8d27f67024db35b55640b221c483a89f6a0742f4bc0c5837cf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422670, "uuid": "9edac8f0-4662-4d2f-be16-99d6baa46e35", "value": "T1F1F633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422670, "uuid": "74a4fc0f-31c5-4781-91ac-dae7002ecac8", "value": "393216:ROvTi7hha62b3N11dOvTi7hha62rOvTi7hha628OvTi7hha62:ROvjb371dOvjrOvj8Ovj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773422670, "uuid": "719c0f55-f9be-4214-b0ed-f7fbab6c0c5a", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773422670, "uuid": "60ec148d-870d-46fb-83f1-74114a5afa48", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773422670, "uuid": "4b00ecb2-9da5-4790-8187-db6eeceab813", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d89357e-1f1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773435177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435177, "uuid": "7e39278a-ebbf-46f8-b43b-e267a98210ae", "comment": "Malware payload", "value": "c9ce02f6556d78d9269958f32534c047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "host-fedmenigga-workers-dev", "colour": "#24A11C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435177, "uuid": "9d21ac55-6411-422e-bca8-469a3557afb4", "comment": "Malware payload", "value": "ddf83332d48455de0c7f9998b806c56eecdf4fc82dbb47d09b838aff77ac540e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "host-fedmenigga-workers-dev", "colour": "#24A11C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435177, "uuid": "19b66126-f41d-45ad-b4a1-390fbd778b7d", "comment": "Malware payload", "value": "4958004fb193ee90efc732415fb0f37a1dd6eb76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "host-fedmenigga-workers-dev", "colour": "#24A11C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773435177, "uuid": "1fd52a2b-cd22-49f1-9816-1de812cedc43", "comment": "Malware payload", "value": "16722b84f0a718efbf9acbdaab01c411175875c2c6aa5de727092c42193389e21a8aae15331c75f9ce340e20f5b00e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "host-fedmenigga-workers-dev", "colour": "#24A11C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435177, "uuid": "ebeec46f-c769-45f3-9959-1d1a4c40b557", "value": "T1CE04390776AC51FCD16BE63889A34906F777B8164B3292CF0390967A1F72AD0EE79311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435177, "uuid": "fcedaf7d-0071-4b14-a322-52435a9eabb7", "value": "72bc4dfff8905033c11dea0c671a7919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435177, "uuid": "c78b0ffe-730e-467c-9895-cf9a756e3d8a", "value": "3072:a7LW6Pr46prwG2k5GlI1JWE9QVsxyvJyn4NTfQf1VZlHWhrchCKv:aXWJ5kICW3Jyn4if1VZJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773435177, "uuid": "26f9672f-d488-4149-aa10-decdea7f4f40", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773435177, "uuid": "7650799e-fb2d-4c5e-aba1-fbe875fc287f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773435177, "uuid": "7b1f1e17-d478-4fc4-8f01-123f2755d191", "value": "Exodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4adfc3-1f24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773437509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437509, "uuid": "0cd621f2-bfe7-401e-aeb3-f92a796179e2", "comment": "Malware payload (Mirai)", "value": "3ba28733af3714fe61cba7a7668c64e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437509, "uuid": "b5c9aaf4-1b05-4d87-b4b4-28a155d208cd", "comment": "Malware payload (Mirai)", "value": "de23649055e3a417734c0f14a98cd9f6b22d74b9c0bbddaefd1278fe2a773d8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437509, "uuid": "cafe5370-08b4-4d50-891d-ce626935f263", "comment": "Malware payload (Mirai)", "value": "b53c1340bd67a6f71e3e388db503a6f71a6e8428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773437509, "uuid": "13285896-853a-4f63-a717-57eabda52dc4", "comment": "Malware payload (Mirai)", "value": "b27ea1c63799b1de3689735712436a7019e8ac05124a7c7054ffebdf97145a6ce31fa6627e5f99d1501563ec6952af57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437509, "uuid": "cc16da97-1f6c-4931-a57b-e0ecdb623a3c", "value": "T1DF24C70ABB520FBBD8ABCD3706E90B0129CC655726A43B393674D72CF54A54B4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437509, "uuid": "20ef8763-1a88-44e4-8d38-b4629ef948bf", "value": "3072:AS0zqhchKA8VCGuMCcTsPbXMquhO5UgINZ8rC:AS0zqhchKrVu9PQXuUtNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773437509, "uuid": "7ef51ffd-04d9-4f22-9a9a-28b9f0fed658", "value": 209912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773437509, "uuid": "d85ac117-4cac-44b6-ab67-0700f388f67e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773437509, "uuid": "a3153064-859e-46c1-b94d-c82dbc33cb85", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da1a1aa-1e8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773371478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371478, "uuid": "e1554de6-d8d9-472e-b1d0-d758977a3820", "comment": "Malware payload (Mirai)", "value": "676ec1f9c5d7cf545ff151c33e9f85bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371478, "uuid": "08bf8d61-2f81-4eff-a10c-975f198f2746", "comment": "Malware payload (Mirai)", "value": "de62aa924bc7e48d6975c08706e47d1b85fda9c5bf22a3b84c37493681897a73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371478, "uuid": "5a6d224f-b8a2-499b-be77-95f5ba10ab12", "comment": "Malware payload (Mirai)", "value": "d4d3e36cc7def579500669e30d2d2d9f71997666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773371478, "uuid": "847f9c64-18fc-413d-b30d-2a44abed668e", "comment": "Malware payload (Mirai)", "value": "80e111d26ead660c9ad2dfbb57d244012bbb2f8c63bedd996ad6ce66f9e03e679a0d56f42a0b634e42e60e96fa214b8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773371478, "uuid": "b66cab85-60c1-4dba-a915-4bbad758d497", "value": "T1B0A31991B8815613C9C556B7FB5E429937170368D3EB3203AE348F72378E89A0F7A855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773371478, "uuid": "bc80eb6e-2eb8-45f8-83eb-6e937b89212c", "value": "1536:iG8jibaOYcb5WbNw/BdgntXS0PpgaMHSOQvEWvAJyABj3XOO6gWe7aT:/DnGNw/BdgntC0xgaXsMMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773371478, "uuid": "72d67705-bbe7-49ca-897c-0623cd48adc0", "value": 99660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773371478, "uuid": "6a0dd1c9-6a22-408a-8da8-f8f1566f535e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773371478, "uuid": "fe4728a0-4bb5-4642-8156-9492ffc59e78", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818e590b-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402059, "uuid": "bc83adf5-8abe-4b99-a0b2-2105f164100a", "comment": "Malware payload (Mirai)", "value": "31cbec18a588833ff788493c0a188361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402059, "uuid": "1f1af154-c357-4d02-b767-d1917d05c99c", "comment": "Malware payload (Mirai)", "value": "dec30b62380655d7f301450180509619a62a8a4669fe35aa29dc307706be984f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402059, "uuid": "0d316c17-3c2c-4792-a137-5d47a0d00e9e", "comment": "Malware payload (Mirai)", "value": "20c8cd52f0066d7d2f406b05671b001620c08cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402059, "uuid": "0d8fd0b1-05b2-4eae-8642-a1c8fb8df60d", "comment": "Malware payload (Mirai)", "value": "be9ffeb49ec29fc4149243bb6f4e2ce51e29b9cd8f6f6f9011cf68950db64733c2a8506786b453a9e4dd309f4082df4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402059, "uuid": "57ea6c3c-8c88-456e-a862-49668232a644", "value": "T115B3B409BF655FFBE8AFCD370AE91705288C651A21A83B757934D818F64B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402059, "uuid": "320ea144-f377-4b3c-9caf-277028f3a9d5", "value": "1536:gyLvbCEoDJh2CitsYsBJcThDvy7iCZs6aUX1zPGRYR7ypTOm:nvbCEoH2CKsRRZs8G87y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402059, "uuid": "727056a6-c203-401e-8091-6a82a16d8e61", "value": 