{ "Event": { "published": true, "date": "2026-06-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-02", "timestamp": 1780444982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "013d5657-2256-4444-b4a5-79d132de55b3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e6214e-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414803, "uuid": "6e78fc31-d5cc-4d58-8b89-9fee7db756e6", "comment": "Malware payload", "value": "31fc57b75074182e57641cfbaf404bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414803, "uuid": "afcfe1fd-e228-4abd-9861-063c4080e084", "comment": "Malware payload", "value": "014c9b69c6082a9b5a302605cfc95267e014a55c56ce4d0657d1251a81cbe113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414803, "uuid": "627a578e-417b-4327-923c-3cef06c639ea", "comment": "Malware payload", "value": "b6010df574f5750740f0c581cdca65df3abd673c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414803, "uuid": "1c90ff60-4b53-45f2-ac26-2015c3f380c6", "comment": "Malware payload", "value": "2438b916f7c95332a5333b266c04fb1e9988ac84bd809d362e50e0a77507ad0cc05351a1cc62d5078d663ada9cd5122c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414803, "uuid": "aac3f98f-4f48-4323-90d4-21cedefb8998", "value": "T1D49523433E8461F7E97723B5E42B3122863175E595EC874F1686877B0ADA1C06E3BF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414803, "uuid": "44485439-c1c2-48b5-91cd-27363a74ac34", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414803, "uuid": "f6f725a6-2e81-4e48-a2a3-93e8a51ebc9b", "value": "49152:zjgwBDyfqvD80uORgGNC25Y8Z7lsKbVfLEibGTia5ne3ouo:AwBDCqo1OC/25YOnJTE8aiMuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414803, "uuid": "0685ac25-dc3e-43ae-a975-fedb4bd06612", "value": 2035712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414803, "uuid": "10d0b43c-f027-47c1-aac5-8226e9d65696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414803, "uuid": "a00afb2a-1746-4e11-9366-775c387edf8f", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4d327b-5e51-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780383791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383791, "uuid": "575a1c84-7ad3-4233-b802-fb38527c53e0", "comment": "Malware payload (RemcosRAT)", "value": "b04336d89aaa84a6cb8ffb8151d48474", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383791, "uuid": "6a9d3f7c-22cb-4ced-96d7-9e8901250741", "comment": "Malware payload (RemcosRAT)", "value": "033a99b9bbd0893a8305dfebe5d7683ff9bf54518e4a6dbde3fa1e052f411340", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383791, "uuid": "9b5aabc1-ac6b-4268-aedf-c658b934d4f8", "comment": "Malware payload (RemcosRAT)", "value": "b16901306f28b4a7b6566f7acc751fcb708aea61", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383791, "uuid": "f46b992f-adac-42e8-961a-78a9f579a148", "comment": "Malware payload (RemcosRAT)", "value": "9b8ed1238473ef777953bf2b279ece97c543020e5d25215d0097809610c34609b1d1a8fe1ad3b5e04591bed1bfceef8c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383791, "uuid": "aea97b0a-14b3-4f99-bd28-c14097d31e05", "value": "T11C832921DDE007BA5F4307BDBDA52A11D6BC8669022640FCF6D9230D600A57CFBBE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383791, "uuid": "1fb42ff6-de34-494b-aea7-207576125c65", "value": "1536:zc4LsX85ED8aP3P+9ytPD10j/o8ZbkbGZ9QmSMU0nbRjeb:Y4LsX85mf+9yRqgLGAmpUyljeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383791, "uuid": "f5dcbedd-483b-40c2-9fc8-3215d020fc9c", "value": 85088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383791, "uuid": "d493ec6d-6228-4505-9e85-34983b42f5a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383791, "uuid": "5d320328-21dd-43e5-af82-482587391ae6", "value": "udarmning.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c67df8-5e18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780359344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780359344, "uuid": "1521d354-0166-4afb-a225-b8d216dc5e89", "comment": "Malware payload", "value": "c90fa058651c12abb38620be9e96060e", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780359344, "uuid": "67914207-1521-449b-94a0-27deab6587e7", "comment": "Malware payload", "value": "03c96da8c86912c31beb2819fec2b6fe11cc844da2089dbf1d17004ee71ae133", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780359344, "uuid": "69d431a8-49be-4ae0-9b40-ad1878a21168", "comment": "Malware payload", "value": "3a4a826549ac67beda76b4bea24def24192fd933", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780359344, "uuid": "765cec50-3e4b-41b8-acc4-754b1373c110", "comment": "Malware payload", "value": "d68707c3172ecda4fcf27fd0435ae80a7b656e1f3abb824b9e8f9151b1feb1bf880e226ba6791a9e06501fa4f25a6c33", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780359344, "uuid": "64f88ed2-9fe4-4e74-aa23-de545c063927", "value": "T1D3E4129D376C71A9E03A643C81A28501E3B6F1B5671217DF22D1827E4FB3EE95D3EA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780359344, "uuid": "b0ba90dd-d73f-4f80-841e-dca782ae6771", "value": "f718d257cb3a4bbbe8310fa60e7d1ded", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780359344, "uuid": "71b08bce-14d6-4b37-913f-231fecba20e0", "value": "12288:YEP3RiGkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:ziGH2fpY18e5Px1aYZ3/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780359344, "uuid": "11b62fc6-ab3c-4d22-9feb-2d07451899d6", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780359344, "uuid": "2c7eb492-0501-46d5-bb62-e1c6861e8c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780359344, "uuid": "ee4b0888-a4e5-4183-a896-08df1d36f5a1", "value": "03c96da8c86912c31beb2819fec2b6fe11cc844da2089dbf1d17004ee71ae133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb90941-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360890, "uuid": "1822084e-401d-410e-896d-aabbb9b0dcd7", "comment": "Malware payload (Mirai)", "value": "9cf15da4f11b212fb271844ea39763aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360890, "uuid": "9ef0d11d-a954-47c8-9efb-91cf412b4b3e", "comment": "Malware payload (Mirai)", "value": "04787edfd07eb4f2ac2e122863d6d4e11822c8fca81b6106484d9b9101ba7d04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360890, "uuid": "6f31eeaf-6f66-4fb1-b17c-886d0ce5512a", "comment": "Malware payload (Mirai)", "value": "332db000a6e3b45e5826e77a3d6047faeffddb77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360890, "uuid": "b197292f-68c0-4f49-8522-0bd9484e8fe4", "comment": "Malware payload (Mirai)", "value": "9b4e17b0071217ea0025afa76ed14ebd03fb0fae5c4620653584061785abef06bb5259b300671faf89a9830301b9dd10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360890, "uuid": "10da565c-5a99-4023-8c0e-21d22cc3e195", "value": "T1CD73A5497F650FB3DCABCC3706AA2B0129DD561722B97B35B930D928B50B24F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360890, "uuid": "0e9a701c-aa80-44fe-99eb-b68036a31521", "value": "768:NHp2vspHpVhzzQ05Tm84tqYsUVNdaVo64AWe8Ge+elgeNTCpMNZhGIXi3r7vtOfm:NHcvsF/hvQ0GvMDggeTCpiZhGpHttJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360890, "uuid": "dd55832b-0b28-47a8-a66d-0243b7ca314c", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360890, "uuid": "f32ad272-d9e7-474a-85f9-7bb25269c381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360890, "uuid": "c35b1b5e-a88f-42a9-9da8-0da5f69302ed", "value": "OGz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc74bee5-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360891, "uuid": "3bd5ac21-0ac2-4ffb-b785-09d6fbe01f85", "comment": "Malware payload (Mirai)", "value": "e6d804219ee1c8e9b7a6473705cf8bf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360891, "uuid": "7c05ffca-522f-40b8-89a5-2bae7b909d5d", "comment": "Malware payload (Mirai)", "value": "04a56bd7545866b91e635a22a389c2350a2e152a0bca35444cb91726dec15832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360891, "uuid": "2e74e271-e32d-4480-8b67-e8dc11f12c7c", "comment": "Malware payload (Mirai)", "value": "6a20d8f76575a21a1a402481f261ad7e589f5c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360891, "uuid": "641d31e5-772a-4259-85f6-36f084e9f0cd", "comment": "Malware payload (Mirai)", "value": "4acff3a67b843f2eb38de7646e01231e65dcfb4bd4af18bfa44020c180ffcda8e6163b759ed727c4d6a5a4ea4f3624c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360891, "uuid": "7ea1a43d-3706-4dd3-b536-d7ad951a366c", "value": "T159431881BC819A23C5D4137AF5AE468D3B2133E8E2DB7217DE214F5176C682F0CAAE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360891, "uuid": "55f464e9-7329-495e-9723-2d5480ddd160", "value": "768:bOeMEMDNVo829FdOcuYbb/Yi5ZQ/Ey8WbXZFP8Rt+sZ/Q16NS06gDAvUGFG7aJPC:uEMqdOcBb/lPry8kADPC1EWjbaoZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360891, "uuid": "20cc926f-df40-4a65-a391-875aed588933", "value": 56064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360891, "uuid": "e5fe7231-dedf-4973-a6d3-38138d066efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360891, "uuid": "c86ac75f-63d4-4007-8732-a681ca9571e3", "value": "OGz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde12acb-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360893, "uuid": "d3bd7cba-f483-4c8b-9c9a-d9f0ebe283ed", "comment": "Malware payload (Mirai)", "value": "00d38c01949caf83bc2e8deff3c542e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360893, "uuid": "7639cedd-7297-471b-8ab1-998832a1f6aa", "comment": "Malware payload (Mirai)", "value": "04b44806cd02e66c06e83d84ac6af5bd7ea20be33473a309438c56b89f9e0cb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360893, "uuid": "df402c18-7c63-4893-8981-893c22aa12d5", "comment": "Malware payload (Mirai)", "value": "dc6e3e95b1d3f498794de63e60ee244083c47cf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360893, "uuid": "cfb02346-1920-4b86-aee0-5dc02a46cd17", "comment": "Malware payload (Mirai)", "value": "be27c6e5293662aca7ee163e67c2dc8658ea40b559460675e75f813e282fad21eb562756405db033f974cc23d0351fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360893, "uuid": "3b2cee17-5078-497e-b134-986e414878f4", "value": "T1A363A41E7E229FBCFAEA863447B78E16565933DA37D1C181E16CD6112D6024E340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360893, "uuid": "adae297f-98ce-45ce-bfa2-79dc04c91688", "value": "768:/oTXXcvJv674Hw74H7TugCD4qYZtVekcvq4y5Eqv5ytQETInsdbd2VygIZrXZOnp:MX4vqpsXeAe2UTInslZrXZsIRwAYP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360893, "uuid": "421fd5df-ebb7-40a0-8109-8cf98ba6ebdf", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360893, "uuid": "e7944435-9bdc-4f6f-ac47-013513b511ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360893, "uuid": "c8f3463c-7d05-4572-aef8-6cf5df6a0a55", "value": "OGz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ae46e8-5e25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780364854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364854, "uuid": "cb8102bd-bd99-4e3d-aabe-6d69a76d6608", "comment": "Malware payload", "value": "c560349919202c910ab730df4df4695c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364854, "uuid": "f82e1a87-081a-49e6-bdab-541d7c1cf47b", "comment": "Malware payload", "value": "04e24a356b9cc6c29374a6644543d7c248dc932e8995d7d41de79ce17d7e928f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364854, "uuid": "32c7479d-c845-420e-b06e-e913c11abe67", "comment": "Malware payload", "value": "e7e617f2b2e86365c8ea7c663dc6507edf247e1d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364854, "uuid": "83fd6c93-1bd7-4f36-b902-7afe3c62eb00", "comment": "Malware payload", "value": "3f1e7e961483a8a69e18422537e34453eb064ff30a4447c5fd77104cc04a424a36f829ae55e4b7dc23370a12bd368c2a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364854, "uuid": "b546420e-4d41-434d-8d75-bb503d4a459d", "value": "T18CB2E0F1B8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938411C71EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364854, "uuid": "4a4a350d-3479-48f9-adf7-3a47fbffdc32", "value": "384:HVc3s1oisjsKG6qkSgjkjV/A4UAcGM3JNRhQuW5r:0shUMkSgjkjVdUAcR3JN3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364854, "uuid": "eca94e46-6471-45b4-93b9-498c3adb38ec", "value": 24307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364854, "uuid": "049de5a9-a02f-4e88-a60c-5287c18a080b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364854, "uuid": "a7d70e19-4837-4a89-8ae6-d4e3b6546e17", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bd6264-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414696, "uuid": "d9cfca3e-016b-4dfb-a369-c163558caf85", "comment": "Malware payload", "value": "7919a421905e2ed3e21aee9faa02ac31", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414696, "uuid": "6edb8656-e63d-49c3-90a7-ecb171d755d3", "comment": "Malware payload", "value": "05b4e225b0e42ea7f0685fa25839b652108b4b5e09bfe45e202341088e782ff2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414696, "uuid": "4fd66caf-f041-4813-83a9-5445817a5dc4", "comment": "Malware payload", "value": "a546f9a5f0fad7f4ab19a8cb2b84f8cf6868e2ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414696, "uuid": "dc96f3d9-bb7e-417f-8f9d-6f4247c0f6e4", "comment": "Malware payload", "value": "abda64e55369497525b91f08e1ba09a223f7637b892b172239c30f68c859cbb963416001f3c90ccd835901f46cf088ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414696, "uuid": "4124b6c0-6320-42d4-af2e-04f6f2f523a9", "value": "T144843A11B7D0C476C2AE3034691AE6752AEDB8305FF5C38B6F90173E2E346D19A3875A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414696, "uuid": "3cd7aef5-f211-4ffa-a579-1d562c30e9da", "value": "38f0b43d433f487462b8bcc8fa086e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414696, "uuid": "87462e92-3081-4e99-bb24-de6e52a56b5d", "value": "6144:cueMzYUSC1Z7rkIcWZhS8RCX5IB9JsMRfS2NNb9qeFrSlRzrI:/yC7rK824JsMRfxNb9qekrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414696, "uuid": "f1ee558b-6023-400c-b9cc-6810a7ebbbbe", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414696, "uuid": "6a5bc72f-6e64-4ef0-9578-c8452cf89f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414696, "uuid": "17d251f2-d6a4-4b07-8f3c-11ed8dadaefc", "value": "7919a421905e2ed3e21aee9faa02ac31.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42e9d20-5e53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780384956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384956, "uuid": "4afa2122-37e6-4601-bb7d-1aee7944076e", "comment": "Malware payload", "value": "6fae649b93d1438e4e4dc94ec67daaac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384956, "uuid": "2ce830ba-c9d2-4172-8825-f352fe006cef", "comment": "Malware payload", "value": "068adfbbe938f346f821e1422a9f533a7bb542bcda433f4807a1a1cd44e39b9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384956, "uuid": "1975f2da-a3e6-443d-abc3-2afc1f73c22a", "comment": "Malware payload", "value": "5a6bd5492247a529a566bd9eaa5a38569cd374a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384956, "uuid": "8adae9d2-2af8-420d-ba8e-d11eef74d7d3", "comment": "Malware payload", "value": "cbd14f7e63eb6ff48d338c6a4efe34b798281902489b6923da37f71563e251d502584580fb2571c2b7942bfb52fde50e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780384956, "uuid": "94364177-507b-4707-87a5-6aec49bf5282", "value": "T15101C2CBC006DB608186F45D22DBA2C47820C3CB26824BE4BF9D443DDFA964CB065F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780384956, "uuid": "d8830d3e-bcef-4a37-a06a-ccbeee34cad3", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaSISjpIZ0sqIMbFIVpPIzUNauD:kXCKysE2hi0ziQvZohaShl/hFKz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780384956, "uuid": "cfc3d955-bc0f-45b8-956c-f2aea30748bb", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780384956, "uuid": "2ae58645-697d-492a-bd14-bc2e721195e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780384956, "uuid": "06c222af-7338-487f-853d-d566006c7f5b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b50ab83-5e8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780408805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780408805, "uuid": "72563b8a-6322-4499-b476-e3797b3ccf75", "comment": "Malware payload", "value": "aefb76cd0e50df68cf25dc5ceb2e4536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780408805, "uuid": "cbdfd8da-11de-4559-8970-53ec3a8637da", "comment": "Malware payload", "value": "073e20109b235245a7192bd8925f742e745d311fdbf2da50ec6eba03de2ba0ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780408805, "uuid": "50da4f71-9e84-42ff-af9e-342256fed36b", "comment": "Malware payload", "value": "03f69ddf18b4d58792e8c8c2086e150ee497f894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780408805, "uuid": "50b99f60-b471-4bfc-880d-f6697f2fa506", "comment": "Malware payload", "value": "45505a32e4748aa85712ff24f7df01fe541a78ad6db657dd27e328b02b64ac3fd23eb54351bc5dbd04c9795135fffc30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780408805, "uuid": "8a764cb7-c160-4e6a-af18-5beda9dec4ea", "value": "T1B2D1834163FC822AE5FA4F38ACB3531516B5FE018D32C65D5C98421EAC32769DA21BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780408805, "uuid": "c918f00b-d472-4127-9f7a-3b0cc8741e29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780408805, "uuid": "2be3506f-f351-4754-9db9-1f0b00c8b506", "value": "96:gZRletEvB4ITJiUC0m3K+TVw790jZlmnewtCIF8droi0EIC:iXMeGsdCPpVW98ZwnByd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780408805, "uuid": "bd8372a7-4f91-434d-b1a5-06a021d35204", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780408805, "uuid": "d15bebab-6f57-4cea-8527-86263e3c61e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780408805, "uuid": "90b9e5ea-408b-4963-a4d0-6684157c720b", "value": "rCorrigir-Adelmo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb903c72-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414227, "uuid": "0e6a486c-8439-4202-848d-c7f6722574f3", "comment": "Malware payload", "value": "d18da8f19de3e5bd2557eb195eed0789", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414227, "uuid": "dadb3715-0f6c-4f96-8dc0-266ceae85b5b", "comment": "Malware payload", "value": "07dcf848c4af8eacd13413a15507fb462e5aad0518d37db9ad69bc3c98c49fe1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414227, "uuid": "21daf29f-1556-4e77-b055-36c9fe4b9efb", "comment": "Malware payload", "value": "693f4c4e8d57f19e0c3b9fab89e143c3727ba1d6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414227, "uuid": "ec293e7f-c658-4c15-8d81-2259aaa37a0a", "comment": "Malware payload", "value": "11f304f1f6c4615c8cdb85a4c95664204d02023ab78aad4cb513688f05ac91dd0b02bc8d44f6c51666b8c8c167cd030a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414227, "uuid": "5d6be8d9-e226-4f23-981e-1f0dcd5bc158", "value": "T17F110E185261BE145883845ABEFED839D52B20F466BC00206AB8C608FC2F002D32B317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414227, "uuid": "0dc3f7bf-3fc0-4e12-a772-661b3f96c14c", "value": "12:fQAkTU3h5eAiPQIlmZ+mQMT73tc9JFqmmsmPz7CCqB5Uj4wNf2zRtkPn:l3OAiP1k+mZTL29LqtsmPz+C0Kj9f2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414227, "uuid": "6e52f7e9-3369-4fa4-b26d-e8643e64c74e", "value": 994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414227, "uuid": "021c8b28-31a1-4b89-870a-60bbc143830f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414227, "uuid": "c467587a-5247-4fd6-bd07-22a3ce32bc0b", "value": "stager.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41862073-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "f9acdc65-63ea-4503-830f-3d4dc31029bf", "comment": "Malware payload (Mirai)", "value": "666be20faee79037908048b5c82f10bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "992ac2e4-b4fe-4eb6-8b7c-ae7859be5b39", "comment": "Malware payload (Mirai)", "value": "0832bf712067c4eb84eee72d18dd60990ac4b07281b9fa1acc81b100d1ed1cad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "289f9cfc-e9bf-4fd9-abe1-29a0cb582ea2", "comment": "Malware payload (Mirai)", "value": "e7a6914f0a1f5d917e984203267b9dde5c66e0aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "54396f15-7827-4dcd-80fe-a235fbe476dc", "comment": "Malware payload (Mirai)", "value": "82c106e78fbf94cda3d4826e477165b8701d23e359b1876708ac830fd816798adbefb77b94760c1ceeab9698b2e85cf0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "6fa4530a-5e4b-41db-a9d3-1c54a3ed2ab2", "value": "T1F5F46B46EF850FEBC4AFCD30452E834705ED999706D1A73961FC498CBA9D26A4FD3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "f81ee21a-c47d-4a2f-9456-795f929411f8", "value": "12288:x5U4wPF8F0DZp5D7M03kT8/eEqj4bt6TJQEsjAYWdiCi5XrHUWBM1jVRUxuyBkFD:xs3wkqlyQpwfO66Ie3Sto+IrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364523, "uuid": "82aad276-358e-4cae-aac2-5cc4b1966a40", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364523, "uuid": "6036ed8d-c783-4a29-9d6c-0581d66e1b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "cdb724b5-f059-4e7c-b5f9-001b148a9653", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4933c1-5e65-11f1-a769-42010a9c0008", "comment": "Malware payload (\tValleyRAT)", "timestamp": 1780392464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392464, "uuid": "2418effb-9379-4317-a257-f0404d4ced6a", "comment": "Malware payload (\tValleyRAT)", "value": "30ef6147b963ce742f0a05197248e4a8", "object_relation": "md5", "Tag": [ { "name": "\tValleyRAT", "colour": "#72C9CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392464, "uuid": "539399d4-f134-4fc8-a894-682106ff4019", "comment": "Malware payload (\tValleyRAT)", "value": "08abc14f85c9a6da7a4333554446426d74f4841a10e18cfb21be901c4e416d3a", "object_relation": "sha256", "Tag": [ { "name": "\tValleyRAT", "colour": "#72C9CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392464, "uuid": "6ccc2604-dc69-47b6-95fb-8ee7075bcb73", "comment": "Malware payload (\tValleyRAT)", "value": "42d5f89360ad4cf824f5d03ff0bda7fe99efbdc9", "object_relation": "sha1", "Tag": [ { "name": "\tValleyRAT", "colour": "#72C9CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392464, "uuid": "890b9079-26a1-45ca-9a59-e6119673e5a4", "comment": "Malware payload (\tValleyRAT)", "value": "923051f2095175519b39e99355b3b62c23da2abd481869e2360698a458906ca1a0fc2bd658c1c0db5856ad4a825cd852", "object_relation": "sha3-384", "Tag": [ { "name": "\tValleyRAT", "colour": "#72C9CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392464, "uuid": "b4640809-7b5b-43ab-bf4f-012631004ac4", "value": "T1AC03097643A9C079D34F51F27F6AE49B7C39F2E66160700713705FB92E17AB06A281AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392464, "uuid": "2296c235-8be4-4740-b76c-c540cb4bb797", "value": "a66ac84db6116999f6cded522d9f3b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392464, "uuid": "973695a1-de37-4c9e-8aa4-aec6327a48f4", "value": "384:eZlW8+guCs/k0WMzi/A2lHm9w9tQJ8peiy778Pep1/hV/wEJAvz5sddHRN7FJQ3g:Q+1/TUNN0J8peiHe7z/XevFIOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780392464, "uuid": "d16d648f-89d8-4491-a85b-48fe4e99d7cb", "value": 38792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780392464, "uuid": "dac0b846-8731-460d-9814-44c434608877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392464, "uuid": "f0ab45e0-be8d-4cef-9f7b-4b159f1cc2e2", "value": "2026.05.29\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42ac9db-5e4f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780383264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383264, "uuid": "184524e4-8e28-42fb-9023-5f9806dc07c9", "comment": "Malware payload (ConnectWise)", "value": "de90bd5654d5cd7559406094fa05f224", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383264, "uuid": "6766be4d-3083-4e7a-892f-3b181c401020", "comment": "Malware payload (ConnectWise)", "value": "0911dda45fad7f223b54fa740606204213dbecbda91c742c455a5d4f8d339b81", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383264, "uuid": "e88572c3-65ca-4073-8fc1-bef560fc7820", "comment": "Malware payload (ConnectWise)", "value": "201990b260a54d41fe5a50a7c3c901d33d9c68ca", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383264, "uuid": "7004ef69-1349-41b5-9b8b-73d733571b9a", "comment": "Malware payload (ConnectWise)", "value": "b788408b2cca99cea59361fd1848dfbb343c08d3c79b436ccba994ef471cf73085105a375b3f8504a559759f7a705a8c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383264, "uuid": "e64bb75c-f0db-4a8d-9299-c0fb831a4bed", "value": "T10246E101B3D695B6D1BF0638D87A52656774BC049316CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383264, "uuid": "1519e801-21ab-4597-ae68-afb8da66ed2c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383264, "uuid": "1c1e02c6-909e-4107-9d5c-7703b470a42e", "value": "98304:zzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:zhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383264, "uuid": "83984567-d2d7-40cb-adef-63cee51044a2", "value": 5662264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383264, "uuid": "bf0ff5b3-f285-479a-bbbb-8387bf6505fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383264, "uuid": "85665265-2d90-4ce4-bfee-74da246b8222", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7220789a-5ec6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780434183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780434183, "uuid": "da84333f-ea29-4be2-9c57-69b5c345a6f3", "comment": "Malware payload (Prometei)", "value": "3f5b09e3d995d4a5b21a521a596f4c77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780434183, "uuid": "0e697d51-d5f8-4615-9c09-410cfdeba670", "comment": "Malware payload (Prometei)", "value": "09275ebdc5733fb114cc4be985acaeac93023f5563ab384e4ee0400cc78705d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780434183, "uuid": "9b0b327d-d21b-4e13-8c42-ad8d9fb83cef", "comment": "Malware payload (Prometei)", "value": "0d7443029066007838e4108d1f392d521a332f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780434183, "uuid": "7b860ec8-5b70-4b21-824a-dd4d07908427", "comment": "Malware payload (Prometei)", "value": "b962dc30c8923038f89c9489e92f10f6db5ae7f33064493870dc3290ab796b6dd6db273b4883e4ffb0c5d04a4c6abce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780434183, "uuid": "aa339227-43a5-4383-b995-3b2a2402500c", "value": "T108A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780434183, "uuid": "988e9d5c-ea27-491c-842a-94b291f4ad4b", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd8:Fs6pyCC/Ya2hpi6T6N4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780434183, "uuid": "39eb239e-8235-420d-b002-36720de07776", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780434183, "uuid": "04feb738-2aa6-4e50-8db6-e367d1e8078f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780434183, "uuid": "1f216f84-2519-4b5e-86a4-8a2c939e7040", "value": "09275ebdc5733fb114cc4be985acaeac93023f5563ab384e4ee0400cc78705d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4122e4f2-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364522, "uuid": "ae63b4d9-e47b-47f9-ac2e-54a79432c0a4", "comment": "Malware payload (Mirai)", "value": "c69e4dbf9871ec221284686f4a56d35a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364522, "uuid": "ffc8128a-2195-4c6c-b7b9-13b60bc4a3c7", "comment": "Malware payload (Mirai)", "value": "0b9291fade337dc74b8373683e8705c825356c3dc910c66976d036db17dddb63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364522, "uuid": "b5d57c5f-abf1-48ca-8758-6c6ae7efcfb7", "comment": "Malware payload (Mirai)", "value": "e4cb6ee001b50d38f8d4866fef6ba7befa1d2690", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364522, "uuid": "4ee807f5-812b-4a28-8d05-85c4e6328a4f", "comment": "Malware payload (Mirai)", "value": "77ceaf1e492b6ec7b0fb361d2a837f20108a05ad1bcf54c4818095ae011940fe1ad1d28923fd87254f9bdc15d67f534f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364522, "uuid": "4c3b9d73-f2bc-4ec9-bfb4-d7ca502b0120", "value": "T14D156D88E7C794E1F66300F1068FDBF71564A2265053F6F6EB4C2A977432B522E1632E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364522, "uuid": "4acb99a7-0a2c-4bc8-ab7e-df84620aa2bb", "value": "24576:mnpEHTxXh6ZhOEDaadvuAb8uUZzwN2WgV+/1wT8m1k2eM:jHth6Zh1t3KzwfgVR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364522, "uuid": "0efc5d98-9786-4e62-975c-09a82183ea77", "value": 910428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364522, "uuid": "74845e37-30cb-4479-9832-58c6e7930a60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364522, "uuid": "3d9d4593-882f-43e2-b444-55c5b27d43c6", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef86efa-5e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369324, "uuid": "15474526-0c6c-4e17-991b-5b60edd79779", "comment": "Malware payload (Prometei)", "value": "b9b254801ced286eb0eb19750e88d13b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369324, "uuid": "56beda21-94ef-4b3e-a5b4-7ad78c721a53", "comment": "Malware payload (Prometei)", "value": "0b955448c9cf85a23129f82a1df70d9d846c17ea01b5d9cb68bf1778d9176223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369324, "uuid": "79723ebd-6ec4-4e4b-aa78-2e5e74f12839", "comment": "Malware payload (Prometei)", "value": "e36f80d8285524f19fb8fee8f7309975dc4bec45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369324, "uuid": "f119b547-d88a-46cf-9057-e84d4ddc27f9", "comment": "Malware payload (Prometei)", "value": "3922536770857b1c8c10508b5d922a6276de018e92d131e9f40c7d372109a5defc68bc57ee1e37d0ecbf9ea115dc2be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369324, "uuid": "105cda9e-1bbc-4e40-9963-a903ca7d9841", "value": "T161A423B4F9219E8F6DD76DB91B24C31DE181C172689D4C2313AE95A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369324, "uuid": "702712bf-aab0-4f1a-ba6c-318532f489ae", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdU:Fs6pyCC/Ya2hpi6T6N4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369324, "uuid": "12bb158d-9c03-49d2-b2ff-fa80ccbf67a0", "value": 449090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369324, "uuid": "80c154ed-b923-400a-a023-846476b50d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369324, "uuid": "cc42b10c-b157-4256-b934-406044048f60", "value": "0b955448c9cf85a23129f82a1df70d9d846c17ea01b5d9cb68bf1778d9176223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5523b8-5e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780369772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369772, "uuid": "c826a4f6-459f-44d7-8226-8b453889f4ce", "comment": "Malware payload (Mirai)", "value": "f491f913de5309269da98a083c8bf155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369772, "uuid": "a3c1da9a-da40-4b2a-9b8d-a73781440c4e", "comment": "Malware payload (Mirai)", "value": "0d3d2e513043f33923c8538f0d40b246730eb64d685628c28b89b04b6efcabf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369772, "uuid": "1c9525e5-5429-499e-a353-f5e02d2c1b0f", "comment": "Malware payload (Mirai)", "value": "f5404870127dd325bdee190374201916f68bd010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369772, "uuid": "0d889b35-bbcf-4b1d-878c-5d367fa5c7a1", "comment": "Malware payload (Mirai)", "value": "ee6f3549bfd1f65ab7c21e3ea973e50b30b5dc065e96c2b7418d34bb1d0ffbd8bc9a2e5d8733be2ea8f687eb56d59928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369772, "uuid": "1a2dcf90-abd6-439e-80af-1c7dee663235", "value": "T1F063190368A081FCC155C570AF7FA53BD623F43E1135AA8EBB947F267A4AD211E1F189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369772, "uuid": "c8ae9319-0497-4927-90f6-f51abec39e16", "value": "1536:RgCa8F1GyhS3oDpJvo1CEP5mzW1/ZLZ6uz:RgCa8r4onvo1bBmzW1BZ6uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369772, "uuid": "2f4cfd3f-77d9-4495-a27c-d76dac253c03", "value": 67872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369772, "uuid": "fb63ff56-2790-45d8-a735-10a414e64834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369772, "uuid": "48cd623e-656b-437b-a9d5-c4587ae46953", "value": "azsxd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11990541-5e1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780361007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780361007, "uuid": "298772a4-60bd-47fb-a53f-17c719e05fc6", "comment": "Malware payload (Mirai)", "value": "9059b11925e05ca47f75594a4f813dd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780361007, "uuid": "8a9ec524-03be-4040-8214-39b3e9ce4758", "comment": "Malware payload (Mirai)", "value": "0eb00a329d6a7c36d25f4524d6a985b44fbfb716efdfd922e1767c802ece7ff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780361007, "uuid": "48f5b8e7-5daa-470f-ab65-0bd8ad418449", "comment": "Malware payload (Mirai)", "value": "096e07c3f42c1fe9ce8efc4f562a184067455ada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780361007, "uuid": "9dbe28bd-ccfc-4215-8b74-671e6bc49c64", "comment": "Malware payload (Mirai)", "value": "f0291ca62c4249ed830c02eb465b6e857a6a182379c6bc22ba117157a668bc981e6f3c8d5ce103fafa677467b56a7581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780361007, "uuid": "dda0b239-7a89-4d67-b72a-121c1abf8287", "value": "T13D334A02726C0F57C0A31674252F1BE487FFEAD122E4F249255F8B6A8A38D371489F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780361007, "uuid": "ac8625d7-4f84-4b9c-a987-47ee095db585", "value": "768:aOXp1s5T7RrIhC3hI68OjAbYXQXaRHVo6rnFRf6eeGyyQgIktHwp:ZEHS683sXT9VouFQG8gI8Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780361007, "uuid": "e824ba62-1ab3-4e04-aaf9-28b21ee2bf05", "value": 53036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780361007, "uuid": "48938987-817b-4311-b34f-9e059643e09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780361007, "uuid": "3a24bc14-747a-4dd8-a187-655f08f164df", "value": "OGz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d9c558-5ed4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780440316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440316, "uuid": "d101768c-e7cf-482d-a58d-32741ebe2887", "comment": "Malware payload", "value": "94303be4139274fc9c48642c591653ed", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440316, "uuid": "47ddcf55-3cea-495e-8625-ad8b6921208e", "comment": "Malware payload", "value": "0f175f7fcbd0e7ceae68a0e720765f367dd6496fd4db9df5f49ebd6f93de2508", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440316, "uuid": "b72ded7d-de0f-459e-81d0-b508a99ad6ab", "comment": "Malware payload", "value": "827e8db13f3619a026ac176bad8235d6ea97c220", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440316, "uuid": "54835ed3-a36b-4642-9611-648260162030", "comment": "Malware payload", "value": "584d303ffe955632572ecb66c0ed23f6596f1cc5feb4ffc0a1e4e679ee74156be1c828a597bb3aee8016d3ed74481aa1", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440316, "uuid": "bc5f9366-49e7-4689-9f9a-c30d2a759dae", "value": "T19FD35D0FA2250F7EC58103B13B56B5CFF22AD5796F359E51E428800E8377D2BA6A2F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440316, "uuid": "5a72c97a-8832-4a06-a690-ca90534574ed", "value": "d195dd9ffad463d4a93ccdbc6f52582e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440316, "uuid": "d5f217fb-7542-43d4-8634-97f52232a9e2", "value": "3072:k5QCi5hIygRPEnk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/gU:oi0RPEnFtCApaH8m3QIvMWH5H3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780440316, "uuid": "9d6aea43-b4e0-43d9-ad3c-6ed24e7d32a2", "value": 139319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780440316, "uuid": "b1873dd2-d29e-40af-9a97-389d3d8d4a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440316, "uuid": "aa989b5f-66ab-47f4-a9a5-1300117469b5", "value": "0f175f7fcbd0e7ceae68a0e720765f367dd6496fd4db9df5f49ebd6f93de2508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f227af-5e50-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780383323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383323, "uuid": "21ac0f1e-56e4-4d1b-ac6d-328d0f12244f", "comment": "Malware payload (ConnectWise)", "value": "81550fb7dcba4903118b744a04f505f4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383323, "uuid": "9ab69b09-7ca2-4460-b9a6-c6585414eabe", "comment": "Malware payload (ConnectWise)", "value": "0f9ab6d794555b5c69ab2c661d9dd1801ce4005203246cb548986a7c651f48f2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383323, "uuid": "efb1802b-b017-4ffc-8faf-757f720c6430", "comment": "Malware payload (ConnectWise)", "value": "430be3b2a420fc7140db170dc79a919d7f0da66b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383323, "uuid": "1722bd34-e14f-4f9d-a98d-623100a664f4", "comment": "Malware payload (ConnectWise)", "value": "c7156eb1d2bb726ce11b17e3c0e72a2241951275133106bfcb37b1774ba1fcbfbf869e462016f4cbf47e44ad66f9f014", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383323, "uuid": "6bd6cede-adfe-460a-b29f-55a1eeeb757d", "value": "T133646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383323, "uuid": "a1fbb26c-417a-4eed-97fb-6867de303736", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383323, "uuid": "589f8efe-c798-4b30-a483-ad014d442956", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9v:51iw7gryNkSV1hy1Z1u2JLu9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383323, "uuid": "ce148340-5d6e-4429-954f-a208049243e8", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383323, "uuid": "0edef78e-d3c4-4643-a9f6-754fe3095236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383323, "uuid": "f8ebed1f-eb83-47ad-964b-3843442e3047", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4059bc9d-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "1680dbc3-5eba-4269-8f45-0cbecf38263b", "comment": "Malware payload (Mirai)", "value": "b1444d92ae55bbe79bacb8c3df4b8ef6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "82e70fa2-05af-4256-820d-65b72b630a6f", "comment": "Malware payload (Mirai)", "value": "1029b86d036289e495b8fc50432abae046ac404306d2e81ec954321fe1fae236", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "e68cf183-830b-42a5-88a3-14dbb3c0a589", "comment": "Malware payload (Mirai)", "value": "e25f8eb8802b8091e9be061ed9ece9d5f0432c22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "2a57a948-565c-4a09-93b0-83ae1ec42ac8", "comment": "Malware payload (Mirai)", "value": "dc34ad31ffe05f81353b22213dc3d52fe5a0a5d29b296687d167598fe5f3fd90ed654ba746c7f04860f3fcd8f60330b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "d368d1f2-d8de-420d-9c90-0062ec4c9738", "value": "T1D694D04AF24B3D42D4D7E5350887C681479EE5AB23F393092B47A8BB38593B64F2934D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "2043decb-2060-4cc5-81fe-d0864ebc34ba", "value": "6144:ZXMgCe+CamHsiXCJaB3cXjRmQHyQVnxoNV6U4CFjffgp+4tzs/0a:5MgCvo4JahAcQfVnWV6U4CF7gp+4tza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364521, "uuid": "aa25a841-6f56-48de-9006-99e0aa8a69c0", "value": 443876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364521, "uuid": "94d0045c-bfde-4535-b5e3-b258ef81b16f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "8c408791-317d-4872-b207-10cacc2d7ccf", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6331359a-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780414831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414831, "uuid": "2ceab61c-8c7f-4dce-a0b6-7621f6e88205", "comment": "Malware payload (ACRStealer)", "value": "1f816b2c14ef696bc6028cbcbcd9dda4", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414831, "uuid": "eec0ef44-b14e-4b4e-80f3-655501670df0", "comment": "Malware payload (ACRStealer)", "value": "10c65315629ebb777d34418d5afbcf2289afaa6de096b5936bdd76060a2740e8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414831, "uuid": "8bb4d716-f3e3-4ec5-9bf1-4ba267de45e4", "comment": "Malware payload (ACRStealer)", "value": "8533fa47e59fba9a09e5975d22285b826b581ec9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414831, "uuid": "2053a345-265a-4590-930c-dc4650830c96", "comment": "Malware payload (ACRStealer)", "value": "67233d21c74befd1204b41694e22e6eed288608101f37cdd7a3792d4422d42ab11332aed5b7e35fa2bbeba3e340ac8f3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414831, "uuid": "c175c995-3c67-4c91-90e0-35b5d2c40adf", "value": "T1C4A59D51FCDB54B1E942523208B6A3EF2331B9091F31EF87DA146BBEBC375910E22659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414831, "uuid": "d895037a-1ef7-4039-8823-0b99a44d2a5c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414831, "uuid": "b59ed3c5-e241-4042-aef5-5a0e5e3a3acd", "value": "24576:TN/5jPrc+EtCcBdNO4tiwlHRvFDME++5VtfADVA/9RHUKQ+LAFjAUuEVQqjT9CQO:cd4elVtfGo++ujAmLjkGmw0h8D1Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414831, "uuid": "d02dfa46-9d09-4931-bad8-81d488ca0298", "value": 2259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414831, "uuid": "9ef1ca41-bd46-4233-b3d6-3b0b1aa96fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414831, "uuid": "083d2cfb-0e52-4b39-9e53-955d52bc8a76", "value": "crz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431549f9-5e89-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780407905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407905, "uuid": "7baf5b68-6ccb-47fa-a7b0-c3602181bf12", "comment": "Malware payload (NanoCore)", "value": "0be0e1ae0862f592c51f500bee2ec880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407905, "uuid": "45c24ea5-8bdc-4bb7-be1e-ad41d407609b", "comment": "Malware payload (NanoCore)", "value": "112ef076061a1f6be03945a02d98fc6ca2ae5d97510e33d04139f929f06758f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407905, "uuid": "d2b7cff5-9526-40be-ba78-d556e5243b35", "comment": "Malware payload (NanoCore)", "value": "791df9fa23c2373917b1c3fd9928aaf6accc41e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407905, "uuid": "0fca9ce9-64bd-44c2-a0cf-ad5a9cb4b0ef", "comment": "Malware payload (NanoCore)", "value": "610e6c28ddc64d8f9464b0bdd288ecf36e726fbe5847d8cde3df1d0487b4b961a5e669b758156b3a4c05858f3932f993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407905, "uuid": "47ba5b27-058c-4181-ab5c-2ac594ca98af", "value": "T1F514CF5677E9892FE2CE86BD612241539379C2E3D8C3F3DE28D415B69B223E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407905, "uuid": "e554a05e-bc2e-4a34-97d6-f9dc2975b05f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407905, "uuid": "967dae54-8d37-4519-8a7a-dea390a36bd8", "value": "6144:MLV6Bta6dtJmakIM59UBPnGZd3wwMi5T7:MLV6BtpmkKMOhwwMi17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780407905, "uuid": "b59fe666-3859-4058-8ed1-23c6c9f9fa41", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780407905, "uuid": "7551594a-c6c0-4df6-b908-e20c5a44a58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407905, "uuid": "90086d22-f473-4a63-818d-3a9276b69c30", "value": "liawhelloau88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be9c4ff-5e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369721, "uuid": "550497b0-beeb-41ef-85c1-934a6fbcdab2", "comment": "Malware payload (Prometei)", "value": "7d4a38c151cf53ac12d45bb36f029e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369721, "uuid": "07ade3d9-ac87-4624-9d07-c59defd34760", "comment": "Malware payload (Prometei)", "value": "156ad5327385b9a6118397d67f5e947f10cd5b8c84c5c7c11ec5aff50792c2ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369721, "uuid": "ce4e598f-ede7-4bdf-bb91-23ed4c25a5cd", "comment": "Malware payload (Prometei)", "value": "cd5f3a80932fe23af7d17c665aca49ecb8e5df94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369721, "uuid": "9b50d507-44e7-454d-a6aa-900f411edddf", "comment": "Malware payload (Prometei)", "value": "e687e9ce135bbf7b425c816f4e3acb98148f5b1e843b866d514a44d7649789df234af73427a0029b44aef3cb65262a16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369721, "uuid": "d6113c56-7234-499e-a652-884b2ec6ab26", "value": "T1D573188678969A1AC6D0537BFA1E82CD3B2573CCE3CD7207CD119F6136CA92F0D6A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369721, "uuid": "2c4206c5-3f7b-47a9-98fd-29fc0d76835d", "value": "1536:FVuza8aam2uLd70zAR3rWrKCdqkZFPK6:HUaZa80MbW+yP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369721, "uuid": "2834e9e1-4039-4904-a07e-af4210e925b8", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369721, "uuid": "d3730582-0fd6-479c-9f56-c4fabc951649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369721, "uuid": "00754f33-ce8f-49ca-9915-420ccf275578", "value": "156ad5327385b9a6118397d67f5e947f10cd5b8c84c5c7c11ec5aff50792c2ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d9dba3-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414194, "uuid": "f680421e-6e6b-4085-b59f-a77474dd7028", "comment": "Malware payload", "value": "3696f9cab5cf3420be680b6afc23b3d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414194, "uuid": "05c3268c-f376-496c-8855-428ec60d665d", "comment": "Malware payload", "value": "1729b357a8b00c8bb9eb34b29e54a8167315e2ca6b9680048944f6e54751478e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414194, "uuid": "e30b3c07-0fb8-4a6b-8cd2-7ce55d8f777c", "comment": "Malware payload", "value": "fc2f8c997d4994f2eb84b9d326c83aac983e7993", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414194, "uuid": "702e49c1-917e-4d27-a5f0-ce705ae946e1", "comment": "Malware payload", "value": "e147c3822b87146850d1cbbc8be8a287f0e2be82081819aa4290ed3a44ec2502d094ce7ee48a2e136f682115c0199cf9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414194, "uuid": "55e54ace-cde2-4f19-8785-7ce5e6af8b0b", "value": "T1F8B197176D640EF1131642AE8E8B30551282431B46AE6D28BAEDB708FF398F562F1377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414194, "uuid": "940c3025-3621-4c3b-a276-7a9d32cd61f6", "value": "96:OH97RcQJnrXFEPeYPbfj0txvrpI/uxCtVjX/b3Sdfoz02A2Yfqm8:sRc6nzFEPe0bb0txvNI2xCjC9ozTX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414194, "uuid": "c1a166e0-2295-4e2e-bd95-ec2036a7c0ef", "value": 5331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414194, "uuid": "4bb79f86-3676-43ba-a314-1afee9a03de1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414194, "uuid": "3a8535a6-dd6c-435e-8d81-f546d091ea5a", "value": "agent.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb881624-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780382847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382847, "uuid": "bc484f11-01a9-4ef0-ae9f-865687fc1f0d", "comment": "Malware payload (MassLogger)", "value": "78c513b03b754e640760d07c2ede0b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382847, "uuid": "c2adcb0f-257c-4c57-a5c9-1a42e1e001cc", "comment": "Malware payload (MassLogger)", "value": "193a995a2533e876687cc8018b4ec7c69e27435b5788fab066d9389ba539cad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382847, "uuid": "d9c0c714-c639-47aa-99d8-9c5a94414481", "comment": "Malware payload (MassLogger)", "value": "f19014507d8287121dc0c39e6dd490731df4d825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382847, "uuid": "ff86ed68-27e4-4d62-9692-babb83a340fe", "comment": "Malware payload (MassLogger)", "value": "d9d66481b3ae6ae47f77a89c1d92805df4bd50d84c87884347fe1397c6ce67d1b21b3de0d5a3744a04264f3a6a5c4047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382847, "uuid": "a7ef1672-5e17-471c-b6f7-148a04545bbc", "value": "T18C15F144232ADD05E4F68BB958A0E7B407785E4DB971D3038EE9BEDB783678189183D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382847, "uuid": "adb89811-a1c7-4a3c-8127-c449fd6b100d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382847, "uuid": "0497fb0d-a7d6-4d5b-a86f-6c934f3175dc", "value": "24576:OJ+4XqEO0L+NOncLzUK3oZutgWgqeKFXbeR:OJ+CqElLGOgAKcuBgqewi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382847, "uuid": "34904a30-0e1b-4c04-a851-6e2a5cf330a8", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382847, "uuid": "46834352-a4c1-4438-800f-3917a27771d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382847, "uuid": "d1b6d836-3bd6-483d-9ce5-66ae2b99a85a", "value": "INQUIRY- SSQ2026.4953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a83910-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780405701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405701, "uuid": "6b413e46-abb9-491b-bb75-663c328d3126", "comment": "Malware payload (RemcosRAT)", "value": "8149c02292bb17f6c5c7ed7e6b42e41b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405701, "uuid": "6c9821fa-c343-4368-b4b5-576c50fe53a2", "comment": "Malware payload (RemcosRAT)", "value": "193dfceab5a4746393c441e2994b8b2c258ddabc1b202b6982acc854e599eb07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405701, "uuid": "c8fc8837-b6bb-4a86-96c9-c7fad88a916d", "comment": "Malware payload (RemcosRAT)", "value": "fbbc6957f6d2827866668daa75a3ff7e93d5d7e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405701, "uuid": "8f1a2c96-66d9-4ed2-81ab-3873ae6f892d", "comment": "Malware payload (RemcosRAT)", "value": "3e3ef423e3492e217b5c77b6f0d40729a88de0f2f91588920229502172f5cff7042d3685cb8034b2d4c2a0ccc0955515", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405701, "uuid": "8ab7da54-5747-4688-9d22-187bd4cec384", "value": "T168145C20EE24067B0F072BDDFDA54622CABD8719462660B1F5DE470D610A5FCE3BE26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405701, "uuid": "b5378898-a190-40fb-bb26-e5f6f5b35480", "value": "3072:c/N0z5IQjGj4gfUFF/uJKnJTFloMa/3lsm4iDjCakWdGWZp2dSFl/2bIY2wpMG:0C544gfeEctF8/3xZ+ak0G8/2kieG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405701, "uuid": "9a3d1a90-133b-4846-8776-891cb8d95db7", "value": 200457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405701, "uuid": "ee53e13f-9e26-431b-acf5-4fec0cee9601", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405701, "uuid": "b9e70af1-2a72-41da-80be-b9b569acbf5e", "value": "Shipping_Information.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99328e86-5e72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780398171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398171, "uuid": "e99d07c2-7960-4d13-9ca1-8cbd2a98b4ee", "comment": "Malware payload", "value": "547ec505a19d84ea2fb716da623a6e5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398171, "uuid": "107554b2-089d-4cf3-b334-34cfd617ddbf", "comment": "Malware payload", "value": "1b5fdc0a2fafb0320c5f4c20727b37719bf334651942e7d1ff9b67a2d299f710", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398171, "uuid": "ecb22ad2-947a-49a9-a648-052112623232", "comment": "Malware payload", "value": "af3777a09674bff945207aedfcdab53acffc932c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398171, "uuid": "688b8683-4811-4e94-b3a3-fa5bf4cd062e", "comment": "Malware payload", "value": "594a784f2b4582a4066181dc48a1c72f81001ac884130b84099679f426ed86ee680c44f8e09f9c7461a4e60d832b188c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398171, "uuid": "0a1c6330-14db-4fa4-a846-aae814d371e6", "value": "T19922BF836D5A3162B8C8092AFA9539F8DB69597ECE742D634CCD15B2F423DCCC0CA1D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398171, "uuid": "6ab2ffda-1ed6-4a6a-8af2-2c2f24f156d3", "value": "192:jyT4mKF5qp7kGwZgtBrNg3UjTcS33IEKTTaBtyHzhN2NjRFehRE/zUnomcxT:jWKjqBTwm2QT/347TmPyH/UjWULQYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780398171, "uuid": "5c434373-a1d1-4a86-acf4-b64a63457ea0", "value": 10621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780398171, "uuid": "2c0d3a18-b044-4d49-829d-22d84366dcd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398171, "uuid": "9fb4e00c-0cd6-44ce-bce1-3b19053d233e", "value": "PHOTO-838697655.png.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71138f3-5e92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780411965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411965, "uuid": "ff825ff9-2234-4f9d-b313-2ed7b9c3e26f", "comment": "Malware payload", "value": "d9cd40d2a2e532f16cd9c2bb9de1a7c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411965, "uuid": "c9f6333b-3396-4d6e-af49-e4585422f8c4", "comment": "Malware payload", "value": "1bc6411b4436c6f9bfb8a9ec5f2d7cf56bc35c0ff2704b69251dd6b3ff06c092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411965, "uuid": "15e8bd3c-d114-4487-88f4-ca50471d547d", "comment": "Malware payload", "value": "8d1a470d6be06c5cf1306f135ee96075b5878f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411965, "uuid": "c0606335-df81-4fcb-85ba-e5b784ec2bfe", "comment": "Malware payload", "value": "6e610e16ed0ff98a28632632f12a4147f9c64bc0eb9872ffa15e2548c2e98fa8f2a311925e6dc9c818ff6e050db2abb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411965, "uuid": "8d6116e8-7472-4ab5-8c8b-bcbfab98e3b6", "value": "T1212723C685B693F997C38748199B13C7A5C0605BE6EE89283ACB9C037150C6B468FF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411965, "uuid": "99c623bf-0be1-4436-ab1c-acf1461bc718", "value": "c5c4f0b8dcd34f1c1fd763c32fbbe969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411965, "uuid": "204321d8-75d6-495c-8849-f31809202b14", "value": "393216:D4yo/k+e80C3cLckaPma5++5d6EuHqlk42eDFcdFq/q0YGCek/Hx:DcM+e8WiPwu9uHqq41DFcFQYbekZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411965, "uuid": "07658bf9-89ae-4593-ac1c-b92e412684a5", "value": 22263456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411965, "uuid": "449bc1fd-9eb6-44df-b962-d03615734a2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411965, "uuid": "82a30743-d624-4f7f-893c-8e99eff65353", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99cbc7c-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360886, "uuid": "5024e76a-ea61-4015-9be9-e5ff0f83a5bd", "comment": "Malware payload (Mirai)", "value": "a4b59807e881ca99932f3b2ca39d347f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360886, "uuid": "f91fee93-cb5a-45e9-99ff-81deee271410", "comment": "Malware payload (Mirai)", "value": "1cfdfdee0d122f6db583f434420d63762c1bb36f278918ee65497fb602f4218b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360886, "uuid": "97b8f16f-3aeb-4dfe-90fd-acf4b92d3c8f", "comment": "Malware payload (Mirai)", "value": "002bba0558efa18304be3ab4f44a12eefdc64962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360886, "uuid": "22f2ac00-4b20-43c9-9900-0bec4bc2041c", "comment": "Malware payload (Mirai)", "value": "6bed78fb47464d576d64faaef19191f7054e6df7fe1e2fcd44c48707cf09c4383349f57d976a7c6998c981d02f8f5482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360886, "uuid": "36f3d77a-99ed-403e-8232-b7f52267f7f9", "value": "T102630A45F8818E26C5D5027EF92D128E371267E9E2DFB223AE205F203BC692B0D77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360886, "uuid": "541818a3-a76c-45ce-8268-8b6d45ab3202", "value": "1536:6tnSZigkxMwIaIWDxqKlFaQz4dBALr5Bjc1I7iUCnr02fh:XihxdIUDxhjbVtCnr02fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360886, "uuid": "6fb423e1-9e1f-4f01-af26-f6eed73974f4", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360886, "uuid": "265a4b91-aadc-4e7a-a780-8f0abfb26946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360886, "uuid": "8f58d9a9-0b41-4b0d-a02d-6f8165ef5f6a", "value": "OGz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6181d5fd-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780415257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415257, "uuid": "10c23030-bc56-46e2-a6c8-6f23db3b3be6", "comment": "Malware payload (PhantomStealer)", "value": "b2e2d71f9dc21853656fe12fe6930de0", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415257, "uuid": "c36dbef0-4c63-4d89-89c9-53b31e94df14", "comment": "Malware payload (PhantomStealer)", "value": "1dcc0ad6701f04e5242f91414ab03b051a0595d99a7557f357a2e5c056eb3aa9", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415257, "uuid": "5064ba84-bc94-4bf4-a61c-8415f95de739", "comment": "Malware payload (PhantomStealer)", "value": "72b6efacf8c14cd799c3b977a780a600ae240f51", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415257, "uuid": "53cd66ae-a9c2-4eda-9d38-7e51286d7e4c", "comment": "Malware payload (PhantomStealer)", "value": "871c786a3123ff9b835ee0b8cff1277665ea7cab15faa530629b96523eb29ff232aaa4b358cbf35c6edf457592e33f12", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415257, "uuid": "90272616-a789-4d97-ac18-005e2cf1b175", "value": "T12D42C01D512BFE6D70627676BC0AB6E3F28D9002E9FA129C857A94748BAD445CC0CE43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415257, "uuid": "fcb461ac-eda0-4361-8396-6f0cb06e26c8", "value": "192:nG5sEQkNxMx52pYT6XVbPtCUr16hGsfe0K2MCNjQq+gUjmV/UYRjeyZj6OpCysG9:nGejkrMv2CT6lb19r16hnv56q+gUa9vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415257, "uuid": "0960c932-80e6-454d-a078-8d4ba9adac27", "value": 12085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415257, "uuid": "34c9273a-8bee-46f1-8f43-6fd6425f28f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415257, "uuid": "1d2335c0-ae32-4811-84e3-c7efb7743c89", "value": "PO_49460.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77a7968-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360882, "uuid": "50d03f93-f1df-4576-96eb-aa841cf8e81b", "comment": "Malware payload (Mirai)", "value": "b60ead095bdc1d37beeddf398838451d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360882, "uuid": "6013089a-f8c7-4e65-884e-3f3dac98df00", "comment": "Malware payload (Mirai)", "value": "1e388861ef1dac63701ec57be6452348d76de5fb3bcaa57016f299d8ab0d8809", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360882, "uuid": "3b0396f2-aa30-489b-be18-546893eaf206", "comment": "Malware payload (Mirai)", "value": "7425596378f86ed364de446b63f5aec1516b279d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360882, "uuid": "0526f342-be04-4f1d-9c78-701030c1d7a9", "comment": "Malware payload (Mirai)", "value": "28ea411a95b9cbe897e1849a3c8871c03711fb9e915af441ba720a08912b5258d9bb363fd8ede2743f364932ffbf155f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360882, "uuid": "9eadb136-05d3-440b-b206-cb6f5f03cda4", "value": "T19433099AB8029D3CF90FE6BE54160E09F92177C152830B2767BBFDA36C721945E02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360882, "uuid": "95921790-0194-4fd1-b6d7-fcb2ef3c594d", "value": "768:7/PWWus5o3ZmxGi3Do9PbSVvetTC8M6M1mkzYYIXOeoKC/OsGF:L+yGi3sPb+vetC8M6MNYYIX3oKCwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360882, "uuid": "b1e3f5f4-7ff1-4146-92fe-971ea45a225e", "value": 54828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360882, "uuid": "22b68a1e-fcab-4fff-bfcf-305eba3fe885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360882, "uuid": "702c9de5-73c4-4fb2-8b38-74a3024a264e", "value": "OGz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ca0c07-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1780414216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414216, "uuid": "43bd514c-ad16-4fef-8407-c5f35829f124", "comment": "Malware payload (Sliver)", "value": "bcdff2e0df8186d76740979c5dd44ae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414216, "uuid": "7bbd9269-5654-4d57-bda5-e8a09c5ff0ad", "comment": "Malware payload (Sliver)", "value": "1f7ea2f066790316d9d296e6f530dee1590a3a1fde171500c94458a264e592a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414216, "uuid": "fb296441-10c1-4a7b-9641-d4dc2efe008b", "comment": "Malware payload (Sliver)", "value": "665465c8fbf3787040c7e521be8482a4913f06cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414216, "uuid": "b16a9cb9-7d1e-45ba-9d81-12857368badd", "comment": "Malware payload (Sliver)", "value": "e7b3a2daabdbd882af741c35f551fef37d12e1a72f3a4290d066b8eb9daa3dc4bdf6c994623ad62ef001422fc4c5d867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414216, "uuid": "1b1e2122-140c-4680-9d62-d7c0320b75f3", "value": "T160B61847F88501E8C1EDD174C6769262BB713C885B2573D72B20F7B82B72BD86AB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414216, "uuid": "fb547884-9c7c-4b3d-8d46-c111c53f5486", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414216, "uuid": "f7339d7f-a852-4041-9762-8d7a737d67c3", "value": "49152:WAzZeGYi8vZpe7/srb/TUvO90d7HjmAFd4A64nsfJouVcQ7w6lFCuXfekDGqV7Fo:0vZp8qCQLlkuiGn8MuZfED1at9tSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414216, "uuid": "fbf1b19e-76f0-438b-8f03-57571f632e80", "value": 10981376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414216, "uuid": "7680f06a-f75c-4bdf-bfa2-5070cca8199a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414216, "uuid": "bc59987c-0852-4ba6-9ff5-f5213eaac9ed", "value": "implant_http.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c59df0f-5eba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780428885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428885, "uuid": "0411989d-a5e9-4ea8-85a9-35837423e5a2", "comment": "Malware payload (Mirai)", "value": "862937af350e732385f5448d86058adf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428885, "uuid": "3560d745-41e4-49a2-a2fe-0edc1284613c", "comment": "Malware payload (Mirai)", "value": "2181637818db1566030dcf44a72c7fd33a96dcc77fd79e86da42b10811ddd392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428885, "uuid": "9f65d66f-7ad9-4e03-a0f2-cf61d48a5779", "comment": "Malware payload (Mirai)", "value": "72de84871ae1c41599e1e1907c10406efdba4b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428885, "uuid": "fde9b781-1792-4341-af73-d1c23a8eb0e4", "comment": "Malware payload (Mirai)", "value": "0889eca30caf981cdf90f685ff4472206b02a26021457e0ed81375f36b397aa3348ece443017b8ebb618a438d6bdc6d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428885, "uuid": "163c590c-0215-45f2-9828-5e5d134cebaf", "value": "T105C32945BC829B15D5C622BEFE0E3189332377A8E3EE7112DE245B2427CA65B0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428885, "uuid": "908505a6-11a8-4ffc-b715-c4adcb3a5827", "value": "3072:3OdE92pNgtL6+EfBCYIUjuvuM7aZQVm8Xizbcq03gb+HUv:edE9sgR9JY3j8aZQVm8XEbu34+0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780428885, "uuid": "748b6c3f-94f8-4585-bcdf-32856e988bdd", "value": 125104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780428885, "uuid": "181d3fb5-77d2-4da5-b525-a56aee17ab50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428885, "uuid": "41d52172-5f88-4ac6-a498-2b8670d54af8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce414da-5e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369723, "uuid": "8d4ddb7a-a5cf-4a27-850b-4136c0c0c095", "comment": "Malware payload (Prometei)", "value": "5145fb87ed29cd2d2f288f37c0299dfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369723, "uuid": "4203dfea-305f-4c5f-bd70-f658c4d0bf5f", "comment": "Malware payload (Prometei)", "value": "235596e7fb00cc04e95c500b5d02891e4b5d5ee54d063553a62c93b6bbd3eb9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369723, "uuid": "59668579-d688-48a4-99db-d8d2f29836e9", "comment": "Malware payload (Prometei)", "value": "cd7d32c0c705d112ae5378cd469d84f811764f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369723, "uuid": "d590a54f-b945-4572-8ac4-ad2def49b377", "comment": "Malware payload (Prometei)", "value": "bff0ddb63469bab1512a92ff1227b07c0fae1803333df68a6000b101e0042d8c7a6500a20382acc6523f4fc4b050e330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369723, "uuid": "85334c45-e1b1-486a-b28c-4a640b760f45", "value": "T137D38248ED68A73DC3E372FFE75902CE732A1B9877D671258E324A5637C8B95A434120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369723, "uuid": "9f26d802-272d-4c3b-ba2b-b79086ad40b9", "value": "3072:TfwjrYa8FQiNnQk13qVqyD76tvkfiDA1E06Hh5ZC5M5x2:YceOP0E5C5M5x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369723, "uuid": "a808d891-4a67-4ef9-b570-6e28e2067473", "value": 131344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369723, "uuid": "dac009a5-5bb3-4bf0-b06f-25193a58850c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369723, "uuid": "197da144-c2be-4666-867d-867818b50544", "value": "235596e7fb00cc04e95c500b5d02891e4b5d5ee54d063553a62c93b6bbd3eb9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a8cca1-5e50-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780383643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383643, "uuid": "5a3167dd-b3c1-485c-9e02-f9623e22816e", "comment": "Malware payload (RemcosRAT)", "value": "2f838244dae46ad3782dc05ed265887c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383643, "uuid": "fadfe698-42e4-4739-b770-f44021c7f0ea", "comment": "Malware payload (RemcosRAT)", "value": "252727b6682eb8a4076734bbf52e79dcccd77533bbe665a9a191b8853b96449a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383643, "uuid": "273780bc-b30d-432a-84c4-633d0487118c", "comment": "Malware payload (RemcosRAT)", "value": "1ab237e2320564b1c5e26aea3ddf06558a910a14", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383643, "uuid": "bba80ac9-3e6a-4d52-8508-8e08b0fa0bfd", "comment": "Malware payload (RemcosRAT)", "value": "80c5270bda08793c05e7bf403755a51f74100cfb825934f1ccb09ff76174238aac34f7bbf32e7381a3b9405b7851b0a1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383643, "uuid": "a5e08a8d-daa3-4d95-819f-941ff25b9652", "value": "T15C833860DDE007790E5707BDAD841A559ABC876D023780FDF69D230DA00A67CE7BFA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383643, "uuid": "463c71e6-1376-4595-aeb5-2a5490bc8be3", "value": "1536:Oc4Lh14DEDyRqaPQBlU172QOvEFM7qEiImj6yVNH3B2noi0qbYeJ:/4Lh14D2uQBlTQOvwnEiImj6yVpx2oi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383643, "uuid": "2ed7ee15-1ab1-4d88-80c6-da8150fee4f9", "value": 84834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383643, "uuid": "9fd141e3-5dd5-4429-8b61-c4d547a77501", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383643, "uuid": "ede71ddc-e776-4907-8bbf-66c92a0ad6b1", "value": "scan.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2a86c6-5e51-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780383841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383841, "uuid": "76dae9bf-8e77-4948-a5fc-fa4027a1e1b9", "comment": "Malware payload (RemcosRAT)", "value": "2df722123e5b7dbf766edb3b0e49c9aa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383841, "uuid": "846bb8bd-c6df-46e6-907c-4f1da258306c", "comment": "Malware payload (RemcosRAT)", "value": "25c74fd8b9497b405d7244a8cba0d7dad5af68770268bcca106c0a764baca89b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383841, "uuid": "87a8740b-be27-4ec6-a5e3-6c2698b83ad6", "comment": "Malware payload (RemcosRAT)", "value": "987b657a950d71e76e531f4bb5299683e5bbdbff", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383841, "uuid": "f21a1804-7ab2-4b9f-a059-340332fa5c30", "comment": "Malware payload (RemcosRAT)", "value": "794b66d9bc29146e232dcba1cee390eb825540e6bf04a8de932886a8896f1f218e2601d61159b42b1b65ae2b013d6702", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383841, "uuid": "48c23f7c-1d55-4611-a8db-8eaaf581dccc", "value": "T1A591D9C39290515587BE3817364B028601FBFD8A29C60ADFA71313E546C07B327BEB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383841, "uuid": "dbb951db-0cdd-4fb6-9666-ff76c1352510", "value": "96:dg1OphIiUY+AlKiXw9khVCsVUNPHGGT0L3ZiN+C7LgY8NUg6vDHKMBlde:dg146AlK3GgsWNPHGGT0zZBCwYqUg6vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383841, "uuid": "1a624522-3872-4aff-8121-65e59c084c0c", "value": 4209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383841, "uuid": "c1df08ff-03b4-4bf1-898d-87c5148e1854", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383841, "uuid": "09dd27f0-a6e3-4641-89aa-f8fc78b6f09c", "value": "Impostum.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5391d6d-5ed5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780440711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440711, "uuid": "8c224f4f-ad47-4c03-a2d2-eba49ca265b9", "comment": "Malware payload", "value": "5da4c844201e9299919defc7d766a49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440711, "uuid": "3e0882db-fb44-450a-a216-a12a0e16884d", "comment": "Malware payload", "value": "25d4caff9a5123e2fb475481f647915c0b11771d439e450c4905813ada8cba68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440711, "uuid": "e09099a7-2b7c-4b4e-8c9f-db3d23be1931", "comment": "Malware payload", "value": "c69580ee9896b682d195452b23cc5610d0426df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780440711, "uuid": "a5fda69f-401d-4098-b01d-f7afe58c9316", "comment": "Malware payload", "value": "bc4939c5f5745f32dba32206eaf5cd9bea5ceb9c6c93c4fbf947f319555b5e1d048881a4c151d8765f4e5d31dc69a354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440711, "uuid": "55fc8a0b-00fb-4abe-b2c1-5f893c2099a6", "value": "T1F1B58C477C9424B6D5EA92328DB552A17730B8980F2137C72E52B3B92F737D80E79398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440711, "uuid": "bd025b76-8cbd-426b-8c94-5342aaa1980d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440711, "uuid": "1420676b-b756-456f-8ffc-7917e1adc47a", "value": "49152:UYjgTI5MQ895f5VdfZOIFcOGaugo4sIlvZgRAb5TD1u:MQ89R5VdO5aur4zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780440711, "uuid": "caf76c14-e901-4934-abe3-7d2afee3fd53", "value": 2373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780440711, "uuid": "77c9b504-1edd-40ca-b785-42430657de0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780440711, "uuid": "f4428711-f112-4bb8-95d9-de535403458f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526e1967-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415232, "uuid": "7f260cf2-1734-4f31-92f3-386d8f1a3db4", "comment": "Malware payload", "value": "3068bccd49a6089cd004c7b274f4ea0b", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415232, "uuid": "05686e05-582a-4765-9783-6e1ac6d3ffaa", "comment": "Malware payload", "value": "26d010db11e473432f103bbf30faf2b9660db59b6a9f7a9cf177115823fdec4b", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415232, "uuid": "c3ac9c6b-9144-4e5c-a7e8-6dc769cca9d6", "comment": "Malware payload", "value": "841af6ca2e1e9086656078356e841a5d8005fb2f", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415232, "uuid": "2d4f66c2-37e7-4d1a-b006-17a7f7446642", "comment": "Malware payload", "value": "630e62087b93432295d1957e6e6ded3f79fe334a03fe4fd919c053a97c933b37ada2a3b7aca6586330f8adeb3f8f5744", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415232, "uuid": "fa8b23ef-27fb-4345-9f5f-46615312b099", "value": "T13FC41255B2E4AFA6C027B47ECE8810EE1428ED306B16E14F318437CD35BB7D69A1E65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415232, "uuid": "8559deea-89e2-4d80-9791-292ab2294da6", "value": "12288:pEcwekXhe3+hWNjKJYK4UVaKIL7d5ArxgGNq1I3EpFeWQim:pHt3uxJAUAer6k3Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415232, "uuid": "bbdc05e5-b47c-4fad-adf0-da5bf719dc4e", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415232, "uuid": "79699177-8533-4d7c-bcf0-0cf5cd7c0c8c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415232, "uuid": "44ba68e5-cc54-4f00-8158-1ad8d51496b6", "value": "Request#9023EQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda129d6-5e63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780391897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391897, "uuid": "b90face6-ffa5-47a4-a176-84a46f06f542", "comment": "Malware payload", "value": "80e99734eb19203be545b6fa365860a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391897, "uuid": "625b1ff5-6718-4637-a6f7-09bb29cb3eab", "comment": "Malware payload", "value": "2aa7f4ee11a91682e64f078dba80bec97ee0926efd4dfe2eb1caa572a61bd4b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391897, "uuid": "d768d42a-c2b2-40e0-83b3-56743b3ac4eb", "comment": "Malware payload", "value": "6675ffa3331e635cc95c42ab5b9078e23cb0ee51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391897, "uuid": "8e89c45f-e9a9-4506-8902-fb483cc7134a", "comment": "Malware payload", "value": "eb71b15c8d3eea5c328ab7a0821af90c9fc271af985d7d0ea32245d06da197c9ef368c229fa3a6322970a3f9585530d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780391897, "uuid": "bfa552a9-7f74-490e-81cb-492cb194ab4f", "value": "T171460203F5A218ADE96DCD34834FD233A634BC454312AB3737D59B213E16B60AF29B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780391897, "uuid": "9563e983-ed9d-4fe7-ae50-001675d5159f", "value": "98304:156fdlVbxviyNwJmYW30wkBLz6BaUxF3H+C:15PyNwJmY0dk18BXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780391897, "uuid": "d9e3f014-1edc-4a06-a6f9-b0550a9247c3", "value": 5683568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780391897, "uuid": "28ce50d7-0978-4741-8290-521b36479f3c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780391897, "uuid": "2b13bcfe-aaf1-494d-8253-0e6c4633cdb3", "value": "antman-agentd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f470f19-5e37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780372680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372680, "uuid": "99e215b4-fdd0-40a5-b024-958fb221ea87", "comment": "Malware payload (Mirai)", "value": "09cdc7c7118e1c412b75572230b0e209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372680, "uuid": "e2697bf7-bf13-4a7e-afe7-d902f5a353f3", "comment": "Malware payload (Mirai)", "value": "2ac9c102f6730babda06b52a51199d3985545c327c3e5fb401d5dd660ae7f193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372680, "uuid": "5ff13798-c1dd-4fbe-afc2-9732d3d148dd", "comment": "Malware payload (Mirai)", "value": "ee7ae5888ed8f33d64bb840b58ccaeac04082224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372680, "uuid": "76cfbb23-8c22-49eb-bbdd-0ddb8877c48f", "comment": "Malware payload (Mirai)", "value": "6b1688d5c0d2cff061e16f24a88ad0c4e51b390edc1fe89ffba342a7c01ff2b3750fb6fdecce4dd4eed529f8e1de9660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372680, "uuid": "b74a616b-5243-441c-a028-203e3d2c7da3", "value": "T175634B96F4016D3CFC4FE6BA81114F0AF93173695E430A6A91A3FCB35D321E46A67E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372680, "uuid": "5833704b-74fe-423f-9876-600781f46a8c", "value": "1536:Qq2dQMnvzh92HLQoEsUn8NiCM/CR5G7wia:aREEtTCZ5qva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780372680, "uuid": "d1d21334-5913-4c27-989c-ec040c34034c", "value": 68368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780372680, "uuid": "95c88ee7-5a12-40b7-90eb-353f4d9fc577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372680, "uuid": "03232f0b-3301-419e-ad1d-1e9bd4d5115b", "value": "azsxd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27caf41-5edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780443821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443821, "uuid": "38214a30-46e6-446f-a1f8-88fcc72ae391", "comment": "Malware payload", "value": "174a95698b7b90db983b38508545abb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443821, "uuid": "a29533f6-20fd-4ea2-bc36-cf2fcfdc567f", "comment": "Malware payload", "value": "2ad43dd82ee2e193cd41cfbfedb35d4306fa4160fdcf77992c8cc4ccfccb60cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443821, "uuid": "954b6ce0-936b-4544-a3dc-9c156faada95", "comment": "Malware payload", "value": "3c5cec0f37a71b7423ab60f0c7ac9cc4bda3e7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443821, "uuid": "1c16003e-a8e0-4275-9b6e-1415573f37e5", "comment": "Malware payload", "value": "d14ada0b21791f1b8ef7e9970800b2ef3ddd67522c751454b0805cbcd67c208be2e179294fd88c28b061865fd64722d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443821, "uuid": "71a3d416-65fd-4c8f-b2d4-a587ab4db66c", "value": "T125575BC3F8A219E4C0EAC3759566415BBA623C191F3823EB1690FF241F367E4AE76705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443821, "uuid": "27f5b54d-e8db-4ba2-aaa7-6af01f7f3d2d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443821, "uuid": "3b72b484-0cbe-45e7-8261-cd1a9fafcbe5", "value": "196608:pwwYCVbWE512iEMPtQ8SI1bTttwuo4eBe:pwwZWE5EKPG8Soos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780443821, "uuid": "806dd883-7eec-404b-9876-310c7861809d", "value": 29717504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780443821, "uuid": "22105f9a-ba24-437d-8dc4-ba0b8d47434b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443821, "uuid": "c68b8875-1616-41f3-85c0-dbb235d4651b", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.33557.20013.25255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b465e35c-5e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780413678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413678, "uuid": "d046a42e-df0d-4ef1-8764-4d0ccc6c6111", "comment": "Malware payload", "value": "21c5ea376a9942f1c821ee450e3ac7f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413678, "uuid": "ebd12d6d-fb62-474d-a0c8-31e9c577b1a4", "comment": "Malware payload", "value": "2b3a4aa709b2f40e16b9ee254226e275952e2f823a6b9a7fccd51d9e0f432691", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413678, "uuid": "58c3d6be-d7d1-4030-b807-40256ef16b30", "comment": "Malware payload", "value": "cb16eba7263df77d720af85510a91e60e84f513d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413678, "uuid": "04a8526f-4942-42a1-bb46-845272544d97", "comment": "Malware payload", "value": "0555ddd9591fc0c8538b87d730801e911d13f1e4402c46ff3608bc907d7d6e766f66f96d39df30d0e233e8f3ba12a358", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413678, "uuid": "e93941c3-045c-4916-8173-a866f39bf931", "value": "T14CB533279298B07CCA8F29F619D70C1B6F3DA77244B72957C58CD9A80AB20D0E56F41B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413678, "uuid": "eb1fb89b-fa1f-46c2-bb29-67afd1ae580e", "value": "49152:TdO9EGgUyOMmorNWUOsz/SSJa7/4YzkQCiOOPSR5wN/4w/:RMEVgONOWSSKkQCBkoI/4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780413678, "uuid": "87b6ab03-1103-4513-b14c-cb4460df2ba2", "value": 2494465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780413678, "uuid": "8f3ef876-9ccf-4221-844d-0f12c9e5d351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413678, "uuid": "30141e06-654c-46e5-9820-981290d6c96f", "value": "system", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6455f95-5e39-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780373712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780373712, "uuid": "250f6557-b2d1-45fc-80f7-a57d9551f249", "comment": "Malware payload (WannaCry)", "value": "843b7d700d01adeb4eddeaaed20eae05", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780373712, "uuid": "b12c425c-8e67-4e35-8304-57a60a9df567", "comment": "Malware payload (WannaCry)", "value": "2bfb9742d15e8c2d1e01defd46d2f09e1d758e68e49a7c1c5dc1a4557b311c7d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780373712, "uuid": "98496707-a10e-495c-ba9d-58f7c4ae9a02", "comment": "Malware payload (WannaCry)", "value": "a5a71a601c41d8346a7279ec292fdbdc8dffea16", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780373712, "uuid": "97aa764a-bf09-4543-9cae-872d6a978312", "comment": "Malware payload (WannaCry)", "value": "cd5d04f8930a82c405ed5b5916e654599969b76f100c3fc6ed151a00f717282fc3dee7eaf9c41b5ffd5b28651c0e0bc2", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780373712, "uuid": "fd53f3bd-e651-40db-921a-efb56f3aefe7", "value": "T19D36235932B881FCD1061874C4B78D22F3B37CBA52FE5B0F9B9049692E53B91B760B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780373712, "uuid": "7dcfa704-6c76-4f22-8921-66e8a3a164f1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780373712, "uuid": "32352c90-27ae-4167-8537-40d60ae1d3a0", "value": "49152:jnsnnMSPbcBVtRx+TSqTdX1HkQo6SAARdhnv:DMnPoB7RxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780373712, "uuid": "305ce100-cf79-4c49-8778-6464244b35f9", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780373712, "uuid": "0bfd29ed-6ed8-4dbf-849c-d10dcb1c9048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780373712, "uuid": "cba22b93-0a68-43d9-9916-f4af2eb972f6", "value": "2bfb9742d15e8c2d1e01defd46d2f09e1d758e68e49a7c1c5dc1a4557b311c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08217eb-5e23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364307, "uuid": "059d1eae-e50d-4470-bcad-3cb664ba68e2", "comment": "Malware payload (Mirai)", "value": "04b67c42af1b047c4150a41f95984482", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364307, "uuid": "f8eb1c67-86f4-497b-b9c5-56d0a2f2425e", "comment": "Malware payload (Mirai)", "value": "2e4112625ce89d545c3777a7bec1923592932a9c380ab6e8a618f43d958e86e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364307, "uuid": "703f0a85-e6b7-4402-8c48-f32bb9a73670", "comment": "Malware payload (Mirai)", "value": "3f5925e27867c6d85e31d421b2a0e7f7233d28cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364307, "uuid": "a9682d65-7f82-4d43-a8a4-dca2f0dc818e", "comment": "Malware payload (Mirai)", "value": "92a2d8354970ce79f950316682ebd315c59d45535fdbf48b26009aa1c15354bde34cd78a01ea57010979f47e3a16d7c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364307, "uuid": "6376b8aa-0210-428a-81cc-9702f5c2e3d5", "value": "T14151D3983DB97E764815CE8CF721AF29E01FBDCF36910D58D7DF256A8869824BC10B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364307, "uuid": "57e6b86a-4b98-4600-9cc0-6ef6ee5d0df5", "value": "24:r05pELMk0aC5EMy0MBswOqZkTL1nzpobsqVKXRC757Z3CaCLoWWWzUgH0zgH0bvM:rMpzaC568IhqhHfHszCW9p9Fn1pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364307, "uuid": "1d9beba8-7f2a-4bc6-af39-b9d320b304bf", "value": 2982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364307, "uuid": "bf45e5b0-e95f-43da-b594-98aeb84142bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364307, "uuid": "1565fe61-676a-4793-bf0e-38505ae0bcc6", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e02a21-5e31-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780370404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370404, "uuid": "f6b3c6f2-73f4-4e49-8d44-6294b9da28bf", "comment": "Malware payload (NanoCore)", "value": "2a22d72d779f802dca61eb2fb7797631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370404, "uuid": "75aad1a7-285c-4e47-a2de-b3f39cce3557", "comment": "Malware payload (NanoCore)", "value": "2ea67d98260f63e5eb13d6add3c0b6f2d093bd56a833756000e343c0179a5261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370404, "uuid": "4337db2b-5107-4947-8d50-46f9c7940650", "comment": "Malware payload (NanoCore)", "value": "657c9ce54197a4fb376a40353325df3c7d24c9c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370404, "uuid": "130e25af-f76e-4803-9773-fe2594707e70", "comment": "Malware payload (NanoCore)", "value": "43e916ee467b59377a8ddca432f92b21524525e6b524fd6fef7fd989d7775dcb1391e1e7ea79016016be5a4c344012f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370404, "uuid": "9a210c14-f6e0-4d6b-8f39-cb2caf570b62", "value": "T17314BF2677B94A2FE2DE8679701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370404, "uuid": "cd577e12-cc90-4b2b-b1c1-dc1c83372364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370404, "uuid": "d7ce3b55-61c6-4c52-9074-8d6f99620207", "value": "6144:MLV6Bta6dtJmakIM5fBGmPDZ1ZgJB6QUWe:MLV6BtpmkqBGmPDZ1gB65We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780370404, "uuid": "6e2e658f-1d9e-4c9f-949f-d770f24f727c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780370404, "uuid": "7aa8d81d-6418-4b96-bce7-85b08e5f7341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370404, "uuid": "318d7a66-40a5-4141-849e-d628635bf1e5", "value": "iiabc8.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e161f4-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780415236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415236, "uuid": "e8849197-3546-4f8d-aa52-064093ec00a4", "comment": "Malware payload (Formbook)", "value": "fc54c25a867c3bbffe30672eaa3dabcd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415236, "uuid": "f178f05b-2ad8-493d-8949-2f78a626e74c", "comment": "Malware payload (Formbook)", "value": "2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415236, "uuid": "37309c5a-ddf0-4367-a297-d665c357403f", "comment": "Malware payload (Formbook)", "value": "d54758ba61047d1e196819a195d597cda9e89cb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415236, "uuid": "c4e16fc1-182e-4869-ae32-52cda5bdf92d", "comment": "Malware payload (Formbook)", "value": "d703fddf1d74e50db4ea4eb416321929e1b34032952bb6e6d7a719c843c43088f3ccb68f6b039a4c22a4b20a979dacac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415236, "uuid": "76fb0c5b-ceff-4bba-8019-e2d5a751e7c7", "value": "T17CE1AEBE0344CD51F87CA412D3715A5A97D79FB5F196A62A17004F602F4872D8CC03E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415236, "uuid": "16295bb9-0be3-4181-b304-9000e8765739", "value": "192:OsW5VkzOwhY2FVluUVf1yjYGM3ZO+ZP1VMiQS:O3k1vNyXM3ZOgTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415236, "uuid": "22fdfea2-d1bc-4538-ae58-f5dcafa93e95", "value": 7444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415236, "uuid": "e74e84c1-6970-409a-8972-acf6fa5d0a0f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415236, "uuid": "9858bd2b-e314-45fa-8cee-1cf2da491e4e", "value": "RFQ_780236427.