113848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402059, "uuid": "0b377358-b6dc-4b73-ae4f-b33deff342ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402059, "uuid": "ba8b6c10-1990-44ad-bec0-f09d35f05e24", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1839a4-1ea6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773383528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383528, "uuid": "81090b9a-3d95-471d-b303-8db6e402bfd2", "comment": "Malware payload (AsyncRAT)", "value": "d49919f4d02f9166510fc18a681bb771", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383528, "uuid": "c321d24e-8832-4d96-bf8d-812603d6495a", "comment": "Malware payload (AsyncRAT)", "value": "df77882b491689f9e5672f9be082dd390d979dff8a0f7839fb301d629c14b533", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383528, "uuid": "ae605515-2207-43e8-9297-d52afd72f823", "comment": "Malware payload (AsyncRAT)", "value": "c4e09ca8c6ddd8342fe0a4e32f39a7e4613e0e43", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773383528, "uuid": "663bbf5a-a6bc-4ebb-8428-27d210f6f946", "comment": "Malware payload (AsyncRAT)", "value": "4a36d83da596512a530b638618133485370dbdb5c62f91b9f23430e31f8c8618467ff42102774f5b547c87149caa4b6e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383528, "uuid": "1e75e442-0770-4b57-b193-15574f8dd296", "value": "T11B034A08B7F84965F2FE9B7D8DB182004335FA579D22D79E1EC4508F5A63788CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383528, "uuid": "c64f3ed1-7bfc-42ec-b4d2-905b21a96922", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383528, "uuid": "80590f31-c577-4002-953d-21091e12900e", "value": "768:ZnCIcEJbMSVnbTpwFRbJpB+WWP7Lc1Wj+:ZCl6bMAnb9wFRbR+dmWj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773383528, "uuid": "ab5dfa00-aa7f-4a3d-aa62-eb0a18d8070b", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773383528, "uuid": "b1dde640-bd53-4f8a-803b-5a7dcad5af5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773383528, "uuid": "298a9f7f-6017-423f-8da6-60f3bddc190c", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6de7ed-1eb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773390083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390083, "uuid": "2b2275cb-ad79-493d-aeaf-765269bb4cad", "comment": "Malware payload", "value": "1bae33c9ac75847392fc8ef4311f09e4", "object_relation": "md5", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390083, "uuid": "a30f1ad5-ea4f-46ed-bfda-2d2197c61923", "comment": "Malware payload", "value": "df7fe0c838764d0077be9a88acb4d93f9de0ecc29b677995fa12436d8df3bdb9", "object_relation": "sha256", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390083, "uuid": "2a6a73dd-f1dd-4c31-bd63-06775c5a6744", "comment": "Malware payload", "value": "c5a21e7c2b0f8dd24b220d11b2baac79a37bb723", "object_relation": "sha1", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773390083, "uuid": "7e52b715-17a8-4946-9500-ef6b985fe08f", "comment": "Malware payload", "value": "8ee3f194ff38e8ea880a61d8b8247f8aa64b57f672673656a1e51c5a644108f7172c4bbe123f1af2bba8770e6baf7775", "object_relation": "sha3-384", "Tag": [ { "name": "186-169-43-64", "colour": "#25F79A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390083, "uuid": "7cbe2dfa-c356-4a2d-8bce-4ff8b992ba4f", "value": "T1449598081FEB84AF75A37D5045E0521B9B7BFABBA5708B9F048103CD07B3508556AFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390083, "uuid": "41b5a955-5dc1-4100-a777-2a7025352039", "value": "24576:Mf0KeZ8WtyKHUpgoSEckwfqY4cmP0kWJVPMF:3O5qHJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773390083, "uuid": "c12f0352-f7b4-4fef-96b1-ac582b75c30e", "value": 1924518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773390083, "uuid": "ed696d29-950d-47df-a7c9-ec9773531e70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773390083, "uuid": "fdead4f8-164a-4ca2-b7c6-5819f316a316", "value": "df7fe0c838764d0077be9a88acb4d93f9de0ecc29b677995fa12436d8df3bdb9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc66cd8a-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773412493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412493, "uuid": "69e9d8e9-54de-4f05-b190-983380139326", "comment": "Malware payload (Mirai)", "value": "1688b7461c74a0752bd2e4c9d76f98cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412493, "uuid": "5edf21e2-0dd1-444c-93f3-d9b8a2da39ea", "comment": "Malware payload (Mirai)", "value": "e06cabee30edff3e4d4cdcd413eef1adcad0009ec695af4cf4e861bcd5af614f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412493, "uuid": "86b24a3c-67bd-474a-809a-6172555ce6ea", "comment": "Malware payload (Mirai)", "value": "cfeb5820b9814d457cac23a7358d0d958a28ec12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412493, "uuid": "7ce5977b-cca3-4638-8031-662c8a3f3920", "comment": "Malware payload (Mirai)", "value": "15f655a1333c50b2a97d88b3ebd0ff6309b4b548bd0217cea1c4b67251e42b7474c1b2d7a209551cceaeacb11295c1d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412493, "uuid": "ef8d141b-bbf8-47f4-adc6-d1524c501397", "value": "T1804319791985F67CEFE10078F09320E6256247183B8D95D36193643BFFB5A0873A9E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412493, "uuid": "6f378c12-045b-4913-a858-2aaea9a0e461", "value": "1536:aND9xxEYYxmeT/cuOosbYdRjklvZ6bzuWh:aNPxYmepOosbYdRwlhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412493, "uuid": "c1344aa5-bc84-4da9-b57f-538bafbd7f43", "value": 58804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412493, "uuid": "b620db44-540a-4741-a18e-979e55a4a68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412493, "uuid": "1f3da7f6-d27e-4bab-ac4f-7097fcd50bc8", "value": "SecuriteInfo.com.ELF.Mirai-AAJ.11431921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c456079-1eb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773391742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391742, "uuid": "89e3756e-13af-4de3-83c6-99fba601ff48", "comment": "Malware payload", "value": "598e02949b561a95d6c0bf9c0e49779a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391742, "uuid": "68e6ad42-a845-4064-930b-5bc7ee320948", "comment": "Malware payload", "value": "e0feefdb61a4101660c2e4821ab96e8789f6b3e2eaeb8aca1ca5389d56aa09f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391742, "uuid": "ba120f5b-df45-4ed6-97a1-6a2362b7dad9", "comment": "Malware payload", "value": "065538caafd91980d6fed79ca5e7d4611cc51d63", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391742, "uuid": "293350c7-f46e-486d-abea-007779d377b8", "comment": "Malware payload", "value": "973bbe743469e7d60c99c022e0f0e4dabc78e4db242efe0b13919224828926bb29a16e10ca414c7c10918ecdde1accf6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391742, "uuid": "5c212b15-e402-4109-a1db-abd9a8b2608d", "value": "T1D78633051F424E6CE5280B38C00350A477F1D9A65657EB3F3FEE40BA6E77F88DA25992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391742, "uuid": "504d9405-c24e-4b25-bbef-e47054de3153", "value": "196608:gCAt/nyFffNZYl6zNDNRNsa8P4DCGbqlZ3QYM3W:94Pytwl6zNya8P4DC3A3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773391742, "uuid": "42b81f11-c680-4e9a-88a7-bd34154b22cb", "value": 8502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773391742, "uuid": "d909f75c-cbe4-4255-84e8-44c9818f815c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391742, "uuid": "5494ddad-cf6f-42e3-9c65-ab15bb14d731", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3afb45a-1e8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773373823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373823, "uuid": "23c11e15-a42a-4b6c-8fd6-059ed724216c", "comment": "Malware