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bff5765-5e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780398954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398954, "uuid": "861a208d-157a-4685-9ff3-da23d1b51d65", "comment": "Malware payload", "value": "c4fd6c476266243e0fe5b137413c36ca", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398954, "uuid": "b60923ca-28e0-4966-8294-802e5a576637", "comment": "Malware payload", "value": "2f28815266a9a716d39b2652da7b7a034faf4958bcca7803344caaa2854d8125", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398954, "uuid": "1de38cd7-979e-4f9d-b38f-51df2eb616f3", "comment": "Malware payload", "value": "a37c687c9742d9e85d5a4fd8e278e4cf7699184f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398954, "uuid": "3405fce2-0cfd-43f0-948d-50dda99dba29", "comment": "Malware payload", "value": "fbb82fc303fd738d3ffbc31a30f186bd0ac55d736b2cb10c301ad7c3b6650cbf2034b2a7a57ec3912b2cf2069fb20fca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398954, "uuid": "535e53df-4bf4-4439-b50c-de456894df6c", "value": "T15F72D0C285F5DC30CEAE993DC3A4BF8266E5536711826DFBD3DB5AC3E9923641C1A020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398954, "uuid": "c3b12483-62f8-430d-acdb-0760b3587dea", "value": "384:kYojKAGB0S/BdRzgLKpXPpOWZX15xJXPGkgCmr9pFu0A9:kNjKNBvgQRh99PzgCmRpFu0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780398954, "uuid": "1a859d37-b1ad-43ce-b9ea-2ee57455b922", "value": 16712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780398954, "uuid": "f19e0954-8d97-4508-948b-9bbcd32a483b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398954, "uuid": "b88fed98-fd56-43c2-a7bc-fe2bd1545b82", "value": "photo-710202529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5721858-5e5d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780389306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389306, "uuid": "63a7ccb3-7d94-4e63-90d2-dc8fabd881ab", "comment": "Malware payload (NanoCore)", "value": "5b6382611a23342e0e9f87935fcf9003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389306, "uuid": "08253fc1-ee1d-4783-99ec-826ee5e8a936", "comment": "Malware payload (NanoCore)", "value": "31e929523db65c3e3a18e34ddeeeba27fad71dfe08a37e49c40bda104dfa7593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389306, "uuid": "b4ccfabf-584b-4d88-9875-ad732e681b4f", "comment": "Malware payload (NanoCore)", "value": "25bfec5926332f30847aad61fbea9517789202c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389306, "uuid": "fc772fa4-9074-4402-879e-0b6168732746", "comment": "Malware payload (NanoCore)", "value": "c45ed69501cb84eb07179a6f803e49b113a54cb22ca60691a940e8992d32f54cb4e6a875088904e91c7969131a4adc4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389306, "uuid": "73f4ddd1-f200-47f1-bcdc-62c6e5f6cc50", "value": "T1CE14BF1A7BE84A2EE2DE8679711211035379C2E3E8D3F3DE28D464B78F666E506070D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389306, "uuid": "548ee13c-06ca-4f71-bdd3-f26990ec3799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389306, "uuid": "cddbde40-7ca8-449a-9357-e36cfbc790a3", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI1rQYusdrK6ymbcYmRriGNnu:MLV6Bta6dtJmakIM5Wax0cYgrimu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780389306, "uuid": "556b3f63-b7f6-48a2-a24a-7c4aef8ee2c6", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780389306, "uuid": "20333f75-f98f-4f75-be68-ed7b742dba18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389306, "uuid": "42fb3e36-e9cd-469e-b19f-3bba5488268e", "value": "ck01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a000199-5e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369718, "uuid": "1705253c-0e36-4c37-85e5-95ab23ff63cc", "comment": "Malware payload (Prometei)", "value": "1bfaf277f047595074b74513c90621d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369718, "uuid": "89d3bf45-4208-463d-866e-e4a1ddf2d803", "comment": "Malware payload (Prometei)", "value": "321bfd80417496f99f32183c73d0a46b42900a8ae9d87b4079740b9297bc3cb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369718, "uuid": "744af2e9-c155-429c-af02-9618d7cd5ee4", "comment": "Malware payload (Prometei)", "value": "a82527730fb73e00d89c8d0b836de5af707f825f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369718, "uuid": "c4c838f5-1f0b-4c60-a03b-135a9c4df3a0", "comment": "Malware payload (Prometei)", "value": "752345fd8ba6ebe1a2253d4ca874c5e6b27947c2aa8c792a24069509a58f534e60539db390b0faca1102b536464f5702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369718, "uuid": "5ea44bd9-5241-44e1-bad2-b0b65498de62", "value": "T1EDE39248EE64AB2DC3E332FEFB5902CE336A1BD8B7E670218D354A5537C8B55A535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369718, "uuid": "547c4a5d-ee92-47a4-8512-ee113bdc2719", "value": "3072:87TVt9dEYVQUNuEuJ2qVqyD7Nk1TXtM+I7mohM5BiN9SXfo3:w2kxiFmohM5BiHSg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369718, "uuid": "d5045756-bc68-453e-afc2-1a2203326335", "value": 144540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369718, "uuid": "ece68349-b2f1-4003-adb0-dbd6e7a86a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369718, "uuid": "058cd185-106e-458b-a30d-61c9e82eccd2", "value": "321bfd80417496f99f32183c73d0a46b42900a8ae9d87b4079740b9297bc3cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e935126-5e37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780372679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372679, "uuid": "17aa39ae-b091-4436-b97d-9a9bc6c1bbaf", "comment": "Malware payload (Mirai)", "value": "117a8230778f5ed207284c4e8a18f02b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372679, "uuid": "93f59cac-49e0-4058-a18e-9d03be2f5fe1", "comment": "Malware payload (Mirai)", "value": "33043651e74a6c8c8e8beb0f584de871b618151e3ba43a06aa81542605662b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372679, "uuid": "c96bd7a3-9a97-406b-8181-eeee41ea2b3a", "comment": "Malware payload (Mirai)", "value": "e1eb74d528b3311b0306fe080b5254cadae814b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372679, "uuid": "2ad4933c-7fdf-4366-9269-a57c122c97bb", "comment": "Malware payload (Mirai)", "value": "9383b220c4e6a8814a89af563966a1afd5108f1f6df1f7ab5c81e4f6b6794f237637173485c3fc83608de048cee13635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372679, "uuid": "fc001648-2434-4bbd-b3e0-4ad0f8ade46c", "value": "T11963194262280943C5F21EB0393B17E1D3EAAB9311F4B349360FA759D1B1D37A946D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372679, "uuid": "3a2908c5-527d-4420-94e0-951b786c16c5", "value": "768:tCMvC8SvX/HzL0j7wn6Xz4OZrdD9FwQ89dkfRKiwzyII2fOJEUNW4WzWx6+bT03g:tCUaiy6BZFBKkQiaI2WJEYWzWVw3KvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780372679, "uuid": "62802874-d5ca-4281-a2f7-a483a634b327", "value": 67820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780372679, "uuid": "3a59ceeb-5d61-4800-9404-3f1351ad3ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372679, "uuid": "87b7c79b-da58-44e4-b2f7-a1913926dbb7", "value": "azsxd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6581d30e-5e8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780410110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410110, "uuid": "7926180d-e255-4b03-86d3-7418619948a6", "comment": "Malware payload", "value": "a26490f77f4feae76d5c522ef272f75b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410110, "uuid": "b3e42731-277f-4576-9ed9-738a1c5072df", "comment": "Malware payload", "value": "334acc05e108cea40d35120f45eb506a23a88c41e4194b03f06f5e59861bd722", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410110, "uuid": "4ea67eb7-da5f-4e9f-a41f-cb7aae5054fb", "comment": "Malware payload", "value": "141b3ea877a66db0ee3aad0ed2c8a26b7bf685fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410110, "uuid": "e3c04966-3c9b-485f-a85c-601922350552", "comment": "Malware payload", "value": "fd44da0d1cd4668e66b69c32bacf4f664bdf77bb2bebca0555a4aa2a20603882df8b6ae36989b76867d7f160315cc996", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780410110, "uuid": "92bf87f5-0ea4-4cab-863d-5789ec86c373", "value": "T1F5137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780410110, "uuid": "1cc9f99c-a547-48b6-9bba-b55d98b70e81", "value": "768:sXRWNGxVS9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:AlxNco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780410110, "uuid": "69d819ad-9056-4103-93da-91a21b585ef9", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780410110, "uuid": "f87dc988-1fae-4f27-9a0a-37145b6e0e9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780410110, "uuid": "d38f580d-3222-46a8-a05f-453657668e8a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6825c2c3-5e26-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780365447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "33ccef85-7ee5-4bbf-97cb-9f59ff4f1ef3", "comment": "Malware payload (ConnectWise)", "value": "96ff9e0932f4e7cc86d8a0ef90ca11ce", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "0e9f53c9-d255-4a7a-8fe7-a027821ff515", "comment": "Malware payload (ConnectWise)", "value": "374d7a229f92adb4925b662bec83206c16a7233ff64c0a5d58428d02f4420d3a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "ff5a6e78-defd-4f0b-b68d-dc400e00654b", "comment": "Malware payload (ConnectWise)", "value": "50da9f08dd75d9877ad072ea3a19b582a245e512", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "70781846-1d95-4db8-867a-45f8e3a9cd66", "comment": "Malware payload (ConnectWise)", "value": "5909ae2648411a751f47f8cc2363bc9988978faaefd0ad8310ae0c5242c61f6f28a05ba95dd62d1074859ac778923405", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "3d193b8e-8975-494c-a028-a4a2f9ad2932", "value": "T19D46E042B3D689B7D07B8778FE7A42655734BC008711E7EB57A0BD292E327C04E62366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "6f7ade7a-70d9-4838-b4e4-9d2ab7b7f385", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "4e22c289-69d3-4867-9aec-a82134abc1be", "value": "49152:vfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:8rs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780365447, "uuid": "e06aeeb7-b9bd-4633-be54-59aca0605561", "value": 5692328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780365447, "uuid": "1bf9508f-01e0-4f14-af97-ed12d0e908bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "ad3a4825-9e7c-435b-8491-c7de33d876b6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815e7ec8-5e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780380092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780380092, "uuid": "0f8d2ff7-e492-4a29-b435-202808f21ff7", "comment": "Malware payload (Mirai)", "value": "eeedaf9c1b7c7006078b318409d46e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780380092, "uuid": "73f21db7-fc18-45bb-b771-8fd00e9aecfd", "comment": "Malware payload (Mirai)", "value": "378610d8625004953e60be2d43f5d7389bcce6cd765b9dfbcc029aad379155b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780380092, "uuid": "f62ac1da-5a46-40a1-a8ae-3d4f4419ed8a", "comment": "Malware payload (Mirai)", "value": "20ec0a579fb21f0d1ff65d2f5fedc1126660dfbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780380092, "uuid": "477c9649-5b23-4789-8083-69bd190f4010", "comment": "Malware payload (Mirai)", "value": "99bf85d5ac8df54d65640038bc373c2e6c6958576443b6904d81dd1ad453f56dd9d9e0092f95a5d0acbe34331f406c54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780380092, "uuid": "3621ec4c-d510-4d36-a9ec-fb5f2aaa7af3", "value": "T1BFB3294ABC819B15D4D622BFFE4E118933136BA8E3EE7112DE245F2423CA65B0F77442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780380092, "uuid": "3326828b-7548-4175-be4a-e29b09834533", "value": "3072:5uqBK/jCrf+9AfQuSOJKzoH3t/a6wYqORDpJAucZUv:MqBK/Sf++xKsXt/a6wYqORFJ4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780380092, "uuid": "9d2495cf-3bfc-4f4c-bbea-c1f7e23bba0e", "value": 108896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780380092, "uuid": "86d48106-cfeb-4f98-9d83-e47c74ca9ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780380092, "uuid": "08cfc6c6-6ad7-4afb-9c8e-28b33701342b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b585ded-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780415247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415247, "uuid": "f086e4aa-757c-4b04-ba9c-96b043cdb5a9", "comment": "Malware payload (Formbook)", "value": "091eaecfdd7bfbaee163d44d896306df", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415247, "uuid": "9221a8a8-3ec6-4365-add8-2d496b1bfe99", "comment": "Malware payload (Formbook)", "value": "37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415247, "uuid": "5bccdfea-3e13-40ec-8792-cd59ec771ce6", "comment": "Malware payload (Formbook)", "value": "f6e5e1ac66a60f4a42aaf4671773df30371cfd57", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415247, "uuid": "325cdbcd-c470-4eaf-a707-fef8d8599b09", "comment": "Malware payload (Formbook)", "value": "d62db60d78001ef3cef7d3737436eef005d0962725cde417718d4147328771f1e58c7c54498816fb104c5898033f2cb2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415247, "uuid": "59bcd0f1-7210-4e3a-a428-c251c55a7f1a", "value": "T147F1BF08B18ACE95C61403B98BB54FDB05D10B1FC30DC849C628B3A249FBACF5A7E4B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415247, "uuid": "7374af15-b2f5-4115-8041-612c9c33badf", "value": "192:Sc8yHjF2MbQ2Ou4MuGPWR2h5HvwKAqacTu7:ScnxbZX4MnPuKA5cTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415247, "uuid": "be841925-d42d-4c5c-964d-78fb1e657621", "value": 7452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415247, "uuid": "89383473-c1ab-41fd-b3c7-e9f97d469278", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415247, "uuid": "6839b018-d3dd-4958-9f8e-71ee6b3c77b9", "value": "TT_Payment_Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733503e2-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780415287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415287, "uuid": "b024b1bf-60df-45d3-bf7e-a6a477846833", "comment": "Malware payload (AgentTesla)", "value": "1166871fb09c5980e536381647af186a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415287, "uuid": "2e30e957-f331-4ce9-b511-86cb6c09cd1a", "comment": "Malware payload (AgentTesla)", "value": "3869c3207197e8fd9633d6a2e5f198846883015b3812d81fca8ff699444f5b16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415287, "uuid": "e4df479d-ecbc-4b35-9967-fab88032f159", "comment": "Malware payload (AgentTesla)", "value": "1293f1874ff9c2ced06976bdf537e07a695291ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415287, "uuid": "ab123b82-b8b2-4452-861e-fc0e86ae204a", "comment": "Malware payload (AgentTesla)", "value": "7e0f2ecd2a2488c208dcddea3317241b9d676ecc4f3c035897f30b06325c776498dfef66ecbc5f62cc2221a8bc3ebb02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415287, "uuid": "c9d0ac6e-4c13-4d07-a595-6c2f1715b2c7", "value": "T14446F8437997911B730A879E8972F9E1E80E2D2BB4035543706CDD28B3EFD5762A9233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415287, "uuid": "f8c68e96-9099-4c43-bc7c-5f7973708b0e", "value": "98304:Zx3a2P0tm+0sDKohNLLjJQ455HAamyuuU42SVStYP9CgHpbrbc4VOYU0XmBBijfz:r3a2P0tm+0sDKohNLLjJQ455HAamyuuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415287, "uuid": "3a11f684-bbc4-482d-9161-31864cf87d2d", "value": 5843105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415287, "uuid": "e61160a9-ad07-4e13-9ce2-87250e7622db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415287, "uuid": "65473afa-3ae1-40df-81b7-44d39619cf4b", "value": "Bank_Slip.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fc1f38-5ec0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780431633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431633, "uuid": "a9613a19-de88-45cc-8d14-3b1f1217e33f", "comment": "Malware payload (Mirai)", "value": "d616332080178fd907c54d161f655e73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431633, "uuid": "cd8fd028-d97b-4540-989e-4ec018be2d3e", "comment": "Malware payload (Mirai)", "value": "392c367b9a7ff8d9a7aa1694c7610a9ede461fa8aef51959bd2fd4ea7aef9a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431633, "uuid": "eba2cece-c1dc-4da0-be9a-646ad6f33984", "comment": "Malware payload (Mirai)", "value": "788e38d3d14d97fb405f07ae10750ef0936f58c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431633, "uuid": "f5155a5f-1178-4b2a-bb11-d6917c6de4bc", "comment": "Malware payload (Mirai)", "value": "59fde1c63cb74aac0eb63c6df232f34766e48066fabe85001224d48c47fe77389eafa200e3336a6f060ac103042d381e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431633, "uuid": "9832315e-b444-4c1b-9000-44abae3a51b5", "value": "T193A31951BC829A16C6C512BBFE5E728D77267398E3EE3202CE295F2133CB45B0E67151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431633, "uuid": "7b103018-97da-4835-abac-8e476e57bcd3", "value": "1536:sW7icrivmaBDebBDvtL4hxVmbFLS0ynCygwTTiJg7VFay+ORWJ:F77eBde1DvBKsbFNygw57/wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780431633, "uuid": "ecdc224a-3cdd-4daf-a1de-8c791bed6bf6", "value": 101088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780431633, "uuid": "97b05027-1587-49e2-80ee-31cd19d82d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431633, "uuid": "5123dd45-d23d-4099-8e0e-8f6025265017", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ee9684-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "26755812-5b0c-4eef-847e-6cd1dd08eab7", "comment": "Malware payload (Mirai)", "value": "b109db1dd797ea68ec96ad32b22c08aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "9d74313a-56cb-4796-a31d-151f4869d712", "comment": "Malware payload (Mirai)", "value": "39bafe5a3d5d60924d97b810c619c008b74700f38774adeafce66bffe0f19b37", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "787a1fe2-4ad1-45af-9b1e-630225644556", "comment": "Malware payload (Mirai)", "value": "baa9f6bb32846de65929f96a11b09735a2ce9286", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "d4d66186-65e9-4507-936c-b96501de3ee9", "comment": "Malware payload (Mirai)", "value": "4b68e3700a672fb6e16ffb06d1d32668c50a59fcca1b46c44d583dcc770c5e6d917a1c0d03f6f9354e8ecdad7c6ed474", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364524, "uuid": "5b0242ae-ca60-4df2-b3e1-f2026e6460ab", "value": "T1D1357051FF082527DE0909F066FF2774F752286381F491323B042FAB586267998E7EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364524, "uuid": "50e3b742-ddfa-4b03-8ef2-5a69b5bad53d", "value": "24576:ZOT5u0ymakQcOmhrE5wAEW2tZX5J3UZxCn7M0hHUu9bO:ZOT5u0ymakQcbhrE5wAEW2tZpJ3UZohH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364524, "uuid": "b6d4bae0-a24c-48aa-b033-c854e75f0fef", "value": 1122936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364524, "uuid": "e2a56c6b-8b31-435c-8786-17fcb9cab33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364524, "uuid": "9832c10c-e01d-49ba-9629-8313586c0acb", "value": "powerpc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a98defc-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780405824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405824, "uuid": "6cb7c0d2-e0d1-4a40-b11e-83c7e23fe68d", "comment": "Malware payload (RemcosRAT)", "value": "a220f4f687ca8f718ab00e30e8b99340", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405824, "uuid": "2348c549-5b3b-4c74-b676-1312228504cf", "comment": "Malware payload (RemcosRAT)", "value": "3cf43cae1854cc9565dd3b14f2e8ab7ca56ba32c29b768a5eb58f88c02e64e57", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405824, "uuid": "eeb3ba5c-c588-4da1-8fe5-7c3896348051", "comment": "Malware payload (RemcosRAT)", "value": "d57c640a464adfc527bf599ff1e33b3a599cade0", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405824, "uuid": "07a00eb5-407b-4f6f-9b83-4e8a044d7eb2", "comment": "Malware payload (RemcosRAT)", "value": "73f30c68dc5b7416de0a30042b520d40f815aef172c5615d9661eccb36cec6b1d55b61fbf4c5c5307abbb30638cfaa04", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405824, "uuid": "aaf7f2a2-1061-452e-bf21-b540ac3c1cd7", "value": "T11405120AF7946A36C259983DCE8C86EE142CBC155542E15B3A4277CC2B7B7F50AEF24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405824, "uuid": "e070f2c5-1531-468c-b6d5-71d247cb4ab4", "value": "12288:X8mZcftefrrsn58m8EcwekXheqskVpJYK4UVB4rrsrVQvSyGBCHp09bW2unwZB:xOf0q8Htqs6pJAUPP7kJmbxKwZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405824, "uuid": "6e2ba3c8-86eb-4ae9-b5a6-9966b695ba87", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405824, "uuid": "3604a7a2-36d9-4755-ae3c-2095297e6d4e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405824, "uuid": "f59dd813-793a-49cf-8fca-ee346f9bcb7b", "value": "SP-2102635 VA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db685fd-5e51-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780383871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383871, "uuid": "9106746c-37fb-48ef-964b-fb9b103bccef", "comment": "Malware payload (AgentTesla)", "value": "5f5769ff7d050963ae7fe6fcad84c671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383871, "uuid": "dfa4f68b-a55e-401a-8290-0e8eb992f03e", "comment": "Malware payload (AgentTesla)", "value": "3d8c2f1bf62cc3670f9ea270c0a7cfa830507e2fcc4d3de37ddc384553a7de08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383871, "uuid": "48540ae7-12ba-4a01-9e38-994630e099cb", "comment": "Malware payload (AgentTesla)", "value": "112e5c389a1b6d5da0683883ce77b977598b0761", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383871, "uuid": "efea612f-d4ad-4ea5-ae99-7e1c6df95fbf", "comment": "Malware payload (AgentTesla)", "value": "9277089e5961eeea898bf839974ede7f6bc8860ad24831e91c3f62aaf1848589a9cf52a9e37c10289e1d184c52a6ad0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383871, "uuid": "7c97199a-6507-4ad5-8253-5842b34d3641", "value": "T16646A4136B57903A630A875E95B2F5E5E81A2C17B092DB07702CD824B3EBC5763AD1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383871, "uuid": "236d92be-96f7-4691-8393-d4c086426735", "value": "98304:d2Xk6VAjErrAGOEqMHVNVIPSUkh4g/me7oEqZyaDV+vTJWR/MsQj:d206Vw8rAzEqMX/Uk+LLyaDV+bJwMs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383871, "uuid": "5bc0f2af-c43e-4ffe-8380-cdb18f2c7f71", "value": 5841289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383871, "uuid": "5f437055-196f-479f-a071-04d80de10521", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383871, "uuid": "abc7e898-32a9-4f18-88c5-631d207fa18e", "value": "Q5-Brochure.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baaab2cb-5e7c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780402522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402522, "uuid": "3db81372-8ad6-4796-9819-d8be00cc3fc1", "comment": "Malware payload (RemcosRAT)", "value": "db9240b896496eff26650e092a8c0e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402522, "uuid": "e529b272-5abe-4ecc-9975-0bcda7d154d7", "comment": "Malware payload (RemcosRAT)", "value": "3da0d51f91991cea4662201e46fa87e7e9b7c74d4704fce249813b76ed48ed0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402522, "uuid": "941e387b-b60e-4bbf-a28a-f4415fca643c", "comment": "Malware payload (RemcosRAT)", "value": "bd51e363809362dd90217b7858169d9dfd3b7016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402522, "uuid": "9b25fcd1-451c-4d45-99a4-98bc12d8fd23", "comment": "Malware payload (RemcosRAT)", "value": "07be1fa9da23c54f94836908e21594bb0320a3171628d295c37ee8ebf4853d79c6a8ce632d8dd5b795c78e6dc7ad8698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402522, "uuid": "d05d9f28-2859-402b-9abd-835396cd911a", "value": "T1AF835C20DAE207791E9717BDBC841611D6BCDA6D093640FCF6CD230DA40A17CE7BEA69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402522, "uuid": "ef6b278a-4a25-4b41-a6cd-80d1b83d29d5", "value": "1536:uc4L9L4BWrEDgLGcOjP1RTMi94lYAkV5B2qfd/XpEYzn08b22sVcF:f4L9L4BWrnx41RT5NACuqFZEwn3y2sVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780402522, "uuid": "134e7a88-cf3f-4e7e-85f2-f7f24570c0c3", "value": 86399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780402522, "uuid": "6a0f36af-ef91-41ab-82e0-44ba831fc8b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402522, "uuid": "bce6fa94-0c4b-452c-9111-e450571a6d7d", "value": "SHB89681.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895486e-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780415242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415242, "uuid": "e7f4c8fb-58b1-4fcb-8e3f-b4d4b56fc68a", "comment": "Malware payload (RemcosRAT)", "value": "484836ac8ff96db191a1c227f26a62ba", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415242, "uuid": "b072dabb-a439-456b-b7c3-f21f69f4eb80", "comment": "Malware payload (RemcosRAT)", "value": "3f4730c6e294f703b95370e6b154faba56c38dfa7c4ab3b42cbea9444de0b751", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415242, "uuid": "142ea1c2-b09a-4e1f-8fd9-7d5d9abfae01", "comment": "Malware payload (RemcosRAT)", "value": "037db220a0fd6be480afc8af7587bbbd8ff65f37", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415242, "uuid": "69ac9b93-fad0-4137-a270-9ba1af473bae", "comment": "Malware payload (RemcosRAT)", "value": "2f386e728e8cc3bc6d65913884a9f95857e29337e19981dfd51a7c0543217f85f09355881a3ec5f2436a62298e089801", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415242, "uuid": "f11c00e8-b383-4a0d-8646-65db7a7b6e1c", "value": "T11992780DBADA5470C81FB9D8F9FCDA1FB82405F9A1711D08CAA1A901431C9FA774D4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415242, "uuid": "6bd1074a-f49f-4c0b-9cbd-eae8802b515d", "value": "96:iR+6HjewEphVcwOPAdbecsT/Bz6jN7nPepfAZFhtQ:ig6DewwfcwOPAd2T/Bq7PeeZtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415242, "uuid": "701cd5d9-5122-4482-ab07-3a79ef32ad2b", "value": 20143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415242, "uuid": "826eab9d-e7a6-42b0-b188-abb0ca9c05e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415242, "uuid": "4ad5bc6b-ee08-4efe-ab79-5972f1e0dce4", "value": "Order-No-J516-034.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac5b1e9-5e50-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780383571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383571, "uuid": "4dbbccee-3d59-47d6-bb9e-e87db449195f", "comment": "Malware payload (AgentTesla)", "value": "b46ee7330937e443ea56f9205ab5f4ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383571, "uuid": "408e3954-0b8b-403c-b8e5-4ba7e7d26104", "comment": "Malware payload (AgentTesla)", "value": "40e0114651519e1e52d0cbbc3249f64287608430983c961ab957d2d211d00b98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383571, "uuid": "5f15a3f5-2ed3-4358-bf46-5d1841691ed6", "comment": "Malware payload (AgentTesla)", "value": "27631b81325b441443b8f7a41477443fbc9d3b51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383571, "uuid": "7970f1db-1eed-46f4-8774-ff1dddc31793", "comment": "Malware payload (AgentTesla)", "value": "495478693b9d22830444b7d7b1afe748cd62895e14a2335332bf7e51f85460ad1347fad46ba213fc7600d32c6adf1923", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383571, "uuid": "cd675e2b-4bd2-4cf7-9e52-91eb0dfb5f00", "value": "T119D5DAEE02069DC763F51F787EC90C6AC731F9E61A0B1F963D634AA522AD7446063C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383571, "uuid": "e24493af-6b69-44c9-ba05-9019eca4a0aa", "value": "768:pviLviLviLviLviLviLviLviLviLviLviLviLviLviLviLviLviLviLviLviLviI:Z+Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383571, "uuid": "656ddd59-e089-437f-91d3-153dc8004c01", "value": 2973142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383571, "uuid": "26080b58-4055-4da9-9df2-46585fc3011d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383571, "uuid": "b11e1e8c-4ec6-4514-a70b-57b58cd66ec2", "value": "NO4200003094.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e012122-5e7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780402018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402018, "uuid": "4cab96fe-ca05-4ca3-a22c-bab85e4c0859", "comment": "Malware payload", "value": "1dc65780e38c1b2144dfdcd834b63f47", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402018, "uuid": "b388a1fd-e296-437a-a8b6-937f9271439e", "comment": "Malware payload", "value": "432f19f87fb23c95959a45f393f6c25834f5444271100b05109c7df52a021f03", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402018, "uuid": "9b0b134d-d2b8-471b-af76-fd3beb2c3962", "comment": "Malware payload", "value": "d2e4b761c18ce67802bbb3714a4c59e6f94721d4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402018, "uuid": "fcc206d6-fb57-4237-b6ec-ea68a2a05ad5", "comment": "Malware payload", "value": "88b9efb74ddf5095432d6ae45f74f359ee25f82458f1b908c01fc2d55e7d5d238bf7318af1e0683180b7c1cf9f04c5b8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402018, "uuid": "65bb1f15-9c03-4843-8606-d7929a4d6f8e", "value": "T111F02388571ABC51D240CF360DC11803DF69D413F4C01483548D58656CFFAA0DFAD6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402018, "uuid": "06084ccf-a7d9-4861-a8b6-1cf82bcfd48b", "value": "12:5jzd0llqYxKWQ+FApLSYERLkANg9CVmicczd0ll6QtJaKk:9p0/3IKpXW9CBf0/6oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780402018, "uuid": "e4cf873f-1196-4678-9898-b6989b53f07d", "value": 470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780402018, "uuid": "36428e21-6598-4e75-90a5-c5d3998fa680", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402018, "uuid": "3d50a23a-629a-4034-b330-0291c9fcb2c8", "value": "Job Interview.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47390a1b-5e27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780365821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365821, "uuid": "71c2ff4b-54c5-4432-aa76-23240254b8fb", "comment": "Malware payload", "value": "e673a06ad1a7fbfd41fc52403d48f08d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365821, "uuid": "e698cdaf-7f9a-46b9-9291-6a6f4f4c69ec", "comment": "Malware payload", "value": "439758e9e28bc77bf2dd098e4d727c68a504b4d7f52b3071bb3d5d31ccf9df31", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365821, "uuid": "2a3c3396-b10e-4d07-bb53-a213d7807e29", "comment": "Malware payload", "value": "753c7cd5ec4086fcf773a9bad9e875431c080521", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365821, "uuid": "382d31e4-a212-422e-8d03-5a0a175359a6", "comment": "Malware payload", "value": "004811ce65b2c3e170b94d787e1841ec953509b5a705b7f0b1ebb1f2075cf3579c69d05d615caaa64fadf55f8fdd1135", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365821, "uuid": "b6b1894b-44b1-4d74-8c82-e202771af568", "value": "T198136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365821, "uuid": "da485573-ea94-4aa8-9eb0-fdcc0fbe4ec1", "value": "768:0XRWNGxVm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:IlxNco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780365821, "uuid": "e25a0e5e-f7a4-4cc0-bd15-359ad0aad757", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780365821, "uuid": "02e0ee1c-e2c6-4c22-84ec-a474b9885cac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365821, "uuid": "3315ff75-0019-4be1-85ae-34fceaabeb6c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d204c835-5e9c-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780416305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416305, "uuid": "a87be562-4606-4387-b9e7-c9d8a85ce500", "comment": "Malware payload (NanoCore)", "value": "52bf5b9ecbff88cf02fe27be98888a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416305, "uuid": "29c725f1-ef26-4428-a334-6bb1d9762c5b", "comment": "Malware payload (NanoCore)", "value": "45e106568889434be142fcf8ad56ab2b658555edd612f007ab3c5c4a926b721b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416305, "uuid": "362db89f-6643-489a-a445-2fde2f0c9f7c", "comment": "Malware payload (NanoCore)", "value": "c82b346b7667449d8b8516c7e13bc7584a9d61ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416305, "uuid": "abeabddb-5612-41f6-a1b9-ebf1da166610", "comment": "Malware payload (NanoCore)", "value": "55abcde91a43d573fc5f97cb24858dea55fc89d49cc2190c0e91af9a54f3eefe13b4336fc36ff06956bc5a8c3916160e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416305, "uuid": "5d06918b-b2c1-4a49-ab54-e8b7b7f86015", "value": "T1A214CF1A77A94A2FE2DE89B9601212579379C2E3D8C3F3EF28D455B34B163E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416305, "uuid": "674d737f-0e28-4048-aac3-cc31eb28fb40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416305, "uuid": "2966383a-c606-453e-bcdc-e522df6199a1", "value": "6144:MLV6Bta6dtJmakIM5CMluAJDAxGJg09osE:MLV6Btpmk1RAioJgzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780416305, "uuid": "3b54ca71-2737-4e4d-b516-9ac8acee4fdc", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780416305, "uuid": "f55c3092-dfbf-4d92-a7f6-61906e13ee34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416305, "uuid": "1ca9e52e-7e6a-419d-b37f-34395ff14e3c", "value": "lesseffort.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40181ed6-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "f2dbaf48-21b3-46ca-a131-9f57cd23be45", "comment": "Malware payload (Mirai)", "value": "82653788c787d0c8028d01cbe11a7eb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "eb39c22d-8cd8-432a-83bd-e2ed1a55af81", "comment": "Malware payload (Mirai)", "value": "465e210236cccdfc5b19f52673eddef7cfd9bfd5540cec812381e550f7709476", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "20d8ba8c-d1b6-468a-8ad9-d027dbbbdc28", "comment": "Malware payload (Mirai)", "value": "c397089743637d36e998751e4d3624ff2c09e271", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "8ca18c52-9c77-43e2-b8c9-84bd5d13c458", "comment": "Malware payload (Mirai)", "value": "cf5df982d36c448b95c2e1b485f402f00e054440fbe892f50381880e80646a90b56b29ea214823c148fef84b4d52cab4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "eb8b7060-4bc8-448d-ad22-5795e6cec096", "value": "T10CD43955F880DFA2C6C02976F65D86A873174B79C3EB720689254B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "a2ffa659-419a-40e1-86dc-f9a3177232a5", "value": "12288:kgP39PexbzFsTR5KQm2V0bK41UkgpklttQM:r39PeJam2ebKmvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364521, "uuid": "1daf2f88-d4de-4cc5-bfe6-4f0326d4df37", "value": 607568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364521, "uuid": "3ac49024-5c83-4397-bb21-a22f5e20171d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "0970a6d0-830c-4ec6-a293-03ec832f24e6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e592fae3-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1780382837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382837, "uuid": "97cd334e-e2cf-401b-81bc-42e5bffee25f", "comment": "Malware payload (DarkSideRAT)", "value": "1dfcd6d0690c4eb10a99b19eb0fd05e9", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382837, "uuid": "277f4077-14ab-4f78-865e-141de8cb6888", "comment": "Malware payload (DarkSideRAT)", "value": "47c72580795661e45c4ea0dcc31954cc63467f149e013fb77a6816ad67ac2750", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382837, "uuid": "75eeb0b0-4807-49e3-a649-214f8992c24b", "comment": "Malware payload (DarkSideRAT)", "value": "dd58e6af2871c70a4532fc7d7bd8a56f7f47966e", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382837, "uuid": "bac082d7-0099-49cb-8396-8b618b44b651", "comment": "Malware payload (DarkSideRAT)", "value": "b32d9f0de8185002721fa687eba4d64fc771f907da70470a8a1c84b31c8c123c1c12900500fd17bf729d7c688c3c9fb0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382837, "uuid": "4c64f776-7bb6-4cba-b0fd-9960d5ed218c", "value": "T1CD43F834EA5EB06FD359D830DD430D16DD52BCCA97A0BB9B57910DD20EAAF209B2D341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382837, "uuid": "c45fdc92-0641-44e7-a3d6-b851a5ff33f5", "value": "838ebf00106c790e199157fb51d61b1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382837, "uuid": "72fa09da-391a-44c3-b642-80c82f9185d4", "value": "768:RUcqx3pSuSDFfQYqXKmEXNt+VtzOOWp54vg5d5YP98yxA1XbXy/kW7rCVr8Z0kP:6WuWbpb+tWp0g5rBSm2sW7rCVoekP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382837, "uuid": "41bd8a68-b223-42bb-8a03-fce7f5e72171", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382837, "uuid": "93e86890-1174-4b37-b493-4166e20f368b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382837, "uuid": "32887702-d71b-455c-8aea-63685b850b9f", "value": "1dfcd6d0690c4eb10a99b19eb0fd05e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681e7092-5e26-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780365447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "70e5e14b-e49f-4a1d-a6a2-a27e42ac9bd2", "comment": "Malware payload (ConnectWise)", "value": "2eb49d11836fd31c1abfd6d3f443068f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "702a8e72-7437-4a79-b421-b817d079609b", "comment": "Malware payload (ConnectWise)", "value": "481f4e7d9724a9863eb1b8a681447a5c51a9e6f43ddc55332f023838e85bff30", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "e3c6551e-b178-470a-8ebf-62bacb5db756", "comment": "Malware payload (ConnectWise)", "value": "9ecb113d7b2c9bb53e73bc278202012d3a724679", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365447, "uuid": "0ec463b6-7177-41e8-8242-ea5e40e2e5f7", "comment": "Malware payload (ConnectWise)", "value": "319fc38206f2a79a31da53e3916040aa80f46d47cab4fac156fe159f5f181f0b85de3fbaed5754f156c8e62cce835626", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "1ea74bf6-5e49-4536-8ab3-a0344c1feb29", "value": "T13A646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "c5afe994-ef56-4fe5-8c83-4a87b7d1d4cd", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "82108c9b-c629-4b71-a0b8-52ac0a76ae6d", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780365447, "uuid": "db944740-1ef6-40ec-be70-42047a508a7e", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780365447, "uuid": "a9036ce2-2379-4e5b-ba1b-63a3b5ff7b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365447, "uuid": "55592cae-8043-417c-9911-2ed7fdd36110", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e14ee6d-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780415252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415252, "uuid": "9ff172b0-140b-4e10-aeeb-e79cdc922e85", "comment": "Malware payload (RemcosRAT)", "value": "eb207b4705ac6f285b2a76c0ffb732d7", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415252, "uuid": "58b681f8-e291-4566-82ea-e6a54c4713ed", "comment": "Malware payload (RemcosRAT)", "value": "4839bf1dd907fc75d20582a25cf5aee9fc2009dda0a54fedaec40298848b60dd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415252, "uuid": "f011ba35-09a6-4688-aa45-6ab1fad48f1e", "comment": "Malware payload (RemcosRAT)", "value": "88a339c653b7061f95e783c5488d257eb98e1366", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415252, "uuid": "a6550711-3623-48f2-b1a7-a9b27020a4fc", "comment": "Malware payload (RemcosRAT)", "value": "54de52068e5d4b0c371bfc94ea105310e88be3e065bb009c67d9d18100fad51cae2bbe3ad45ad0552e8d50fd879989b6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415252, "uuid": "f7d521bc-57f6-4533-9ae5-31415d3d13a9", "value": "T11713F13A2CE6E850366ACD313088679CD6C049631A579BF61A22EC4E93E384971E537B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415252, "uuid": "bc6ecba6-427b-41bb-9379-32cd3d2920af", "value": "768:CxaID061a54slo9y5MUx5MiY1ST8Q6bp8298Xl4DwEzYQNaLLNGsLyQkZ:QaIDY54sl6pgMSgQ6CloFYQNaLLNZyQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415252, "uuid": "eef396c2-38fa-4bbb-9fea-0316405a1ae1", "value": 44008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415252, "uuid": "56bc3aef-0a9b-448f-86bb-401928abef66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415252, "uuid": "077f3f91-d816-41f9-9e7c-b338384de521", "value": "SHB89681.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1147739-5e4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780381890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381890, "uuid": "05ce4753-80b9-4b28-b050-ce8862575b88", "comment": "Malware payload (Mirai)", "value": "30a9c5c58006425115330d215a4960bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381890, "uuid": "e4d61b4a-0991-4624-a584-1737b4cf19e7", "comment": "Malware payload (Mirai)", "value": "49d8f79a0fbc89507bc4c321bdc0c8d0d02aae6d3b36af29ae0a7f590b5cb685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381890, "uuid": "ab451c81-dfa6-4ece-854c-c29d5655e007", "comment": "Malware payload (Mirai)", "value": "cb76a770356f470d68136a00ee0f586ce8d61202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381890, "uuid": "65ef693c-56d8-4c82-8e74-32f7450a8a02", "comment": "Malware payload (Mirai)", "value": "d482561a66fe66fdb0aaeafa65cf6ab1d4e9c687bd47e6ac1836010d5c650966ad876ed3a2b2d7cb6b4193eaa6c6b1d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381890, "uuid": "4a0ac810-4c31-4c08-aad0-32d850dda240", "value": "T179831895BC929A1AC6C513BBFB4E428D77266788E3DE3213CE255F2133CB52B0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381890, "uuid": "90690cad-18b7-40c3-8bab-d332211077bb", "value": "1536:hhfPBVuKNLVNOVukKhwIqRyzjYgil+MhroR/G9s7y:rfbfZcVvKhwcYgivCR3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780381890, "uuid": "7b3fd244-c510-4e88-849e-b169fea7484e", "value": 84428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780381890, "uuid": "137a35fd-d621-436e-8b64-8c62f0a400b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381890, "uuid": "a0aaebe6-03fd-4a97-b282-25139a30eec3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0e3264-5e53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780384887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384887, "uuid": "1ba23118-cc5b-4bc1-8952-4203ee386ad7", "comment": "Malware payload", "value": "086cb0ea05dad3146faac76d77005567", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384887, "uuid": "988b3311-6a5a-4e57-bf99-14367e2d2ddb", "comment": "Malware payload", "value": "4a4efde5c502f18473b52667608adad58d7d13593a52b4e8530ceaf21718f1c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384887, "uuid": "48a2b88a-6df8-4147-8aff-ded4394c6909", "comment": "Malware payload", "value": "08de4923298a2830ac1a2919ebaa47b32f4c86bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780384887, "uuid": "9eaec188-4a31-4a31-b55d-510f0f57780e", "comment": "Malware payload", "value": "7bfd186efdecf2bd799b2da28bd702471b3e9973fd8cd1a2af5f74e29932be995adb5e04f3ecfddfe8f6b1277ca30195", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780384887, "uuid": "60de7089-3ef4-441b-873a-15db8dfeade7", "value": "T19A137C6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780384887, "uuid": "46eee8e5-75d2-4f13-9ae3-4974db65c2fb", "value": "768:1+p9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:1+ico", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780384887, "uuid": "f2346193-c1ef-4bdf-9089-1efdac3051df", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780384887, "uuid": "5c305b0e-5eba-487b-90f9-f963ffda5ed8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780384887, "uuid": "ff8fe0d5-e68f-4b06-9af8-9a6cab9be68f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1df97fb-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780382858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382858, "uuid": "53687d04-6fbc-41e4-b0dd-15201619691b", "comment": "Malware payload (Formbook)", "value": "447f1e6ff2c970982e8e8f1afa3adf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382858, "uuid": "8b44b8a8-81a2-48b7-b9a6-3d013b66d116", "comment": "Malware payload (Formbook)", "value": "4e635e08da9caa7a6c08b4d401acbd9141bbde92d9f5cb5aafa03d6706cb228b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382858, "uuid": "51464eb6-edf9-404b-8b4b-d05405c2af2a", "comment": "Malware payload (Formbook)", "value": "57251d9a0619f4fedd03e8e863e4a2398d3cb98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382858, "uuid": "4a4f1a1f-67b0-4064-80e7-e370cbbf325e", "comment": "Malware payload (Formbook)", "value": "5a964fec20d711068b39a7dbe42fe5ad4540d21364ace033ea084408b2875728b1638b295f793d9306f3931f9c0f0c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382858, "uuid": "f311f331-b7bd-4013-8c46-032f6d2da13d", "value": "T1712501556B58CD41C5FE0BB85AE0D33507B84E0CA516E3268EE4BDE73C367966A0F283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382858, "uuid": "523e6e65-4369-4de4-aa9b-e02cfbabec6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382858, "uuid": "3240a50b-9f6b-4a85-ad07-9daadda15123", "value": "24576:PMg8+gQeul2iChzoJmXyJtN/baW3et6fM95OH23AuZ0:0gdb2iChzoJvDTu6UKHZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382858, "uuid": "ec925d94-db50-4c41-8b08-740e370d17f2", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382858, "uuid": "91f19476-ff56-4ffd-8e10-1b14735ce47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382858, "uuid": "b1d2358a-3bec-436c-8560-c6ccc331ea9b", "value": "Para transferi makbuzu 2131RI50089500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf4f43a-5e90-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780411223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411223, "uuid": "8d43ebcd-2aca-4a21-9b6f-0c4d4f5aadf5", "comment": "Malware payload (SilentNet)", "value": "2abb4a9e84a6216284401dc0d351ac1e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411223, "uuid": "dee92a13-c26e-4d04-a8e7-6ee4285c0eba", "comment": "Malware payload (SilentNet)", "value": "4eb132b44b2fbe2769ae3dcdca4f58655f6487e28c4c37f392841cdf3473ece8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411223, "uuid": "7c948e61-e29a-422a-be5e-c44dc4141943", "comment": "Malware payload (SilentNet)", "value": "bda0e68bfb9d15f869eb95bad5bd0ad1f00d0f07", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411223, "uuid": "f87c7d8a-1642-4da6-ad1f-eff73366a58a", "comment": "Malware payload (SilentNet)", "value": "8f54c2b7dc8b0fb995a7c44ca9be6d6ea13e0a36388f3675a1937ab9af80cdce336735d518ddd283dc1d096490ddcef0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411223, "uuid": "5e0631ac-0fd0-47e5-a768-62900278ef95", "value": "T1C27302C534AA6922C49FD6316C504D6BB2566B56FD0F852FA2F4180E1853ECF5FD08F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411223, "uuid": "a05726d6-9ca2-4228-a060-34c9094e0e6e", "value": "1536:ErAk8w1VBRzbSQsmvO9iQvuW7V4FfE5IOp2RIvW4PQr6TMai7:BkbXO9i3W7KXD4PC6Hi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411223, "uuid": "f0d069f0-bba8-4b26-9683-efbb24ac81bb", "value": 75019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411223, "uuid": "c56dc125-c004-4d5f-ba50-e62d88010175", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411223, "uuid": "1e4b59cf-4adf-4f13-b76a-4c49a747c626", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f022f1ef-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780382855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382855, "uuid": "715023dc-b7e6-4bc3-ae7d-c86c6fbc90e7", "comment": "Malware