payload", "value": "6ea5ba8981ebe6c225fc4e98f1101575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373823, "uuid": "c9aeafbc-0788-4114-b46f-0824e8a3f207", "comment": "Malware payload", "value": "e13780da0bd60617e54a2819357246d64227576e753c46a5108d2c653fa73f9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373823, "uuid": "5a2fbd8b-ff17-41db-8e82-46b38ed6d2e7", "comment": "Malware payload", "value": "88a6df83bb6643a477a6440584ac798f99f039b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773373823, "uuid": "bf747eed-1544-442d-8dbb-218ee0575a0c", "comment": "Malware payload", "value": "bb3221aa3b44321514704ac458a52d42897df5d86e1e5e64a3515f159704eaaad335f1634e0879885fe2bf8e24cb66a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373823, "uuid": "9f48f6f9-d16e-4a7c-963b-d75e75e4d2b7", "value": "T11A7302056F15ED0BDF100C733ADC8E9D8DB9AE5B49ABB0B568E1948F67911CAAC57300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373823, "uuid": "36335ea4-6b78-4a3a-8e02-0d273a27e05f", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFN:phNlHuBafLeBtfCzptaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773373823, "uuid": "5e9f6cfe-2ff9-42f7-8f28-f3ccb34b7308", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773373823, "uuid": "70cecbe8-bef9-48a1-a612-bed6e96a6b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773373823, "uuid": "e9ae4b9e-bea4-4116-bbab-2864c35af892", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c138fb7-1eab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773385595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385595, "uuid": "c98d84a6-79c4-4591-a664-a00fe75d0153", "comment": "Malware payload", "value": "dc0be39564496f874d2f72b8d6745be4", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385595, "uuid": "bda4c9ca-a94a-47f5-9b28-e42bb4c623d0", "comment": "Malware payload", "value": "e16604d0eed69a870f5d340266c3459c5516f8a548ab61e04ddb87f10b3cf256", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385595, "uuid": "7c4ed271-940a-4244-bf20-55c99327a7ed", "comment": "Malware payload", "value": "67f339dfa39c8b22624b26db5cff33e56743f5e4", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773385595, "uuid": "873e36a6-7964-4317-95ec-5d0ea3319efa", "comment": "Malware payload", "value": "b12289f1d2722c101c3ddd3b18323457cc0bc4d6cf0f1f5d1be6fc4de5daadcb24be5fc59539dff8bbf53ee0d238d76d", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385595, "uuid": "5f861257-bc81-411e-bc7f-4192ab0bb6f1", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385595, "uuid": "c7736180-7a6f-4c4c-b2bc-00de3201d73d", "value": "3:VSJJFIqF1F65IFdPoA:s8qF1F0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773385595, "uuid": "3853f43b-a8cc-48c0-922b-e5b9f603e1e7", "value": 48, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773385595, "uuid": "77bf55f0-a937-4077-8a9b-567d631099c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773385595, "uuid": "945922a6-83d8-4d47-a79f-fa5e88fef0d0", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31c166e-1eb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773391888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391888, "uuid": "2d488aeb-13f6-4ccf-ae98-496a1cfdfd80", "comment": "Malware payload", "value": "5e24c58eb15249f7d4d087f66dd1ce02", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391888, "uuid": "1b44247f-164e-40c3-a0ad-6acc73e79d5b", "comment": "Malware payload", "value": "e2b75baeb7ed21fb8f27984f941286770d1c3c0b60fce8d7fa5b167bd24ba6dc", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391888, "uuid": "471542c3-a7ee-4ca9-9cd8-f4087eb67ef2", "comment": "Malware payload", "value": "e45cd29f904ab54e0d7f831982c7a78b4a370e9d", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773391888, "uuid": "84b6f39c-7af6-4090-a7ad-9f29e3584713", "comment": "Malware payload", "value": "1cf806e319e2d8b3d124392d1c4d4dd58a869730b86cfe6fb550684ba324594c2ac887ed7cca6405ddbaa26e6f3b57de", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391888, "uuid": "7e9907f9-402e-48cd-aacb-842d0149ca39", "value": "T101F3E0689904D8DDF9DAC2A35B757C02454CB39BA7C880F13C6D0DB2DB80E46DFB2659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391888, "uuid": "8ffba8b0-c338-418d-91f3-ee17aa1b104b", "value": "3072:Io+6OZPu1eVRWDSax8s6k7hQ3pkpb4ji/kcPn/mdEjqTFikwWuI:Io+5PhReSGPSpkB/hPeBQmuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773391888, "uuid": "d7a8d3b0-0fce-4ec1-80e2-047d23e24dbb", "value": 158441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773391888, "uuid": "5a30024f-7d93-474d-9060-cd74f1fc8afd", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773391888, "uuid": "07b55856-dd95-4217-a589-a584ed339ef8", "value": "Shui Wu Chou Cha She Shui Qi Ye Ming Dan .pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9681ab61-1f22-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773436883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436883, "uuid": "c72e6953-82fc-4a6e-8875-19b4aa55bf07", "comment": "Malware payload (njrat)", "value": "7d19b113f3faf859bec3e2c89fc80e03", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436883, "uuid": "4cc26692-32ca-4b59-b2af-233764047d1b", "comment": "Malware payload (njrat)", "value": "e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436883, "uuid": "492c35b1-4e03-4841-99f4-e101d77e0fae", "comment": "Malware payload (njrat)", "value": "640c92982d1d3de852daba1e51036d1950f11ee4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773436883, "uuid": "c9267bdd-950a-45bd-903a-f43455946ad6", "comment": "Malware payload (njrat)", "value": "cf513808db67254f50393398805eebf1857f6f53b92189b3e4e81dac1200983a48bedbee7e23e635aae18cdf247744bc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436883, "uuid": "9add5313-3807-4782-a03a-02ce34e81db0", "value": "T107E5E667AEA68440E94B407178FD7E44387936F3C0C9D15C826BD29057E2AF6F64ECAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436883, "uuid": "69d7d154-8c72-438c-9ab1-9b3c37aba9fd", "value": "24576:+zy3FLJvoQMmS5icfUvQfCvMWist7EC9B0GiI7yoyaKgIhsi4t1C5gJYDW8s:+zy3tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773436883, "uuid": "55fb7fba-1f45-485b-9cae-02d25bab446b", "value": 3309962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773436883, "uuid": "97c4e33a-468b-4bc1-bc10-02628d07b4a7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773436883, "uuid": "770dab56-2325-4e25-bc22-f028264757fc", "value": "haunt.