payload (AgentTesla)", "value": "469104e4cedff0ef34ffe43a09f6afec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382855, "uuid": "d321771d-451e-459f-b983-e03b0af01475", "comment": "Malware payload (AgentTesla)", "value": "53f819ea72abcec54c85b499f7bf327466b509b3cfbfb18a64bddc25e647e866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382855, "uuid": "93fbdd1a-3819-46e8-8071-96605a15b8c0", "comment": "Malware payload (AgentTesla)", "value": "01a9347cec9b4ad4d3b42009de270768466a4cb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382855, "uuid": "b7452170-a9ee-4c73-885d-c4f3d0b89e2c", "comment": "Malware payload (AgentTesla)", "value": "915bfb3697be20484350e7138591441c254de192f2de390afea800ae908cd837329ef9c4ff004a6d2b3e2fb71fd84d23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382855, "uuid": "5a915d4c-d08d-48d1-8714-de5691857f5c", "value": "T1502512692B039001CA5667315F7F1FEAD333DE280639824B8BA31AADDE37769E1D0D41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382855, "uuid": "7a950cdd-ce3b-44d3-93d1-cfb06cfeecca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382855, "uuid": "6cbcd84b-8329-4a91-a686-4fb042e46bbc", "value": "24576:aFJz7c5a8uGrxt66LghoGFq4H/+0a7K5:kvL8n/6thv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382855, "uuid": "582ec1d2-15b2-41af-9c70-eb66cd87e3fc", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382855, "uuid": "45a15aa9-e456-42f9-89d8-2136bb2fc984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382855, "uuid": "15cdf373-7a96-48c2-abb5-d3084e1f4cc7", "value": "ORDEN DE COMPRA DEL PROVEEDOR 4300004245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6180dbcb-5e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369301, "uuid": "48829ce8-a8ac-49dc-809b-e053c764077c", "comment": "Malware payload (Prometei)", "value": "3cecd2370671619b62e8acdeb22fa240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369301, "uuid": "afd31689-651a-403d-9441-3ae25d33bba5", "comment": "Malware payload (Prometei)", "value": "54b8fa83ba955fedc2a935216144effcd4e6006363bf2bd185602aaebfb68721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369301, "uuid": "d464bdba-d091-4c65-b2a4-1e586130a7b5", "comment": "Malware payload (Prometei)", "value": "05756ab319fdc0eef2c5d3b9e95f58f7d20afafe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369301, "uuid": "32cacb1e-0941-45ac-9a1b-cbfdfeacaa16", "comment": "Malware payload (Prometei)", "value": "d0f768297f9250cea38373c39d3fdb5bd2e67a7da93f36bf4f970dbc123d44f56324945488f1d30755466dc920018c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369301, "uuid": "c49f2aa3-975d-4050-ab2c-45c1b7b4084d", "value": "T15734BF63A4BCAAAFDDD82F379C4E880713B66FE5D890203E1C44710EFE1A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369301, "uuid": "66718ca1-9bf5-482f-a739-8ab0603ef911", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369301, "uuid": "a1f448fd-cd60-43fe-8270-7f1c10733c3d", "value": "6144:nGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOD:nG60BpL8jk1FGjDc8GVdOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369301, "uuid": "6cad3a09-154b-4e5e-bda4-94c13fc2d2aa", "value": 246154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369301, "uuid": "c9db06cb-0d59-445f-875f-3fd1444e9ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369301, "uuid": "536aaaf4-6ffa-453a-a79e-85fc6d9de342", "value": "54b8fa83ba955fedc2a935216144effcd4e6006363bf2bd185602aaebfb68721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05aeaef-5e4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780381889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381889, "uuid": "fff488e6-7edc-4d3d-bc6e-0753d82921b0", "comment": "Malware payload (Mirai)", "value": "9b632d8d81d48801ddaf09ef7e62500e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381889, "uuid": "6bed750c-3d97-4555-85d6-41cc712850f0", "comment": "Malware payload (Mirai)", "value": "56229a6050f43fd51c2a1b82dc823f4dc3ef417fe9984e90dd7ee3cb2fcd0085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381889, "uuid": "4e83d790-00f1-4bd6-abb1-64d8f08f0bb8", "comment": "Malware payload (Mirai)", "value": "435d6fe86c095f72fe7797096c6e5fb9ef6bc5c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381889, "uuid": "cb1c7d71-1610-47ad-8c56-dbf52aaa6867", "comment": "Malware payload (Mirai)", "value": "304970700c807e36a2e690ad8dd18069db41f5dddee962d94ee49710024ee96b6211de2607f6e6f9e71e72904d281b36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381889, "uuid": "d95f7516-a220-41f6-8ca4-4c90d9702c37", "value": "T151B3D70AFF600EF7E86BCD3B06A81B06348C651B12E97F357938D918B95A50B16E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381889, "uuid": "84f82863-b497-4f63-8a62-193a23934eb7", "value": "1536:sOSdzzjrMT+tZkVK3hup0789EWR0rU4sd9md6Za5cMS72sWnsjZLjvwc5I69:sOezjQUu83hz89EWRsUlQ6772jnsjj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780381889, "uuid": "08e1151e-b45f-47ea-9ba4-87d5c583d3d7", "value": 116556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780381889, "uuid": "5a502aca-cdf2-4b62-a762-f000f48c31c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381889, "uuid": "070f5a39-d40c-482b-9460-5ebd8670bd5b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6710ac35-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415267, "uuid": "d6d828e3-0cb7-4550-92cb-fe26ff8fa280", "comment": "Malware payload", "value": "306eb9b7a9c8d02aa83bf335cd885000", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415267, "uuid": "a34d709a-bf8e-4fc7-88a7-2cdda2f901c5", "comment": "Malware payload", "value": "56690bb7e73b18d50f35a9117b32362364c95acc5bc4961f240302ba28484a6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415267, "uuid": "a4d278dc-9111-495e-827a-88582b279aaf", "comment": "Malware payload", "value": "d2ab109c723a9f6cbe9a1fd2efd5d21de9d831df", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415267, "uuid": "24c32f22-8a29-420f-b012-cc4dbcc8800a", "comment": "Malware payload", "value": "3a0b9ca48f37cb905cf9260d0bdb782309f591186a64cc925962f9db7d62239fa85766f1016451ea9a606c4b557e5f70", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415267, "uuid": "13f77505-b0df-4219-9f59-f91683adf047", "value": "T1B5942337C1615F74FE0FB7AD8C33330B23951827A4188BA695C5951C81B6ADC39AF9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415267, "uuid": "5cf4e191-55db-44e8-b9f6-b6b905030ec4", "value": "12288:Ia4Ak2acxsHHenNTno4Pzws1JMZZchI3VF5zCCvKUP:Ia4AvtRno4scMFrKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415267, "uuid": "3518813e-22f4-4744-a068-58c33f115f3e", "value": 442232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415267, "uuid": "02f6ceb8-bc2d-4822-aa97-0af9e92cb80e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415267, "uuid": "0ea48b54-6000-4a42-92a8-db070d32bbb8", "value": "PO#062205_(pwd=123).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89138b89-5ed0-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780438517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780438517, "uuid": "1d018a2a-02b1-490f-92c8-f32f636c4074", "comment": "Malware payload (WannaCry)", "value": "4d309715c5d73550f8fdaa46fdc545b0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780438517, "uuid": "8b30886d-221f-4721-a560-d207a05da19b", "comment": "Malware payload (WannaCry)", "value": "575c68444ece3d0d229b577033a557e4e57bf44a143d2705df0abb40d5648b4d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780438517, "uuid": "42a438c9-365c-4c17-8c89-6c302d674b35", "comment": "Malware payload (WannaCry)", "value": "d0b661908d325498088e4bae3a5fc60453ab210d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780438517, "uuid": "9a190156-3d63-45c6-80fb-475795183c31", "comment": "Malware payload (WannaCry)", "value": "27b93cba0ca9c59399a698107d4eec5b25630b5d031e4e803beff5f1800677de9f078c8df707b15e98e10f1eed8f5fdc", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780438517, "uuid": "467ca0e1-99f9-4973-8d7b-dc9b32b605fa", "value": "T1F736239531B880F8D107167494BB9F12F3B7BC6922BA5A0FAF40497A2E53B47B724713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780438517, "uuid": "547ea60a-4fe0-4fbd-a5a2-0fead757d570", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780438517, "uuid": "f7e98710-046d-4ba8-ae71-41d9abe8a4f7", "value": "49152:jnsn9MSPbcBVQej/1INRx+TSqTdX1Hk7ARdhnv:DM9PoBhz1aRxcSUDk7Edhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780438517, "uuid": "8fb2bd24-df00-4680-93a4-3c8e47db3cf1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780438517, "uuid": "aa028757-926e-43b4-9642-ab6ac0aada2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780438517, "uuid": "e5d8b671-86a3-435c-983e-c71c9f6cf4c7", "value": "575c68444ece3d0d229b577033a557e4e57bf44a143d2705df0abb40d5648b4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c45777f-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415275, "uuid": "cf9eb533-cebe-4d02-95ef-79904e497d8c", "comment": "Malware payload", "value": "604dad5e2ba983c641868530c956e518", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415275, "uuid": "d216f2da-ad20-4bf0-befb-8684e7a31a5a", "comment": "Malware payload", "value": "57d30e4e1dacb16f24d5a20cd5b3eccc4a7d45903b27aae77402b612a51f8e5b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415275, "uuid": "6d20e83c-8bcb-4c97-99f4-5194b8f5cc4a", "comment": "Malware payload", "value": "670290128f96c0f6cfece3f7cff4cfedf8ca3579", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415275, "uuid": "c6a44dd4-1411-4747-bfb1-0be0cb54476c", "comment": "Malware payload", "value": "ed4502aa842ecbdc1a2d30d62de524d6c3e9bd7c67e3e23d50228f64c46d33fd1f24247b99b39a218537c8ddc447eb1f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415275, "uuid": "dedafc94-0206-411c-bb69-b68eb1860b8e", "value": "T1EFB558F1AA1809599F75037C9F0F0064BA4E1A3E0B09DF097AA2F551FA644FE1A37E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415275, "uuid": "a10216e0-ee91-45cb-a964-fbf5b0152528", "value": "48:wWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlWlV:6r4Fp9BHxtYPrRcS1do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415275, "uuid": "de9af49c-4fcd-45b7-9041-52f6c4f4f8fa", "value": 2323217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415275, "uuid": "383f686d-059a-4fe7-8450-c963aa45f9bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415275, "uuid": "6eb74996-f107-4553-b5dd-40c11091914c", "value": "pago_894557878-787876767.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6d3788-5e41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780377155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377155, "uuid": "2d8d2c56-789d-4790-87c3-91096a953d27", "comment": "Malware payload", "value": "9314f0fa42caebcbbe5261bdd2795f7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377155, "uuid": "1da7ea3f-c6ae-4da9-8b4f-64c3205b2c14", "comment": "Malware payload", "value": "57d91bb5b6e0da0e6e7bfff3bd03b20a711e3d09cc1b19316a671bd63351b8a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377155, "uuid": "59774004-8ab8-4b26-a91c-e62367b71089", "comment": "Malware payload", "value": "40bc784a57421f1e51a7498fb5977448559e8ca1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377155, "uuid": "91167269-f55d-4091-8708-ecb6f0756def", "comment": "Malware payload", "value": "e73d73af02aad6a8f712ad3c428ec5845bf5af2153cc90308815908ca39ad9084f54ad21d49b6aff5dc42289a5223603", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780377155, "uuid": "21e7cf33-3821-412e-9a84-17ddaf23bc7c", "value": "T19405235CC1CFEC5683BB418A631E924A58F761B834DD6E18AAE3355373E9272CF448E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780377155, "uuid": "b3e4bba7-0451-4321-a1e4-c12c9fba4bcd", "value": "24576:/suUfYsQgiTO5CC0LbNzQw0cYUVoZorAU:ofYsjZ0F3oZoEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780377155, "uuid": "9b5aedca-cde1-4ad6-bbb8-36028670b49e", "value": 801372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780377155, "uuid": "31de294d-77d9-4f1a-8e0f-adf7980f42c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780377155, "uuid": "8b38e290-05b9-476c-903f-e9f4af2066f5", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db0c529-5e54-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780385240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385240, "uuid": "2b3f14ea-f8e2-46f8-a43d-92e2172c3b03", "comment": "Malware payload (DarkTortilla)", "value": "760f25e6201b781df3c3011abe7d267b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385240, "uuid": "9bf11aed-e811-4c54-8cf0-e1f2a2a97a2a", "comment": "Malware payload (DarkTortilla)", "value": "57f17ffaf11524b19efcc4eb8860ac6d822143b214326baeb2d36504f7117cd1", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385240, "uuid": "48be826a-d848-4ced-a4bd-3eeb312959d4", "comment": "Malware payload (DarkTortilla)", "value": "27d7c8f01bec511414ce133fa25a775285993a45", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385240, "uuid": "6e6857ac-ecf3-45aa-8ec6-7692675bfc3a", "comment": "Malware payload (DarkTortilla)", "value": "29adfab82591ccb413fa89313c32c01afc8608281d59f22cb90a7008976981bc8880f3c4c1199510b8cb52a776a7784f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385240, "uuid": "294374b0-5dd3-4b23-9390-7413e875f107", "value": "T10F457B32DF467BD8ED285F3AC002044827B0B74392D2D75BAEE985B51966E7D8B3E530", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385240, "uuid": "0128c790-bf24-4bf4-b93a-1a463de86d0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385240, "uuid": "b8dd5987-6837-4740-b7c6-47a1028fdd3c", "value": "24576:q/Dvjn/ov+ugZU/FHGtYINStGFt2j6wB0He1Hzf:q/DL/omuWU/hGtNNStGF0WIUel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780385240, "uuid": "a7f8038e-be5a-4d42-b52e-fc9ecd944ab4", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780385240, "uuid": "a208f702-bd66-44ae-935a-66d1c5547c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385240, "uuid": "da15747f-e35b-40a2-83e9-6ba5672e5221", "value": "SecuriteInfo.com.Trojan.PackedNET.3564.30359.26749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67f69fd-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780382839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382839, "uuid": "75e90434-d622-4103-8157-9fb36a48c79a", "comment": "Malware payload (RemusStealer)", "value": "53ce30c8ecbe698e9eb3ba85aa57d29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382839, "uuid": "64daa560-be82-436f-8cdb-8f5dae7a337e", "comment": "Malware payload (RemusStealer)", "value": "5942d6c41b1abdd1b35af2c1a62ac429141ee69209dedab82daae19a24d6a2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382839, "uuid": "9a9aea63-3cf1-4130-ae1d-e9aba3468730", "comment": "Malware payload (RemusStealer)", "value": "3014de18c39637d3575b0f20ad54b97735ddc0c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382839, "uuid": "7102431b-01e8-4627-a85d-e68687c78e08", "comment": "Malware payload (RemusStealer)", "value": "3e989000ab99fa2123de7a658d2049f5b151f4063d158967cf51b6ea583971eaad84fbedb9eda9b2ef84c7010739ec74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382839, "uuid": "c6099d0c-d987-4346-88ee-d15d2cb1843c", "value": "T182757D41FCEB54B1E946523308B7A2EB2334B90D0F32AEC7DD447A7ABC775E10922665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382839, "uuid": "f5b925da-779f-4beb-94f2-30150e64c735", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382839, "uuid": "c83db822-075f-4af1-8c7b-063e72cb389c", "value": "24576:vRQHARMFHGCcURTu4Pkc5zttvbFSLmAexU6huSUhzckp6Tcgu6XJWK14dSQqKNLY:vmp+LSUhRC1hA+weR6YK1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382839, "uuid": "8461e0fc-a172-4cb4-8d4c-b26823b3d915", "value": 1613952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382839, "uuid": "12c3111b-06a3-4680-8471-d2e9a8a61a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382839, "uuid": "89893548-3ca8-4a60-8d63-e564fdc7742c", "value": "53ce30c8ecbe698e9eb3ba85aa57d29d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fa23d9-5e6f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780396775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396775, "uuid": "7d126af1-ffab-4aa7-a521-e74447000ed2", "comment": "Malware payload (AgentTesla)", "value": "d80dfba34a95849939e889a8106ca814", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396775, "uuid": "95a87f2b-0bef-42d9-b698-9d405d06f582", "comment": "Malware payload (AgentTesla)", "value": "5b860bc85d95cdf0b70e6b5909507a12f541b8dbac7a7225f2e93df3ae110dbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396775, "uuid": "327a419f-c648-4ce0-9f37-5404d749e17d", "comment": "Malware payload (AgentTesla)", "value": "2275ad250fa9fc55c17e35b1cabe65570e2e8de9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396775, "uuid": "be84c880-ce2b-4eba-83f1-6a71d6985f45", "comment": "Malware payload (AgentTesla)", "value": "7e44fc8c92e14802b49bad3d79d75b17e877a066b3e7da4fd8a6b716290ca9030edebcd32a5216638dd78bc941236852", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396775, "uuid": "f3a5bc84-181f-45d7-87fd-9f35be54a872", "value": "T121145B20EE24067A0F472BDDFDA54621CABC8719462660F1F6DE470E61065FCE3BE26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396775, "uuid": "3802d0c6-c7f3-426c-bb4c-028628a66cce", "value": "3072:9/NRBKx3wrVPz/u3EkJqFZ4amDxOsm2i+EC0kQdGJTp2KSUG/2bxY2wm8:9ZKx3wrFaU5FqDxwuH0kiGS/2Vim8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780396775, "uuid": "21165b7b-3f4c-4349-b1d9-4edeb9f2c254", "value": 199868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780396775, "uuid": "7e984b23-bfad-445d-9708-1f130a875ecb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396775, "uuid": "35625ef2-390e-45bd-a2e4-9e19add8cdb5", "value": "Justifi000055885.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81086cc-5e4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780381472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381472, "uuid": "c868a481-dda0-4f2b-9fc6-aec88248dff7", "comment": "Malware payload (RemcosRAT)", "value": "0b2a85730c59b021254c94fdf09d86d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381472, "uuid": "b6bba4c5-5561-4e85-b0df-80da632c8d88", "comment": "Malware payload (RemcosRAT)", "value": "5bfd0fcebd3e1ec9dcd472c4597165c6787c56ecc77eaa4855c5e918e6812cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381472, "uuid": "74c933d6-aa5a-4186-be32-16bc8dcee5ff", "comment": "Malware payload (RemcosRAT)", "value": "2edcedd374d4bb4da12037261d97be688d182b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381472, "uuid": "52efaa9c-4007-4313-af62-a9022b4539c9", "comment": "Malware payload (RemcosRAT)", "value": "182d5f9698be1cddb0a2c43fc1103a17677a84a87c0d115b6dc276c1db9c2ed15593bc7989e355ea2ddee9e89738009d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381472, "uuid": "31c0b329-944a-4703-b4be-aa2b9eb6827c", "value": "T1286501D037F95B05EAB96B349936DE7407753D28B431F69E06D93B9F387A6018C08B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381472, "uuid": "303cab9e-e0b6-463b-ae12-14d563f1bce4", "value": "24576:C04zhh4FJb7ZGyLaQp8mumceyGVgR9SWc1+jdQeXy5Nu9y7j9k4elUOvMLb:C04F6bxOQpnum1qPOePW6y764eyY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780381472, "uuid": "088f8863-56f6-4abf-89fe-42784bb01658", "value": 1547776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780381472, "uuid": "d5366e4d-65f1-493d-a19b-5ffd27fa1e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381472, "uuid": "17d72b59-a874-4317-980e-3fa4c5f96068", "value": "In-House Tariff-1 \u52a0\u6bd40614.PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a82a6a-5e98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414238, "uuid": "1eeb550a-cbe1-4214-af3b-0b9dab312d95", "comment": "Malware payload", "value": "c6ffd210df43abb02dea1122ffd5bb9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414238, "uuid": "d989ca9a-07e4-40e7-9cc0-46fbac93db55", "comment": "Malware payload", "value": "5d97c8662f5db7a45960f94a3ab088cf59caf90e87bf95317aa59efcaee596b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414238, "uuid": "3eb6dff5-b1c6-4a91-8dc4-243f32b848a5", "comment": "Malware payload", "value": "466cbda05a26080494bbda3f537ec624f1c89e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414238, "uuid": "0f0d9ba1-eccd-4e56-ab54-6f9a3efb49b2", "comment": "Malware payload", "value": "3b3c8bf06779fc44403579c555e2fb25d6c7f53bdf6be926f29c3d3fab51b52abc0bf4f14034078e69807a54bfbcb92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414238, "uuid": "a350d5b1-61e0-49e0-9430-075f5f0dfb80", "value": "T1B7872A47F8A22DD4D4E9C670D125815BBAB23C2D1B3C23DB1AA0F7601F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414238, "uuid": "31aecb8f-7191-4090-a830-67e7ba57114c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414238, "uuid": "6fe3e2bb-ff80-4d77-938d-8a588472dc76", "value": "196608:PDvVv8MiUFXNP60500+HUnTJ/9rPzBkiGdQ1Lzlt9MWCl4f2cqqxdiW0+Myqs6CP:PDl8XUFdP605tB9rP1kzeJ1MJhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414238, "uuid": "e655b6e1-33ba-4eb8-a125-7e055d0ee1e9", "value": 36839936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414238, "uuid": "f6ed06a3-53c9-4b9d-bb40-8b432c07a870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414238, "uuid": "331e5e22-96f7-4121-a823-d953de0e6263", "value": "test-beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafb3f29-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360888, "uuid": "1e0aff4d-2bd3-4b1c-b309-7c7f6b529dfa", "comment": "Malware payload (Mirai)", "value": "e2f963ee8dc03a083a95baaefebeb433", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360888, "uuid": "a741a257-78df-4c79-b102-5f3d5b821769", "comment": "Malware payload (Mirai)", "value": "5e7818bf26d0640b1e0008fd325f174a56c47f9bd35a7dcc699976fe978aad6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360888, "uuid": "6b642dbb-3348-4c55-8efd-67eda967d6f1", "comment": "Malware payload (Mirai)", "value": "acd0677607af121a4239e28964fbb4f5bb050772", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360888, "uuid": "5210ea99-39aa-4070-a098-267361afafc9", "comment": "Malware payload (Mirai)", "value": "10f5cbae08fc478f21b0c2765f1fb209d05d8b6f1d945a376578b6d825e3e67561947e67cdfdedbc367a4ee7ec909b65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360888, "uuid": "6054da50-1f52-4470-b95b-643eaec158e0", "value": "T10711B68D02125228080D8E4C705AD909CBD7C2F4F9B8EED464E40737B89BB06F18CF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360888, "uuid": "6f6da797-1111-44df-8ba5-15cd89f485e0", "value": "12:+9SqViW+l95Bq+l95NI3PA+l9iIKqlEH+l9z+l9NLq+l908Z+l92D+l9+jdKA+lF:BquNI5KqKLDtOgFoB0M98yxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360888, "uuid": "073c3bd7-9e0c-4997-9a77-0178d1c5d06e", "value": 957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360888, "uuid": "a373bd82-97e9-47f6-acb1-b96f0ce98123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360888, "uuid": "5ac5e839-92bb-4fac-89c0-ac0ecbe0c82a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7af2810-5eab-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780422757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780422757, "uuid": "90a5cad2-49ee-4df7-9f72-106da2c6b27e", "comment": "Malware payload (NanoCore)", "value": "07774a2c6b1d8430666d1d314c363f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780422757, "uuid": "b3eb4ede-4dac-4cd6-85c6-ed3c73e8bf67", "comment": "Malware payload (NanoCore)", "value": "5eb4c9e5099fd47511d7e427514e92be2a2c2c7659bd73eb15b72b4caba16b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780422757, "uuid": "0faea082-73b0-4be1-9ace-c308fa501881", "comment": "Malware payload (NanoCore)", "value": "e195835dce9fde97b736d3b54b487347587d1400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780422757, "uuid": "7aace10a-51fd-4aa8-824b-74f0dc376d1e", "comment": "Malware payload (NanoCore)", "value": "2a8c886744c53602c772f6264d1313fbd76263bde072086e5a005778c61c3958d54fef97f0f8b6df6d2517c8cd93ad4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780422757, "uuid": "fe1d10b4-935c-46d9-ba3c-129d560d9fee", "value": "T16A8401967BA84A2FE2CF517D62220116937882D3E9D3F3DE28D444B79B527F5061B0E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780422757, "uuid": "ebaa3fa2-c838-4748-bcf8-8399588a00d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780422757, "uuid": "51215cfb-04cc-4946-86ed-a8ef7bbaeba8", "value": "6144:7LV6Bta6dtJmakIM5oe6ask2IqFFCJGiRrQ/0fwh2OK1K2IDnNN0lr9oUE9i/mDA:7LV6Btpmkw6lIqFYrToh2OK1K2IbNNO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780422757, "uuid": "408f0ee2-7e47-40c3-90c9-bc9725dd4f23", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780422757, "uuid": "fc2125c4-acfe-4c81-ac94-35c7564e43a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780422757, "uuid": "e2ad2aab-b8d0-4d25-ae74-57b08275863f", "value": "Leon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dc13eb-5e8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Latrodectus)", "timestamp": 1780409898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409898, "uuid": "9bf4fc0e-1ac8-4351-b0e2-2bfa4e1ea46a", "comment": "Malware payload (Latrodectus)", "value": "d1a6d99493deca9e3742e411038cbf72", "object_relation": "md5", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409898, "uuid": "6d18abc7-28be-43ba-a401-113636a61ed0", "comment": "Malware payload (Latrodectus)", "value": "5ec37444f9ead97f89b74b0b0ee6707bd67a61cb1ad1aa7f5ba85613b722cf4a", "object_relation": "sha256", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409898, "uuid": "9c83c52e-760f-440c-810f-707a8e7a9191", "comment": "Malware payload (Latrodectus)", "value": "6e3b10a7bb0742ceaf95d061bf65263e702d89f5", "object_relation": "sha1", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409898, "uuid": "acec2b26-cf4a-45ee-9cda-532bd578774e", "comment": "Malware payload (Latrodectus)", "value": "1e074e0ac6c8a546d0426cdc079642df83faa2106b56e789cd02c3e5c5499bfed305ed61db9f4953380b9c524ca01469", "object_relation": "sha3-384", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409898, "uuid": "a281e1a1-2256-4e43-8b52-762d331f5a6d", "value": "T135E502217386C63BC96E06703529879B147DFDA70B7180DBA3C82D2E6DB41C16639FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409898, "uuid": "7a3b10a9-9c13-4c34-9547-e937a88ef9db", "value": "49152:f7qHYjZKumZr7AcI1KqJekweoSciUfAaj8yGsvNnULhDuS3IpXi75So1YK:UY1K/AcI31XVEfAXtsvN8uS4pS9x1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780409898, "uuid": "bae0310f-3ea3-4102-81a5-713b69cf1030", "value": 3215872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780409898, "uuid": "3c3d1c21-79cd-4c9d-a068-56bef7fbcb11", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409898, "uuid": "5d13a6b1-9515-447b-9823-4a38c27e4248", "value": "5ec37444f9ead97f89b74b0b0ee6707bd67a61cb1ad1aa7f5ba85613b722cf4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b179c8-5e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780372682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372682, "uuid": "0e03634e-0077-4564-900a-af02d4fccc75", "comment": "Malware payload", "value": "10c11153a30822afc7eed9b420842590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372682, "uuid": "6334ab0c-20b9-402e-9e9f-89fa608164d5", "comment": "Malware payload", "value": "5f46e25d6818a805d2d424e1fc3739d030c3aad30ce8a7b9e5b6273affbfa9cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372682, "uuid": "6ba243d8-3d34-4209-a05a-afdb1df2d992", "comment": "Malware payload", "value": "fa8ac397d4c116a709c65193a4edc29b0821dc0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372682, "uuid": "f09772b2-5a44-4d64-90f5-445ec87dd803", "comment": "Malware payload", "value": "f857d8cdbfdca483ddf60ee1e60b61e98c74c57faf424788c9880e9a31adbec0750910fba07ebcd52b8b5e4ce07f33f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372682, "uuid": "268283df-4b56-48c6-8730-5230d4ca45fd", "value": "T1887319351652B22CEEF5A4B8F80331E524110F083BDC92E378C35579DE79B48B65AE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372682, "uuid": "d7c4cb15-d228-4110-aa9b-7f8f79251fd8", "value": "768:vYM8fQQVDTz2qF5edphYKySgRWd8iLQKkkAaXscWU88g5eWIGQyxNjrcH05DT:vYlipgcdnLQKsaYx8gIWHLra0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780372682, "uuid": "186f0ed1-1655-4b48-b566-9c67750920fb", "value": 75364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780372682, "uuid": "bf22ebb2-6334-4531-b6f3-73e958a6389f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372682, "uuid": "ffc29010-6697-4540-bf87-1c291953ef5a", "value": "azsxd.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56368384-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1780415238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415238, "uuid": "829e549e-ac0c-442d-bcf2-ca6d2aa760b4", "comment": "Malware payload (VIPKeylogger)", "value": "e1dbb47b1fdec11b1335f83e29f25419", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415238, "uuid": "3630b2e1-9b47-4a9b-800f-85c2df9d917b", "comment": "Malware payload (VIPKeylogger)", "value": "5f8829c25409bd985e35113939e4c25e3fbef1b9bbc3209c6e0086d21eb1426b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415238, "uuid": "cc2b29fd-8e31-4449-a8c2-50a37ec498e4", "comment": "Malware payload (VIPKeylogger)", "value": "d025e0c3c2d78fd45a1001e0190dec55686c73b5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415238, "uuid": "c873f80e-d26f-488e-b09b-934d91147f0f", "comment": "Malware payload (VIPKeylogger)", "value": "95ee21cb2494b0f9b16f5179c575aeca01a91e9a5ba6c1c8027dabf26e8572a33a8ebc7b83f8369b9692acedad3641d1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415238, "uuid": "9c51d8c5-ba52-4f7d-a09d-7cd332fb1d7c", "value": "T1A7514D33F56B37D929634122E860C25A20333BA3BF56618A5B5F70667211237247326D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415238, "uuid": "6575924e-5cd4-4ba3-9745-1017b875c2b4", "value": "48:ZSt4Is2AnAI0K+isnb0Ebm0SUSQyp4nIlTyDRht9zdF3E4BxBNQTHmvLc:ZSt4P9T0K+1kU3Ihc19zr3E4eGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415238, "uuid": "c9663827-2a1b-4690-bca4-dd9083d609e4", "value": 2559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415238, "uuid": "a613732b-fca2-4ad3-94da-5aa0ccaa325e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415238, "uuid": "4755dc0e-e8fe-46b4-a5cb-a3c9fb194898", "value": "Construcciones_CAMSA_S.L._REQ2060026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0842bd5f-5e7b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780401793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780401793, "uuid": "3583c5ac-11fb-410d-8ee3-4939b18f5a00", "comment": "Malware payload (DarkCloud)", "value": "156fd9daf00b27ba3e114787515c3681", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780401793, "uuid": "b5a52b41-624f-4a12-920d-8254bedb50ed", "comment": "Malware payload (DarkCloud)", "value": "60d5cfb89c982a73d92f700f982bbea72180b47bcef2f870572a12d7f198263a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780401793, "uuid": "1c24eba0-3a5b-4ace-940c-b670729c567c", "comment": "Malware payload (DarkCloud)", "value": "a8145b19f4e7d3f6ee3432da2c003f8e0a018c14", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780401793, "uuid": "4f799ebe-61ce-4348-9ccf-6140d80828b1", "comment": "Malware payload (DarkCloud)", "value": "c2044b6c01db1f351b687b6fc24544080385f5b2d3a0971c17a583763d5a5877dc08f911583bd23804d0ad91cd4e0c1b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780401793, "uuid": "bb3d34cd-dff4-47d1-9d8c-2f2a40f70c82", "value": "T17B550155AB58CF01C9BF0B7844A0D27607B74E08AE06E3968EE4BDEB3C717955A1F183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780401793, "uuid": "4a600afd-4f1b-4a6c-82b2-f04fa0ebd272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780401793, "uuid": "e2f8d4bb-1d92-4850-b333-d57dcc672fd5", "value": "24576:CPs78+gePLgMOLSC4iaU9hLqcQ9MTJSp4NINwN/N1kzsHA8GqnDAmkrBv:As7dlPLyF4ixhL5Q9MT8pk9yf8GGxkrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780401793, "uuid": "bc537bf8-04c1-400d-ba14-bb8dfa04c8e6", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780401793, "uuid": "ca02dd0d-79b8-4916-bc85-7ba9d6177b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780401793, "uuid": "c23dd13a-c77b-40ba-9264-371ea20dca0d", "value": "70_FEBRUARY_2026_IMPORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4afeef0-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780382836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382836, "uuid": "874fd702-3dcb-4b74-8863-87139819b8f6", "comment": "Malware payload (GuLoader)", "value": "78244c4ca11f3c471ee34bf71cc9d933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382836, "uuid": "6c430bdb-c8fe-449f-a040-58358c1db463", "comment": "Malware payload (GuLoader)", "value": "6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382836, "uuid": "ecaa2c05-c763-41d0-b1e7-f9d727b31980", "comment": "Malware payload (GuLoader)", "value": "3df2469ee5bb829dace9bd636d5a910611b9fcd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382836, "uuid": "44888a3d-153a-4251-b808-189598906a6d", "comment": "Malware payload (GuLoader)", "value": "a33feb6d62ee5fcbc07df4ca5ed009bfead228411d8a284a529b144557a86038339307ea8dc0bcd06060e754095ee682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382836, "uuid": "f62917bb-b534-49af-a2fc-d82b736ceba2", "value": "T1EFB4220127A48807D9F2AB314A7A68B6D52FCC69197DA34B0B043F9B7D72271D59F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382836, "uuid": "19234658-f052-4970-a853-d8241ca39e89", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382836, "uuid": "cc3ea167-3ced-4c0e-9872-2d4cfe0631c2", "value": "12288:GyWZK0nGbgcXhM9aeqf8tAWuh+x7NKokTHVy18AwQjA:GyWZK0nxwM9a7zuN4kmAwQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382836, "uuid": "561a1023-e570-4f79-9cf3-f2a88e599276", "value": 509192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382836, "uuid": "079dcadc-ee05-4f00-8288-caa557dc4485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382836, "uuid": "731bd1c0-d676-4764-a408-a392c95d5a3b", "value": "01062610084.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa01e414-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1780414225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414225, "uuid": "89661e05-e41f-461e-a55b-d38a4402d926", "comment": "Malware payload (Sliver)", "value": "c87e90ef5b3a0f9bec78f2ce1d3017b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414225, "uuid": "7a470c91-de93-4e56-bb89-f2f06ec95563", "comment": "Malware payload (Sliver)", "value": "637bd85594e5357c183f6ed3860833f6873ce2b9b668bc06790791747d8257b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414225, "uuid": "fdc3cd80-8642-4e59-9e1c-47526d87852a", "comment": "Malware payload (Sliver)", "value": "3f788cbb5bb0f4a1f06c1190264ab94e17b34c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414225, "uuid": "c34fa6d1-a318-47dc-9eee-a41adb31090f", "comment": "Malware payload (Sliver)", "value": "bd4eb1473434aff5dcf4d2b60ec9f5e97a0e6bcd340289523e156b385e25e8e4113ec692bc7a4ac75de1548d9756e215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414225, "uuid": "299b5934-c443-4111-952d-6b38a1056134", "value": "T1F0B61747F88501E8C1EDD174C6769262BB713C895B3523D72B20F7B82B72BD86AB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414225, "uuid": "e3be65b4-4033-4597-a0b9-d8a2d201915a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414225, "uuid": "c9260c1d-f5ae-43a5-a7cc-56a54d7d79c7", "value": "49152:9zGI18i9mr0farworb/TUvO90d7HjmAFd4A64nsfJuuccBz5sQT3a0Y3UwrJdxaz:m0faM8fBaQr5KQagguOEY+VQ2Zgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414225, "uuid": "8a47dd7c-e0f8-4b69-b23e-c0409c8b31a8", "value": 10981376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414225, "uuid": "ea5d2dd5-042d-4492-afc4-1e4f60bef443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414225, "uuid": "dba8fcb6-3b1b-49c9-8482-f35928dc5082", "value": "sliver_implant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c460037-5e6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1780396646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396646, "uuid": "d03b15c6-07a2-49ab-aa34-55dd0141f7d1", "comment": "Malware payload (Amadey)", "value": "1d864eace110c42355aeee66ce94adaf", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396646, "uuid": "37ff1ff2-f0c2-402a-9ead-33475d1b1596", "comment": "Malware payload (Amadey)", "value": "650d61d299e7b1b22f072344253d5282f9218037d7a215c7242a1aa81336818a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396646, "uuid": "4d405fb9-ab69-43e1-8a85-514fb727cde0", "comment": "Malware payload (Amadey)", "value": "deaf20bd8cde3b502a58e7d739f4489abe64a935", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396646, "uuid": "4dc20f9d-3a24-435c-b791-3569da7b5e45", "comment": "Malware payload (Amadey)", "value": "fb16e9ab460bebac26caeda99573c968eefa347bb87e6aea962c5521d4c49842d95f988f349ca7940cbeb1f603dfc1f5", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396646, "uuid": "59b8ace9-8c78-43c4-ae53-35ffe53c40cf", "value": "T14BB59D47BC9060B6D5AE92328966A1E17A30B8850F3037D33B41A7FA1E7B7E41E7D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396646, "uuid": "d8e04879-1a60-4bf4-bbe3-c493d12b6acd", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396646, "uuid": "f6b56874-4722-4667-90b9-b4dc4ecca36b", "value": "49152:h0RhWp8QOhshlEoeoQWxx9BUiziCemagRdxjs8D1WY:mfwqWQ6xxMmNSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780396646, "uuid": "98160849-510c-45bb-942c-6da0cbb81ea3", "value": 2339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780396646, "uuid": "bad5d6b3-53d3-4e3d-811f-0f83ca3eb008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396646, "uuid": "aa7c7c9a-54c6-49a0-93cc-b4e43d11c95e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a5fbdc-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload (rtotiStealer)", "timestamp": 1780399611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399611, "uuid": "613d6544-78f9-4476-aef0-463d8e960c60", "comment": "Malware payload (rtotiStealer)", "value": "1e2af7520ed90b53f752b8c530f76388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtotiStealer", "colour": "#CB511E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399611, "uuid": "2d7a872a-c428-4477-85a8-e479d3cc4a18", "comment": "Malware payload (rtotiStealer)", "value": "654405c849cd9155b69a10a679c71704b2a6d331898efda3fd25ef26d3c7cd14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtotiStealer", "colour": "#CB511E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399611, "uuid": "e9813b15-834b-4e7c-a20b-938135fa8940", "comment": "Malware payload (rtotiStealer)", "value": "8f0475477796548153fb677b05e9753b825f1a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtotiStealer", "colour": "#CB511E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399611, "uuid": "a30c7552-7005-4b95-a0e4-8a3643238e7f", "comment": "Malware payload (rtotiStealer)", "value": "3ecd5d357f469200e178a87cf6a55cfda145f6d9843f98a5809bbceb1bde1c00b8d84bf278a6a71edab2d51374af0d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtotiStealer", "colour": "#CB511E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399611, "uuid": "d171c6d4-ac56-491d-861e-a609220bb5e2", "value": "T1D4459E4BB3B900FCC05FC1B8891A5607EBB2B40513749BDB5594896A7F23EE11ABE734", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399611, "uuid": "689a085a-3aab-47e4-9277-eac10936d377", "value": "bb0562088a38fddd2a0d9c0477b0afa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399611, "uuid": "d2941c15-54b3-4ead-ab9f-1ac68ca5bbad", "value": "24576:o5kVcrpEfkL65Cz2WVTsZlSpem+66y3LMQJtiHBisux+3sDchNy:oBl1dJVTCSpe4hLMQwssWD6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399611, "uuid": "9ce4475b-e473-4d61-8be4-54c7d42c6562", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399611, "uuid": "49caed99-fe67-437d-92a4-53aa0c3ec789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399611, "uuid": "6cdcd0c8-db24-4c3c-a94a-10096a1274dd", "value": "654405c849cd9155b69a10a679c71704b2a6d331898efda3fd25ef26d3c7cd14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4065ae2f-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "bda1900e-3f05-4e8f-a4db-65570771955c", "comment": "Malware payload (Mirai)", "value": "2afc412653b570e437de5056fc1848ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "b2fba7db-cba2-4369-a4b9-6a65acbdde1b", "comment": "Malware payload (Mirai)", "value": "6596231c11c6eb28819344670a2ead48c777f6c50dd42fb291998374ad47c38e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "4bf114c6-d30b-4200-8c81-eda457d958eb", "comment": "Malware payload (Mirai)", "value": "ade1bd9f3e7ed8524f0d1aaecf3c693c5db6deea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364521, "uuid": "bffadfd0-68db-49ad-affb-47636192360f", "comment": "Malware payload (Mirai)", "value": "777c77f18034490f1ce3bfffd928710e95e1df09c34ba58b417e919b444577b2b35691f58ed3e26f47b0170d020210c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "b4ce429b-714e-471d-8121-38d59d08d147", "value": "T1CC2161DE94D5A2A395ADCF6AB271D778900893C320EF6E48DDD8AC31C8D5D05B434B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "0ce2f9da-f521-41be-9ea2-0fb726809c9a", "value": "24:Nr+2aXD1Zo/e/PyGA3t1Tz2JNOg2FNZGe9MtKRfkz10+JtNgBvq+TSd:Nr1aXpy/e/PtAdBz2JEg2nZV+tKRfkzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364521, "uuid": "d392c485-afce-481a-ab87-1ed42ffa338a", "value": 1433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364521, "uuid": "8b9ff603-996c-4a3b-ae4f-bf1eb6e96249", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364521, "uuid": "f4411f5a-51c7-408f-b60c-368060ad26d6", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7559ff-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780382849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382849, "uuid": "1f4df8fd-5886-4065-9871-0091b2b59b57", "comment": "Malware payload", "value": "bd07def4f283a65be87ecf23c6c6f392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382849, "uuid": "4f9b45ec-8816-4260-814e-c10c9ab7a8a0", "comment": "Malware payload", "value": "65d132bfbc08910945b0392eac99a24502dd879f3e74d2df773e702ced9bf354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382849, "uuid": "5270f19a-0fdf-4c64-86da-6af8835b61b8", "comment": "Malware payload", "value": "cc78a4e092f8efd8c1e40b74798920c6e5c5d0b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382849, "uuid": "83a64613-4e0f-4f14-9b1c-59a114092778", "comment": "Malware payload", "value": "80ca99808c7501dd156592a3bb4884f87516db094f6365fcd3c9803c39169f277a8aee4b7a81dc57e1c5f2da0aa24562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382849, "uuid": "842850d6-099e-4d73-88e2-12e3b2f79fec", "value": "T1FAC5C065B3C866D9D456CA3DD714E332C1B278234BB6E0CB5A96074A0FBBDD14B3AB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382849, "uuid": "16d2d36b-4070-417a-8e4e-fbea5e244cca", "value": "1c3ef98e02a3b1528e9c725ee9347d20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382849, "uuid": "d4d4feaf-8c6b-43ed-859c-9a7efa282ad2", "value": "49152:lcSYH3RYMz63VHhNKk7uLwYGfNtPogfBV85P2EEkFvGCPUz8STHGlHhVSjd4:lcTxoVBuGfNtPogfBV85P2EEkFvGCPU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382849, "uuid": "cfdb18e5-dfef-4b4b-91f7-ceefbba8fe6f", "value": 2726912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382849, "uuid": "899990fc-2518-4ec8-a125-a6f0dc2c0eaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382849, "uuid": "6c089743-b4c4-4121-9008-d396fdc5f366", "value": "libvlc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0382486-5eaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780424436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424436, "uuid": "a6229269-a5e0-4601-8b2f-c29766e1641e", "comment": "Malware payload", "value": "17c4272f6c4c37759046d2f396addf83", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424436, "uuid": "bbab1f06-6967-4101-ac22-53ae8fa08842", "comment": "Malware payload", "value": "665598166efa71674b561fc02ca1d6e0ebfddbaf7d2b75008b71e540a5ea4158", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424436, "uuid": "b35b605f-62dd-452d-b99c-866474d46a79", "comment": "Malware payload", "value": "213b85546fa243ed37b659abe836993fe1f9af87", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424436, "uuid": "cf33fa49-0325-4363-b024-aa5b7c7e71f3", "comment": "Malware payload", "value": "8a976e965226f7e5af0b81480955be2d08ed2650f948f1a62605d4db92f452bd0c91925aefa9a7a9a53d233c10fa34c6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424436, "uuid": "0021ac56-1a4a-43d5-827d-675188e82956", "value": "T1AE329F0EE149D864FA52A83DC84543E2D24D3005CB41719F7451B97C9B819EB1BAFAFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424436, "uuid": "fc1165a5-3e68-4c9e-a4b0-335e5f2dbf53", "value": "192:Kgq11eb3UB1TOcXt+wmy4NGkmAfTmn5rDeqhtbGJCW3kZUlf0z3QQ:Kf23+4c9+57NGkmAbmn5rD7htzif0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780424436, "uuid": "1de2adb9-6d6b-497b-b2ab-7ab7217c31eb", "value": 11754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780424436, "uuid": "bf40dd66-01b9-4bd8-9cc5-d869a971fde6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424436, "uuid": "2d845384-fc15-4a20-895e-bfec17d4cccc", "value": "SecuriteInfo.com.Trojan.GenericKD.80268890.24667.10694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f5e2f1-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415245, "uuid": "46709063-3d9f-4bd7-9a24-ea18606544cc", "comment": "Malware payload", "value": "2671d486d6db55183acbfd38fc861131", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415245, "uuid": "025eaea1-6c20-4e93-9cd6-ebe5594ef863", "comment": "Malware payload", "value": "6682744c15be58e019118516b31b380c1ae0edb3afb7aeced83c0bfa453d2e3e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415245, "uuid": "53eb4eb8-a03e-4293-a840-015ae78c6ed2", "comment": "Malware payload", "value": "cd18da8527b06a2fb3ff18fe2603d33d4fd088d7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415245, "uuid": "6d6187bf-4ccd-4490-b04e-ddf3afad8dcf", "comment": "Malware payload", "value": "8720d3643e30a270bc95a1d8eda9f60d7d8da473824fe0495d346e6f9fdf5aebbcb224c9991382fee5386c03264bdaad", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415245, "uuid": "b8e4736f-d755-4f8c-84a3-1fc6e0074d29", "value": "T1A8C2E1588EDC37F119C30865889C88D2AD6114849FF6AA3D259EDC60F33C5E1F9F09A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415245, "uuid": "5a95ccf4-65f8-4a04-8966-37cf9c563559", "value": "768:q1SEOOPTzfhCdPTIaxA/8muWG3W5yaju6BYMdRV:kpOOHfhCdbLxAk7Uyaj/WMdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415245, "uuid": "220586e2-22d8-461d-b0e8-3340e2f570fc", "value": 26162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415245, "uuid": "3016c9a7-56fa-4d56-a8fd-c313c504f682", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415245, "uuid": "653e09aa-0dc7-4bfe-b1cd-74d3f2a9f5bf", "value": "pago_894557878-787876767.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e5a208-5edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780443779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443779, "uuid": "cac35ad3-2542-4588-aa4e-66c585e6defa", "comment": "Malware payload", "value": "cac3ec99494af7f419794e4273477126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443779, "uuid": "1cdd4440-0a2f-4206-b0c0-555df542d6b3", "comment": "Malware payload", "value": "676a0709a060929528bd5cb484d933629ca2a76a50be6f1e137106d7ec58a4d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443779, "uuid": "3f0f91e4-8908-4819-92e0-eaa323be227c", "comment": "Malware payload", "value": "16c9ea005113b3ac059efdd63a7de6623f3cc679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780443779, "uuid": "2b38f13a-beb2-4bf8-b0df-88dca4183ff4", "comment": "Malware payload", "value": "4622fc6b0e7036ed688b719dc48fd32bf1ba01ed26144472dc8395306747447ac1679e714b538bcfb0ac050e4de45941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443779, "uuid": "7d07b1b4-889a-4ad5-b337-2040ea6d6138", "value": "T197A633E732D84B28FE7855739D5BF386E69A36E6E6428ECE0C069978C5737D1140C123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443779, "uuid": "73c00233-52ea-4973-ad30-ad61f600195d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443779, "uuid": "fff72bb9-111b-4c9b-a371-8e3b4773eef7", "value": "196608:5YqYn44cVdpssymrsQB0q84xIeUp88zY32p5PT+B+g7GAJs:5Cnczpr0BXe8FISk41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780443779, "uuid": "1106804b-c569-468e-af44-725ac58103f0", "value": 9516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780443779, "uuid": "c8969ba2-1070-47d6-a94a-5c7381269154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780443779, "uuid": "655377ea-b252-4446-8a42-c3ee3d93baf8", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.33557.20013.25255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c570e0-5e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780413545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413545, "uuid": "95b14c49-98a5-4e92-8162-e2b5a1c7e60d", "comment": "Malware payload", "value": "2fbfc58d50032c2a1a17fd727450fc9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413545, "uuid": "e3fd2322-b4b2-4d7b-b290-acf5c96a047d", "comment": "Malware payload", "value": "6a4213a96859bb10005ede4bfd2dcf3e489e74ea131eb248cf14bd01289fbbfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413545, "uuid": "caa884e1-9ec1-49ea-b0d0-025c955be483", "comment": "Malware payload", "value": "235257f9c80a37a507b169871321fa5f8ee794f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413545, "uuid": "83f7f90a-ec22-4e0f-abbb-5d6cf882cde3", "comment": "Malware payload", "value": "5f1f5f843c5a89bb7ed149f1bd2dd77b4ee0ec1a3333c0c476c5d3683474f55939571aa0eaeff1a704f2104ea3f069b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413545, "uuid": "e3774d25-e474-4ce0-b1c0-83a79f638120", "value": "T1B8C64A07E89545A5C4F9C574CA66D263BB717C498B3123D32BA0F7282F73BD06ABA740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413545, "uuid": "5a1ab2e9-6577-4da7-bc25-9682e15b6b75", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413545, "uuid": "c007179a-cfa9-42b2-b172-25177b4058a9", "value": "98304:Bh1d9ltXiO++xDu24TIGMExWLC1dVlOhSkFvYHfE0:TXIO++xDrKlxWLC1dF0SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780413545, "uuid": "e47b1440-47de-46b1-a46b-e7dd8c7d089e", "value": 11835392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780413545, "uuid": "b57c4da4-2a7d-412f-a97b-a42bce6a5dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413545, "uuid": "16c9ba56-4825-405b-bc18-c5ed790ebab0", "value": "2fbfc58d50032c2a1a17fd727450fc9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca43ee5e-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360887, "uuid": "d194ed8f-ee43-483e-9a8a-2ef347a3a4b3", "comment": "Malware payload (Mirai)", "value": "dd908a59926119e1880d93f676fb8688", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360887, "uuid": "54257925-b489-4c8b-93c7-8f90ece65d79", "comment": "Malware payload (Mirai)", "value": "6b95f9e2a2549ce85d6f769fc1c3694319b6ed90c400bfa5e21967f39ff3507e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360887, "uuid": "d631f9a2-68dd-409e-bfea-0dcd23dfa286", "comment": "Malware payload (Mirai)", "value": "1d1af17123475b976c490ea4bcc2437b9ddf23a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360887, "uuid": "830dc98a-4300-493d-839e-77dd64e6e78a", "comment": "Malware payload (Mirai)", "value": "07e1e75a6fb6e698fd5bc192d71934e2392474c541466afbaf2d64925fe15ab153edc8992582019afcefb9455369037a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360887, "uuid": "9c7ba13f-f991-494f-91f4-5881130ef155", "value": "T1D511D6CE021292340C0D8E8C705AD81DEAD5C6F4B9949ED864EC47B5B58BF1AB289F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360887, "uuid": "f8a8c2c4-0996-475e-aa42-e7abdbe52826", "value": "24:vqkiINI92KqbV4L7ea1A8ld1yoB0gy98yHR:5iz2xbVUea1A8ld1yoB7y98yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360887, "uuid": "1101ddfc-9ac6-40ac-985c-58355b4309f7", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360887, "uuid": "5cdaabd2-1903-4f65-837e-1053e36df0e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360887, "uuid": "71bbbc18-895e-45a1-93b6-8fec65a00289", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cbaccf-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780415271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415271, "uuid": "8625a368-0ee2-43ee-adb3-7ac854657d67", "comment": "Malware payload (Formbook)", "value": "b63c0aa08e1dd7d832d5afbca7522c30", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415271, "uuid": "1f0f8cc4-b5d7-4754-9c6c-4b7a4fec7660", "comment": "Malware payload (Formbook)", "value": "6c93ad9f29b8f14a17a256aeaa9d3a11cee47a427a306b309b8a6c78d9ac34ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415271, "uuid": "27b83807-aeba-4fe0-8065-f6bc7728022e", "comment": "Malware payload (Formbook)", "value": "4ecfb18fb12fe3334553514297f35686cd5a706f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415271, "uuid": "bada5dec-edb7-47ab-8424-77d817271b6d", "comment": "Malware payload (Formbook)", "value": "684fe88af255ec67f4c9914ea77d4fe3dd0edfb62a8f6e9f8c322981b3f9e5b151dc6045d6a870bdfd676319b5c095a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415271, "uuid": "a169a09f-7941-46e3-96a7-7a6f718a9971", "value": "T18B6320B1676844487FB49D5AC4D41A7C0A06894F11C2D239A3D6ACFEFADDEE3884D4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415271, "uuid": "2fe423c4-5b28-4732-bb48-ad1d8a795c22", "value": "384:mu2yB0i0MDtUSey+ebdTHgojQd6ey50F9:mu2yBPbhUSey+AdTP4Fy6F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415271, "uuid": "a9a46320-fb0a-43f2-88bd-285e35758574", "value": 73001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415271, "uuid": "9c131a9c-75d7-4efc-8ac2-548ec2d5282e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415271, "uuid": "c8dc35c1-bc52-488b-b95a-4e9663df961b", "value": "RFQ_780236427.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425d923f-5e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780372685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372685, "uuid": "b327fee7-cce8-426b-abdc-1755ad1e0525", "comment": "Malware payload", "value": "f6c5fcdb653b035394d0128e21d7f057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372685, "uuid": "03289252-38c6-41b4-8abc-c0dbdbeec6f0", "comment": "Malware payload", "value": "6f8defe241989135944210e5dd705af7b53c158b95da34fc3ceac08d2aad4efd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372685, "uuid": "145bb117-033e-40d8-8102-1d22aff880d4", "comment": "Malware payload", "value": "5dd5fbe27d3f23d4d44d0355c959f4f8c63aef7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372685, "uuid": "83085630-571f-4f94-bb5a-5312026326ca", "comment": "Malware payload", "value": "f109d005df79b286deeebfc33f627fe8b68677cce4d5ebdf169d31de4a846f393db99a3dd658ba644f245eed84a9eeba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372685, "uuid": "e5131448-cb8a-4c9b-a214-587bc84af7a4", "value": "T1E1734A35B6791B2BC4C4A97D16FB4B64B2F5268E18A8C71E7D720F4EBB311401A132F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372685, "uuid": "f33ea782-355b-4667-a86d-346e41c40d23", "value": "768:QLNWFxefA9/HP02IJLY+sbGtgSSHkuTrzIchfaGArziiy2c/ueR2O+wBDHzQ9n:uQxem3trTbG+Hklc95Qi7FueiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780372685, "uuid": "d3123718-34ec-436a-b91d-75ae86ebda8b", "value": 75328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780372685, "uuid": "4080d8ee-448a-48ea-bb6b-e19e4d622b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372685, "uuid": "447fa177-95a0-43b8-92ff-91bc76b4db94", "value": "azsxd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec9bf59-5e51-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780383953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383953, "uuid": "f4223d1f-4367-455e-a849-d06aeedab725", "comment": "Malware payload (AgentTesla)", "value": "4fb3dd6ba2b4c5f18c229967c24fd90f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383953, "uuid": "6c341196-a74c-4f85-9da7-4d6a8d8fd7f3", "comment": "Malware payload (AgentTesla)", "value": "707a26e9f7bc1106f0d10386fcbe2ab0dbbfb8a697f7f206b574b2596b8f3154", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383953, "uuid": "eda745fc-98cb-4c6e-8a69-78ec06d3a83d", "comment": "Malware payload (AgentTesla)", "value": "fcee2478a8a56d6ebd15db2497b34bac6242e3f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383953, "uuid": "5b254313-e6d5-4775-b9b7-22c54354dd84", "comment": "Malware payload (AgentTesla)", "value": "bd0dd046ec1f3ae6e80314e9d87df7f554bc95c97539c8817c1c5a8cfcc840f7d01a23551ac27091658d0961833a959e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383953, "uuid": "d466b38d-2cd2-482b-b38b-f254be2a899d", "value": "T195D4231564508613DE794F32AB289DA6FAFA9D513CA182CB33C27F0B39793120F9E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383953, "uuid": "454e7f8a-4b17-4d0d-9b65-d61b13ba6d0b", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383953, "uuid": "a373c7ab-ca78-42cd-9743-c4f50c9e447c", "value": "12288:iiMUrvBKRpqkVRh3pQvImn1Wrxb7P3C5+k0L74FMFr0FLIKvBt2c:iiMULwp/R7FyW9Py5mL77ILIIBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383953, "uuid": "d4d244e4-ba66-4fd0-a1a7-7e41976a76de", "value": 628480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383953, "uuid": "cc3b542d-a3b0-43d7-a2d3-ac919f8eddba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383953, "uuid": "45a8fd1d-1836-48ae-8cc3-473a0a2f5a53", "value": "PO-NEWORDER-0046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e38bd-5e58-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780386927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386927, "uuid": "7978f73f-1491-4e76-aeb2-cb8ab45df7d1", "comment": "Malware payload (AgentTesla)", "value": "416f90fa0dbc69747d8f037a641c41e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386927, "uuid": "db9af886-2d6f-47d4-917b-498afea7b09c", "comment": "Malware payload (AgentTesla)", "value": "71048b3e9ddc26fdfd2938f2f96fb2670b2ee5303463da80e4795cfde31dfc15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386927, "uuid": "07a41646-d9ee-4e63-aea7-c5ec8815fa00", "comment": "Malware payload (AgentTesla)", "value": "c6c6fe700855f560a07bd8a9cb578aa57abc4aac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386927, "uuid": "1631e589-b5b0-4df6-bfd3-2eb4d47bbc21", "comment": "Malware payload (AgentTesla)", "value": "23d2762c5166ceeae997720730901eb2fece815fb7dac896f7903a1a226ab3a13d4d1a36745431231697624a40960729", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386927, "uuid": "25b90104-47e6-4531-8ef9-3a061d24430c", "value": "T134D42244B291C513E92688300E79A166BB5DFC60ACBAC76F13953FAF3B323455A0D76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386927, "uuid": "ea4728c8-1238-413f-9e0d-6aba68bfa5c8", "value": "12288:M8RX/0POO+p9iiyquwiXqDbs/mQNPHcmRXQC:MI0Pz+p9iipuwbs5umRXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780386927, "uuid": "12f1eabc-a5b5-4943-9bb2-83e13c547441", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780386927, "uuid": "a41eef6a-f1ce-46ce-9e45-78f6bc6a613c", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386927, "uuid": "261cdc56-96fd-479e-b8b3-1899d8215ea6", "value": "PO10045_2026-06-02.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eed9630-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780405777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405777, "uuid": "308773b2-5001-4b3b-89c0-8c5b4c355f9a", "comment": "Malware payload (AgentTesla)", "value": "e7798fe6b8f2624588b14fba41053068", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405777, "uuid": "7657e609-b8bc-426d-935f-8e0e54d1d847", "comment": "Malware payload (AgentTesla)", "value": "710c867f88580a724179a226f01a141ac030d155bb0bb629baa94c805374adc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405777, "uuid": "0b23a787-0ea1-4ee1-928a-3b7e49ef79b5", "comment": "Malware payload (AgentTesla)", "value": "a9eb612e87efef440c2325c5837e83cb78e64a9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405777, "uuid": "72b195e4-0be6-4b3d-ab6b-0368bc2178e5", "comment": "Malware payload (AgentTesla)", "value": "03b10cc05d0758309659c0f659bb6be3ef90a7be171ea1b03069cf5356a8d5eae5175e447fd860f4fa69ead8f3cfd642", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405777, "uuid": "cd219e7e-347c-4921-b56f-0fd23a218ba5", "value": "T13BA5AE02F3C40A79C16AE574CA578B33C2B2B9510775968F2AA5D74E1F33B925F3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405777, "uuid": "4ff9d80e-15a3-4289-a5d7-9be0d03c389d", "value": "a74aa7e3f7bface91a0c13a664c38b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405777, "uuid": "85a17b33-5198-41bc-a919-04a252df56e5", "value": "49152:8hawmRMsUbt6vMA2YPH1oQidOUrzXwgnj1SWy1e:rcsUbgid3rzggnj1SWy1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405777, "uuid": "7747e7f0-edfa-468f-9834-ab0c62f3e8ab", "value": 2172416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405777, "uuid": "5fca7728-6125-48e9-b53d-a96372ce06d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405777, "uuid": "d9d635ca-faa1-4042-8706-3f569dde2ff5", "value": "libvlc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad480b96-5e5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780387897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387897, "uuid": "c139ba67-6f01-4a15-a8d8-2ffc4e6b3e5c", "comment": "Malware payload", "value": "8c8c3b0d2b15a65640c08a8f6a34edf3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387897, "uuid": "594e642b-8d36-4650-8ae0-02d6d0a3bf9f", "comment": "Malware payload", "value": "71827f1e0195f276a387c074a828afb3a585797ed8a2acca8be95c4529baee76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387897, "uuid": "d3b7fd23-df3f-45c3-a1ea-0b95a92893b9", "comment": "Malware payload", "value": "68d9a84cb9ebe1513593000d3f18378c07f03f7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387897, "uuid": "eb22e18d-b5f1-4c9d-94ba-2722684bb68e", "comment": "Malware payload", "value": "1088502b5b497f1b9d114d12648782f38f457790cf347ab36a4d544153427093da92802bbaa98760e5b739b40dd78e33", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780387897, "uuid": "9f4992f5-11e6-4329-8ded-5f43f762cd00", "value": "T14A136D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780387897, "uuid": "eab22fb8-155a-42c5-a71b-2cb182492694", "value": "768:WXRWNGxVN9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Slxkco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780387897, "uuid": "c257282e-ae17-4d50-89f8-dd2a69ea0eac", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780387897, "uuid": "4c4d585b-c6d9-4e9c-b794-1c0fd635531a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780387897, "uuid": "3765cd0b-c2cc-4088-9ea9-c2b17cb57a9f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ca5297-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780405646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405646, "uuid": "c666e201-7810-4da9-955a-578ea51d1cd7", "comment": "Malware payload (RemcosRAT)", "value": "d5327bb1b3a918b773c754c18d04f8c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405646, "uuid": "05330c03-0b21-413f-8ee8-0fb202f1ba96", "comment": "Malware payload (RemcosRAT)", "value": "71c29304a2de3c58998e6c086e13b37dc9333b6003ceac0ff7275a11c5e8a6da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405646, "uuid": "a22d2a7e-cc72-410f-82ae-e71e8243c77b", "comment": "Malware payload (RemcosRAT)", "value": "b0f974f7ac6d6a081f6ba57de8f7a4db1cb9a882", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405646, "uuid": "f73b67b3-94b3-47ec-b020-7f430c10c209", "comment": "Malware payload (RemcosRAT)", "value": "5a8df1446eab4ac00f87e97d8819768b694d3191a51c5aa7eca6647f34e07c5cdacba3506e2afee66838c265576bbf1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405646, "uuid": "9a523c8e-55cd-42ac-8824-05d8e46b38de", "value": "T152C512DB82727D0C3200E67E142AFD94DDCD0A1B8DF2223A21F9DBD5D518539A88AF75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405646, "uuid": "7dc57e35-0966-4ab8-8cf6-07d5a07d3339", "value": "768:w33333333333333333333333333333333333333333333333333333333333333E:WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405646, "uuid": "c8b13a68-4910-4125-89fb-2ec81043bbf6", "value": 2640226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405646, "uuid": "8f43d3d6-4837-413a-b6a8-bbd2d93cf02d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405646, "uuid": "a820a157-7f17-4033-9b08-fb6d4378be1d", "value": "Order-No-J516-034.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fad091-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780405650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405650, "uuid": "be00ae6a-fd46-4e9e-968a-ff478fb48c36", "comment": "Malware payload (ValleyRAT)", "value": "ac9c01ae276bbafaf8ac8ebd33270253", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405650, "uuid": "06429889-a1b1-4347-914a-aba758a618fe", "comment": "Malware payload (ValleyRAT)", "value": "71fcb7c5b591a2459e1fb6d7ad2cb69d712dc1002efa3c275241aad8f5779594", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405650, "uuid": "2156f904-0639-415c-829e-7f10e9961c52", "comment": "Malware payload (ValleyRAT)", "value": "79791e45f64ae1f1f190ae0891766d21fb59c867", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405650, "uuid": "5551b476-64af-4628-824e-c5325495ee81", "comment": "Malware payload (ValleyRAT)", "value": "867d4b3b587b6709913c84bbce0c9780044609649f499ccf9ce7797aa268fd41cdfe04dfecc838ea891cee51f28d3be1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405650, "uuid": "706170a8-66dd-46cf-ab53-e3896a0fe49a", "value": "T1A3B5AD217387C436D56D01B3A92EFE1A643DAD7B0B3001D7B7E8795E29704C1A27EB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405650, "uuid": "da8b1417-11f2-46eb-9604-86eced0b445f", "value": "49152:8gbvc+TEanLBm/usqOVX7GpnADREFClUDxuj45G17VKFUs6KBOK:9zyXwlFC2YZgUs5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405650, "uuid": "8e5b8f07-2b79-43da-b587-9408500089fb", "value": 2475520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405650, "uuid": "ba140711-0389-4e80-8838-4958f4cbc885", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405650, "uuid": "ee623e0a-6679-471f-bc41-0378abe7d309", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfd3526-5e44-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780378580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378580, "uuid": "238556f8-574f-405a-8e1c-c9ca5feaa785", "comment": "Malware payload (Prometei)", "value": "703b6d366ec8ab84a5858b9896f530d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378580, "uuid": "e40e3441-4219-4d21-89c5-9864b18ff92a", "comment": "Malware payload (Prometei)", "value": "726c39d4e04e53ba793105882a1efa15f79d1a566fabb2092f7dc54596086264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378580, "uuid": "f35d0abe-c48f-40b6-b261-08bc2a5ee3a9", "comment": "Malware payload (Prometei)", "value": "40476e8d5e3d5ee1ef6e896f603965053ff1f4fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378580, "uuid": "8df38eda-746c-4fb5-b8d1-77df77becaa7", "comment": "Malware payload (Prometei)", "value": "8515942154b12e1ba4ffe577fc0d39d4f4769f454aaf4cf99b1ddc869702f22afc8e84c88aa7fbe6726a206f8f816b7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378580, "uuid": "2b79b231-b36c-4c48-8ae1-3acb02ddeb54", "value": "T1B9A2E866B692CD3DC8E486304447022AA5B47471EF32931BA59817F53CD3B5CCE2EB57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378580, "uuid": "5a119eb2-e8ed-4951-8122-5c270a80f9ea", "value": "192:RlyyJXpERhwyrdHITl2EwfhtCGNG1s+P7rrUz5zD0gDNddeV7pgNilsZy:NWfrdH/vjlK76t0kNM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780378580, "uuid": "3a7cfd54-e490-48b9-b1cd-20bf61870b84", "value": 22728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780378580, "uuid": "5ef8dd17-d931-49ae-89a7-827a9a538207", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378580, "uuid": "b84a5a58-bba8-489f-94e3-54f043f0092b", "value": "726c39d4e04e53ba793105882a1efa15f79d1a566fabb2092f7dc54596086264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3d4db4-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780414849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414849, "uuid": "1a854800-3a1b-47b7-b2ff-a3f8a735c3ae", "comment": "Malware payload (ACRStealer)", "value": "9a331c1e0627cf2905fa262d141fc8aa", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414849, "uuid": "73d44f5e-122d-4a7b-a7ce-1759cd95d26a", "comment": "Malware payload (ACRStealer)", "value": "72abb09c4e65fe2369c3c2e328617bb44ddc12cad24181a7e5c53169b05fb543", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414849, "uuid": "347c3d36-82a4-4767-8c75-08ae819893b3", "comment": "Malware payload (ACRStealer)", "value": "d6a949324969f81cf2c8f533882b1c5dc468e74a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414849, "uuid": "91182015-c329-4e2f-976e-b39918040aba", "comment": "Malware payload (ACRStealer)", "value": "a0862eba967b2337189cf96b4a7c488c6cb01a60b6ebfb8c4e5edb75dece8c0f2e17ff8bf285bf2b8fa4cc9a4b97469e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414849, "uuid": "87ac52cf-425c-41e6-8208-431d3675d0a2", "value": "T194D56B50AEDAD5F6D942373444E2E1AF166895077B7DFBE38934A729AC3F040092BBD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414849, "uuid": "bacf40cc-6212-44db-9177-58e1133236ee", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414849, "uuid": "e31c6379-2156-42e2-824f-fa2c7039084f", "value": "49152:thuXz+rCdsGNUitwLme+eHBCeY34Py8wYK1q1y:thuj+rCdsGeitwLmvh3zC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414849, "uuid": "6184a2d7-a7e8-47c6-ae24-55545ed71d8a", "value": 2940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414849, "uuid": "db15d0f9-7f53-4fcd-85c3-85303ccd785a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414849, "uuid": "2333ec0e-eadd-424a-bf36-5273a104593a", "value": "crz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695a8249-5e6f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780396802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396802, "uuid": "39cf38f0-e55d-45a2-b649-2d085431ecde", "comment": "Malware payload (RemcosRAT)", "value": "840429f2cf484ad87f7a90912d885e05", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396802, "uuid": "10df20b2-acf2-47e5-bfd4-313df6f69af9", "comment": "Malware payload (RemcosRAT)", "value": "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396802, "uuid": "927e7b6d-aef0-4050-a704-b07632977787", "comment": "Malware payload (RemcosRAT)", "value": "0588aabf43fbc14366ae6e820c29c90849d1c556", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396802, "uuid": "ab4fdb6e-bbc2-456a-a243-0fed58c94b9d", "comment": "Malware payload (RemcosRAT)", "value": "691fc413cbaf1c6f37b32e57319d18ec5a5d3dbe7f349dc5020605d1d6cfdff535b13285dd996f4b7a4fd219061db6fa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396802, "uuid": "32d5066c-fd46-4498-9980-cb19663ed4ad", "value": "T14E858D266B24B3AC375BE84ECCE6BD147A204D052CE3D39B1167EAC76C74A15ACD6F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396802, "uuid": "1578a52d-d684-4b07-bf96-9be04249ac6e", "value": "3072:vqPX+U6XaSZKLaw9JPYQk3dtCNHZWyz3s3wGfWvUiQAt9Cm1jZ4eJeYPMqVDTlCv:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780396802, "uuid": "e7fa9d38-5654-4b47-8e8a-a09e606f05df", "value": 1835958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780396802, "uuid": "4da18641-dedb-4bac-8212-fa08aa71f450", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396802, "uuid": "bfd0eaaf-c265-4f7d-b4e6-f173a96d5593", "value": "Draft Documents for ref 6017257934.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bf1e01-5e92-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780411805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411805, "uuid": "8facf120-3c3a-4b9d-a8a9-62e4c739e3dd", "comment": "Malware payload (NanoCore)", "value": "3250faedff07ddf2482edececa091669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411805, "uuid": "a4ac231c-6f48-43df-a746-1caae86eb6fe", "comment": "Malware payload (NanoCore)", "value": "75c53840ad4978faba4569f16386846a12198b82c8af1761aa7544b978248af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411805, "uuid": "9c0e245a-df71-4e12-854b-763a1dd28e2c", "comment": "Malware payload (NanoCore)", "value": "dd371a3509208b0dbbe4bec1a809db8138821bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411805, "uuid": "b92d1a02-8c67-456e-aa19-53def6fc1f0f", "comment": "Malware payload (NanoCore)", "value": "e77b1af38b3d1b0698e929666b85ea1808c8387fcae3e60cb3bc0e4164e160cfd47fc7c1bbbd1b5b3c077ea216aaa78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411805, "uuid": "757e3d07-67ab-40a3-beae-7266e2720181", "value": "T1BD14BF667BA88A2FE2DE857D601242139379C2E3D9C3F3DE18D465B68F663E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411805, "uuid": "5404edae-fde3-4967-afc2-28b3f9c1b908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411805, "uuid": "587c25b7-bd7b-4e3b-a302-d79bc9df4f23", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIjub8Wd2H2hdHZVLdkjQW:MLV6Bta6dtJmakIM5vfTzHTLajl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411805, "uuid": "03ed2b02-9597-47c7-8962-59fea1100f53", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411805, "uuid": "02915e65-45cc-40c0-9fb3-9567b20d33f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411805, "uuid": "06b732cc-0231-4069-9188-461a79058b8d", "value": "bluespaceproperties.in.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dbb6c9-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414085, "uuid": "bcf53883-467a-4013-a4e5-6c8803311f8f", "comment": "Malware payload", "value": "24baa532d1e0c483df060a4754595114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414085, "uuid": "924d2586-2f12-4331-b220-3a4de7dfee49", "comment": "Malware payload", "value": "795d9ded37f82d443e68ea31d77a4f8225ebf3ddff4add3669f8185793603861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414085, "uuid": "fa005757-ba60-497a-9d07-813a65154697", "comment": "Malware payload", "value": "6f02497254c1c36088999aaf89dc9d5e65905747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414085, "uuid": "af12dddb-2e84-46bf-87b4-38f4cc55adee", "comment": "Malware payload", "value": "3480ebb765268c2d3833bd29677960500401a491784df1bb396341e56bd8830d1b84d6e0e215df85a3aac102ab1138c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414085, "uuid": "c4195b14-1bbe-4317-a9d0-d43f0931d280", "value": "T168F68D47E87506E9C0A99276CA679213BA753C884F3163C36B50F7346FB6BD0AE79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414085, "uuid": "74078277-8e82-41e7-b705-c225b70dc23c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414085, "uuid": "5bb07b9b-1867-4284-9800-c74c2b1364fc", "value": "196608:t8SdPuNQf1LL6KO2xOT95EM6mEdrRuq0iu9xGku:twNQf1NOvE7mSNuq0iWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414085, "uuid": "f66c0402-5d79-4940-bc14-e4dcc5819b14", "value": 16523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414085, "uuid": "91c84637-6021-4e15-bde8-c0ee9151f590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414085, "uuid": "0fe67e8d-3dcf-4562-b3f2-86eb832630a6", "value": "24baa532d1e0c483df060a4754595114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b004ef-5eb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780425202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425202, "uuid": "f4a838ac-0a14-498f-87a5-93bfc38a75a8", "comment": "Malware payload", "value": "293ee50f323e14b1972f9d70d7c7559a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425202, "uuid": "229bc4f5-c2e9-4e6a-b098-80f02db37986", "comment": "Malware payload", "value": "7c1275b93737536b8eb0901801bcbb042d2ef9b47c310cbfedff8916679f5c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425202, "uuid": "13b21f94-1a6a-473b-aa05-b1a84dc297f5", "comment": "Malware payload", "value": "83bcbd7be78682b2ab4c5dbb8ae2da0c86735dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425202, "uuid": "4de1205c-e52a-41ee-abb0-f49edf045b3a", "comment": "Malware payload", "value": "1f2ff9e9c8308a047d6389853dc96f7afeaeec1baf89e9d6d34468c5f6cbaab056bd2c45d2fca0f6811d288141afdff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425202, "uuid": "6765a27d-a987-4e4f-8613-ea611d162299", "value": "T14A643A3E6BD862BAC37A813AC4F80186AB71B4133602EF5F258713A41E53797BD9711D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425202, "uuid": "5f124baf-6a9a-428e-a368-3798733777ce", "value": "edc8ef44e1870aad7a3e58dab17f8e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425202, "uuid": "db0e0cc6-bfb8-474c-8a98-5675cecc0851", "value": "6144:o5W/FsEJnmz9SIBV7+3Yf4r/lUq7kvpJMzV1PSqhb0B:o5W/DFmz9SIBN4rx7kh8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780425202, "uuid": "03c7d4c8-e375-4051-aa51-98b17b0e463f", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780425202, "uuid": "c5851dd3-8b44-4ded-aa98-2669cd9da068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425202, "uuid": "6c106c05-72c2-46bb-ac47-4fe3833cfc54", "value": "158.94.208.104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa4fa29-5e4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780381888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381888, "uuid": "c3b1c785-0e18-457e-a8c7-915135012779", "comment": "Malware payload (Mirai)", "value": "97a85187eb85c70807c7c028cfc1aa15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381888, "uuid": "a95a3142-7694-46ec-b103-479c8b3c3d67", "comment": "Malware payload (Mirai)", "value": "7ddd7b3502a2e1c0e1358c0752b971468b88e01e4dbfbf84d9a98e5f9630624d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381888, "uuid": "6b2d9385-7a14-44ea-af1e-37d031cb5945", "comment": "Malware payload (Mirai)", "value": "910f3d52a86a06ac2a4e8fbb012bf1f0bca4ff6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780381888, "uuid": "edd79bb8-3c71-4617-9afd-3332c73e8c9b", "comment": "Malware payload (Mirai)", "value": "46723df941bae972ef77710a112bb637db9b17a8d6bec2dc032402184f140bb1650e84a4ada06deb17287e53c60aab2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381888, "uuid": "75895fe5-e0c0-4979-980b-fa1f83ee8b5d", "value": "T1EA635DC5A653D4F1E8A206B6053BA3129F76E4374639EB87DB9539329C13F00AA1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381888, "uuid": "5775203d-3c79-4af9-b451-99d9d3d364a9", "value": "1536:ouOmHbuELEV/2guKO9kAsOPsXTVxxeJq3zn5Q/5dTw9q99e/:FOm77La/BuiAsNMJq3zC/HMsU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780381888, "uuid": "35539090-5006-4164-b28e-825d5178c3bc", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780381888, "uuid": "b88a123d-417c-4d02-bb9f-74dbdb4ccf1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780381888, "uuid": "4e848aba-8e9b-4dcd-b4ba-91467f470eec", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1157e6ca-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780405674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405674, "uuid": "dc343060-8524-4233-b20a-006a5b86d195", "comment": "Malware payload (Formbook)", "value": "d36c5e773a5a98774800e4f4f42d384a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405674, "uuid": "6734907c-a614-4a13-b603-cbd4b1b55483", "comment": "Malware payload (Formbook)", "value": "7e3a341ae5457e72407140502cf99c7bd4e2d8f74f8ee7d1063385c454d512b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405674, "uuid": "579af6bf-4bb5-416d-a903-ee2168521f1c", "comment": "Malware payload (Formbook)", "value": "3788f24b77c5c9581d7d1b614886bddbe06a09d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405674, "uuid": "b593a516-dc35-44c7-9ff7-03540b3f7c4f", "comment": "Malware payload (Formbook)", "value": "d2c99e0292caa3df974b395165c37d296761c0355c71ca88a5df6a30a689d002a8fc4260ed02096f0ecff894502c6f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405674, "uuid": "1bf0c832-1780-4341-8e06-ea22f94033e8", "value": "T1BA45E0D037A99B08EDB96B359975DE7412763D28B431F24E16C83B5F797A3029C08F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405674, "uuid": "49316923-d698-4734-a416-31d279cda223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405674, "uuid": "29db59fb-3323-4dcf-a5f7-9eb587924089", "value": "24576:A60iNuzvi+8LoEMs5DXMUxt+AyOfQapVzhhy:A60iALiXl5DXMu/VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405674, "uuid": "51e7396e-2afb-4d03-962a-57122c279059", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405674, "uuid": "766358d6-eadb-4a9e-98ab-fd65bbe8d3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405674, "uuid": "e8f1e0c2-5002-40c3-abd2-38ba82b711a0", "value": "PM-H24008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ab6fa2-5eb1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780425326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425326, "uuid": "343d02ac-4c26-4e1a-b4e7-e294242a02d8", "comment": "Malware payload (RemusStealer)", "value": "3b5d5b3387c6fed59ca7f0c6b9363f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425326, "uuid": "c55b4a1a-bc1b-4a12-84ff-7ec06376a0a5", "comment": "Malware payload (RemusStealer)", "value": "813aeb7a3cac0a916501d370ad1f350a56b4bb36835f52b3cc92d624da728674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425326, "uuid": "33446ed4-0aab-4954-aa02-ace52a79501e", "comment": "Malware payload (RemusStealer)", "value": "259bc6818fd02ac18248f6c652c764743f913efd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425326, "uuid": "b61d3dcf-ccb3-40e6-a053-147f41c46235", "comment": "Malware payload (RemusStealer)", "value": "1badf7ea32da0b1410ecfa002fe04edae0ef9858b395d6b033f1a39f2926fb39c1c140bc886a5e55262d59b48c5c4342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425326, "uuid": "6bfcc22b-3182-4c19-9c78-7678c6374b20", "value": "T10A855B42BC9420B6D9EA923289B552917B70B8490F3137C72F55B3B92F737E84E35398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425326, "uuid": "93e4b89f-50ac-471d-81dc-f1836b194812", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425326, "uuid": "41d6dffb-badc-4604-92ae-50e100e77ab1", "value": "24576:gGKqELW6QFrSRRltJf2yds9eFpP2BaZgRAbTKVkD1Pr4S:gxqgW6or8UoFpPvZgRAbukD1jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780425326, "uuid": "d118b5c4-580b-410e-a8cd-b5adce8efbd9", "value": 1778816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780425326, "uuid": "6d0dda24-248b-4829-98e3-95290b5c835a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425326, "uuid": "957b8397-d5cc-4a88-9c12-1fd0fd3d967b", "value": "\u0412\u043e\u043estr\u0430\u0440\u0440\u0435r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28ca206-5ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780431285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431285, "uuid": "cb5a4ae6-0665-46c7-82ea-e3f551f34790", "comment": "Malware payload", "value": "cc704a6b5a986d417aa97e9b6889efac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431285, "uuid": "6bffd98a-7245-4a0a-8cd8-466fb8871118", "comment": "Malware payload", "value": "816730256c97e19572ce424f1d3064eb09e57485c11e170d523d18950cffeabf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431285, "uuid": "f3232342-d27a-407c-8917-d49b0e848dee", "comment": "Malware payload", "value": "65ad831aa1be455fca57959c63ed2ce4120d7a36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431285, "uuid": "07429be7-46ef-4538-b9f8-a1f11695b3bf", "comment": "Malware payload", "value": "1313f4669dec054911247a7f19f9b622d3739f430d5fdbe52446bbc2f08a1c5362aa7b5142239a620d1147de1d251c91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431285, "uuid": "ba97db62-4e42-4618-802a-5076fc4ec1cb", "value": "T18E136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431285, "uuid": "901a871b-78e1-4894-9400-0f473ac38ed9", "value": "768:WXRWNGxVJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Slxwco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780431285, "uuid": "717ecce8-f13e-423e-a326-8c35e929a6f2", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780431285, "uuid": "eb6e98b3-e8c8-4b91-bd38-6db4fffba154", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431285, "uuid": "dda08e11-a6e6-4015-b115-2e54c30c8820", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813d2b2d-5ec0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780431632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431632, "uuid": "938456f3-4234-4d49-b8e4-e6402a5eb4bb", "comment": "Malware payload (Mirai)", "value": "78680ae365d251804eeaeef85a69c5ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431632, "uuid": "8453a739-2dd7-4876-b762-bb5ad95e7bb5", "comment": "Malware payload (Mirai)", "value": "81f2397f3d5676b7aef66780c1d667c68e325b15b25a32a3702bacd86f47b7b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431632, "uuid": "01f8d1e6-1d9e-4ff4-bdeb-ceeb08d6f16c", "comment": "Malware payload (Mirai)", "value": "822de80352fdeb904114f8aa689fe11a18843ec6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780431632, "uuid": "71c8caab-9482-449f-b206-5d8609b48eb9", "comment": "Malware payload (Mirai)", "value": "608a43ff8135883f1b6fce3556da4d6e979383b195fc190e16524b87abf18848cf3ae31be145e687387f8f98953f47aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431632, "uuid": "f1e02d07-79cc-4027-98ff-a672e55404af", "value": "T15CD3D70F6E618F6DF369873447B77E31A79833C627E1D645D16CE6101E2028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431632, "uuid": "85a92401-f7b3-43a4-ad39-c5267b182d58", "value": "1536:2rCze/ONPXox06ZpB5svt6aSjqllcp9TTWL0RGX1+nOecnSg7YlWFmp:c/ONQp4UzjvpxTWL0Rsis7lmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780431632, "uuid": "8c4bcff4-3db0-4323-aee4-51ebc740751d", "value": 134640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780431632, "uuid": "e8f1b01e-7182-4d82-bea9-14e389a61f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780431632, "uuid": "4a091354-6cd9-46e9-bf5e-ea160b0852e4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8377fb-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload (DeepSideRAT)", "timestamp": 1780399624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399624, "uuid": "39db7cc2-ec93-4f90-9676-2dc5d76e6d6c", "comment": "Malware payload (DeepSideRAT)", "value": "5f1876605dfffbfdb5b18abddf0c89ed", "object_relation": "md5", "Tag": [ { "name": "DeepSideRAT", "colour": "#4739CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399624, "uuid": "a51410e1-8102-4200-a6ad-d6e6ba30b8dd", "comment": "Malware payload (DeepSideRAT)", "value": "823fa920b249f3813a43a4f59f07a28e1f400dcbb2ca43d147de5aa89e779a8f", "object_relation": "sha256", "Tag": [ { "name": "DeepSideRAT", "colour": "#4739CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399624, "uuid": "31fadc98-98fd-4f09-81ad-f278ad51b27f", "comment": "Malware payload (DeepSideRAT)", "value": "a384b54195fdbf40c42a6b840ab73e6ed3165cb0", "object_relation": "sha1", "Tag": [ { "name": "DeepSideRAT", "colour": "#4739CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399624, "uuid": "651f54cc-0249-4a41-a788-2d4fdb637b5e", "comment": "Malware payload (DeepSideRAT)", "value": "59d8222c64811beb6dec75c0ed9906ccc33027438fe46f63eb91b9dbef8b613b88b9049b3b4c5d3d7e194be36397632f", "object_relation": "sha3-384", "Tag": [ { "name": "DeepSideRAT", "colour": "#4739CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399624, "uuid": "43282f0b-2dd2-4e47-b16b-ee362a24ba71", "value": "T125758E17F2B800EDD067C2B9C9566A03EB71B4451B346BDF16D08A696F23EE11E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399624, "uuid": "188535f6-00c0-4595-8ddf-fe86c803039d", "value": "a740888c58f4d48ab8d0fb971cda201e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399624, "uuid": "15e4bddb-210e-4213-818b-42c6095ecb25", "value": "24576:dpdhsgp/dUgJMjTPrkE2Iu7duiuEd1RRHVd+ooxF2uVlkDPSJI:dpd6g/Va3rOIuDuqRp+pTVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399624, "uuid": "f6e7c53d-8e72-44c0-90c7-c1f12e481a0f", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399624, "uuid": "8f8363a4-d59b-4387-9db5-4bb3c14e2b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399624, "uuid": "463d0ab3-2055-41eb-ae77-1bfea234de18", "value": "823fa920b249f3813a43a4f59f07a28e1f400dcbb2ca43d147de5aa89e779a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec346f60-5e8c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780409477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409477, "uuid": "f487c811-3517-447c-9085-2de7532f851c", "comment": "Malware payload (RemcosRAT)", "value": "83976a086d1e9dbb6d2e357627e77727", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409477, "uuid": "9ad4372d-93f4-406a-849b-5b3c0c3b003f", "comment": "Malware payload (RemcosRAT)", "value": "827b155806cb5c7a61c8bee24eb8fdc8b39d098f80a1c34edfef9020bfc41f0d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409477, "uuid": "6a8849ba-f567-4e03-b846-622862c867a9", "comment": "Malware payload (RemcosRAT)", "value": "5d6450ee01cfce33d3acf4155ec47cda2c9cc451", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409477, "uuid": "ccc588f9-42e7-4de8-b152-ce2bdaf84213", "comment": "Malware payload (RemcosRAT)", "value": "07f5a545c4bde37415d8f697997dc1525d46a305ad774477dd2e4a624a097e488dd3271f5ea7cee1f52548cdea4bad85", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409477, "uuid": "1a4c653c-56ee-45b1-b0b7-35282f6ce2b5", "value": "T14F841222B516B347C9AF577105E0EBFB7349BC45AB6863573050738C1AB27C3E81A4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409477, "uuid": "53e1378f-104d-489a-a91c-b9ffb503c851", "value": "12288:cu51KnyUqeWzrkUcyM1Dvs9Bu51KnyUqeWzrkUcyM1Dvs9k1Fymuf:cuKyU40bauKyU40bF3Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780409477, "uuid": "4e69455f-409b-40b6-ad3e-8afa52af9651", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780409477, "uuid": "fa0923ee-b7df-4642-9a9b-9d9dd73c9863", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409477, "uuid": "8ee34575-a0b2-40a1-82b1-11a43b0bde95", "value": "Orden No. 5700080331.