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a9fe08-1f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773427269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427269, "uuid": "f270daae-6217-48ce-9504-53f4b4689504", "comment": "Malware payload", "value": "ba03d2ed5ec326628d3c5f4bf613f414", "object_relation": "md5", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "CLR-patch", "colour": "#B81AEE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427269, "uuid": "846f397c-55d3-4385-913f-3e0cabeab419", "comment": "Malware payload", "value": "e4cde29a0d57b577c238160458bc4f8a9aaef78dba554d068aeac8c23b54c23e", "object_relation": "sha256", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "CLR-patch", "colour": "#B81AEE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427269, "uuid": "e566b897-dad6-4e31-bbef-61d6edef8afa", "comment": "Malware payload", "value": "5ad17ed21c5017e78f3c88b58dd42b5f22962c12", "object_relation": "sha1", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "CLR-patch", "colour": "#B81AEE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773427269, "uuid": "15b1a2a7-8b64-4409-a01f-7f44a36c71af", "comment": "Malware payload", "value": "e4b2a3f3736701877530bc9ba6c4670fd175d43543e171993589a6258321d385097942cb951ff95ebef0845573c91046", "object_relation": "sha3-384", "Tag": [ { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "CLR-patch", "colour": "#B81AEE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAG-124", "colour": "#5A374C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427269, "uuid": "8d271ddb-67f3-4310-b543-bbf7aca37d8b", "value": "T18B1263E17DE55BB78EDB54E2D8D3EAC28D257F21000634109AE9CE135C6E0694DB223B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427269, "uuid": "b9507728-13bc-4fc6-9606-1218c911199c", "value": "192:aMz5nov/ppOLmYj54Cpt2ErIA4q4ThUm+1A:aMz5ov/ppOLmYjmCpt2ErIA4q4ThC1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773427269, "uuid": "496fa719-34c1-4cde-ad91-02bf2ec6218c", "value": 9099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773427269, "uuid": "6039ec20-2545-45a2-82d4-d3e1710c40bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773427269, "uuid": "672de8bd-3a62-4be4-a0e1-fc1b6499240e", "value": "stage2_inner_payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67d8372-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408161, "uuid": "94ba0604-98f1-4923-9e04-a9472a436ff2", "comment": "Malware payload (Mirai)", "value": "75ac5b70ae7ab50b4fbc75e64643eca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408161, "uuid": "7b26210f-a498-48dc-9d87-84393061ef6b", "comment": "Malware payload (Mirai)", "value": "e87700e1c78335c9165eb5aeea10f4bbd2c9dd3ba8fa5f2d45203f0e6da20b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408161, "uuid": "ade3471c-7ddd-4223-9f6d-f2d2e9c5e198", "comment": "Malware payload (Mirai)", "value": "2333d10c6244dada6b489ccf7ba8a4babee4e9d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408161, "uuid": "0fdc2151-7700-4721-a95a-0d79a9f211f2", "comment": "Malware payload (Mirai)", "value": "91bb4a377b9b998ca7cdc9827db36067246ec28d114e27aed670b38f19c5602a2bb5442f862f088cc49c2180a1c94698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408161, "uuid": "9f325844-5b14-4038-9db5-6ab26bad36c3", "value": "T176736DC1E683D8F5DC120A71317BEB339777D4391129EF86D7A8A932AD42601E51739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408161, "uuid": "14aa2cc7-967b-445e-9e0a-590fa8b6b1f9", "value": "1536:YWKIDXUpvtwvahnjUlZdqNAzoZG2k3i+btj2lIkeJEHetT3E54Sn7S+3:Ymr2SvahngfINAzoZ5k3jbtj2uLJaetW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408161, "uuid": "85ba4d8b-1331-4fce-b5ea-61cc3bf30188", "value": 78736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408161, "uuid": "f6fdd33f-a7d6-4d63-b87b-3f66afd0020c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408161, "uuid": "cffc1c25-22a9-4789-86c9-55a0eb671734", "value": "SecuriteInfo.com.Linux.Mirai.9774.18497.20812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880367be-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773402070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402070, "uuid": "21f4af75-5a6f-4e0a-8218-9f78f26c4e2d", "comment": "Malware payload", "value": "af945489c7cac094c823253a3841b292", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402070, "uuid": "0db9e4b5-2332-4207-9e15-cc9ecd6c4d51", "comment": "Malware payload", "value": "e923f881a1106ff5e11c9d61815b124964929a3b8a925c91388e7976f19c3cf0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402070, "uuid": "f106055c-a26a-47db-b544-47d7af89af65", "comment": "Malware payload", "value": "9527af34f5c483f666bb08e3cf47139fab68e4ab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402070, "uuid": "365a89ca-968d-4666-945f-db36f81446fa", "comment": "Malware payload", "value": "d06924954dc4bb4b5dab9cad8c9cc2c3dc89ee8d06b6b066ccc3be1ff17db1a12893971b90bb4a96cdd653ccc17fe0b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402070, "uuid": "8c82435c-e99f-4ead-9537-9484763f4c5a", "value": "T190E43338B14EDEAAE66F2FF4ED108623F7D0210D5C898C6C13E6C8DD745296A82CCB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402070, "uuid": "9ad9dcd4-20e4-40d4-9a5a-c687b64ae89e", "value": "12288:YkVOxDem7/a/breWluS0ersVLkIwDGiXOf3xI7n/VeWnIZTx:YSOxDF/0d8SRsVINX2u/VePZTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402070, "uuid": "0d6645a0-17b4-4b91-be08-96fe9e0440a3", "value": 708482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402070, "uuid": "3c369a92-98dd-4a5f-9f3e-538992a819a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402070, "uuid": "8ef011ba-9a0e-4883-a495-592ee337f349", "value": "xyz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bbc41e-1f30-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773443009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443009, "uuid": "7c03e09a-0e00-44ba-a09e-f12c03bb2b85", "comment": "Malware payload (RustyStealer)", "value": "e7bc70deac880ed4697622488ec0a4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443009, "uuid": "f8e6d570-2640-4149-b483-eda7e4fefa38", "comment": "Malware payload (RustyStealer)", "value": "e92577746ac6de3cef8c3bde6a4b01030a962d5bab70a6274ac16079be50b4f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443009, "uuid": "c7434704-0083-455f-b66c-f4479d516ec1", "comment": "Malware payload (RustyStealer)", "value": "f68fefe118a1af0823d0e16b31fdb3eeab98f6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773443009, "uuid": "2637f2ce-ee2f-47c7-9dfb-f8207ddc04e8", "comment": "Malware payload (RustyStealer)", "value": "40ec8388dce7440b163c58bcca2dcdc5a27088c0f6501deb302bbc0c72e5c9aac433a71ea52a68463e7db20f2ea4e3bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773443009, "uuid": "a20d3d93-2f02-44d1-926b-59b4e3927e09", "value": "T12CF6171020D96607FD7EEFBD85DCB6444F7AB2953722EA389B4109E90FD1B08C9439A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773443009, "uuid": "52705417-ebaf-4689-8bd5-eb1bc5274a57", "value": "196608:H0c1Tc20otoRNm/lDsjc1ua1kVwT2Mq1NB1ITDytwFPs:HxR0otANmtDsjc1uGkI2Mq1N3I3ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773443009, "uuid": "f09c3f81-7b3c-4cc9-a697-1cc386131f11", "value": 15328768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773443009, "uuid": "9b221371-a54e-4229-b9de-cd134d23a1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773443009, "uuid": "019ddab7-53b4-479e-9880-4281d8a987a9", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7798055-1ee1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773409075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409075, "uuid": "ba03cb95-26d2-47de-b6cf-f8efb6cef936", "comment": "Malware payload (Mirai)", "value": "94b16313c2938dab152e47ec6ee2dd05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409075, "uuid": "7d6b8b17-ec9d-4cad-8d11-b306cd46e25f", "comment": "Malware payload (Mirai)", "value": "ed6df656b2e4517a6a7d4024381cd920b1ec96518c1b05526f24f8b3c0739b19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409075, "uuid": "09ed3dd0-8209-474a-88f8-cb3cd6504f66", "comment": "Malware payload (Mirai)", "value": "0c9002dfc353029b1b284e030cfa181f974f5e13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773409075, "uuid": "0a3c3496-5f3d-4d6f-b0b7-2adcc272d3a2", "comment": "Malware payload (Mirai)", "value": "8c93fca92c28ff8baef1bebfa006d56f982396a0340e64a0ac3f2c41eaf8e9317f0484beba914d18130e0bdb4b99d6ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409075, "uuid": "1d2815c4-ea7e-442b-b6f8-2adf1355b933", "value": "T1D2836A25BC792E13C0D4B83F22B78325B2E5230E25A4CA5DBD760E8EFF156A034575B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409075, "uuid": "bf846df6-d86d-409d-ac15-c20ca14f7f03", "value": "1536:bKMo/69SyAXsE3QdMvjPV4jlbO4WQ5mQ84UAEO1K:2hCsZ6M7PIbvW4h8rAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773409075, "uuid": "9084f655-397e-482f-8c0a-2abea1e407fc", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773409075, "uuid": "d432393e-f00a-4e8e-808e-bee97fa960e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773409075, "uuid": "9928c744-59ea-48e8-8f46-17699301dcaa", "value": "db0fa4b8db0333367e9bda3ab68b8042.