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a4318b-5e5d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780389310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389310, "uuid": "f7860ccf-5b4c-4f64-915d-d6b5068878ee", "comment": "Malware payload (NanoCore)", "value": "492ebb55789ba03d4e1effdc45fc0264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389310, "uuid": "4135f34d-192d-4db4-a8aa-701fa5c028ac", "comment": "Malware payload (NanoCore)", "value": "8316795c025f8ea8c1d65c1c791aa39c15d73191fc2e39fc59d3b78f50cc3792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389310, "uuid": "0484a61f-fc39-4a29-80e2-1970dafc169d", "comment": "Malware payload (NanoCore)", "value": "2b8024f5b86d9ce390b7d3f38f5df5332d0c0a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389310, "uuid": "a8dad1ba-0f4f-4389-bb35-cdfa3ceb6c60", "comment": "Malware payload (NanoCore)", "value": "104ab885d435eaa37c8048a5183f58c0f44ef4c865b9b6e5612d6b401c268bdcf80e3c135cd03518ac2a2b4e89c97dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389310, "uuid": "fa96df37-53e1-4e13-b1b7-0d7a9049b19b", "value": "T18714CF157BB84A2EE2DE8679612202179378C2E3EDC3F3DA68D454B75F267E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389310, "uuid": "67e4d324-44a9-413f-b473-364e39fb54ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389310, "uuid": "3733d93f-ad69-4a4c-a90f-f06f6777d1a9", "value": "6144:sLV6Bta6dtJmakIM5TplNzULgm7SB7e+7:sLV6Btpmkozcb87ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780389310, "uuid": "65fffdb1-3f2a-4b7d-8464-b27624a986c4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780389310, "uuid": "f38b7348-9463-4fec-ba36-e58e0a79b405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389310, "uuid": "a681218d-1f14-460c-9233-3bec35e4c878", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74aa8c47-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415290, "uuid": "29d89c4d-76c6-4f78-8b21-6aa897e25a33", "comment": "Malware payload", "value": "d6477d9ba7a40c6deeaf0aef9ff372cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415290, "uuid": "06cceb6b-8fbe-4805-a3cb-ba222ce0d997", "comment": "Malware payload", "value": "83f2db1181db66925720fa42b738ae21d3735b78c9f24daf97a9424eca7e5caf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415290, "uuid": "f466113c-844b-456e-ab92-33a878b51c13", "comment": "Malware payload", "value": "bd0f295b5b9779c1962292093855aa16b23d6b92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415290, "uuid": "ed5622b5-c5b1-41c3-8faa-c43e33767045", "comment": "Malware payload", "value": "65985cdece53a6d9b9bbc0b55d368a517d4b917dfa7cd9ee69b946d8e46becee88a26c7858826f9fb37a06087d5e6188", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415290, "uuid": "553d3fec-bdec-411d-845d-f4499095cc5e", "value": "T125E5A7D25201BB65F6523567DA1CE4A1E3D8EEC7927C1F3E32D920408CA8B79A35F835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415290, "uuid": "6309a234-f15f-4a2a-8b4c-354349b4f372", "value": "96:Lbv+dsbPbn3ZV4aJTNfigrSVrzRsP+Av3e7hYyW0NVz7V2x5Zaxmt3hBR7m8fhND:rQ07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415290, "uuid": "5a46894f-6dba-4417-a0ef-f4483c1bc867", "value": 3114194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415290, "uuid": "a1cff025-5d4f-44f2-b83f-17200596320d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415290, "uuid": "9a59971e-98e5-4ffe-84b3-e449e91472ac", "value": "TRANSFERENCIA-23689890978856.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23394865-5e22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780363613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363613, "uuid": "f150330b-a6c2-4ed1-9858-14fbcff5748e", "comment": "Malware payload", "value": "3fcd68d1177be4f73d9f27d4e883b13c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363613, "uuid": "8b6ba56e-ef98-4c1d-a054-633355312def", "comment": "Malware payload", "value": "8561c900bf144fcdf512eefa9cdb8c7c22b1ff4007707a242c1d3f1b332cd558", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363613, "uuid": "50153a59-99d8-40b2-85b7-704e6850d4a6", "comment": "Malware payload", "value": "41cdfef2ea0f16a404792c9b85030142fdf6e3c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363613, "uuid": "470401d0-45ba-460c-8ca8-63f4a0207dcf", "comment": "Malware payload", "value": "f944fc7ac15cf1e76b9b353114672d3c57bb0a2beb481459e0be16943acd2e64a01d0df777a95eb7d8e927672ab380c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780363613, "uuid": "4ee62482-debb-470d-85c0-496e6826adbe", "value": "T13D01AFC9C111D75080C9E85EA2E772807411C3CF65864BA87F8C843D9BA97487159F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780363613, "uuid": "99a5a607-da41-4d7c-9438-31a3aa57b4bb", "value": "24:kXCKysE2hi0ziQvZohaKIlotevsNPZjVA7:e9Qp+MsKIloo0NPZj27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780363613, "uuid": "e6ff8b0f-b751-4090-b852-ca86d3fa33f9", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780363613, "uuid": "6e0eeffc-06a1-4443-80f9-654b7c480eb9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780363613, "uuid": "4cc69ea6-5c3a-449a-bdbd-8a8866afd036", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760f99dc-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415292, "uuid": "fdbf32a8-d0fe-41f5-8d58-6730205c7253", "comment": "Malware payload", "value": "c5e47e4d9c1d944a79014e2b1fa62384", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415292, "uuid": "a0c06353-6cfb-4efa-801b-5f3e2d3024da", "comment": "Malware payload", "value": "8918151f86687bf6dcd6962b05fe94d4a48c400d89cfdee172d8ee70f06c3403", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415292, "uuid": "f6a29c43-f10c-435c-b498-3dc0886d9ba6", "comment": "Malware payload", "value": "6dd583daa12f79a828ceff743a387ea2abced289", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415292, "uuid": "7718a4be-daaa-4105-b22f-f1b85ed30461", "comment": "Malware payload", "value": "49eb6223af0437c5d749dfa7bf9b641bb1a8849fa520dd7300a41e11594bff8eeb499c8fdda977ecd52ab3ee0cb89e6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415292, "uuid": "7d80b6b7-e147-4e35-a3aa-fa73a6be3516", "value": "T12B05393CCC58412FE476C928C69A486FF4D11617622CE94710C73B5FAE73A86B7A326D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415292, "uuid": "e7d5c1e4-8859-4fc9-a657-911f65a58e95", "value": "3072:qmzHrRznCviA328QXSw/U62OUiqjNnBe9yYt5sSURwyAlziPZU40GhvueKUrSsWh:Cs/UOUiq2yjw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415292, "uuid": "87b5e275-c8de-4a53-9f88-e9648a5c90a3", "value": 806008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415292, "uuid": "187cd904-7599-4ec9-9d61-d3a36633ebb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415292, "uuid": "705ab2c3-fbe0-48eb-8546-49ece8e99d33", "value": "REQ_For_Payment_Invoice__FER9079900530981016230-800119_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36cd3d2-5e7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780402161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402161, "uuid": "8a6aad16-5359-47fe-a0cf-32b311df8609", "comment": "Malware payload", "value": "0366ff9a7e9703ab107857cc60dce1e4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402161, "uuid": "a02df924-899d-4993-92d0-e1184aebcc07", "comment": "Malware payload", "value": "8bd2f1bb6e7ddbfa6c86bd21f109ef46c634cafbb0e80c84d19fe8b5dc7d9c7d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402161, "uuid": "e5fcba36-3363-42fa-a144-c8ecbc445ef6", "comment": "Malware payload", "value": "18ebb56bba29a4c7ed99b23f3b2c4b9708161c18", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780402161, "uuid": "03199a50-0b34-4e17-af04-b2aaa6799581", "comment": "Malware payload", "value": "7d952aa473abca392c6bd54ec8dc8b23febba5e7ee2cc3f7c3a6411f81c20c1ff4e0be3e47324539fd3cb525c24d7f89", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402161, "uuid": "f07dea7b-16db-498f-8705-eaa438d1a52f", "value": "T100D63369398204859AA901AB74E84FE1B33420743B5CC44178A7D796FA776EDCF8BC73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402161, "uuid": "3d5cbc64-27ca-4972-9b42-5a0bbc6b5226", "value": "196608:0vMOTNCMYihTY46BSL+Cb+270F+onNI1SPVFl3txQjaipthuFh36vhoHe:M8MYilYaXb+C0F+EI1uFJtxjmUhqo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780402161, "uuid": "bc4285fd-05b3-4b18-bd4f-c721664158d4", "value": 13089395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780402161, "uuid": "dd6f08b9-b83d-4e21-96f6-1ede2fe40bd3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780402161, "uuid": "97ee86a1-4369-443b-bf40-ed225b543b1c", "value": "Spisok_na_peremeshcenie_proekt_prikaza.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aac0af-5e55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780385710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385710, "uuid": "c8328928-f049-48e1-b22b-4bedbfbdcda3", "comment": "Malware payload", "value": "bc9c77eed42680f1b71ddd3eff75bfba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385710, "uuid": "8edd677f-ee46-43fd-ae46-ba2fa42731b9", "comment": "Malware payload", "value": "8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385710, "uuid": "eddbd390-c590-4a10-92ac-7db99a459e1f", "comment": "Malware payload", "value": "78972c3038b4be9a1d89e97317ff400b47ff3890", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385710, "uuid": "55dac537-588e-4100-b810-b29146afa1d9", "comment": "Malware payload", "value": "32f299c9a5d90b0990ac2b178e546d1c00e8944dc2a151d5302dad71038e05b622d7a2dac1bb88f1a9e08168514dc63f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385710, "uuid": "99cba175-4efd-4800-b967-389a2bda18b0", "value": "T1DC01EFCFC001CB90C1D6F49C32C75584F821C3CB25168BB4BEAC443D8BE6A58B066F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385710, "uuid": "50201da5-d204-48e5-8a53-3a01d48c8c11", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaiIS5IDNn/nc1I8OIxcFIsTX:kXCKysE2hi0ziQvZohaiRG/c1Oq+PTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780385710, "uuid": "9c8b5a29-d81e-47a0-b4f5-539f46f2d17f", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780385710, "uuid": "ebc1c084-9225-4975-877c-44191ec1e068", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385710, "uuid": "c45bb94a-fc00-4614-b67a-848624294575", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a9b1a7-5e91-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780411448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411448, "uuid": "c1a5bd20-ca77-4303-b975-7179d789bb32", "comment": "Malware payload (SilentNet)", "value": "eb7b1d831cec0b6bbdfd02d98d20b33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411448, "uuid": "1b1f754c-d9ea-4175-a8fb-84b28ab9ac57", "comment": "Malware payload (SilentNet)", "value": "8ebfa90ecbfeb5d095a5bf131a7c453b9e92bab752ad2b98743d2d9150e13292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411448, "uuid": "4f01a49d-e20c-4ef0-b483-215e683b1092", "comment": "Malware payload (SilentNet)", "value": "ffda28ba241ae415383a190ee60de20f8db4da8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411448, "uuid": "6c6bdfb9-35d7-4d4d-91af-b2e44e7a72f2", "comment": "Malware payload (SilentNet)", "value": "bfbeb813cccfd70aa7e6c8ed535382596dbf824ada6f5dae2ba2c950f922b3a15b75c2b1b40ac3ca2ceedd16dad1fa1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411448, "uuid": "1c39eff2-bf17-4e86-9ce9-d61823abd70d", "value": "T19F357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411448, "uuid": "089e2b7d-1441-4ac9-b330-c11d1c584d9f", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411448, "uuid": "57ed8add-9ff9-4854-8f57-db6b18389a91", "value": "12288:BZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGpvPqItNquB:Bcb4M06WpoPrwqvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411448, "uuid": "601d3744-3d70-4e50-9956-c58bb9347fbe", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411448, "uuid": "c2e35a79-e3f2-4b27-ac94-436a4881c260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411448, "uuid": "ce26403c-26ec-4c57-a573-808fbaced518", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438deda5-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414778, "uuid": "9eccbf7e-f40d-4e59-95ea-2e37cffe2b45", "comment": "Malware payload", "value": "d124ae92bd435a73a2587ef45669fe30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414778, "uuid": "a4338b24-2261-4edd-8828-cb055322dbf1", "comment": "Malware payload", "value": "8f924cf70da38face250e4058a559a05785d189713959390c31ac8ffd9c81650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414778, "uuid": "c102d939-c43e-42ae-809e-58642b14558e", "comment": "Malware payload", "value": "1985783cbfff1c62c0e59d67bef03e5d636a90cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414778, "uuid": "78e79900-df47-41fe-80ee-e0c4ee5c9a5a", "comment": "Malware payload", "value": "fdbf068d95d90fb664312ca69ae8b75b35e87deb7520e552258dc7ce417ddf5bf141f194c8209edee42d262ee64bf358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414778, "uuid": "9f58a46c-8aa7-4bf3-be14-4f4b0466a993", "value": "T173C5D01AA3B401FCD0B7D2B4CE579907DBB2F8061235969F03D189A62F63B619E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414778, "uuid": "d90668c9-f764-440a-8a07-0759bccc5a97", "value": "7d2bd09ae9d9b74185a09a128003b5c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414778, "uuid": "57cda5ba-d9c7-4fdf-80fa-7d895c8ecca8", "value": "49152:8V8J7Ih1Ie7SjpbAHzhUEdG5CYUzDC0QOu/rU:J/jbA7gAvxeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414778, "uuid": "fea7c2cd-ba98-43b3-803b-75f708554aa5", "value": 2576582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414778, "uuid": "777a5f2c-498f-4d74-879c-fb72e4df039e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414778, "uuid": "6e45af4c-6ad3-4265-902d-2f3f45ef6ca5", "value": "d124ae92bd435a73a2587ef45669fe30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2274813f-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780405703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405703, "uuid": "4a89d047-d5fd-45c6-a4a0-2608d1c229fa", "comment": "Malware payload (ValleyRAT)", "value": "684e3065127fa3939b9749914c9d90ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405703, "uuid": "ae4106e7-db04-40c1-b117-9c57735d09a5", "comment": "Malware payload (ValleyRAT)", "value": "911fbdf248eba7f0cb54e8bb124a4f6bd9299288b9c2d6da72ec34815bc35a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405703, "uuid": "68c5d3b8-6102-4c12-a5ba-01b372334b2d", "comment": "Malware payload (ValleyRAT)", "value": "ead0c0fab80685624e7b05996f57aaab3467b1fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405703, "uuid": "3a21b964-3c7d-426a-b04c-06a5b2a565ca", "comment": "Malware payload (ValleyRAT)", "value": "87d66499c89d5dafd9541e58fe98eeb1248e58050bcbedb60e6dbe9bddae91d4a04dcb9a74fa807676c6a57285331336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405703, "uuid": "9f7123b2-db17-457e-bea3-a9ded97c305d", "value": "T1F0958C06B66541FCC09BD278C61A5657E7B17C86172097CF1290BAA62F73BE21F7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405703, "uuid": "429cd3ea-85e9-4e4f-badd-45c7707a9d1e", "value": "49ea913537e8846d169d32fce7302ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405703, "uuid": "442fef0b-e134-4f3f-aa2e-455295a61ad6", "value": "49152:7/7E4O8OBQOH7D1dCKAJg6PwcVPPbL7MyTt:7AJ9Sgcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405703, "uuid": "d8d105b1-32d9-42c2-9a10-c269497b32cf", "value": 1941448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405703, "uuid": "c28be411-995d-48bc-b518-794a8a1c186a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405703, "uuid": "c6de71e7-5603-4e23-8d6c-eb02851d3bfb", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6858d82-5e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780413655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413655, "uuid": "6e6ef7a3-c671-469b-b37d-a209db997b3c", "comment": "Malware payload", "value": "b70c9197ace587359d59035b4e1b2ecc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413655, "uuid": "666751f9-4f98-44f8-ba3a-94601cf46db5", "comment": "Malware payload", "value": "918eb87af81e92709d872621ea8ed0c086e38fbdf48a5e5ebdcab190f41bd07b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413655, "uuid": "ee51e5aa-2338-4c91-86b5-45ef5a0ca51b", "comment": "Malware payload", "value": "891f5b0667e269610547aee06828b9fb3cca1a69", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780413655, "uuid": "ea0d10d8-1424-4370-923f-8b8ab75ff099", "comment": "Malware payload", "value": "79af342fea6ed83c1070daf2328a2c9e871313531ae473e813bdd12061a5d4c6892a1658aa1ec47bc841ead37ca1c2ce", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413655, "uuid": "6a977d1f-2f36-442a-b647-406d02ae02c2", "value": "T15217D043F149483EEDBAA434564F8331E9257C49831696EB6608FA343DB3AE44F2D7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413655, "uuid": "e70d51de-15fc-43af-9f0d-42ece9ecef30", "value": "196608:KDw8fC609eCRC++ksxtfR/F6IF+wdj9eETfrMmJ/8j/EQfAcNWD/0SSUZowAE/:KlC609V7+pXDB+ueqDW2D7Sg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780413655, "uuid": "5503254c-4fce-49a0-a05e-45cbceafc4a0", "value": 19192343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780413655, "uuid": "53a8487d-33a7-47b8-b731-d11656a820c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780413655, "uuid": "f8b5dba7-1865-41f7-9bbe-99251c51d22f", "value": "inat-box-v15.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6445a7b8-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415262, "uuid": "0908319d-1baa-47da-a0d0-b8d4c0a1e4ff", "comment": "Malware payload", "value": "cec789613f63fe1c31682af255f83870", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415262, "uuid": "1d95ebb2-408c-44b2-92d6-09812e770334", "comment": "Malware payload", "value": "91b93a603eae1ac06c7e65cf5189c34ea8848b19f4b3890156cc5240f8b22f92", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415262, "uuid": "117e8df4-87bf-4ef5-a284-685a8f376ae4", "comment": "Malware payload", "value": "4520a319ef33cf69734c17cd2f3f09ea05741cfe", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415262, "uuid": "de632478-0c93-4d52-af1a-1d841381cf2b", "comment": "Malware payload", "value": "517b4de4d34769b7adafd04652aecd0469c74318e66cf61b1e472908a98a10920ef0449cdeb082f3c77ca41efb4756d0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415262, "uuid": "3ad9bf8a-b4e4-4ae4-a2a9-dee816a41c3f", "value": "T182F2F1AD9DD00C7483DD216279EB8B08BF2871387903C16E71DED8D16B1393462EA62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415262, "uuid": "398357c9-fd32-4a51-ae83-1cd112bc44c7", "value": "768:bZDjckBaPiZqXuZxM9Ab/iDCYzVXmQCpn4XhDOgesYlI36p5:lDYwaP/CxMqb/jqcWxCgesYq32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415262, "uuid": "560feed1-fbf5-41f8-a637-3c792fb5cc63", "value": 36879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415262, "uuid": "dca02187-0328-4f90-816f-c1297129cefe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415262, "uuid": "163a8082-94d6-40ab-8b1d-b167853bc8ad", "value": "TRANSFERENCIA-23689890978856.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890cbd77-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414035, "uuid": "3312f207-322d-41d5-b5aa-2826d1e4a483", "comment": "Malware payload", "value": "016a8790d44d97a57a0edb0a31cdea51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414035, "uuid": "ceb1cde0-ca12-4378-88ce-7e39721bbdbf", "comment": "Malware payload", "value": "94fd617f2959f91be80a2b661d8202313fe78aa4975becf6d74aa7219b91a013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414035, "uuid": "7e39b39b-53ac-4643-820d-4d242004f712", "comment": "Malware payload", "value": "3cdf9e5b7827a31d3558dae5f8565501872e2ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414035, "uuid": "9e8ac906-abcc-4fb7-bede-cb91b6110482", "comment": "Malware payload", "value": "dbc51ac250366f9616d03cf90287b89aa4779c7c5ec5492ba70833307823600d46675a9e48047f8a832920293d812d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414035, "uuid": "d105c411-4132-4449-bb9d-5a4c37496b6e", "value": "T1EDA68C03FC5559E9C1A9A23489A39252BB717C495B3227E32B90F7382F77BD06DB9304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414035, "uuid": "54f0a2cb-12f5-4e2a-882f-0b8983d02a3b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414035, "uuid": "4fa2fba8-4cd8-4108-a4ab-80f3997f1f64", "value": "98304:8gXEdK/sdH3AXSQESgwqMEEbpXE7Bi0iWZsey9zzu6YakXm9Bo:8+/8H3yEzRElU7Bi0zseOzuta4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414035, "uuid": "3b5699d9-6686-4dfe-a2c8-31ccb88007d1", "value": 9924608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414035, "uuid": "117a6b2b-d22b-4e8c-adac-75c41d3eba36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414035, "uuid": "62e6fe0b-8985-4348-b8e8-a8d25b3e9749", "value": "016a8790d44d97a57a0edb0a31cdea51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd5a068-5e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369725, "uuid": "7e02b354-9676-44ce-b1ce-ee29bb02d5b0", "comment": "Malware payload (Prometei)", "value": "b9600aa5866e3e0407f896298ccdd067", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369725, "uuid": "97fd71b2-0234-4c21-b84a-9b1a6cc6f880", "comment": "Malware payload (Prometei)", "value": "99ac78541bb555b05a2c82d6c191d62e639b9fefd26ddee1f813b79cc6baf4f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369725, "uuid": "1ac47935-be66-4c4f-b7b3-3dd94ae8e46b", "comment": "Malware payload (Prometei)", "value": "a512a06d33133e64cafbb233f2c62aa87599a858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369725, "uuid": "557d21de-7efd-437c-93c7-2bc453967e91", "comment": "Malware payload (Prometei)", "value": "6e7b24cbb42032297c5fe88d53a98e5ac568ae1748bf0c9efb89ffa0f49f3c8240b097475ef9314b261cdd7f41a98cf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369725, "uuid": "ae85668e-7f22-4bf9-846e-c2dfe1fad260", "value": "T146A3850F3E554FBDFB6E873847B75E369245239626E2C140D15CE9002F6424EB81FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369725, "uuid": "3de493ca-b701-4295-b527-678f51939598", "value": "1536:uoZm1d9O9hdZIzHcUhFtYyrBSevws8dR+DHxJFc5RNN89byVmmYvClDomUsV:uoH9h07bSevw9lmmYvClDdUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369725, "uuid": "83baa37b-a926-4411-b7ff-f1b4d00225d6", "value": 99228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369725, "uuid": "a400e28a-ed4c-44b3-8001-95da10cebd02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369725, "uuid": "5b7519f0-bff8-475a-a7b3-52b92dc229db", "value": "99ac78541bb555b05a2c82d6c191d62e639b9fefd26ddee1f813b79cc6baf4f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71aa9c67-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780415285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415285, "uuid": "6852fdaf-c582-4798-b858-979b36c7712b", "comment": "Malware payload (PhantomStealer)", "value": "b044ebb3470402de7815dd86fad66980", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415285, "uuid": "e4fcd863-60fd-481f-a669-8623797e5c0a", "comment": "Malware payload (PhantomStealer)", "value": "99c735acbaf69a379b8ed0e8ead17d961e316a17a3d69063b59179b48eb8bdb7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415285, "uuid": "5de457b5-ac5c-4bb1-8f49-6d31f93d0aad", "comment": "Malware payload (PhantomStealer)", "value": "b080209ceb1f8e87c09f7736b7f5b09b3667105f", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415285, "uuid": "d8468b35-efef-4425-93af-96f88aa0d6b2", "comment": "Malware payload (PhantomStealer)", "value": "6a3d1d3d7e791f8f29065450aaaa43109f3382d1d1b276842ac9d3a80891fa012caccf824a1f108454c6c78aa4a915dd", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415285, "uuid": "593aa029-4f61-40ac-91de-0ad5bd289689", "value": "T162C2A43EC584AFF40B6F61E2698F3E135909071275743A1DB8CED48D2B6A320CBB55E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415285, "uuid": "d18d7be2-dfd2-4501-ab8b-a7162459cb6f", "value": "384:KIRkNHGCnr1aDhTX9B4Fcch3T0hZfQwEVkZZdDMEHQq8x+mRl2JohyOuK+aX1f7s:KOCxaDhzwF5xoXfZlpbBZJodh+w0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415285, "uuid": "d11becd6-d7c3-472f-a04b-f8114fd85572", "value": 27766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415285, "uuid": "e7f9a4d5-f0e9-4f3d-b17b-d0a505bbf78f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415285, "uuid": "d00974ce-bf7e-4bc6-971e-d9d6ba62759d", "value": "PO_49460.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c593822-5e85-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780406337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406337, "uuid": "a7b6f05d-2e89-4773-852f-70524ba1ada1", "comment": "Malware payload (Mirai)", "value": "cfa771441470e1769871621fd80abee7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406337, "uuid": "35f26982-a79a-46bb-a998-da92ca8faf3f", "comment": "Malware payload (Mirai)", "value": "9b2c9193978809f503c09ae4aa0848575436aea2dc64e5b85542c2a350ab1e65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406337, "uuid": "64ea6c0e-6f39-482b-a486-869aa2855319", "comment": "Malware payload (Mirai)", "value": "01e31840ee3aac13ded0843f220b7d46fc63432c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406337, "uuid": "1473e6b1-acdd-4ecb-a8c2-8644f2cbc8b8", "comment": "Malware payload (Mirai)", "value": "a9bbca36cbb636d4e709d180cc6047a832fd95d0efa8e557f89ab86718ff79861b4db8604e404f4f278e59646405f8f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406337, "uuid": "6cf904ae-30eb-48c8-b9bb-d18e51041327", "value": "T12F831895BC929A17C6C513BBFA0E42CE37266398E3DE3213CE259F2133CB56B0D66151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406337, "uuid": "27b94e7c-1421-4862-91b8-c91acad54929", "value": "1536:a9fPidXKAL9EnVukaJ41dvy70vJ8ELOtc834Gv1:8f6LxQVvaJ4FvJ89LP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780406337, "uuid": "f9e269ad-e531-4e77-82cd-58897d1dc3a5", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780406337, "uuid": "5438ca8c-39a4-41c4-9e55-9a81b8f650f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406337, "uuid": "a7a39bab-42eb-45e2-af3a-82f2fa2f1836", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7773437b-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780415294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415294, "uuid": "67ecfb23-31f3-4e16-9906-7c2c8405f7d6", "comment": "Malware payload (QuasarRAT)", "value": "c31ceb586dadafc03153388caf8b0bf3", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415294, "uuid": "6bb29bb2-1c4e-4f81-ae32-015d21db0cc6", "comment": "Malware payload (QuasarRAT)", "value": "9b6e31817b788e4f3c826ba9d3fe323112c4625cabd9950c15d8cea7bed95c10", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415294, "uuid": "65fb59ac-8509-41c5-bba5-08ecf4bb2541", "comment": "Malware payload (QuasarRAT)", "value": "115566b27b90467ac7e8d297334b05474149a11d", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415294, "uuid": "c44295f8-ca74-48d5-9c0d-e7159c792123", "comment": "Malware payload (QuasarRAT)", "value": "80c74aceac90eb34d5d3b43857cb08e8b6d5c30423bda476ab987aa79484e9c40dc06784d9875cf9dd8995b6106cc0d1", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415294, "uuid": "6e6d190f-04b7-4faa-98e8-0ebfc1843ebc", "value": "T16E94CC38ECEA402EF173EE199AD47597E95FB663372E985910D213864713942ECC233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415294, "uuid": "b30e635c-6d96-4003-b907-a384f6a3b8b9", "value": "12288:AQJ5dm1xI86CR3RFd+L98S3Xqw2YIQI0xbWg6eke0:hzyBTdzSnz4aMN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415294, "uuid": "9f94f573-5313-4242-bcd2-84f1a68478fe", "value": 442060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415294, "uuid": "788df1ff-ae36-4799-9f17-aa645bbb8fe9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415294, "uuid": "c7eaa5d0-696f-405c-9ed7-4e70eb905511", "value": "PO#062205.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd52c24-5e2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780367601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780367601, "uuid": "83acb6de-352b-45f2-9fcd-646914f91934", "comment": "Malware payload (Formbook)", "value": "a87e0c2472aa2b21ac8032312d628840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780367601, "uuid": "1691eec5-7fea-4dc8-b42b-cf42ec2db262", "comment": "Malware payload (Formbook)", "value": "9ba709e3e9389501c7a2dbf36e1d199bb8d878bb232a6bf49abf10d74854748d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780367601, "uuid": "e6cfebbe-3c31-44a5-ba46-da9699883280", "comment": "Malware payload (Formbook)", "value": "a2c0473f65561ce9b26b6729d92ad4edea7863e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780367601, "uuid": "c257a751-a092-44f9-b864-b3ff32e52abc", "comment": "Malware payload (Formbook)", "value": "171f08c3f3cf41d8b6e2585c37016bea312a7890078384426f73d55d2e90cb4fef577567b3040bf3939edde65d4fcdc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780367601, "uuid": "a5fa75c9-a42c-4606-8fa0-b2a19e06e7ac", "value": "T1A645EFD037F95709E9F96B309934DE7006763D28B431F69E6AC93B9F38796019C18B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780367601, "uuid": "720d4486-c435-4453-8422-27c97e8419ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780367601, "uuid": "32c75c00-c93d-4ebb-b23e-699724f5f657", "value": "24576:UcXJzhh0z4c92ykohgYPDPEBywLaCpZpdIsur8onmPZ:UcXJFCzhMRTY7E8kaSZAjrVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780367601, "uuid": "1302c9e2-ef7f-497e-80af-93f02c233126", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780367601, "uuid": "efd98aaa-a2b1-4ca1-bc2f-688915b5e8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780367601, "uuid": "258186c4-3772-42c8-adea-031cae409031", "value": "MT_Caribbean_1_Main_Vessel_Q88_Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6869c130-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1780415269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415269, "uuid": "d7814f24-251c-4144-b103-8d213a6f59b2", "comment": "Malware payload (VIPKeylogger)", "value": "457a490b953f63779d55f3e006782494", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415269, "uuid": "b9410b50-0a31-47e3-a878-6f1be124b684", "comment": "Malware payload (VIPKeylogger)", "value": "9c45728ef269de5f7b84f2802775d15ef8c1f89b59d01e75fe6239e8720c38d8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415269, "uuid": "156d334b-d120-43f1-acde-5877a53571b6", "comment": "Malware payload (VIPKeylogger)", "value": "6e01cfb35e0c3c996e8f5b96e17bd7163479daa1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415269, "uuid": "1846be35-a12f-4245-91e7-07048d4529a4", "comment": "Malware payload (VIPKeylogger)", "value": "35ca857a59815dbcaf252167d545130e81b11ee44570ea6f7638ed11ca3784d3ac49488eeef53a628094b9de1b649743", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415269, "uuid": "1b18c76d-6d7e-4c69-9687-b51845d8382d", "value": "T11C913AAA4F12C8EB8F2A0998DD5E2FE628051BBB013454599336F359615DC93823BC97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415269, "uuid": "5ac33153-f1cf-4daf-9f88-5fd306b01b38", "value": "96:4HD8JTFLAgXRVdFh/OIQIqp2m8tWNAJWyRJg3kn:uWZL5Vd3/apLzsWyU3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415269, "uuid": "d39c1b69-6e86-4463-838d-7ec50a4698a9", "value": 4233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415269, "uuid": "952ab8bb-bca9-4159-9ca3-800770e9f7e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415269, "uuid": "b03a2bcb-e40b-49d0-ba7b-0b2371c4d5ef", "value": "Construcciones_CAMSA_S.L._REQ2060026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16144457-5e65-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780392368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392368, "uuid": "778aca32-c51d-4f4c-8be9-9a682e3ec253", "comment": "Malware payload (SalatStealer)", "value": "0e18dd8db99c7d807de4ff4b5024b76f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392368, "uuid": "8edcca77-bbf5-45a5-9969-2c5ea4ac7bfa", "comment": "Malware payload (SalatStealer)", "value": "9cc33d9b96c9b82c8ecbc8e4a984d4e2283a84d6b1dede3f83fe0acb5ae1dbb7", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392368, "uuid": "bcfe2cf6-4cee-4b8f-b604-81657de2fc27", "comment": "Malware payload (SalatStealer)", "value": "b5b63d504218a488ea3b2e37412a48bb71c32a04", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392368, "uuid": "977c6fa4-dfbf-4e9d-bc38-484677afa9c7", "comment": "Malware payload (SalatStealer)", "value": "a2a2a549d99eecc669ca153d7bf11de4ec00e05cd02fa406795e5a2db518be919d14f6f58980c565e2ce8c071fae1ee0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392368, "uuid": "82a272d2-6a4f-4f9d-94c2-c1ac99ec0264", "value": "T1E006230337FEB47ADE7A43704468A7545925F8360F42C9DB329C049A0FAA6507FBD2E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392368, "uuid": "cf0bf4be-8eec-4e66-8ec2-39fbdf62bf97", "value": "586d78e010f9c522229346124b35d0ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392368, "uuid": "51e9eac5-6f0a-4fe0-9a9f-c19bfe3c8149", "value": "98304:Gp1ncMAhHq31zoQXjwXk0MUTm8KU1/OiyYK:21cMAk31zLUUDU1GZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780392368, "uuid": "bde4e98b-0bdc-46d1-a1c8-55d44aa70b4b", "value": 3977216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780392368, "uuid": "8234006e-2ac8-4393-ad55-29dd8c078a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392368, "uuid": "8ae15366-b53c-475b-9c6b-d037f58d194f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51faa539-5e41-11f1-a769-42010a9c0008", "comment": "Malware payload (Tsunami)", "timestamp": 1780377006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377006, "uuid": "c7694909-accb-471b-8a08-d805a604354a", "comment": "Malware payload (Tsunami)", "value": "7822cdf1cf8e30d9997c9743f8897f33", "object_relation": "md5", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377006, "uuid": "f71d264b-6e95-4330-9d63-4e84a854723e", "comment": "Malware payload (Tsunami)", "value": "9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572", "object_relation": "sha256", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377006, "uuid": "59e04ce3-63a9-4162-9dc4-724d797dfe55", "comment": "Malware payload (Tsunami)", "value": "0f97481dd038a7a894d31f49148a6d03ddc66921", "object_relation": "sha1", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780377006, "uuid": "f06d416b-dbc0-490d-9b49-a16df13d8d1a", "comment": "Malware payload (Tsunami)", "value": "04fe808b0a7a18d804e9bc32a46cdc9f0d62ca2a5d4420550ad9d1909f1edf50d6f769e201de93b1b59465f0995e96b0", "object_relation": "sha3-384", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780377006, "uuid": "bf2a2354-6d64-4cac-9a94-cba7c47fb752", "value": "T155230227EE672841F0C50178893E15366F31B6424D4AEF1F2D2E38875AF89DF88AF581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780377006, "uuid": "39609f1f-ff4c-4338-a1d6-a3d098f35a84", "value": "768:XI/noIixTExsxBl76KRcGBP6VJ4rFzwgfTvex20qJNdcNm91Qsqx:YPmTExml76KRrB6VJsLk2rdc891G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780377006, "uuid": "0e46168a-0ed4-4f32-aa70-14e304ef3e09", "value": 49124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780377006, "uuid": "ba383613-ee27-430f-8ff4-6bd228b50d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780377006, "uuid": "9bcfe9a1-4368-4b2a-9c27-748213a9b5e2", "value": "pty3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd6062c-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload (larp53RAT)", "timestamp": 1780399600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399600, "uuid": "f9b0229d-4bb5-4e78-9c9a-2f0744b2a861", "comment": "Malware payload (larp53RAT)", "value": "8b2547f7abd96be4ca20728a2e28be01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "larp53RAT", "colour": "#94D708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399600, "uuid": "c014e46f-bdad-467d-9afb-b40685fc3d41", "comment": "Malware payload (larp53RAT)", "value": "9ea2b28790af29be511de10f54d3cea2f6441e51832db4bed6c11c0d01f2c76e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "larp53RAT", "colour": "#94D708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399600, "uuid": "5b0245c6-d340-4ecb-8f4e-ca79970e0319", "comment": "Malware payload (larp53RAT)", "value": "1088667671c6bd29258f7357752d34ea9ed1a0a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "larp53RAT", "colour": "#94D708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399600, "uuid": "3eeb30ff-6391-4971-8b3b-955cf6f1b41c", "comment": "Malware payload (larp53RAT)", "value": "c7b8c26c5e94ebfcd35b568eca568b7514f10ec485432dd6a449de76e742e846abb22058216ded7cef9150ef5b520e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "larp53RAT", "colour": "#94D708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399600, "uuid": "c62f8ed2-ce8c-4162-ba12-c7f2d417a4b6", "value": "T190047C21B4C1C4B2C467197418F4DBB29A7CB8314F6199CB73DC5BBA9F302C1AA35A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399600, "uuid": "bb0d0761-522e-4dbe-9e3c-677ac25ce62e", "value": "5c1626a64d6cc8e7a13853ccb8ce39cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399600, "uuid": "526b2832-cab1-4cbd-8d68-1145439fb6fd", "value": "3072:slP9uqKGXBLltUJtlN7TojS1n1jMp+r0BbHy2JBLnuM3OxM/0/4tJvIOwNfRHF6P:wkqK4MLt11c+r0dH7jt3iBiIOwNfRl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399600, "uuid": "03651bc7-24b0-4fff-9e90-89c06930c29b", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399600, "uuid": "103e8f33-78bb-4b7c-914e-a26b0b34606f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399600, "uuid": "99edaaf3-e4c4-4d81-b2a1-716673671d8b", "value": "9ea2b28790af29be511de10f54d3cea2f6441e51832db4bed6c11c0d01f2c76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c914e44e-5e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780396104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396104, "uuid": "a47ee342-e663-4fb9-9674-aa46af57754d", "comment": "Malware payload (Prometei)", "value": "f4444c358e2be03f75b553bff7cc9980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396104, "uuid": "1ba2e74f-712d-4c0c-bc33-170993221664", "comment": "Malware payload (Prometei)", "value": "a1435b46d9f4089dc92b0bc156f8a2cadfefbebb361e725b42b416f5f0746f49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396104, "uuid": "aa6cba03-86f7-4172-93ef-1f7879da2984", "comment": "Malware payload (Prometei)", "value": "7aa41d2f5b5ddf90d27a65e13dcd9560d0d36b12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396104, "uuid": "fb875b24-bc44-4de9-9d79-cae12c2f7f60", "comment": "Malware payload (Prometei)", "value": "fe37b6187fb74f268413c39d902243da7d62bf08f1f031bb67aa14216fbc1f6bc6f00b507cdaa879eccd0869a5da9624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396104, "uuid": "58e88ae8-2aec-4277-bb71-a6e67ee369db", "value": "T153A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396104, "uuid": "97ee8b00-896f-4f30-beae-d66c3700ea7d", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdH:Fs6pyCC/Ya2hpi6T6N45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780396104, "uuid": "4c1fc44d-913d-4431-b0d8-9592e1b70d17", "value": 449088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780396104, "uuid": "44c86483-bc05-4ed0-8baf-d382a67e22cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396104, "uuid": "0fa1544a-8776-47fe-ac8a-90ce873572b3", "value": "a1435b46d9f4089dc92b0bc156f8a2cadfefbebb361e725b42b416f5f0746f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2ea621-5ece-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780437446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780437446, "uuid": "95bc9e98-13d2-4118-93ff-5b2111d02629", "comment": "Malware payload", "value": "222ac2230e1258693ea9ecc7eec12a7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780437446, "uuid": "4d32808d-3c4e-472d-a9c6-ff073661bfec", "comment": "Malware payload", "value": "a26d2eeecea147ce1a3dfd84bfaeee95a6d9204909cec0764a3fb40bc0476ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780437446, "uuid": "b21affe3-0f1c-4cf4-a6dc-ed70bf315e23", "comment": "Malware payload", "value": "f835cf535de116c36840e636ba7e9356499b32e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780437446, "uuid": "f0b5762a-9049-43fe-ba42-4122e961eb86", "comment": "Malware payload", "value": "3c0fb95e132b9f96b9d08684206cc4dd21a89e16937f2ee3dbd1ea8609fc6bbbc1bf524c8277b030965c1426ad93c06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780437446, "uuid": "b65a5755-1bf8-4a9c-b03f-b9291d0a50b5", "value": "T13537CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780437446, "uuid": "f29d3a6b-3b35-47a6-bc08-c6d790ddf08d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQE:cqYUQuVDt0TZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780437446, "uuid": "9bcb48db-d629-41dc-9787-b73eee6d1077", "value": 23330816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780437446, "uuid": "f6788d04-f832-48bc-b68c-351d29c572d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780437446, "uuid": "cb916561-a61d-482a-9042-aab38dc658db", "value": "a26d2eeecea147ce1a3dfd84bfaeee95a6d9204909cec0764a3fb40bc0476ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b79e4ae-5e88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780407409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407409, "uuid": "61cfdec9-e75d-4b84-9eb0-723f604e1166", "comment": "Malware