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a17836-1ee8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773411973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411973, "uuid": "b553111f-03b7-4a9b-962e-7dbac366e4d7", "comment": "Malware payload", "value": "c249e9009fbd2ddb2bf06d6e8411dc21", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411973, "uuid": "8a7407f7-ed82-4472-9ccf-5fe49ed913bb", "comment": "Malware payload", "value": "edf56f77e260852159a6db03a08dddd88ee3775ab09a779b080d9f1ddf925c91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411973, "uuid": "ab3f9e05-604f-49a3-828f-dc73a5325709", "comment": "Malware payload", "value": "ce30708641c865a79eb14e5e2d4c2b439ba8e64e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773411973, "uuid": "2a4f37ec-2d6a-472d-961e-0e5f5288bc52", "comment": "Malware payload", "value": "bb9a6e56defbe29ff54b4fca75699dbfea4e15ff9c71beacf914591e5c33be294f2c167fec44e92733d41e234d63ba1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411973, "uuid": "720751ee-f088-4ea7-83be-f01326fe45fc", "value": "T1AF45015861622D9D81DFAA4E503CE9B0DEB31930E716181A3F39E6EB6140D4F742E33E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411973, "uuid": "5d5c9898-8ef1-4e47-a3e3-b150ccc06d40", "value": "96:WJgHg04GLUjG2NH10AoGNZfZs3AGdZbZ0lcKmI2NZcvCJZNV0leQcvZ7xm7VgCvD:TCH/nR3fjoRxU+FyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773411973, "uuid": "3f180519-9b9f-49f8-b518-67eeb8c3e053", "value": 1174261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773411973, "uuid": "aa6f898b-3236-4a0f-96fe-548e04b0493d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773411973, "uuid": "d3b5af16-0fa5-466b-9a2e-3f6d9b2a10a8", "value": "Euroasia PO-ORDER_Request_Quotation_105_40FT_2026-03-13_docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bddfcc0-1ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773398104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398104, "uuid": "6a79406c-b058-43c1-ab2a-07a33432ebeb", "comment": "Malware payload", "value": "81035a364d9f0746821a49726409d6f8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398104, "uuid": "c4991c82-a01d-46c7-9595-9bd7fd7c8998", "comment": "Malware payload", "value": "edfa1a6f614947f0e116a2a3d8f5a1bcc6b0c2d742e4cfb152b03e122b942b89", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398104, "uuid": "212390dd-8b0a-4d6b-8049-d67f58474652", "comment": "Malware payload", "value": "7301f2b6f28f33fa95d14e166603b9bf86bb7732", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773398104, "uuid": "13800ca9-2e7f-45b7-b68f-dfe6d4f5e40b", "comment": "Malware payload", "value": "aba82cb655b0a086fdffa6c07e15d4916197db3cad3428d490cc7d404b73db481f5820980a56be7ee769495ba3d4e127", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398104, "uuid": "12c56987-b0b9-418e-a571-cd34b5c074ba", "value": "T1A1E05560E78AA66D0B10158E8412E958B2B406060218D9D277CECACDA0A6FC5A168072", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398104, "uuid": "e590d30c-6477-4314-8e3b-9ff8ba40aee9", "value": "12:LVmopownLZysSTHLknpHbnP1eWMot4zXB+3z:LVmoFLZULknxbnPYWMoCzR+3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773398104, "uuid": "25ab5dee-09dc-47de-bf87-6dc89ae11115", "value": 428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773398104, "uuid": "6f3395de-3db0-49c6-a7f7-dc4192732b9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773398104, "uuid": "76ff4a2e-4c79-48ff-bbff-8e454dfe77d3", "value": "49Te3xW9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c1017e-1ecc-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1773400098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400098, "uuid": "35d9930d-d308-4bb1-8032-5c10bff036bd", "comment": "Malware payload (Koadic)", "value": "6d184529b130e94ab606897aa21a1622", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400098, "uuid": "903d3cc4-fe67-46fb-8cb8-a81efe682682", "comment": "Malware payload (Koadic)", "value": "ee26e23429e2a93a9ec1a83a7dd490deb2035fa3a3b5ee8feea16d8612441272", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400098, "uuid": "cbe70f19-91f9-432a-ab39-75ef3981d159", "comment": "Malware payload (Koadic)", "value": "17e7e9825336c4da743c6e41c9a9847ebade1867", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773400098, "uuid": "7099827c-4160-48be-b282-1b03d6028d9e", "comment": "Malware payload (Koadic)", "value": "31c8e88208649c0547bdba78a621963081a860b06082b012c17d160460bc5b5557a952134883409da238969eed5b9957", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400098, "uuid": "ddcc4ced-1d4b-4ab3-8a0d-d458e51f6d8d", "value": "T1D8F5EEF01BE65E6D20C7E92482790E0BAB6F773E01691D66B9FD3D6DEE9408D0139039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400098, "uuid": "26ab2f5c-b95c-45c5-8678-8b64408776ed", "value": "768:tCnYjqCRXw9N+Eth2PyPctYl6MnzfXsogmy+KqJZ5otBhl0vbejTtm46WjxgK02b:jV0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773400098, "uuid": "da88b6f5-5086-4617-9d5b-dbabf9af542a", "value": 3507007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773400098, "uuid": "afb73fa4-0169-4ac1-ad40-8462dba31bc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773400098, "uuid": "3cb6dfcf-b636-49fd-9c8c-314e9ad88b0c", "value": "Photo XRay Ultrasound Medical Records C1203.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219a015f-1ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (Braodo)", "timestamp": 1773396315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396315, "uuid": "9a9981b0-a87b-4f7a-a731-75e94c810cf3", "comment": "Malware payload (Braodo)", "value": "f174a5d8df2860710469ee58d3a0c565", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396315, "uuid": "9555584b-6618-4e6f-a31b-ddcc2ea70b3f", "comment": "Malware payload (Braodo)", "value": "ee2f2da940b6d73878a3f7a5642c1d6604a186b4f42339007bdd261e452f3e5d", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396315, "uuid": "adbaa4c0-8b51-41d1-9a23-11b24b33df4b", "comment": "Malware payload (Braodo)", "value": "9ce583de5ef3abcf9e39e9b2b5a2954159e65983", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773396315, "uuid": "f97ecb9c-71b0-4893-b7bc-705f17040af7", "comment": "Malware payload (Braodo)", "value": "fcd6654afe9db91f9edb470819765bd8cb8c63280dece7901b8a2b136887f1b30704b9fc053664fae9aebeb0f0f30e15", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com--m1-nc", "colour": "#55EB56", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396315, "uuid": "d964d051-e76d-4d68-a384-152021e69300", "value": "T1C8273342C24A0766ED8FBF3532DA113FA568E12C766650DB3F1897C02CF36D66A13E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396315, "uuid": "25e22c38-d3b1-4ecf-981d-8345eb419de8", "value": "393216:KHJbQNpyOmmrN8Evjm6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKqEI575UKV5EgPP:KHJbQNp67mjm6XV95BFZ8Md8zwC2wqEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773396315, "uuid": "756905e3-3681-4523-8232-5d2f272129db", "value": 21952360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773396315, "uuid": "e73d6636-a8ea-43d8-a040-a9b7957bbc04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773396315, "uuid": "327b2835-4608-4420-89e4-71bd4c618c39", "value": "m1-nc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83f519a-1edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773408164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408164, "uuid": "73c4761c-9b51-4b10-9978-9a3dbb3675f0", "comment": "Malware payload (Mirai)", "value": "448c13cb5c032196b27d05f7b4cde44b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408164, "uuid": "d8a985ec-efa8-4345-8697-5e8658f3c4af", "comment": "Malware payload (Mirai)", "value": "f15aec8699d88e2009bac8fbadba524f8a575a0406eafd8b4519226873147e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408164, "uuid": "94b12cb8-9f0b-4384-ad71-82b6ce57d401", "comment": "Malware payload (Mirai)", "value": "ed5b3f2cfa27dd52ba23b3320203f09df1e8618e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773408164, "uuid": "0c2776f4-e13d-410a-a0c5-797857c8a056", "comment": "Malware payload (Mirai)", "value": "d7883316bae32189fe9803042c2f1ae3fb43852b3ce7dd00a9cb9c3e126e69f62a0a9cdd8c2df5dd27f1d2e63df8f2e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408164, "uuid": "caab9706-73fb-4645-bab3-a568ea24b276", "value": "T178833A52BC829A12C6D422BBFA6E418D371213A8D2EF3217DD156F2477C691F0EB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408164, "uuid": "2bf80667-d09c-4742-b3e4-979a3d68d0c4", "value": "1536:JcQ+pZvSuy4lXWJ1/IppXcxw8nhV58DiLwypC8UJJD2dvcbkqsgmloPOPzOeuPBm:JcQ+v3yl3IbuZhJwrVJJD2hc4qnk+Pkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773408164, "uuid": "49f21d56-91b2-4c27-a412-aa1444d6e765", "value": 88664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773408164, "uuid": "0ca9902b-cb77-4bf0-822a-1f92873c4cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773408164, "uuid": "4b8c8dd3-b6b5-4883-b9f9-a1c80f79f9d1", "value": "SecuriteInfo.com.Linux.Mirai.9774.11419.19956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ad148a-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773407170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407170, "uuid": "a4ad26ee-a6da-4193-989f-33e92b863308", "comment": "Malware payload (Mirai)", "value": "8dcaf0e2a0baf54e65f46689b2a845ef", "object_relation": "md5", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407170, "uuid": "989b7184-800e-43e8-9e6a-683cb14816cc", "comment": "Malware payload (Mirai)", "value": "f18ddb10b3f9044fa2f9d1bb5152e388d4f68c2209165b117135fb2490243d2b", "object_relation": "sha256", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407170, "uuid": "8e53b50c-b2c2-4c13-8533-d413a9337d48", "comment": "Malware payload (Mirai)", "value": "99e3b1616008106c89978d1c5fafdc3da2abc873", "object_relation": "sha1", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407170, "uuid": "10269211-ea59-4457-84c7-79a046c0ae06", "comment": "Malware payload (Mirai)", "value": "60a3a18e53d33acabfaa55c047415e1f5806a61f688bfc9021f0902d40af53f914cd16973f4c400d792ff929d7cd0426", "object_relation": "sha3-384", "Tag": [ { "name": "AVrecon", "colour": "#367A45", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407170, "uuid": "2aa9cb03-2d2d-4d06-ac18-a09d054a693d", "value": "T17D517219AFD12D2BCD7FDC37059D1B6436DD402720AA279172B4E8243D2F60999C3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407170, "uuid": "d89ea86f-b294-412f-b3b5-2b538ba0e2a9", "value": "48:hf6wfIuQ8sea1Qq1D6HPv/UzcmVTeS94f2Tk3oi62w:l6wwuQ8Yz1e/WxeSC2ERTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407170, "uuid": "ecc7a88a-b066-4eba-b552-30eea736018d", "value": 3016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407170, "uuid": "38be415a-cd23-40ac-9d50-2aae7e63a9ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407170, "uuid": "e1221356-bbdf-4e5c-899b-957d2c8ce706", "value": "dlr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8344d41b-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402062, "uuid": "ebb978e7-84ae-419e-a013-25b1145ae5d2", "comment": "Malware payload (Mirai)", "value": "6b4d6e4517f21f98b8e135d4b98a8ba7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402062, "uuid": "8c4263bc-9a2e-469a-938a-dcc105d204dd", "comment": "Malware payload (Mirai)", "value": "f2ffae7077205cd33b7facb16c7859c97aa8bbbed6c573c9c71ba9940e9f2322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402062, "uuid": "a90b217b-14bb-4dee-b718-0b09244e5cd8", "comment": "Malware payload (Mirai)", "value": "e03cab2e3fa145c74effb426e77e736d76faac21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402062, "uuid": "895f1afb-c7c2-4819-addb-8dc8c65c4e1b", "comment": "Malware payload (Mirai)", "value": "790be6153442b12851c7dddbcc039c34c84de18a4f0cc004b6a671b65b6c5c967687caaf2b1056cbe1871d29c033d039", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402062, "uuid": "7d4a5e5a-e076-44a5-9dc8-a54cdc2cbf48", "value": "T168833A02771C0A47D2965EF02E3F17E1D3EEE59021F4BA882A1FDB469175E32558AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402062, "uuid": "42720d2f-30c9-4334-8123-5f0eb73cf95b", "value": "1536:ol1A2WYNONqE4IdnnuMcvs5Xc216zBC+X7ypD8C:VUIdnnu7mv1gBj7yCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402062, "uuid": "7c914a47-e2ee-40e5-96ce-bb3846f3b188", "value": 85336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402062, "uuid": "c0656f79-3465-4225-9033-599fcd41930a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402062, "uuid": "f457dbb7-2cf6-42f5-8fe3-d6e1b5180abf", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad4e80a-1ea2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773381781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381781, "uuid": "fbb5f4f5-c4ff-4dab-adfd-787d1361c81d", "comment": "Malware payload", "value": "ab0b1c3a47c83f5bbb47d189eda1ae65", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381781, "uuid": "8b1a6f13-f05b-463a-aa94-c63927ca4d6c", "comment": "Malware payload", "value": "f3166bdd4147ecc9b3efb44cc571b74674ab60419dc8d4dd4ceda1e805509b48", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381781, "uuid": "0b859e92-d1a4-435c-b192-3b09be54cc1f", "comment": "Malware payload", "value": "a7a7e3c80cf16581496a242e69e00df4c67685e5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773381781, "uuid": "53c1d297-cf90-41be-af56-3a2445d2a8b3", "comment": "Malware payload", "value": "2f0c6671117bf21bf6bbb31e92d1990088a20e2c83abe31d943b26098c011b519a5102088095ffe4c24c9d5cf57b8b34", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381781, "uuid": "c1955895-e935-4a42-bd44-c210c010e6b1", "value": "T191B3228B194AC5ED871F6464451F9C0BE69F8313172EC9A0BAEFBD443F22C74719AAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381781, "uuid": "1c381dde-3018-4612-a821-d3994ec1aa14", "value": "768:nNswIpUKII/iuCxh3fUGjmE6twCewULcjLMkjVW6lGArpmaFUkguovBBaanLfCu2:+XVWmp9475BxGg/P8vZl4idV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773381781, "uuid": "6dea2221-d1bb-4855-bb5d-1a83917a69fd", "value": 112481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773381781, "uuid": "ed3b4361-8e6f-4911-8138-6d76cf5a3be3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773381781, "uuid": "3514ab98-507f-427b-917b-3f291949bcc7", "value": "Config_Asia__11.