payload (ConnectWise)", "value": "3daafb52308cfa491473f12da4380194", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407409, "uuid": "e336cc71-918b-41f7-a49d-277e27c37c6d", "comment": "Malware payload (ConnectWise)", "value": "a299d16325dd6c794edf1b93b8ed6005205aa2d73620d1998650ff25115ca4aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407409, "uuid": "be5ac4fa-3441-4afc-be2f-db910bf9fe55", "comment": "Malware payload (ConnectWise)", "value": "26bbd1aa8b68b27cbcaca62d86eb50ba1098f692", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407409, "uuid": "89ebbcbf-27f4-400b-ad04-abf0234842ff", "comment": "Malware payload (ConnectWise)", "value": "06b732393a8d2e8686f69f5119173d621538d391f45d91c8a3f8cbf041ca2e89ed9e07a154aed6eb1807afff6629084c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407409, "uuid": "3dccb1bf-d92f-47b5-b023-96679a8538eb", "value": "T1F5A6232523FD801AE8F64A7DED3682F45972BE64CF22C11E9328790D2A74D5096737B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407409, "uuid": "75223ad8-2f6e-4d23-979a-1ab3ef4a2d79", "value": "196608:qWh0cGwxWh0cGUWh0cGFWh0cGmWh0cG+Y:qWacvWachWacCWacvWacZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780407409, "uuid": "e891faa6-dbc4-45ad-a850-85eac0c7ea3a", "value": 10329678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780407409, "uuid": "30cd3a08-5eb3-4baf-8e41-0cc979d1c15b", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407409, "uuid": "d57b6cb0-af44-4655-910d-de248cd81030", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefa6ddd-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload (AdamRAT)", "timestamp": 1780399603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399603, "uuid": "d54da232-6a52-4273-b884-b4ede4d812d0", "comment": "Malware payload (AdamRAT)", "value": "60444cf8bb83eb5a4916ae1a84658a3b", "object_relation": "md5", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399603, "uuid": "bf36ce58-d43c-4e5c-8eb2-a220a9c321b0", "comment": "Malware payload (AdamRAT)", "value": "a3c099c07405f0c11987d79f82b2db5755bcaca79fbaa50dae79ad485608aefc", "object_relation": "sha256", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399603, "uuid": "2b996c70-42cc-464c-9dd5-e42ee2bcb573", "comment": "Malware payload (AdamRAT)", "value": "2bfb3480f4012cf3db95fcdf2ad258265a55b54b", "object_relation": "sha1", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399603, "uuid": "9534f17b-a1fe-4bd8-8736-2268ee3db82c", "comment": "Malware payload (AdamRAT)", "value": "6e94950b91a5a084f1fe4d2484e052a6215e693ee5d20a0e2381087c31eb6ef8aff0c8fa7cf9170636fac83b0297a7cd", "object_relation": "sha3-384", "Tag": [ { "name": "adamrat", "colour": "#B066C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399603, "uuid": "d9f41b3a-e981-4f4a-bede-b5c935fef5ee", "value": "T11C546C65F7A508F9EA77C57DCC524906DA32BC424771EACF03A04A9A1F276E08E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399603, "uuid": "85feb98c-13bf-4e89-9793-b03b45f32b22", "value": "16f09e993e0d5dcc12fc3982ef5e7af0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399603, "uuid": "650f1b34-615d-4b69-8363-f064c6e07297", "value": "6144:wTatZazr4miI+Bxxn7beH76eIL1C1sHfUGc9i0htVr:9HwS7q8Les/9Ai6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399603, "uuid": "c40dba25-1972-4a3c-ac8f-91888d497cdf", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399603, "uuid": "0eb5dd6e-a1a0-4574-8449-aa57260638b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399603, "uuid": "24e8c4c0-cc7e-428f-bb1c-3e57591e9431", "value": "a3c099c07405f0c11987d79f82b2db5755bcaca79fbaa50dae79ad485608aefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9e692d-5e92-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780411815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411815, "uuid": "20551001-838a-49d0-b89f-7b3ad5caca98", "comment": "Malware payload (Vidar)", "value": "a4baf25a4fd2b53488ac7e59e04b30ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411815, "uuid": "78609544-bd4b-475c-9f0a-5717d54ad267", "comment": "Malware payload (Vidar)", "value": "a3d34b24e69c72db43ff718127b6951b29e466026afd2ab12ff13d1841b4cbb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411815, "uuid": "68e3a125-0fec-410d-9892-77f81d259ed4", "comment": "Malware payload (Vidar)", "value": "91a93839938b2540227c6c30fff6496940765d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411815, "uuid": "85e3bc30-ed06-40b1-bb33-bc23cb5a7775", "comment": "Malware payload (Vidar)", "value": "37dd14a218983c09c1dbce4bd78e62e4de53d689be365e63c6b3c07dc9df061ad5110bce8d0298310ea9ae62becd0010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411815, "uuid": "f5876da2-01cf-4da3-bdb9-1113be126782", "value": "T157B59D47BC9424B6C5EA923289B151A17B70B8891F3137D32E52B3B92F737D44E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411815, "uuid": "9c2b132b-5f9c-4594-a85f-596fde05262d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411815, "uuid": "92ead88b-70bf-4a5a-8aaf-2d647187a312", "value": "49152:kkGrj0I2owEPdI0hSzKvnVvZgRAbLpD1m:fC2owa26SzKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411815, "uuid": "87655cd0-7a94-4ee0-99c8-577519ee161c", "value": 2376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411815, "uuid": "a7d91e67-f390-41b4-917e-903d670aeaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411815, "uuid": "2e8ff3d0-ab5e-4f08-b433-f90d1ef0fc61", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00065de-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360897, "uuid": "6017417c-7e91-4ceb-833c-443d4a709774", "comment": "Malware payload (Mirai)", "value": "e0f77678dc02f1388ff330d31c1eefab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360897, "uuid": "8cc4a32e-d187-44ad-96ce-7d6e28931510", "comment": "Malware payload (Mirai)", "value": "a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360897, "uuid": "54cb08a0-3b6a-4bd3-b121-a00430192ce5", "comment": "Malware payload (Mirai)", "value": "96430b92f58cc5255990997d379eeb6453f5e6bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360897, "uuid": "2ae29ecb-f81a-41df-a180-02e568f6cfd1", "comment": "Malware payload (Mirai)", "value": "d6a7c6072cb1a840a69606ee2f6f05e2caf21fc455aa946d8649effcc177d6bf2b20d92dee06ed3f1b8e3455ee389533", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360897, "uuid": "d31a4e53-28a7-468c-9733-a4a5c4d552d5", "value": "T12111BF8D021293A61D0D8E4CB05AD40DEBE2C1F8F9B4ADD0B0F44734B49B70A7188BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360897, "uuid": "ca949c7d-0695-470a-95a2-174aabf3deee", "value": "12:3J3j9SqViWQj95BqQj95NI3PAQj9iIKqlEHQj9zQj9NLqQj908ZQj92DQj9+jdKX:3J3gqSNIpKq8L3PYgloB0m98yHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360897, "uuid": "4bef8be2-89d3-4e98-80c7-4ba6934a5849", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360897, "uuid": "89d4f0e3-ae09-4253-8edf-1074060c4ed6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360897, "uuid": "ed4519b3-9872-4d6e-80a9-f51a0ec737cb", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69b55b4-5ec3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780433090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780433090, "uuid": "7f2a3769-20f2-4dd8-b487-c306503784cf", "comment": "Malware payload", "value": "d760b0cee0d67f1024f099edf280ea07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780433090, "uuid": "8e34d24c-8a8b-4943-9f6c-77635a372bf1", "comment": "Malware payload", "value": "a60f58618c8548ff60978d7c50176bebb38486690d87ba24a8581b62dd478228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780433090, "uuid": "25a7bfa2-5153-4460-932b-a7da380deafb", "comment": "Malware payload", "value": "a179996effa6eaa7a4268ea3a5b9a615d3478d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780433090, "uuid": "f2c3d11f-e341-4e2d-968a-9ba4db05b646", "comment": "Malware payload", "value": "efc056355f7eaa99268981b49e57bffdbf5ccd416433b3bc7a92d92a7039d75c5983b5139ac9b01f55fd4cf36de0ffbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780433090, "uuid": "b56d838a-7d78-44cc-bca6-a7f627721156", "value": "T128C27C22A7E84961FDEF9D71A5F541024E72F2869C50C68F244E80CA4E73350AFE1F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780433090, "uuid": "2c146470-9cd2-46a6-8bd4-d86ae2e944e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780433090, "uuid": "d855178d-2fc4-411c-9526-49ea6a35753f", "value": "384:hpZiR4rcADtJkIbp2hepPeC2+XsDEjIEn3uu45R9dg2mNDj7gDoy8RbmL4nNy/6n:XnrcADtJlbZL5XsojZ1K/dghiDo5ALQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780433090, "uuid": "8bf37271-0092-4f98-8a05-c3001067f2df", "value": 27072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780433090, "uuid": "86bdcfe9-096f-4207-84db-a86ef41c6418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780433090, "uuid": "61af1431-6312-4dcd-aeeb-5e2640bb2eb0", "value": "java.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41735631-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "7ed2b126-5b9d-4296-a7b0-6bc6b215a37d", "comment": "Malware payload (Mirai)", "value": "40daf7785c328d8024c3b5055220eb10", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "4b5efbd0-199a-4969-b633-91f42cae8f52", "comment": "Malware payload (Mirai)", "value": "a7266feec63b4ca35550e59c9c6ca3787c6a3ba5f95db4b80ae4a66d6bf55353", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "aaf0a7bf-34af-4d5d-a7bf-a6aa89b30475", "comment": "Malware payload (Mirai)", "value": "a79f4d77ad4759d8bccbd55db73df34a324abfc1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "3c7cdecb-e309-4f83-8c03-45d13b9db119", "comment": "Malware payload (Mirai)", "value": "3d23263bf56b17c104c6d59b5a8ced2f48ac027bcb5c74f8316b086c5dceb7248876e681d305fe06f9b1ceb10ba301e5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "f2ee560d-9169-4d17-a5f5-a44866d7bf32", "value": "T17DF46C6377218F54E361D67005F387119E9521A30EF294C6A2BCD220BE6066D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "9a4e9a68-b510-4795-8a9d-05ab4f47de69", "value": "12288:NvSvg6liV5jpFgb1tr7fIE4MQGWPOBuL5sGtgp9kMrFrmL:ZWg6HbH4MQGKOM5sG5+Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364523, "uuid": "26467714-b3c7-4a7f-9b78-49a503b7d69f", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364523, "uuid": "9c8d3d3d-b319-4834-b945-2e4d03b4d9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "70b29688-0a7a-46db-957d-2307a54b5715", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3c8e31-5e4f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780383305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383305, "uuid": "5443cf00-ba63-48f1-a5c5-634577209d97", "comment": "Malware payload (NanoCore)", "value": "f0e92614b84f5110c7956b4deedeae26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383305, "uuid": "5933064d-5d2e-4c07-989a-49d62002771d", "comment": "Malware payload (NanoCore)", "value": "a81ab795e5d2dd555ab9db0b4c2e59429ab0660ed6c1374c602489acf5c0313d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383305, "uuid": "4d3f379e-ea06-4a0a-8c24-845b449b71fa", "comment": "Malware payload (NanoCore)", "value": "7d322279f1367516fc89b80bf7b1e5e1902c5e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383305, "uuid": "62600415-a0fb-413d-88f4-d5b39bf1659f", "comment": "Malware payload (NanoCore)", "value": "62392fc57dc660004e487632b6c779e42b2e5b459bae9c5f0c81be601687cd927318e45f40a1da1f1ce5a9b6c732e2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383305, "uuid": "80b6600f-900c-488d-a05c-5588242dc766", "value": "T1E014CF5677A84A2FE2DE867D611212169379C2E39CC3F3EE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383305, "uuid": "be10fc4c-c414-434f-9cc7-87f3361c739d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383305, "uuid": "939987f3-c5f9-4c08-a33a-7c4d41f07723", "value": "6144:MLV6Bta6dtJmakIM5I6V2qhLyNPYTbEjR:MLV6BtpmkXM2uL4YT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383305, "uuid": "f8cb0479-9780-4cdd-b075-f1fe64f1a8f3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383305, "uuid": "8a993966-6bdc-4888-af3e-3a0e8f4243ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383305, "uuid": "8b597286-4b3a-4ddb-aab6-a66cdeefea82", "value": "kitlife.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac12ef3d-5e90-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780411088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411088, "uuid": "dd5cc60e-a9e7-41e2-bdff-e90dbfb19bad", "comment": "Malware payload (SilentNet)", "value": "28e5cf4ac63d45f7fa5cc9ac8fb12261", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411088, "uuid": "c81cac11-8a86-46c8-a630-56d8aac8521e", "comment": "Malware payload (SilentNet)", "value": "a81cb039be675069423242bcdfc536867b35645ddee957e7910de031e8cd6dcd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411088, "uuid": "e64d1299-8a4f-4a8f-8ad6-e5abe04c55ac", "comment": "Malware payload (SilentNet)", "value": "85d207e7312a46ae127f568b9fb30acf66f527f2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411088, "uuid": "76b297e6-d559-4677-bf60-49be0fb13a6f", "comment": "Malware payload (SilentNet)", "value": "f11c6b9747acf8adf6661ed40387e5a53209ffdae0738c78d964481e4b1f48c5c1c5e5d9e2b027d107990a6fccaec267", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411088, "uuid": "75310bbf-819c-45cf-9db7-f37020264c94", "value": "T1E57302EA7422EC02DE17827C89C6852AE11D25F6965FAD1700100D1B1F6FD67AFEF4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411088, "uuid": "ab24406b-85ba-4c03-8a16-dfa91762102c", "value": "1536:E/NsTjpxfWOAbCuMaf9DTClF19c73oQQ0:E8WfbRHmFunN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411088, "uuid": "9d5a22d5-5ef3-4759-8248-af8455da62e4", "value": 78472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411088, "uuid": "43eec892-e3c9-4d16-8984-619f26533fe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411088, "uuid": "24b784d2-9e3a-4c18-b071-1476e9d5cab8", "value": "KryptonClient1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9d87b1-5ebe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780430985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430985, "uuid": "51b6e1e5-80ba-4cbe-b887-74474d35e667", "comment": "Malware payload", "value": "2de833f036e33509cef0baf9598b14d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430985, "uuid": "53d6829c-4677-4a9a-9d56-0aaa81a2e795", "comment": "Malware payload", "value": "a8f0ca21a6d4867580b2df765ee296f71df3cea01f204848a88d2ddf565bf1ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430985, "uuid": "528156b8-e788-41f1-b8f2-60b30063965b", "comment": "Malware payload", "value": "70dd8fdc80781e375c341421c182dfb00c0448af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430985, "uuid": "32d23680-2bf9-4bb5-a59a-d72f721e7406", "comment": "Malware payload", "value": "b964d1b08562517dfb2e87158b7f706dc085ff2cbff253959219bb151212ae5441337e6097e3868b541d3cd04e862777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780430985, "uuid": "c942a7a9-65e8-4187-b31c-b2848c010d2d", "value": "T1CBD3F80AAF601EFBE86FCD3705A93B06258C755712E93B757678C81CB94A14F0AE3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780430985, "uuid": "e33c3bdb-574d-49d6-b1e3-5d7d169a41c2", "value": "3072:v2hyGBVGOH8WstIlY7JQHpTmuPqv+eTfOBXDwDNY:+lVGOns77JQHHPqv+GmBXDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780430985, "uuid": "8f0e729a-449b-4da2-97f5-93f1a771fa20", "value": 138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780430985, "uuid": "5518134a-a8df-40b6-ab42-8deecaa921b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780430985, "uuid": "558cf5e5-4869-4116-85fd-e2023a799614", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6585435-5ebb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780429546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780429546, "uuid": "a61dd5d9-fd00-49d3-82f4-c9e9235aea6c", "comment": "Malware payload (Mirai)", "value": "e19431b47786ef5105a3d3f72f9e0c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780429546, "uuid": "a79f5bd3-f2e3-4621-9475-67c7ae84c0ac", "comment": "Malware payload (Mirai)", "value": "aaa9aacd2f1297dc2429d24641ce98efd59a070535283439783c7acf4d773da1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780429546, "uuid": "d241b8e5-f139-43c4-bd3d-6f84871cbf65", "comment": "Malware payload (Mirai)", "value": "de27c2925b2bbf4b4f7e1ba08e2905321af06062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780429546, "uuid": "ce7269b0-f3a4-46b0-9f06-bf21e7144a37", "comment": "Malware payload (Mirai)", "value": "213cb3d7868335a364ef2187105a8b2d5aa6af1ed55e48ae9baa381253137ee37d2a6718cbc2ebc0741f741ba275b9ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780429546, "uuid": "906a010c-7c05-428d-a237-08c5ca2b071b", "value": "T1D6836CC1AB43D0F0F9A246B5007BB7629E76F43256F9EB46D7952832AC13B005B1B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780429546, "uuid": "bfdf2ddc-86d9-4ba5-91aa-efca5ac94c73", "value": "1536:m4pqPbxIxK1fopHIO7rsY8Q/xKG2nebytHIS3U3N1E6viC9qjiqrZh6C:DqPbu41AtIAF8SrTMHIS3mNacH9qlZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780429546, "uuid": "3e0a0f79-4f29-4a46-9047-f4af61ae544c", "value": 87188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780429546, "uuid": "cc624816-4d6f-4d8a-b71d-14211169518d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780429546, "uuid": "50f33190-2745-4b6b-8879-9546a85fc594", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3d0a53-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780414821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414821, "uuid": "a68b472b-c3f8-4f79-8f32-c2d1c6165d9c", "comment": "Malware payload", "value": "78cb669c60979d9bd85970a9b2c9eac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414821, "uuid": "b1cabdc4-7307-422b-b02a-a93388884f40", "comment": "Malware payload", "value": "ab89d0d06e6aae6baefa58acb36b2caba2bdd402b9ad699ee4022dddb18317cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414821, "uuid": "97f7daef-9328-445c-8610-c019ddf6f166", "comment": "Malware payload", "value": "00e044aaaeaed930d65de0acd48bd70d5e37a790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414821, "uuid": "01338d03-b999-4866-b77b-738b4aff0085", "comment": "Malware payload", "value": "0944eed6d5c104e9078621ec6da2854360d8cc4861b05aba164206e71a05077ccb13357d7ccc072505ff7e46dab0104d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414821, "uuid": "e463134c-c3e5-4707-b7f7-e26f233797ac", "value": "T1A1952392AAA41557F8BA03F1D4BB014617B17CAD9B6403BF258DF2640EB33D24937B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414821, "uuid": "1d9b095e-da99-4b03-b265-6800534cb109", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414821, "uuid": "94bcca8e-9af0-43b1-8037-c4af7b796528", "value": "49152:wj3TVq6wGwy19G+rZrnVsmVraeXsBoXPSwCno:ggGwoGgZrnVsmxRcBoX6wN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414821, "uuid": "32d4c683-4280-4f20-8059-2666daa28810", "value": 2027520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414821, "uuid": "e0d02186-801f-451a-8c07-33616b8bed67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414821, "uuid": "ce599be7-1b2e-4b00-a928-31f105912d19", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42aa0da5-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "ec61f52a-0cea-4280-b6ab-c23e976498b4", "comment": "Malware payload (Mirai)", "value": "770167eb49657975b0b25ab89173a3a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "813bf053-321b-42d7-b9b6-0faefcd84b1c", "comment": "Malware payload (Mirai)", "value": "abac1a78346934c6d69506b0753593030c42bf3179d77e967b41d5f0f2ddae6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "a60f8a0b-1492-4d30-89d7-d26616233511", "comment": "Malware payload (Mirai)", "value": "abd09dcef887952fb8a625bfb4322a1024fd3df8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "258e5e3b-cc6c-4797-ab82-c74ea18d79ac", "comment": "Malware payload (Mirai)", "value": "9afe2173539527616241bea2eb6482de7dde7f9ae98e29e91ade2a3d5ec46489db29a33956ad77021fc6e9d4e0684603", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364525, "uuid": "88abca92-0e0c-4f6f-9827-48f0296098eb", "value": "T112157D2EB2B3B5BCD00BC03447DBCAA25535F07522212DBB26C4DA353D6ADE51369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364525, "uuid": "51750461-4d53-4407-b749-1e6ca97d86eb", "value": "12288:dJDXDCrONgkfRhYBKsgndRH9bC52+SepOW7hEC5fLbV0Gn/CqomjLayUHTw18HX:dJXuONgkphk5g1UtFLbfn/3+To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364525, "uuid": "26a10f7b-aa37-46a6-b339-d7aa07b37190", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364525, "uuid": "e4869892-99c9-4bda-bc36-7137663c4f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364525, "uuid": "7ccb225c-897e-49f9-9326-c37dca257185", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca98d9db-5eb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780428319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428319, "uuid": "f53ef7fe-57a3-4d44-9aea-27828c29f084", "comment": "Malware payload", "value": "1512bc9947d0b615b19c8a83a02b5c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428319, "uuid": "7e940252-16eb-409b-b2bc-4021159d2db0", "comment": "Malware payload", "value": "abd712a8bf49f35d5669696cd86ffdd971289fef50339f0e9235eeb0b962a5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428319, "uuid": "fe8a98db-5ba4-4b58-a29e-a083f07d04d6", "comment": "Malware payload", "value": "29ea8aedcfd89c099e27fccbc4cf19307f5533f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428319, "uuid": "bf58e341-b310-4aa1-ae6a-688bbddb14e3", "comment": "Malware payload", "value": "b3e9cac0924dd611a7fac532057b129cece2cc9418a660b341a87ba0fd3849c0278e15f5cba39197361fceb8d63f0377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428319, "uuid": "6f7b4ab2-ed80-468a-90b5-2288899d640b", "value": "T199F4AF13B5D14032E29201B0A1691F116EBDBD310736A9D7E7C919486F6CDD2EB3AB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428319, "uuid": "5ff08a6d-8105-4b3f-b832-af9eb42be0b7", "value": "e520f1e98c73ae087c92d6d5d344b774", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428319, "uuid": "6614ff0d-8f87-491c-827d-2ee0abdd7f3f", "value": "12288:MGevuDdIhw+HqMoBau/imShxWf4+vYhukvq6Rw/pXvNDMJorpdAErYskduXiT/Z2:1YuD8KDBH5S/WChLv3Rw/NKFCYsyT/Z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780428319, "uuid": "f3a79797-1d4f-4cab-ac05-069f2b00368a", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780428319, "uuid": "c8b56f08-8d16-47c0-86e5-bca6049fa0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428319, "uuid": "891600c2-1683-4cde-84cd-729a8c52c34a", "value": "cfghost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425eb9e3-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "87ddd04d-cc68-4c8a-adc0-9b03970a24bd", "comment": "Malware payload (Mirai)", "value": "5fa47d5b14f2ff54e7a7fa675df2b3d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "b6474a4f-6a29-47e1-aa1f-5df87cff586a", "comment": "Malware payload (Mirai)", "value": "ac55551b32b45143d3f590534f6ad59de64b2d35edb5873557613dfd4037de9f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "b0595e27-b673-4595-a82e-6d619e7dfc7b", "comment": "Malware payload (Mirai)", "value": "790dabaf2bf3db4b2d0aed55d30173b9a03406eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364525, "uuid": "aefa8aab-052a-4e13-93e4-9ea6bc943037", "comment": "Malware payload (Mirai)", "value": "73bb1db0a1509f10147320c393b1773c8cb340d4fbaeef260e02c6c1bf7b391bc15752342d9ccfa28abed1a5f61f432d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364525, "uuid": "7266c4c4-27a5-4ba9-8378-713bd88bcfdc", "value": "T1E325AD11BBF2062AD280933586A2D750B613D7A668D5030BCF618EEBEF571750F85CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364525, "uuid": "16baae34-51f3-42ab-96ba-20b08ce18730", "value": "12288:y1O/dBj4qwjqnwY6wvYJaELPaax0j1NVH30u8c9vDtw5nZ9yR5:y1OFd8On5iai1x0N3l9Liw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364525, "uuid": "cb0eeb3f-992d-4c3a-90e0-cfed87196e9c", "value": 1057224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364525, "uuid": "31725fea-0d73-4250-a798-c06ca28e72aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364525, "uuid": "f5c5bff2-2607-4ec1-8001-25bb2b552fce", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36695364-5e84-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780405736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405736, "uuid": "c0c80b81-c043-4777-93a5-fd7f36ab87f0", "comment": "Malware payload (CoinMiner)", "value": "775196e6aa8c3dfd0ca492a0ba61c57d", "object_relation": "md5", "Tag": [ { "name": "alpine-container", "colour": "#96BA56", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405736, "uuid": "17b6d7f4-cda4-4d34-bd03-1caa48546ea2", "comment": "Malware payload (CoinMiner)", "value": "adfa14deed04a850938bf48ef190b1f30b93d1bebe07ad2e7d0b48d8a03bdabc", "object_relation": "sha256", "Tag": [ { "name": "alpine-container", "colour": "#96BA56", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405736, "uuid": "5594cc46-39f9-4884-8d91-487ad8e4c02b", "comment": "Malware payload (CoinMiner)", "value": "e882c96908a674c5e0fe757c7fa3220831c3e8b2", "object_relation": "sha1", "Tag": [ { "name": "alpine-container", "colour": "#96BA56", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405736, "uuid": "0ebe41e5-2e5b-4c16-8a67-be53d74dd917", "comment": "Malware payload (CoinMiner)", "value": "033ea319ca0e032509b49777cac9fe32bd15cab6f1f6ab90ca4402e301992d871361a7e75cbe19d9137527d67cf914db", "object_relation": "sha3-384", "Tag": [ { "name": "alpine-container", "colour": "#96BA56", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405736, "uuid": "13c1762b-4d38-4acb-a498-beb3a8fcbd2d", "value": "T16E468D4BF1F394ACC09FC4340B5BD592AA7074B802357A3B3794AA312E77EA15769F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405736, "uuid": "efd1307e-8b5d-4e40-a046-09ebcbde6763", "value": "98304:pJHqPBEyaD71+euktzX07w8w0JArrMGAB3UPEeG9dk7esNC0+JLu9uRNrPODOmv:IasgG9mtNgu4nOCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405736, "uuid": "982c4ef5-1693-4db0-a68a-55e7b14c6c02", "value": 5642288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405736, "uuid": "e57342e6-5748-44bd-8f23-2989224deac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405736, "uuid": "ff69c597-f96e-4e2f-9411-7a2cfecff255", "value": "xmrig_dropped.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef95c0ef-5e83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780405617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405617, "uuid": "8073a445-e8e9-4c00-9762-1db14f96d825", "comment": "Malware payload", "value": "955f52542f43d25ec3851cfac6a70c4e", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405617, "uuid": "1bb406f9-a8c3-46dc-9efb-bafa981c8bcb", "comment": "Malware payload", "value": "ae37206dad26b1e7f6e927ae108d2e2a73f9335da25c724e6f7cc5c41824cd3b", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405617, "uuid": "97bb93b4-388f-4e4b-93fd-d13400f2c95c", "comment": "Malware payload", "value": "77b039c0d86a089a910e8f6916915f74c30f4fd0", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780405617, "uuid": "7b6b4e5c-0f7f-4fbe-a262-885f5f39fb57", "comment": "Malware payload", "value": "a0317115b440881d75fe6681f29afc85d150b070651b26b6c8aa1cf4c962f619c21f25f8ad5c8313acba4ccf04eac8e9", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405617, "uuid": "d329977b-4a60-44d3-8a77-d97ebdb3bed2", "value": "T12A561221A38BC275E16D01B3D82DEE0EA139BDA7073041DB63F4759E2E728C1567E792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405617, "uuid": "ff6a94e1-da3d-43d3-bdfe-5037fc059b33", "value": "98304:cdBlFC2YwwRuMVdbu0guJsP1X2VuPCaWFVcMQw9uSscGjjDb:KBlQ2vRKbSPX2o6aWbcMQtSscmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780405617, "uuid": "7e4d7653-b3f3-4e2f-aee6-68ad1ef7b874", "value": 5984768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780405617, "uuid": "5485bd0a-c45c-4165-a660-a4661e45f295", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780405617, "uuid": "671f029b-d26c-47a7-bbe1-b5e25a256d57", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d62b29-5ea6-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780420528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780420528, "uuid": "94e9dc6b-cafa-4cda-81a0-615dd2dea6b1", "comment": "Malware payload (WannaCry)", "value": "862b123a0a348512aaec7c9aba0db984", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780420528, "uuid": "0ddf775c-0844-4222-9718-792beb207cc8", "comment": "Malware payload (WannaCry)", "value": "ae3a26b6394fdb1603da54cd7284bb65c1f490b6d757f3675e8ee6b0e6b50ff3", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780420528, "uuid": "fa005700-fb85-4557-bb1c-5fd378235e39", "comment": "Malware payload (WannaCry)", "value": "646540102d6fa38c0bb5a4100e244776c7cfed5d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780420528, "uuid": "0ef68e19-5eca-4cc7-98db-604ae44ab8c5", "comment": "Malware payload (WannaCry)", "value": "6da28b6d374deac0aec117d624a444725b1c6bae1d2d54e523248324c32a6537daddc6a9d5a74577cfde1f46ca888f73", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780420528, "uuid": "6955fd52-77a6-4a9c-8d6b-2bfad3743427", "value": "T1E336F711B84B0C9CCABF63704C277F65CA56E558023962B783B25B1FAFE435EE2B4854", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780420528, "uuid": "8b0ee7c6-ceb5-4029-8e75-6b5476c0d7d6", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780420528, "uuid": "c1137d25-79e4-4eeb-876c-51b4210efef6", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAQOwN:DXDqPoBhz1aRxcSUDk36SAPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780420528, "uuid": "1d2f78bf-ed8c-42d3-a17a-f3fba79b0087", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780420528, "uuid": "5d6dea72-c59a-4794-bce7-65c758ea9c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780420528, "uuid": "19140bec-e792-4911-ae4b-b29ac1d84e03", "value": "ae3a26b6394fdb1603da54cd7284bb65c1f490b6d757f3675e8ee6b0e6b50ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d52a50-5e50-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780383541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383541, "uuid": "f5403825-9453-49fa-8535-91e03fd443f6", "comment": "Malware payload (AgentTesla)", "value": "fced8b825269871c641e264f8c84f966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383541, "uuid": "060f7eea-2352-4def-aea0-d3e5a2e931d0", "comment": "Malware payload (AgentTesla)", "value": "afa6bd5cc7372003db13a64715d3919ab7f3a9c4c628a51c845f58ecfcb8fe14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383541, "uuid": "73ae26ea-6ee0-46f3-aab8-6db2f3c8cd18", "comment": "Malware payload (AgentTesla)", "value": "7e35a1abba676c493f73d005837c97ed19b4e0c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383541, "uuid": "6ffeda20-e6f7-46b0-b130-210a800e3ff9", "comment": "Malware payload (AgentTesla)", "value": "509025cbb22cde7e065546937bc562c88421a7e6ce0f93bf208691cfcd5f967eb3c7455c5ed298d2d9267ecbfb4fccc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383541, "uuid": "9d796d9c-f580-4d10-a779-13ae8e2c8a5c", "value": "T1DC4694136B57943A670E471ED9B2F5D5E81A2827B0929B0B702CD824B3EBD53639D0F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383541, "uuid": "f96f6294-1c22-47bc-865a-11f7e78ca62c", "value": "98304:MxxIZ1Cz9zCSnFpReRn/QAV8Y2AvV+wlS+od1Ut3IV0oB:qxI+5OuPAR/QAoqlS/2oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383541, "uuid": "7139cde4-1a23-4d46-97cc-cfabe5eea4d0", "value": 5841289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383541, "uuid": "c902b447-eef7-4ce7-b1b6-0eb3cfb174a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383541, "uuid": "9e97bdc6-51ff-4743-b1f4-6f44453b9124", "value": "Facturas y Albaranes.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc08079-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780415249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415249, "uuid": "83ffebe1-19d2-4843-93ac-094116c5e5fc", "comment": "Malware payload (AgentTesla)", "value": "386320126dd4c40d4a4204d1ae41a177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415249, "uuid": "25bf4aa9-df34-49ba-a969-10b9bfe6b70b", "comment": "Malware payload (AgentTesla)", "value": "b14bd6c205f47ffaff9ff8313fe61a4811a2c0fe60d04ce83ab40f53ab5ba865", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415249, "uuid": "c4b41c33-f6cc-4ed8-92b3-7b1df7d806c3", "comment": "Malware payload (AgentTesla)", "value": "151e0270c0aa16109118761af7220aaa19f9a58c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415249, "uuid": "135b88bf-a575-46b7-9b17-79e2d9b3b6ab", "comment": "Malware payload (AgentTesla)", "value": "b6a738e0fd69e09e8d6b64420248593460bfca84d5d7beb28fa86b9699e90a1772329a09633dbf37f15907393f581e76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415249, "uuid": "a284bb6a-82e7-4f19-8873-917a6123af42", "value": "T1447533334C5CF59AF34BEAA794C25F06180AF8C9C03C0E6ABE559493D29A07E1D6958F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415249, "uuid": "55176f8c-b002-4b96-9bf2-88b45e55ef03", "value": "24576:dNG7WEk84LVxLOAi5NoUFdsiG3Ts84GvHxdOMhU7mluBaCYWlODInuOT:aiBBxL+9siMTs840hhd+aCcDNOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415249, "uuid": "c70e8710-2c4f-4ad6-9627-81f2acd43e27", "value": 1625561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415249, "uuid": "dde72130-c14f-4b49-bffb-36b7e22cfd64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415249, "uuid": "b85412e8-e29a-4068-826a-9b52820976d2", "value": "Q5-Brochure.pdf.r15.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b96b7bb-5e5d-11f1-a769-42010a9c0008", "comment": "Malware payload (LucidStealer)", "timestamp": 1780389129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389129, "uuid": "b645fbdd-7a6d-4d49-b0d1-515f8a4239cb", "comment": "Malware payload (LucidStealer)", "value": "c5017151d584bd00a3bb472d3cac4586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389129, "uuid": "22cf6c6d-2a1f-49f4-8cea-ef7e2d7de3e0", "comment": "Malware payload (LucidStealer)", "value": "b15b13a9421c213b63de7e7ba5a06962dcb7753cdb5f8248d7a139f1b0ca4187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389129, "uuid": "a36bd1ec-97f2-4063-b414-79d179822959", "comment": "Malware payload (LucidStealer)", "value": "0d86dac61db3f2a5cf1e0aefbf8bd82b8605b538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780389129, "uuid": "e391d81b-26bd-48e3-93b1-d8a98b125420", "comment": "Malware payload (LucidStealer)", "value": "609ab4057d33d33f94b08eae7f48ce17c19d5904215692cf046a18a7fd93d05d33ec18ad73ee22be37a278fd39143e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389129, "uuid": "b1049e0d-1c5f-4db8-8061-38d08610195d", "value": "T188285C22A2A605B5E4BFFA3196E65D239D22BC076F3045DF334817362F736E05A36B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389129, "uuid": "9d4145a1-0b15-4d08-9fd0-6868f3bd58e4", "value": "359e649ab913e838011b9d61180c7f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389129, "uuid": "fdc7c0a4-bf33-4f8f-a425-3639687174f9", "value": "786432:aWJVDSfPhj2e7pAp6B65Eu1J6dG/u3XFU41:aW7DSRj2e7WEu1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780389129, "uuid": "a95c8698-25a1-4f6f-8e7d-8b9a7ce59663", "value": 100516352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780389129, "uuid": "82bff02d-88ce-48c3-aa52-791de1085245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780389129, "uuid": "03a700c9-41e4-45c2-be0f-998cc83cad78", "value": "InnerEvilSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab07c7c-5e64-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780391999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391999, "uuid": "cc36a726-1646-470f-8f85-f2de8f247b5d", "comment": "Malware payload (Prometei)", "value": "b246107364a8e14bab5846628ba44c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391999, "uuid": "d42d1aa9-ae4c-48c0-8601-667d954b0c68", "comment": "Malware payload (Prometei)", "value": "b2020e2debd2ed3c81345ea75bcdc91b650f1608bc9cbdba6f566dcba6e3afa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391999, "uuid": "95ed7c7c-dbc8-47e1-9d36-3669aec990d1", "comment": "Malware payload (Prometei)", "value": "4f1fd842f93d31f6c138fdcb2b45bc60ff76df45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780391999, "uuid": "31f32952-6cf5-4c36-8728-7e46aa671bbb", "comment": "Malware payload (Prometei)", "value": "3fc45b21c45b89472ead4d46f6ccfdce62aca5a262ff213dde8f5691e3853caeca53d4bd0a926412a60efd8f3d8bc78b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780391999, "uuid": "c3a81499-bf6d-49c1-beba-64e682940936", "value": "T16337CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780391999, "uuid": "62972017-994c-4031-8c7a-70b71aa829de", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQk:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780391999, "uuid": "b1724d58-15e6-48c5-b988-5e56678c4f38", "value": 23035904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780391999, "uuid": "ba1a254d-c279-4cf9-8a81-0fde61d1a17b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780391999, "uuid": "f735c311-9973-4f2c-95bf-139d017df947", "value": "b2020e2debd2ed3c81345ea75bcdc91b650f1608bc9cbdba6f566dcba6e3afa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd29ff27-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360892, "uuid": "934af4c7-c88a-4dad-938d-59a3fbdf2224", "comment": "Malware payload (Mirai)", "value": "7664ec719f17370bbb557dd4cc09670d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360892, "uuid": "86c729ed-a2d6-405a-983e-c412f9722b28", "comment": "Malware payload (Mirai)", "value": "b27165c7accccbf0a3502820e2ede1a5f6839b36ca29da9d15fac01eae592e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360892, "uuid": "77c95e87-120e-4c2f-9aa6-5748055e38e7", "comment": "Malware payload (Mirai)", "value": "b71577cf0e740ac07ec2215150182c40f4ed8465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360892, "uuid": "e90bc60c-0ec0-4b85-a4ea-11b29bc2febc", "comment": "Malware payload (Mirai)", "value": "3f3f6579a79e2db5b0d8d6e28de0f7ec1e0a23883104f184770d2df1f3b9bae9aa6ae9de0c14c46efc0f98f768650b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360892, "uuid": "8bafdd5c-347a-49aa-becf-fd90f8151add", "value": "T19E230891BC819A2BC2D41379F57E998E3361B3E8D2CB7227CD614B107AC551F0C6AFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360892, "uuid": "b72b57ff-31bf-4855-aa8d-4ba1cfa6ac2f", "value": "768:kPQeJmiLsiyTVmQyIziM42GpUZQ68pJWQYe/3+bImMSTlNS06gDAvUGFG7aJP7LH:kHminfIza2GpgEJWQYwEplbwQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360892, "uuid": "a760d177-d8f3-4e03-b0a7-ac7e68943ce3", "value": 47000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360892, "uuid": "859f509f-8a59-47c2-9804-424c2d90d0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360892, "uuid": "3027e1e4-d3f6-4b40-ae3d-7b5fe5687dcb", "value": "OGz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e751bd7-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780414823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414823, "uuid": "a0512819-3dce-40f7-8a7d-9ee816d1f895", "comment": "Malware payload (ACRStealer)", "value": "90d7ed993ecd11f40897a332a2e4ac6d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414823, "uuid": "37791e08-16e4-4508-9bb0-61c7f663f8b0", "comment": "Malware payload (ACRStealer)", "value": "b34a4a6f7a301545e391b6886e15a91da610b2ba80b323b042b0a7b79dad9d7d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414823, "uuid": "1983fbda-9cd7-48c4-a66d-e3cb9ac32546", "comment": "Malware payload (ACRStealer)", "value": "a727590218fe90a0a14d59656f22b226a98d007a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414823, "uuid": "4dfdaead-8900-4cc1-a63f-5b0fa7f1d669", "comment": "Malware payload (ACRStealer)", "value": "1534c64babd1b59ad13344d5956f79c188902ea1e9b2491eccf40302d9004b60241272cf84c67f74378f7f8b21ace168", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414823, "uuid": "d482d0ab-1cbd-4f72-98e8-5cfb30edf833", "value": "T11EB58D51FCDB54B2EA02563209B7A3EF2331B9091B31EF87DA046F7AAC335D14D22659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414823, "uuid": "4b3ecb6a-16e2-4de0-8e79-69afd418d9e3", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414823, "uuid": "f0f4adbd-1fc4-4098-9883-bb313784e6dc", "value": "24576:kskGhBLDzvtCcO+fUOvdl5iFem891uk4tVmH/J75cECbMUHVPv/5410Krw/E/kvi:Kcl9r43U8MYh41pU/E/kHF4g8D1Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414823, "uuid": "aec42ab9-77e0-4204-be02-6f71a6fb25f8", "value": 2275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414823, "uuid": "e73bd2aa-7b04-478e-a2e4-1780f521e6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414823, "uuid": "cf7a2842-ab7e-4b3f-9d46-5cb1201e3ab3", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5f5dbe-5ebd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780430333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430333, "uuid": "88351fb6-d62e-4096-922a-e5b82f55cf15", "comment": "Malware payload", "value": "7c5514a9312a4e2250b72cbf4f62226a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430333, "uuid": "c7afabb6-49eb-4380-88ed-fbb3ef74e36f", "comment": "Malware payload", "value": "b41ba217f19bee7cf3526c7bb840034cb6e91e725f48eb53da18385cca49cb55", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430333, "uuid": "969197c1-beb6-46df-b01f-bc776b7fe54b", "comment": "Malware payload", "value": "cc57e6cabee57a1b105ef460801bdf8c75cb8439", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780430333, "uuid": "e56dca00-3135-40bd-b18e-228f0c5b3a9c", "comment": "Malware payload", "value": "9f4a43fa846c4bafb9981f8bc9484fc50e37538c11fe77f15708963efd30c008f528f8f386d3f3293558b8c1bfa4f8e7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780430333, "uuid": "0cc9d135-f226-48fb-82ea-de78f0d0d82e", "value": "T13B5122F77A5696C6BC3299AF9A2F1089109416021362E0F8FBD7DC41EF88F5D44787D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780430333, "uuid": "fd165d3c-e43e-4109-8380-170ab8f2a56d", "value": "48:/f3klwDRvTILw2ZhlsqDTQhTF6I2HwcK+vEkrOS0oXjLX7NM:ElwKLw2LlsqD0hxSRK+RLz7JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780430333, "uuid": "0eb28e33-61a5-4e35-8918-78e394f16416", "value": 3119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780430333, "uuid": "97163d86-f291-4d92-820a-0f31b9f55482", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780430333, "uuid": "15daf0d6-f0b4-4c90-a8a0-1c4367ede64d", "value": "Fatura Eletrnica AT-HY7CCH.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f858d51-5e57-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780386451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386451, "uuid": "0940a4eb-72ca-425f-b7fa-3dcdd145750d", "comment": "Malware payload (Prometei)", "value": "1ded5e5f555af89078d83bbfeec19cfa", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386451, "uuid": "0cc3cd07-9b3c-43dd-9df1-592b8a77cb44", "comment": "Malware payload (Prometei)", "value": "b4ebcfa967250caf913636d8574f3655fac86b8884cf59b4da61484c749358af", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386451, "uuid": "c668dc67-0921-4466-9c40-bdf41c7322c6", "comment": "Malware payload (Prometei)", "value": "33e70717464164ed6d03f237e949d3355251d05c", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386451, "uuid": "0434b11e-411c-4e9b-aac3-63e498dcb55f", "comment": "Malware payload (Prometei)", "value": "2e2d4f47e3181a8bb56137ba900d10876682b386b92009072ffbd2a6c8ff09a39aa7c973ea245074901b64c5174947dc", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386451, "uuid": "0c1d2d13-e692-4aa1-a720-531410e1762b", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386451, "uuid": "6da53056-7702-4d8c-a450-02bfbbcd8090", "value": "3:MD4AXa7:u4AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780386451, "uuid": "aa15819d-19f1-405c-b6d0-01a7f6df68a1", "value": 26, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780386451, "uuid": "5688c248-c0d3-4c02-8ea5-e66de2087cf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386451, "uuid": "5bec24cd-ccf6-4dd1-84b7-45055d96a572", "value": "b4ebcfa967250caf913636d8574f3655fac86b8884cf59b4da61484c749358af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d56b130-5e91-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780411385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411385, "uuid": "49d15bc6-613a-4828-9013-7c163fc039bb", "comment": "Malware payload (SilentNet)", "value": "55f9e0d229eda8ea9edd3bd87d18cc26", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411385, "uuid": "04f816fb-afbe-4d9b-b39b-407753fbfad6", "comment": "Malware payload (SilentNet)", "value": "b5e1d712020803315f962a7bc178a41bb92c3af22017d94234ec2e1ce3e8a178", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411385, "uuid": "d7efab93-a093-45fb-b30f-39f5c5f0480e", "comment": "Malware payload (SilentNet)", "value": "4118d7fbab67e0025951ce432ba337cac5e10e42", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411385, "uuid": "b58409cb-07de-4421-b9ed-91d6ae1de881", "comment": "Malware payload (SilentNet)", "value": "9cc701ea5d5714bdcff0cb666757a02bb8de54b2ba1c4bd191799a16152a63bc27146939e9ce4549aa29722f25248308", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411385, "uuid": "617de13f-45bd-40a5-85fd-d7965f242bf2", "value": "T1987302EE78898F1EDD232D340E939130B1630BF6A7AC695BD56C394EBF509190D5487C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411385, "uuid": "404fe12d-2fa4-42fa-aa96-b8e88f6c4fdb", "value": "1536:4I1NvHC69m5xbLcO8R62APkvKhXEpENM6t70QAP:4SyLX8RrIkix28M6uQAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411385, "uuid": "14c98e8e-37b9-4e30-a32a-71efac8f3658", "value": 75654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411385, "uuid": "d29577fe-e19d-4919-a178-a2a6a5a9a924", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411385, "uuid": "82cfd252-741f-4d0d-ac89-fbff6c20eccb", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51db122b-5e4f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780383019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383019, "uuid": "9349f1a6-feeb-4de5-8434-07ad6b8cb203", "comment": "Malware payload (ValleyRAT)", "value": "57aa7041cd459162d855d815b58f0037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383019, "uuid": "7cc55db2-c0cc-4b33-895f-cb4658dd4e35", "comment": "Malware payload (ValleyRAT)", "value": "b5f90b716852ec3adf75f5f3c3ddba0172fd75a46892f986f9a1d60dbeb16ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383019, "uuid": "4e158dfb-7213-48ac-b253-3124ca9233a9", "comment": "Malware payload (ValleyRAT)", "value": "71a5f5254eddb0169b297455adfb61bd15a13620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383019, "uuid": "fd74ac6c-d6f3-430e-9256-ac66df0c14b9", "comment": "Malware payload (ValleyRAT)", "value": "6bd1279baac0fc6736b1d36724a221d4f6cc47ebb7d89749bdada98dfa7bb9b4e331f100ad5e8ffa1d9c1df20ff421d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383019, "uuid": "70b4d56c-a70f-4a95-9751-b33f18036c6b", "value": "T127F79246BB81CD97F86946348C9B87903372F8B54B5A83C333A8633D6E6E3D44EB1951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383019, "uuid": "d047b01a-6183-40bc-b19c-99d0bfb2b66d", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383019, "uuid": "5e8ad4ca-083e-40d8-a6ab-43cb308d8ed1", "value": "196608:6dFbcB/7ePfoeO08oAqZ2ArbcojUAt21Ch7Dhb6Z/LzEnSQ5PR:ycB/7sNDcoD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383019, "uuid": "79486bb9-392c-4ac0-a568-e153f8058fb8", "value": 74603592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383019, "uuid": "23783fdd-f9ae-4f24-bdad-e8ea08cf5fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383019, "uuid": "a4eb90f9-f59a-49c9-9033-a88f766afb71", "value": "zmh8535663201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2083e08-5e6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780395206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780395206, "uuid": "2410fc1c-eb7e-472f-86ee-204640a07a2a", "comment": "Malware payload", "value": "4047d8709272ed1cb2d9d9e98b595802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780395206, "uuid": "696e211d-441d-4ad3-b162-42746268ec85", "comment": "Malware payload", "value": "b5fcb93599c391a6ab9c16ec4eb961b8ca2c094d4be9f812a0a71df77a83b949", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780395206, "uuid": "9e454220-65d1-46b8-9574-a532a1938b38", "comment": "Malware payload", "value": "934f87ac2fbc4f370494bfb3779850f8b5c4605c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780395206, "uuid": "25972d0c-95e5-4313-9744-98857efffa53", "comment": "Malware payload", "value": "5a40ea18a73cb7b89b09c56629735abe8397c5b0beba94a871a1c39f71ce70c23378cbd0e565efba07aa46d84388b8a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780395206, "uuid": "0d912770-4fdf-4003-8331-e131a654b96b", "value": "T1D61533E05A2285C5ECF35426BCFE5150A3F272F13E5CF6261121BD782A64BD6C70B4AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780395206, "uuid": "d5ad6747-7afd-4aef-a232-8017911144b2", "value": "24576:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKV6x4WjyBgZbMa:5IrLqbSJM5ZlShz5uIKVGvjyAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780395206, "uuid": "0cc0d956-e4ec-4d33-b4a0-1a7b613b4826", "value": 928388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780395206, "uuid": "fc00a274-a30f-4656-bfed-0f156065b32c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780395206, "uuid": "2fa0d63d-cba3-4ee4-a9d7-20396915425c", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b6cf25-5e31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780370362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370362, "uuid": "c63a5bcb-85c8-4d6f-92da-8faac137e77c", "comment": "Malware payload (Mirai)", "value": "bba04393a7ce6ef6ebd606b966bd52bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370362, "uuid": "28ff5890-82b6-465b-bfb3-a1cb64c698e8", "comment": "Malware payload (Mirai)", "value": "b68f1fb991f1adc4749ad091d9115dc29b2d8445e9ae0b981b5984aa10499123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370362, "uuid": "725ebb94-f0b1-41ee-9f0b-4ffec0c15575", "comment": "Malware payload (Mirai)", "value": "e00afb1ee3ada0e1544cd67ee3745810d0c69d99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370362, "uuid": "b0335dad-cfa0-4543-8373-f75a59655d6e", "comment": "Malware payload (Mirai)", "value": "abae480f245763dbbec31d5d56e710733b1d53140c14490f25651ec966b6a6354346b5cbeac7897d6eb330de67a75394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370362, "uuid": "11b21284-1d73-4e05-aa0c-e8935d2d6e81", "value": "T1FBF33B56EB408A13C0D61779B69F4246332397A4E3E733069928BFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370362, "uuid": "13213791-478b-4934-977a-4a63c217c9a6", "value": "3072:MN4SkmXorf/ml6yvanKBEOi87T2NL2w03WmbsFTTTXM/9YZy+ON2FK+:o4SkmXQm4OanKBEOiw2kw4W0sFTTbM/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780370362, "uuid": "f1005fe0-3e41-4b8b-94b5-30dec3df4de8", "value": 168007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780370362, "uuid": "704198ee-8f25-41a8-a3d6-ddcebbb08940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370362, "uuid": "5c430569-e8b8-45c0-be6e-679e3397350a", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad405721-5e50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780383602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383602, "uuid": "bf50234d-cf6f-4054-98dd-8852a5cbbb48", "comment": "Malware payload", "value": "127b6c40b7add576877b5ec5a5897813", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383602, "uuid": "4bd03039-432e-42c0-bfcc-b67792f8b1c2", "comment": "Malware payload", "value": "b8035d90d4e3f118e230ddcbce0e0ef358531ea04e38c77e20630c37c24b3613", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383602, "uuid": "bf4b43b0-0e6a-4001-b979-d2537d99d93a", "comment": "Malware payload", "value": "1445028f2e1aca63b046a28c34929454f288d39f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383602, "uuid": "42610898-6de0-4a95-9fbc-67e010e29a9d", "comment": "Malware payload", "value": "9b19494535f5668f549b4cff3152e86788bf7ee2ba42e51ea9d1c0e1f77328e628f55246d48522b70ca4150d4da7abbb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383602, "uuid": "d9fdb5db-366d-49b2-9c54-49f183078c02", "value": "T15924238CC74F14A5DF58A33A13674E0A42BCB62EF31141B634AC57B133E9D3A59A64BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383602, "uuid": "6e46929f-e32b-4f36-aedd-6b15de0af656", "value": "768:1daRhPcVS71dtkN4GacV438cTAikgZ5Mg:1daR9zPtkA84AeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383602, "uuid": "b8e118f8-f0fc-407c-bb49-1ef8e5d9e1ac", "value": 225655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383602, "uuid": "e815a6ab-8aa6-48c4-9922-2f4153144644", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383602, "uuid": "90495c3a-27b1-474e-afc9-5cef27eddb28", "value": "RFQ.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413db32d-5eba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780428947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428947, "uuid": "922630f4-323b-4664-89d2-3bee92fd8822", "comment": "Malware payload (Mirai)", "value": "79df6404211d3463880456fb8c77c100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428947, "uuid": "ef886594-b9d2-48a8-bbb5-4d4a2d80ab78", "comment": "Malware payload (Mirai)", "value": "bb93a456ab8706c0f22f22d59ca613a7a14ba2a4c19b2f461fced5db0059577f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428947, "uuid": "384dd9ad-f287-49bf-87a4-7f8ec1c75566", "comment": "Malware payload (Mirai)", "value": "6c2789b09c4249a4060498d4de72bf105df5b1bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780428947, "uuid": "0dee7955-ca64-4431-b345-21d68a37c545", "comment": "Malware payload (Mirai)", "value": "531a0d45fc8679db58f7ae729ad9d12aa577a8ada34789fe439ffbdd39d92b91df6f3278f9c500a0b334361fbbcd9be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428947, "uuid": "e9ade18f-b746-437b-bb51-679523a7b411", "value": "T115A32951BC929A16C2C5137BFA0E728D77267398E3EE3206CE259F2133CB55B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428947, "uuid": "22e995f8-2922-4650-a872-37438a957dad", "value": "1536:tbZoWrQ/m2BRebBB3+ijxVmboD5ayXT7PghhC9TYGKNpv4WJ:NZvEdne1B3+CsboD7Pg6Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780428947, "uuid": "eab36e20-6ba1-47b7-a511-da4e22016b2e", "value": 104640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780428947, "uuid": "a653a8b0-d87f-43d8-b3e3-1baee4cc4789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780428947, "uuid": "46f91455-eaba-40fc-b363-4814a999bfe2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddad37b6-5e8f-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1780410741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410741, "uuid": "08e7c5a4-7446-492f-bc9c-93d778029595", "comment": "Malware payload (ChromElevator)", "value": "4f5edee9203223e0cb4a28c4068bc930", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410741, "uuid": "fecab5fb-da66-4f37-b7f0-7b0142eb802e", "comment": "Malware payload (ChromElevator)", "value": "bcff5812c1bdd518470f91a0b2e5c1e8ed28ba96c58e28953c1e5d9b6cfe9db0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410741, "uuid": "d815736c-260b-4881-ab5e-3fe6c4b32648", "comment": "Malware payload (ChromElevator)", "value": "14c4d760244e049511bfe0039d8244452793f074", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780410741, "uuid": "b6f07ed8-3705-40a7-92fe-bd483f61478e", "comment": "Malware payload (ChromElevator)", "value": "95da179d8562ea72da1834413c2875b3312d52d516dc4a3c6b1b2d8fbf6f54a07deb96ea62ba8528a8b050c459dd285a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780410741, "uuid": "49f03e15-f8fb-41ee-abe2-4b22991d2fee", "value": "T137D44B47DE9226E0DD38A9F85051D2A59C8C4B174E1CFF2B79A9F533DC6284CAB2036D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780410741, "uuid": "cb0055e6-b2ae-426e-aa1f-f43ad5e01dbe", "value": "6144:yGxTdy6GrzB29g99hp1DnVZkoviNfZYTpFH6rEyYTYvevmHw4jWsTNWAcR4Ezhj2:nTs9fRaoviNfZYTpSYWe+esabG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780410741, "uuid": "ed4fc8a4-1088-41ed-903b-9d3783929dd2", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780410741, "uuid": "a8e4c839-4961-471c-846a-7c06f7d2ed3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780410741, "uuid": "968eabe1-ff58-4078-a033-b48312be4a4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2233d893-5e85-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780406132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406132, "uuid": "03305ef7-5ed4-4ec1-bf3d-efede56ec2d6", "comment": "Malware payload (WannaCry)", "value": "805409c556d014b560617b38659c7b39", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406132, "uuid": "e4558378-314f-4da5-80db-3f1531ff1cf3", "comment": "Malware payload (WannaCry)", "value": "bddeb527d7b9fd6d61d5359fcbcefdbf2acf3096cd5d4feb668187dd5eee91b3", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406132, "uuid": "bc9849de-83bb-429d-8b7a-3b600f2a2199", "comment": "Malware payload (WannaCry)", "value": "db2fb36a2eb467dbce7221d22d6fbd444291470a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406132, "uuid": "efa39912-a653-47ac-ae2a-fed6e4d9c509", "comment": "Malware payload (WannaCry)", "value": "be379c2a7760a8be3cba543a0d759fe51ef1b91e8f777e09773b968ed1c5cdf64336adc5015e73a8f206a6e6875ae6ba", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406132, "uuid": "46258457-019d-4692-94bc-aa28376e5ca5", "value": "T1573648C156A24C39FA8B3733B4ADE42249512D0F1BFEA11FD3583D5217721608AEBE9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406132, "uuid": "74f648ac-ab42-42f8-ba33-0bd31094797d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406132, "uuid": "f72ad941-390e-4d75-b475-e58bbadd522c", "value": "24576:jbLgBbLguriIfEcQdIBrYbcMNgef0QeQjG/D8kIqRYoAdNLKz6677VT:jnsnpENbcBVQej/1INRc7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780406132, "uuid": "a15292b7-991a-4725-bc36-72ddd7df73a9", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780406132, "uuid": "ecc068e1-6dc9-4184-845f-5cf46eab092c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406132, "uuid": "62a8c89d-bcf0-4581-ba51-8a0ee2f51018", "value": "bddeb527d7b9fd6d61d5359fcbcefdbf2acf3096cd5d4feb668187dd5eee91b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9997d4-5ea9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780421661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421661, "uuid": "12103067-ba0e-47d8-b8e9-3e5c9acb9e36", "comment": "Malware payload", "value": "ecfb1097cce129eeeea4810201da5b09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421661, "uuid": "734dd4ed-c386-45c9-9c8e-a0ae85c00ccb", "comment": "Malware payload", "value": "be3caa1f93402452841b964035cdfe1b5c16417f15dae3e1272419aa3ef20f46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421661, "uuid": "47c09886-a2e5-4169-9aea-97c8cfbed070", "comment": "Malware payload", "value": "b46ca286b4e2dc1b30f1e9d4df06c22fca13525f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421661, "uuid": "20f645ae-153c-4c68-bc33-3e45b3b85d19", "comment": "Malware payload", "value": "63e8a7913ba1b6f44214682d9fa056dc8723b036cfc4237aa5a34277f9953a468d09b128ca6e32364609f437cb02843c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421661, "uuid": "15b0de28-c187-4a13-8cd9-ba017ce4ba1b", "value": "T1EE92C000DE8042D5CDC17DBA1E8CA731A2BBA780F9A6E47143E9C5AEC77AD51DA72150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421661, "uuid": "07c6fca4-d312-4899-9e67-adfe6a2c28e2", "value": "384:GaiAgXHo4zkejSudOylMns6PmUipfaES8TR057HUkOeZHoc4I:GfI4zlmuIruFUZ+47HU49oc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780421661, "uuid": "c0d66118-1bae-4485-bcce-502455e00d69", "value": 19392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780421661, "uuid": "61fd7217-8d66-4173-ad03-865a4542bf1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421661, "uuid": "1c722978-82f9-416c-961c-5eef065903c1", "value": "be3caa1f93402452841b964035cdfe1b5c16417f15dae3e1272419aa3ef20f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3092f02e-5e88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780407444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407444, "uuid": "99b73893-bd1d-4e84-bb44-33c6ff331523", "comment": "Malware payload (ConnectWise)", "value": "6f57cf15aa31a5b87b4eee3f02848d70", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407444, "uuid": "e5734c34-a4fd-4668-969f-7d139922fa85", "comment": "Malware payload (ConnectWise)", "value": "c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407444, "uuid": "bbb052e8-7966-4141-bbdb-703d35fa755c", "comment": "Malware payload (ConnectWise)", "value": "0cc83f6f915c6977cb5a0c5a1c46a2a82c0ad63a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780407444, "uuid": "7c3aaa07-467e-4dec-8226-50674b2dc79d", "comment": "Malware payload (ConnectWise)", "value": "49b2ce40c38999b6aefa08aa749d4687ca59816191c55621c52ab8a37a4c0a248733a05309f8feb7ce25c834a6c5f4b5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407444, "uuid": "f6116647-c35b-4d74-9b07-61203cd4c80b", "value": "T1DE31959A6B05E237253A4793B173E44ED373884D2C24A4697C21C48A1E354F88BAE4A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407444, "uuid": "a1e6afd7-5762-464a-a745-a2418591703e", "value": "24:XhUcuwF5URnas9AH5K+aLRmxWCuG2Olw+AvkI0JfXzl7tKRXTzQebr1XbM7S5fLx:XeXAZGtUWG2gw+Cl0Jf57tKRRpNZ7GA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780407444, "uuid": "602a14e0-fdde-4bd1-a1d9-1aee180ba91c", "value": 1519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780407444, "uuid": "08122528-cb41-4521-8099-4c7d111dece1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780407444, "uuid": "9a584f6b-570b-4648-bf73-ee8b8d5eb590", "value": "New-statement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c831038c-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360884, "uuid": "6f4b172b-e91b-485f-b68f-5754e2fafa66", "comment": "Malware payload (Mirai)", "value": "b2c366b8fb1997bf3449a64f62bca315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360884, "uuid": "39fffa35-a521-4b94-b821-351b865ddc3c", "comment": "Malware payload (Mirai)", "value": "c3e56b9094e4e2cfaa1fd3dd624a3f96bceb0d71cc222c81e5246c6d9981b8e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360884, "uuid": "6054faba-6204-4831-b310-6067c1909864", "comment": "Malware payload (Mirai)", "value": "9a69fbccc210b1dc47e3848d73c10eaf04892b3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360884, "uuid": "6f513dda-4cc9-4b78-97c9-38de60d2d064", "comment": "Malware payload (Mirai)", "value": "f70ac6352bad56a64d25dfe247500615d183fc25a3d0ad56bd847b3f40d301f289a1cba03bf82b31e478d23c43119c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360884, "uuid": "3b12fe8b-74ef-4ba6-8036-1641969bd504", "value": "T1E7432925B57A1F23D0D0A4BD11FB8B59B2A15ADE26A4C64E7D720F8FFF216406803DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360884, "uuid": "c57c0344-c080-4d91-87a2-666617ff3b48", "value": "1536:fOeCbzFJjlxC0SnNoudzHOGuLNrBNLfi8:GLYEGuNBN7i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360884, "uuid": "7b04a2ec-20a2-41e4-8495-4a512309c363", "value": 56952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360884, "uuid": "13e4850c-059c-465c-a160-610c1388b2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360884, "uuid": "d71a5752-c114-47a7-9b46-b77a541034e9", "value": "OGz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e63b36-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360885, "uuid": "c375e196-c253-4e33-8ba9-027be115577b", "comment": "Malware payload (Mirai)", "value": "736497750c1a573a9e230a2a8454c4d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360885, "uuid": "3b0cbd7b-22dc-419f-9053-49a5d1096581", "comment": "Malware payload (Mirai)", "value": "c4d7f0702d537d9a208bfec3d54da6bd6a0542e3b832a88fac8e35757dfa5cc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360885, "uuid": "1edd9b1c-df1a-4639-9f8b-27099d6b2ab5", "comment": "Malware payload (Mirai)", "value": "2d283609fd3ad5bf7065585f47369837dc67f8e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360885, "uuid": "d520cf37-cd9d-4cab-a459-8e4bf0189ba9", "comment": "Malware payload (Mirai)", "value": "a4be2fe332182ffbf47c5ca1f2aba06a3cb8c55b88d6a0fcef8f6d67b7af8bbec96e87ee2c92625497a2bdc3125e550a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360885, "uuid": "3aad0c06-2490-4714-9180-4e3e36d2960f", "value": "T18BC35B46EA414F13C0D61779B6EF024A3322A7A5A3DB73069A149FB43F8279F0E63D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360885, "uuid": "9eb39164-3df3-4d40-b555-be0e1b3836d0", "value": "3072:4osDtN8ekA6RRS9kFKSZHlvQTnoXrP/jM/9Ic7QMw:4osDtN8ekA6jS9kFKSRlvKoXrPbM/92J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360885, "uuid": "d59b5e07-2043-4258-82cd-a1791ce9e230", "value": 129338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360885, "uuid": "dbffe0d9-5c32-4047-8ed1-855c18a92665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360885, "uuid": "095407e5-22cc-4fde-aaeb-9c9f553a6e3a", "value": "OGz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9118e40c-5ea8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780421350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421350, "uuid": "3d765791-8868-46a1-8282-2bf95f3848bb", "comment": "Malware payload (ValleyRAT)", "value": "f121814711b8a1325b0440ce3e616de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421350, "uuid": "b066389d-111b-49eb-84e9-2f472beaa390", "comment": "Malware payload (ValleyRAT)", "value": "c562df3c7ac0cf1e261430d61740573c8295b7258eaa256e267629def6750376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421350, "uuid": "ba2bb8d9-2c2e-4750-8db7-c386c7744ff5", "comment": "Malware payload (ValleyRAT)", "value": "bb8157287184a6cccbf5657ac28a4cf20380926f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780421350, "uuid": "6bbb7ee9-0880-4f20-84b9-72b4da5715cc", "comment": "Malware payload (ValleyRAT)", "value": "c3df579400c9664a757ee20f99fd5aef3bfd87b9cf2564255b239b78a142046d3a2db88a7c09feb5c1fed5540bc3b554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421350, "uuid": "7c6a3934-2fd1-4494-8e78-8066f0b8c69f", "value": "T12CF79246BB81CD97F86946348C9B87903372F8B54B5A83C333A8633D6E6E3D44EB1951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421350, "uuid": "776016cf-f9dc-4f31-a9b5-3b26a3bb019e", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421350, "uuid": "76c5dd19-86f3-4033-9c58-39c1394e723c", "value": "196608:6dFbcB/7ePfoeO08oAqZ2ArbcojUAt21Ch7Dhb6Z/LzEnSQ5PD:ycB/7sNDcoDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780421350, "uuid": "071983dc-9c76-4d29-9c5d-40857edb6350", "value": 74603592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780421350, "uuid": "93dccb79-0fef-4377-89c9-705e6e3468ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780421350, "uuid": "1aa850bc-0410-4924-ab41-27c805aa8709", "value": "zmh8535663201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf474ca1-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360895, "uuid": "31591358-8ef4-4ad4-bea5-5fca05494d0f", "comment": "Malware payload (Mirai)", "value": "ea1c652593d5052021d221ce35a3c58b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360895, "uuid": "bf01b9ac-54a9-4e29-862d-4c73ee5d0602", "comment": "Malware payload (Mirai)", "value": "c7d829b7d16c7e05dd6693f074428680e1f1fd953f72e929a10185bd14af3afe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360895, "uuid": "e643fbd3-f6ec-42e2-aaea-9d0598e497e8", "comment": "Malware payload (Mirai)", "value": "afe700b01f05d2472e3c1c61c2e402282ec17c00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360895, "uuid": "c7de0f4b-234e-4def-bb72-cb3418ead4eb", "comment": "Malware payload (Mirai)", "value": "69b66286a73434b624f9e4b24a83a03beb34b4c804be9c93307c221403a342e3e55016ec237a4d2d5eee3670ad3d1f29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360895, "uuid": "b035722e-d93f-4724-aee6-915faf8889ab", "value": "T14C2309C4E443DAF9EC4605742032FB269BB3F6FB2228DE43D7A55523AC51742B905EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360895, "uuid": "56731d8b-185f-43b0-910e-d4e1ff3224ca", "value": "1536:YtTeY1ouu8z7YRBRk2zBh5FPapavTwFq7WM:Y0Y1ouu8z7YRnkG1Fyp8Tw8iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360895, "uuid": "c34cc5e2-184f-4641-a6d7-320e287a8997", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360895, "uuid": "fa25890d-1c36-47b8-a58c-f56e6536a035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360895, "uuid": "f327004b-bc8d-4086-9aa8-19723e122e04", "value": "OGz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70ecc67-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1780414220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414220, "uuid": "4c491914-15d9-4f95-b920-35058e611ab5", "comment": "Malware payload (Sliver)", "value": "1888b807ee5a483a1adc9805b6ffd1d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414220, "uuid": "b4aedabe-ffbf-4e94-837c-fd7dc5a95976", "comment": "Malware payload (Sliver)", "value": "c92f234ca51d4aeaf1fb840c3f9d8d66b294aee5fce6ce4a1c2df7ac0378d09f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414220, "uuid": "2939a73d-13b1-4ab2-8035-deebd9b67415", "comment": "Malware payload (Sliver)", "value": "5175e428884ce88c5b193830c06d01788d4731a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414220, "uuid": "9511c606-8fab-415f-8107-36647969ad2c", "comment": "Malware payload (Sliver)", "value": "169d03e52e75b4da50bd4231226b393a94bb0d8e904b1c1db72d89fea012063d4f673debd7c0d1d1adb70a4cb659435c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414220, "uuid": "80f3f913-032e-489e-92e8-d4789b615f0e", "value": "T19BB62847F89141E8C5EDD170C63A9252BB717C894B3067D32B20F7B82B72BD4AA7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414220, "uuid": "f29fdf8d-64fa-470b-bf32-1864aa01ac1c", "value": "49152:RC254sWhbZfoBchxrb/TfvO90d7HjmAFd4A64nsfJgnGXlGz1B3YL2x76e9HkoZ/:efachHGXUz1Bgm8R8EtCf9EyOj07T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414220, "uuid": "45c1c27a-80dc-42cf-ad67-1bce962a8fb6", "value": 10555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414220, "uuid": "a5947b0f-5b41-4989-9ff1-00280237e152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414220, "uuid": "cec13854-9cac-4842-8457-9c42a025916b", "value": "implant_linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64169e5-5e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780396072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396072, "uuid": "326d8a45-d8f3-449d-aa83-d2ab12ea48d2", "comment": "Malware payload (Prometei)", "value": "6e87c7ef8c35e27948fe2bb278661e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396072, "uuid": "83b74f34-d56e-4861-8f9e-9a5b3f71f88c", "comment": "Malware payload (Prometei)", "value": "c935ef1e96c503bfc7030e884cb4b1676ff4c92d8f0543e23cb2014e44b13950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396072, "uuid": "0c2f4c1a-880b-4ca1-9fda-931947ae5790", "comment": "Malware payload (Prometei)", "value": "278998c37270d2f25d07cb30d8f831004b48cb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780396072, "uuid": "c7c0a085-24f1-427f-a111-4faa12105198", "comment": "Malware payload (Prometei)", "value": "39ad34403fc5f980fafb0644f37876920e309d4ad38d32fa8943585f6a9908152858b27e2cd14b482aaea8a201704c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396072, "uuid": "8c060b82-b8db-42a1-a555-17481c218212", "value": "T14D34BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396072, "uuid": "7c75d381-9f94-4ded-a8c4-343ccb3edffc", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396072, "uuid": "3104c4e6-bda4-41a2-a71f-f2851534ecc3", "value": "6144:FGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdO2:FG60BpL8jk1FGjDc8GVdO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780396072, "uuid": "1826bc73-e705-4af3-bfbb-f0e455391a9d", "value": 245865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780396072, "uuid": "6cbe44e7-5c4f-4161-96c1-0034b191c312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780396072, "uuid": "c7501dcd-0d49-48f9-a681-6b218d4b7997", "value": "c935ef1e96c503bfc7030e884cb4b1676ff4c92d8f0543e23cb2014e44b13950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c36fb6-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780382844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382844, "uuid": "9667a956-7d24-4c32-837d-5787224b7939", "comment": "Malware payload (AgentTesla)", "value": "25d08b9fb6f4641f2f912c416b39af87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382844, "uuid": "3acfbae0-fbbd-42ed-8a64-d605612dc3a4", "comment": "Malware payload (AgentTesla)", "value": "c98b4dd7d6feffcbd72c39b272cc3b829aa1b92f9ae27c29c2a68abdc1bef4a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382844, "uuid": "dd0e2f39-345b-4736-afc5-26cd036ab6f9", "comment": "Malware payload (AgentTesla)", "value": "3797fc417b8e6d91e8b0255c5fd6a2c69a68c3d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382844, "uuid": "4d6e0beb-8f3d-4188-93c7-efa77c17520f", "comment": "Malware payload (AgentTesla)", "value": "26c4945d41b2cab6ca256ab300987fe18de8e65815a3791f6348a16296fd434ad7661ee82e07a8d63234d06d3aeb21fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382844, "uuid": "118cb637-244d-4a40-8b53-65783010466c", "value": "T13C35CF226E976F58F63D1F3C8012189C2BF0D853921AEA1F7FFC91B569A6F41C927901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382844, "uuid": "9a682670-e1b8-46f7-816b-72ee519fe189", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382844, "uuid": "b29e1397-6313-4745-88ae-b6c11e72ce73", "value": "24576:x+okLItW+ugZU/FHGtYINStGFt2VHEQCvoGFnYq:xLkLItzuWU/hGtNNStGF0VHOvvFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382844, "uuid": "f5b98d1f-8578-483f-9c27-e76747655b8b", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382844, "uuid": "bed0c55c-d845-4d98-93a2-e0b550ae9f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382844, "uuid": "064bff75-d048-4e0c-ba7a-5f8262215df3", "value": "Documentos justificativos de la factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5948e65-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload (PaloRAT)", "timestamp": 1780399614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399614, "uuid": "855bedb2-48a6-42b6-8f0d-2b8b50200a7e", "comment": "Malware payload (PaloRAT)", "value": "a1e482fd0ad35a730d7dbebe97860576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PaloRAT", "colour": "#C98472", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399614, "uuid": "07262563-2066-467a-8b46-6d9897c16084", "comment": "Malware payload (PaloRAT)", "value": "c997b7cfddbdff7214ce5eeb1c7e65f627d12c4464e9f10364374b0121ece68b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PaloRAT", "colour": "#C98472", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399614, "uuid": "40933861-5e4f-4649-b164-922f9dbc1781", "comment": "Malware payload (PaloRAT)", "value": "a9c1b1d7bb7e3b6cb54a8de0918adf6375577451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PaloRAT", "colour": "#C98472", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399614, "uuid": "3215e40f-bfdb-4345-8b46-34b79b5eff50", "comment": "Malware payload (PaloRAT)", "value": "b36d16835b5bfb8ff67877192981c70da8fc09e681bd04cd07244e437ebdb5816b7e244c4543baef2597c329397b310d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PaloRAT", "colour": "#C98472", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399614, "uuid": "dc977c66-8a8f-4ed9-a7f8-8a76e545f1cb", "value": "T10792D74577E84624E2BF0A74D8B706608670FAA69C33CB9D0EC560DE5C77A444AE3B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399614, "uuid": "baec6695-9159-4fab-8a76-9701e6afc511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399614, "uuid": "596df574-5186-4726-a896-601eafaaf578", "value": "384:iMDKlGl3iDgZYVwX0LQsCEZuZ2UG9xanOobdCbVPDjMPxmYfihB8C5Ey34:XOEl3xDE7uQcj4V2mYe88Ey3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399614, "uuid": "576ac6e0-7e01-4b7d-8caf-72d02c015084", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399614, "uuid": "7ca64c20-6e96-4ab9-9f26-a140b42a817d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399614, "uuid": "86e2ac6e-291b-4622-a04e-5681b5c54922", "value": "c997b7cfddbdff7214ce5eeb1c7e65f627d12c4464e9f10364374b0121ece68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf45b91-5e99-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780414847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414847, "uuid": "baee1b05-afcf-45c4-98c9-3d5effe9c4fd", "comment": "Malware payload (RemcosRAT)", "value": "938758d363b8c79dbaafedef7bcd4ca7", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414847, "uuid": "c97922f5-d4ba-4948-b928-2444efe5821b", "comment": "Malware payload (RemcosRAT)", "value": "c9e6374b7ac0a335c2b8d3db32195de84507f2a3e18a762e96023d85acdfdcfa", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414847, "uuid": "6ed649ce-63e3-4e6e-a694-3b0fc6405bd8", "comment": "Malware payload (RemcosRAT)", "value": "c75c316a2921b7577e8370d0e184b3a02548089c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414847, "uuid": "6c86c1d3-a16b-434c-8dff-2f0533566660", "comment": "Malware payload (RemcosRAT)", "value": "a1191526fdb28336d9bdd71b30b456133c30d2e70016f2e872ccddf2a1cc366cc2537d8d796bb7665146c4c23e0a4a1e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414847, "uuid": "952617d7-ba99-49db-8034-b8bdb5185767", "value": "T1D4E6D0A2CB4A68FDFCD6A78163B6BD1C86099F1726C5F6C64270241E7211C2E6F179F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414847, "uuid": "a7b99d2d-911e-469e-a706-5d717e7f372f", "value": "1536:53X/cMbOD6hxLuxDjtwpE6ShrPC3q55tC7rLH44aB72UNKO2g3BXuVckTRj9br8b:4nIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414847, "uuid": "1d92c152-5021-460e-ad6d-3759565705e9", "value": 14377538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414847, "uuid": "60dfcc54-42ce-4d90-a3d3-caee8db903ed", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414847, "uuid": "7ff70168-3889-4458-9223-d1ef688f8760", "value": "task.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f61f64a-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364520, "uuid": "14d3ea44-9f0b-4356-86c9-d92150eaac5e", "comment": "Malware payload (Mirai)", "value": "8947e1bbc3b22fe054b87c8f394ec802", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364520, "uuid": "bad029e2-b39d-49d1-b6aa-6a928123b63a", "comment": "Malware payload (Mirai)", "value": "ca0a625cd414475b97f79dab3a1e62713b8d2fef1468765637667e35376eab72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364520, "uuid": "07e0dd37-3afc-49c0-bf5d-00e1c6c861bb", "comment": "Malware payload (Mirai)", "value": "f6bc5e59766acbe3281a27b781ef06a8785b5c72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364520, "uuid": "66648a1e-ccc8-423c-9f4d-9ccfec69a446", "comment": "Malware payload (Mirai)", "value": "d5fb803f3a37d0c206cf765d41145aef66dbe1ab34edc3f3483c9635f4d4fd1eba85da2b63742651e19fd583a252f1bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364520, "uuid": "c07f577b-ed00-4566-b033-6ddfd07856f6", "value": "T122F46D5DFE0E3C41E2CBE3789B4E83E1F22FB194D32351A23981534D94C69E98BB1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364520, "uuid": "e8e837e9-868b-4f97-aef7-8a382f182565", "value": "12288:dqE4Vv8vkT30EdkPRt5214cVdb2azPUpbK40w5lmtaI:Y7N/0XRDIXVJzMpgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364520, "uuid": "56e57ba7-31f6-4e3f-becd-06320c170e91", "value": 729328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364520, "uuid": "70dffd79-6244-4f14-a74d-6ab8ba2e91c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364520, "uuid": "dc57569e-899e-4672-b893-5e2afe936534", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ec6400-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780382841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382841, "uuid": "80211e24-01c7-4752-ac01-f8b19466f2e9", "comment": "Malware payload (a310Logger)", "value": "d5e3c35dc8d2599ef806abec5ae0e2d2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382841, "uuid": "36a94b59-519b-469d-8731-5ad723e165d0", "comment": "Malware payload (a310Logger)", "value": "cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382841, "uuid": "d8cf8bef-2daa-4b0a-9ba8-a705e18a6d73", "comment": "Malware payload (a310Logger)", "value": "6619f1964ab6c27a871e130665587a6edfc3beeb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382841, "uuid": "ac8725e8-178c-4e6d-8c8e-fbcd533422ff", "comment": "Malware payload (a310Logger)", "value": "321ca0a038207c8a3152d43e1616b68df045345b4a1a075890207cb03b72f6c6294db6f3398fa9182a8730487af0c969", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382841, "uuid": "f268e7b9-ec74-45b9-9a87-ff8ff1d14397", "value": "T16C551254271DDE0AC4A62BB45A71E2B067B05ED8E912C2039FDBBDFFBC7E2511D05282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382841, "uuid": "af634043-aabd-4ad1-a91e-403ffe575664", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382841, "uuid": "2bd0810b-76f5-4331-bbe1-043d2ad94e03", "value": "24576:6bAEFT0DMNZgwbXDCeJ33X6LSWM2wZTiWy/mK+kdrodK:m3FQoNZxbFlXwsGWI5oA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382841, "uuid": "9d4f38e8-ccbb-4baa-8c70-9c2a96b5c655", "value": 1281536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382841, "uuid": "db3e7415-1ecf-45d9-bae3-c6f26c2e3304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382841, "uuid": "48c1c0c2-d44f-46d5-82f5-f31e8f706ad4", "value": "BBVA_____PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352ca170-5e65-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780392420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392420, "uuid": "f73c924b-fadf-4191-92bf-eb982b6eeb6f", "comment": "Malware payload (ValleyRAT)", "value": "202bdd2d8a2bbee45547dc60ecf582df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392420, "uuid": "e738298c-ed5f-42ba-be36-6e69f6f81038", "comment": "Malware payload (ValleyRAT)", "value": "cc4aed185ff224de372d968457382222fe685cadd14934b26b349935da88e64a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392420, "uuid": "307cecc2-15a0-440b-a8b1-59b54669d437", "comment": "Malware payload (ValleyRAT)", "value": "8527ca91d8a82a0d78e2c2b0da5c723d0fae9745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780392420, "uuid": "66acadfa-f1d8-466f-b108-eed23e84147c", "comment": "Malware payload (ValleyRAT)", "value": "d08686876d47ab76e79b4e4c5f6f3f1309ffef4d8b4b7a086c4eee915a23175b547f302116ed66131db20ce22ebfb217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392420, "uuid": "62777b2f-6b30-47d6-a019-0790dd996f1a", "value": "T10D843BABF721CA7CC08BC774459397E29270FD181A716B9632C0731B6DB1E606E6C64E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392420, "uuid": "d0cc50a2-59a9-4fc2-b16f-fcc3b49839c4", "value": "35dcd74465f5f2d6ae6093577ce6c187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392420, "uuid": "011fc053-10cf-4f13-b094-8f63253f9dc7", "value": "3072:LOGZ3NX6ZH8eochi45haPWd1ZU9bCDCHsHv9mNm71KvafC7GQjqLOAaBaORZCS4/:LOGZigwzOwYhHekNNcGjn6M0f0U9/Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780392420, "uuid": "3ee81aa7-6fd3-413b-840f-6c600c14a96d", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780392420, "uuid": "0fe5b153-50ed-41f7-b58f-c34254c32425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780392420, "uuid": "4a237592-6a17-42a0-8d7f-72fee1f7b137", "value": "95.41.4.54_253.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aedccfb-5e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780369720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369720, "uuid": "aa5b8aa1-655c-42ff-8dcb-99785f0b3a65", "comment": "Malware payload (Prometei)", "value": "e2b07678cadfe3f1c83ef534d27f3c89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369720, "uuid": "bd7564d8-3cf3-463f-bd42-87cf10d4176f", "comment": "Malware payload (Prometei)", "value": "cd52cc74f7340252a66ad7c08f38c528db0b5755de4e0d8299e0d5377f64b2e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369720, "uuid": "110f3b60-800b-4e0a-8376-b66f32f2eb8b", "comment": "Malware payload (Prometei)", "value": "48a958a7ce54f69c46b223273f948de0238b7748", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780369720, "uuid": "a5b1f993-c990-4aed-88a2-2cb0362ea9ea", "comment": "Malware payload (Prometei)", "value": "2ee3b7a25769af04d9ddc5fbb8cf4302f777de74f18a5a9acf00a287c92274666366d958ea3c5f24115ba1d00a337629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369720, "uuid": "d97cdf3c-da52-46cb-af33-f1dfda6be729", "value": "T136A3810EBFA01EF7EC6BCD3B45E41B05248C651A21A97F75B930D818FA5A50F0AE3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369720, "uuid": "1ea1a200-f81a-4df8-adff-442a07718346", "value": "1536:VmHc8CWGWQY/9WqyU7ysd2lbUBBnBAj0m+Ax+RdZUTb1097uxgK:V0WWGWQeWqyUOQIbUnn8GdUMWgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780369720, "uuid": "7222235d-dc1c-43ba-9680-ad0cd3c91ef5", "value": 102540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780369720, "uuid": "7ae8c74c-1037-4e7b-b4af-5a31ad2481f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780369720, "uuid": "335b20d6-4bb6-4ebf-8ad7-4166204a9812", "value": "cd52cc74f7340252a66ad7c08f38c528db0b5755de4e0d8299e0d5377f64b2e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e104f867-5edd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780444248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780444248, "uuid": "b091a732-b576-4b7d-bdb8-c0d959f8f2a3", "comment": "Malware payload (Mirai)", "value": "ea2aaf78fe5b2f98796f612a8f354566", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780444248, "uuid": "08f0f6fa-502e-4379-a0ff-3d1dd40bc207", "comment": "Malware payload (Mirai)", "value": "cf6ddebc6513543f73885b8f522e39f55da6755e9ce8771f767f037a4e88d96e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780444248, "uuid": "4c4fe8a4-ec90-4c83-88c3-f936a06a6cbf", "comment": "Malware payload (Mirai)", "value": "353c0103a8c04dbf1e5c4aa45d98c8a3cc81d704", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780444248, "uuid": "e362d7ec-d341-496e-85d4-f913b0f0170a", "comment": "Malware payload (Mirai)", "value": "1a7530a886709a1f3149e06ff90ba6af50693eaad8b9a186849635e225b4906dea73e6a07bec19e04fc9a22ebf7d9c53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780444248, "uuid": "fb2a92dd-46e8-463b-b1ea-32040824b3fa", "value": "T1CDF068920B90002B0F7548C4F0FDCB10210523B64F24422C7D4E892077C02D7F77386A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780444248, "uuid": "258b2262-76f5-4beb-81e8-aae6a632a3e4", "value": "12:yEdEqdwq4XmaZVgzd3/FFscll7qxOiK4aF:ucHH7qxqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780444248, "uuid": "79a38333-0f37-4621-a88e-32237a139c79", "value": 462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780444248, "uuid": "5297f635-965a-4793-897f-321f6f8d4951", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780444248, "uuid": "a7f4d907-1501-4ac4-9b5a-82b04903c099", "value": "gpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a589e401-5eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780427827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780427827, "uuid": "e683e1fb-c4af-4f48-a257-fa9a337d5b76", "comment": "Malware payload", "value": "265e294572cfe20121b81c10594bb89f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780427827, "uuid": "ef5f4cb1-919a-4a94-900c-85b520d08b15", "comment": "Malware payload", "value": "d0b4afda9fdb84d932510