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d1b22f-1e87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773370386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370386, "uuid": "b383bec7-38fa-4904-9193-7075a11639b9", "comment": "Malware payload", "value": "87edec001538ec56af45d40fff733566", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370386, "uuid": "45adc609-e831-4b23-b03b-30ffeede4e78", "comment": "Malware payload", "value": "f3578dedae26d74971b2d619fae372ffeb56eaeb1b9ec630e239c511b9070f1a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370386, "uuid": "4a434bfe-2730-4330-8846-31479e2713fd", "comment": "Malware payload", "value": "747b5ee112fa825291acebdbb1ef727fd332410f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773370386, "uuid": "b4c3215b-f062-4003-9e25-fbf35ab659cd", "comment": "Malware payload", "value": "91035b353a85fe936d1ddaa4f7b4c870ea43d311e1fd84e7f904c495dbdcacb526f23789041719e1d59984d3194faa52", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370386, "uuid": "a57d7b13-b484-45ba-aad6-93213a94d5fa", "value": "T1CCB3DB8B0A4EC5FD960B3518255F9D06D64F621A1A2CCA907ACEFF543F22D3760E79C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370386, "uuid": "9979e09e-00be-4984-bb38-98c6a9506173", "value": "1536:4U04KsjrQ9iURJPgeXS1/V1KSMsiWj07KDh8ePpI2h8o1w:4U04Kso9iu21ysiWj0ueePp1eo1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773370386, "uuid": "2697f4e4-5ab9-4063-81dd-67cefb4bcb99", "value": 115876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773370386, "uuid": "f05c3ca7-cdd9-4dea-a94e-d8a1e1ed62bf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773370386, "uuid": "4b7c1bd5-dcf2-4348-9b57-62201e1abdc8", "value": "Session_Draft_v6.0.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06499329-1e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773379089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379089, "uuid": "0e485657-6ebc-472c-91c7-c51fcec4253d", "comment": "Malware payload", "value": "377a2581433b1c0383402a5cd02508da", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379089, "uuid": "10cf6b27-1afe-4e41-81e8-8a5dd28dfdce", "comment": "Malware payload", "value": "f36cea2758fc6837370d56d81eae3b8d3a89845334a381921084abb082912518", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379089, "uuid": "f62e3dc1-f18b-4094-a14c-dff8463407a0", "comment": "Malware payload", "value": "7ad3b99f82059411717e184e806d09408931f336", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773379089, "uuid": "1ce36892-3760-479b-8278-10e1947a9859", "comment": "Malware payload", "value": "57b67388f5d062485581669b6dc9d0303f5eb14b5cf0ad4efed64329402ad52137f15107e892ed22883601ce7739e712", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773379089, "uuid": "06faaa0b-88c7-4606-93ea-fc0c5ba76c38", "value": "T128C33088058B48DC8F9F645147DE9C13EFCC1913621CCA58BBAFAE552F11AEAF0D86D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773379089, "uuid": "2718a0fd-6dc6-428e-91a4-8fbaebfdbd8b", "value": "1536:nY8G3p4nJf7dMLt/Mue0aidpThfY5OvV9Rp7sYdXUrKzmq6:F90aibp7sYdXUrKz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773379089, "uuid": "42a79e3a-a28e-4567-8116-7408aec5e161", "value": 118309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773379089, "uuid": "f68896ca-c94b-450a-8f0c-1724dc56c79a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773379089, "uuid": "861d23c5-9d5a-44b9-9ee9-301f3b812fd4", "value": "Data_Germany__29.mp3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677d21b6-1e9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773380111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380111, "uuid": "7c949589-6630-4084-bbc3-214e2f30e606", "comment": "Malware payload (Mirai)", "value": "30cea8063be3761538f1d6d84dbfc9e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380111, "uuid": "a720b2ed-be7e-443b-8271-a6bb44dc5fbb", "comment": "Malware payload (Mirai)", "value": "f4c7b83ffdbbc43ec3a12bc8e8f458c0649bf3fe5d1a9c23783ab924feff2254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380111, "uuid": "d166e5a7-8780-44ae-b291-a3d60c339cbf", "comment": "Malware payload (Mirai)", "value": "8a02a88bdf2e2b0d6f880b405915726bd83a170e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773380111, "uuid": "d386d190-6e84-4a42-826a-a37f06d87989", "comment": "Malware payload (Mirai)", "value": "2d82c3334cd4c48436dc17cde7f3b9014f0c6c6e9e2a040d0c0c49c284eb756d2e1c4b41461e7aaefc7ffae2a47e6f3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380111, "uuid": "9db798ca-e6f7-4057-9287-45b1b9768425", "value": "T14874190A6F911EF7C82BCE3742A90A4A30CC645752953B3A3974D624BE1F94F59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380111, "uuid": "6b14fb5e-2c8d-404b-810f-73676e9b0c43", "value": "6144:pyNITNkrI6gvPUclbUS1TMvxJoXlo8NPv1sdg:sBGTMvLK1PWdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773380111, "uuid": "23c1ea22-afed-4776-b4ad-65cb8298a227", "value": 356172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773380111, "uuid": "63511ed6-d6e7-4b47-934e-22b919e112a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773380111, "uuid": "28f3555a-9fde-4ad2-b385-9ece1852f07f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b2a316-1e95-11f1-a769-42010a9c0008", "comment": "Malware payload (SilverFox)", "timestamp": 1773376264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376264, "uuid": "8396727d-a9bf-449a-af7d-27a0f2acccbc", "comment": "Malware payload (SilverFox)", "value": "e7a44eefa067578cee37980f23a55f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376264, "uuid": "b79df3fd-37e8-4832-87dc-7d89449431dc", "comment": "Malware payload (SilverFox)", "value": "f521193428b6917f6f5ac1744e1c484b1cddc8d4772ad0d6cb91233ac75d0980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376264, "uuid": "51e8311f-deff-4060-b5d6-9cd38da4bf25", "comment": "Malware payload (SilverFox)", "value": "910bff65ece1d434230df134cc9066eefe6fb7eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773376264, "uuid": "619bd069-84bc-40a4-b806-cfed665e6c01", "comment": "Malware payload (SilverFox)", "value": "a8f62214f9c5337431f81af634523cb5a9bc730e86142f5b3ff8810b23c66ec3fe93dd64fda8b03c8a454b12535e4277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376264, "uuid": "ce417447-2703-4e26-9388-1b32ff3b13b4", "value": "T1D2147C57B3A570F9E1B68235C5610A65EB727C3107605BDF03A4777A2F232E09E3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376264, "uuid": "a412f7ee-4393-4a32-a9c1-33151f9fcbd4", "value": "69493b7ef36e3677cb34b3b5860c95b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376264, "uuid": "51a4b531-4f40-48a9-97e4-cebf5271a483", "value": "3072:DG+5R1bRRMhcE/J/ktKKEUU/WnixdcwEBDCSA9p+IPyPEW+gS6cHWB:B5RrSFVsfEUUki6mwIpVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773376264, "uuid": "5753385e-7ae3-43f0-8c39-2d5492248a6a", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773376264, "uuid": "92628d6c-644e-43eb-b427-67d8d4de3ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773376264, "uuid": "490c4540-6e3f-47d9-ab51-3662a2461a44", "value": "287090437JunkCleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4723d1-1ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773412194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412194, "uuid": "103b46d9-28a1-4eb9-a28e-16ea99eca507", "comment": "Malware payload (AgentTesla)", "value": "75311b21742cd4f5fe9a33b13974afe2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412194, "uuid": "8b97a98e-1577-4f23-b49d-85ed67a9083c", "comment": "Malware payload (AgentTesla)", "value": "f763fbeb6f8ea2104445b74b4e8cc716432734540a8713f88e6b72355f1ea66f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412194, "uuid": "b1a79853-9b37-40f9-890a-56e36eece3d4", "comment": "Malware payload (AgentTesla)", "value": "febda06706ab7857137688cc58c12d4f144815a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773412194, "uuid": "96d23704-b29d-4623-86de-a6c486a4538c", "comment": "Malware payload (AgentTesla)", "value": "2d397cbcc9dcf6ea3c3c169b238dc17bd4f044c5439c2574e0ec4fc606d61570f052f7030e37733d1deefde379e1fd42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412194, "uuid": "b212e278-485e-48de-be8d-e9d828e79f0c", "value": "T19C35AE0273C1D062FFAB92734F56F6115ABC79260123A62F13A81D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412194, "uuid": "217af4a4-6e9c-4d76-bd56-760976eb267d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412194, "uuid": "87823576-fa1d-4235-a2fc-36fd12a53df7", "value": "24576:95EmXFtKaL4/oFe5T9yyXYfP1ijXdamYWj5zPVAWoWq:9PVt/LZeJbInQRamPzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773412194, "uuid": "38cebc7d-a21a-4817-8bcb-81f0f58489bc", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773412194, "uuid": "2c635a25-f0c3-4e64-a32d-173ac57302ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773412194, "uuid": "cf07f72c-c40e-40c7-a83d-c95959f2f0de", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172495f0-1ee6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773410900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410900, "uuid": "f4d8ad3d-401e-4ec0-b545-f78c5be68e96", "comment": "Malware payload", "value": "d3316065dc89f6f702878d53046da698", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410900, "uuid": "4a77e5f5-3ffb-4e01-a38e-22626d2cb1f9", "comment": "Malware payload", "value": "f910bd1bcce02fb8feb6319956ba922b082a61b3dea3b6bc21ee22d0f957d550", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410900, "uuid": "04b86512-4a13-4736-91e2-b77d757ab980", "comment": "Malware payload", "value": "44b00171cffd773d103d8ad6c6074cf9aee480ad", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773410900, "uuid": "f990b2de-f590-455d-909c-505e497e9b98", "comment": "Malware payload", "value": "e1c9b9fe9dae0a692faf23877fd29c6b89008f24bb6ef50a5396f22dd37e7ef04e42d4553bef21a5daa8cd80af993a1b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773410900, "uuid": "2dbd32eb-c96e-4f96-9c61-5e76cff3098f", "value": "T15EB3FFDB4E8A44EA9B9F2464C45E5D07DFDE1202196EC980BE6F6FC03F22D3560A79D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773410900, "uuid": "9b3a84a4-9c0f-4188-8b03-8e92a05a3985", "value": "768:WG1P1gj1gyyWJaTbimkGWrcJoapm+6oD48VDTbHCvndoCzpmn9N+BzbK6dAdlAMC:LpoaDXD/DT8hBw6+5h529LiMd5KRDW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773410900, "uuid": "a4bfa592-2bbe-4a43-8954-e2ae420710fc", "value": 116463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773410900, "uuid": "8f03b31c-ba1e-4479-a2b8-2dd5ba3e63a0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773410900, "uuid": "81f2ee9f-8d5f-4f46-83ba-5421398c100c", "value": "Tokyo_Journal_Final_42.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5f74da-1edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773407149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407149, "uuid": "787ed327-6d1b-4e93-a9bc-37dc7011ccb2", "comment": "Malware payload", "value": "7f6d11ac52fa02a215d074e988ce296d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407149, "uuid": "7b209974-abe6-41f0-95d6-53ee176c3e5c", "comment": "Malware payload", "value": "fb6fe0f18ddf70d1ee348956c5913b9c93ce46dfd3c26989f82361b3dd5a9f1b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407149, "uuid": "3261a322-3a2d-4957-b8b0-e18da09f6cc6", "comment": "Malware payload", "value": "a23c49c78bf40e685d2748e27f7725ae693035e6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773407149, "uuid": "c549ae6a-c8c9-4dee-b6bb-461b7f125d45", "comment": "Malware payload", "value": "69b57519990804497ad670f879ef3325d669503bef87f714c7224d5e274944b4a051ad72bc94e054a54d0b25a53aeb50", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407149, "uuid": "38209abe-e07c-439e-8968-b800406146b7", "value": "T15954DD1E198B81C24363B8E586D7BD8BFFC42516061CD9887A5DFEE12F075E4E0BA25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407149, "uuid": "14ecd350-b4fc-4b7a-9f89-0b971cbe2c29", "value": "3072:Hsu/i5iXlXCwP2kSVnzmEjCj0BskkiJ2VgcpTfWSm/aFeUTYDQ725chh6wGsJsxe:x1XgkxoGhBePlwXozwunUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773407149, "uuid": "1dd0b2db-9d35-40ca-b6f8-ee22dc3055ff", "value": 290565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773407149, "uuid": "8ea4ef20-59b2-4c83-8eaa-e0c5bff30ae4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773407149, "uuid": "9375eb3b-b0fa-4138-89ca-0630475778b8", "value": "Global_Fusion_Backup_350.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dcc9c7-1ed1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773402065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402065, "uuid": "3ed3efde-db01-4d84-b9fb-bf1f12bac770", "comment": "Malware payload (Mirai)", "value": "b5898df7a1e13044b8f353709b503016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402065, "uuid": "f5128732-331b-4d12-89e3-37de1241a5a9", "comment": "Malware payload (Mirai)", "value": "fc4831705703eac95b86d474267d89af3d85e24e10d6ebfa56ac2dfa84258ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402065, "uuid": "522a5265-bbcf-419d-b543-2aac21266f1a", "comment": "Malware payload (Mirai)", "value": "8048297abfbc6855750dd4aee8e9a37861098120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773402065, "uuid": "c861f9a5-881c-4989-a28d-a1b1de3ef0d8", "comment": "Malware payload (Mirai)", "value": "89c7c6ec17e98253bb566a2e79856426424aaba861d02d6308e75a11d5c49fd1d0b34cb0ebc4526b0160a69973838228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402065, "uuid": "7240a46b-9a30-4a8f-97ae-eb84b3d34910", "value": "T19A73AE33C4195E64D19406B4B4B48AB54B73EC01919B2EF6AA9BC2F99083FECF5193F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402065, "uuid": "eb3c2a08-fdf9-4cfd-a026-904b07e625eb", "value": "1536:eAoBPi79VKLNtNPQWvOzIqKKRRV73wA0CoremxH7yVw:e3SOCzItKJcA0amB7y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773402065, "uuid": "363f4201-fffe-44f4-9e1f-608589f04eb8", "value": 78984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773402065, "uuid": "7ecf13b8-cbb4-4996-9bbe-25d4e7b52d15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773402065, "uuid": "b553142e-c3b7-4218-844b-3143d7875e98", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75232163-1f12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773429956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429956, "uuid": "30127474-d1e9-44e5-b0bc-8832a1fe1e1a", "comment": "Malware payload", "value": "346897d2a7e851e5c06f200f7a0fd158", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429956, "uuid": "5bc070f0-350b-47de-954b-274afe7e4585", "comment": "Malware payload", "value": "ff100a7e7784df48b0078687ed9cd32da7a4329e9f7777f47a1e0a6011b18f27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429956, "uuid": "407bbe1b-d3d0-4313-b564-c576e99df9b9", "comment": "Malware payload", "value": "005faf1882f08f49f58a293091687ff3fa7c2a70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773429956, "uuid": "48e9bc22-2fb8-4a52-8f1e-7360636cb47e", "comment": "Malware payload", "value": "26d317e2cda74f34d9573f90a1def0b18adb98a3e46a87adc54d133debf121fc2e38b6b556d2585b24de66a6a6d1c691", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429956, "uuid": "d656512e-79b6-4ad9-a158-16e2808f0b0b", "value": "T13EB36349169F44FA92776490A5CF4C03EFA5466B032CCAE4BB6EAB503F25454E0EF7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429956, "uuid": "43dfad12-320a-40cb-b1d8-a793f5c0b87f", "value": "3072:Bzv5+xRnIdkVR2YKkl09AnN+QNg9aDsAHBLCh4qlZLad8Gh92qykS1OqPDKRoLYB:HAZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773429956, "uuid": "a112d6e4-7857-4f69-977b-7fee731fc004", "value": 113661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773429956, "uuid": "8f9733ce-a935-43a1-8938-b42df497b88f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773429956, "uuid": "7e97848f-6a3e-4998-aeec-09d373b908d6", "value": "Internal_Config_Secondary_4043.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }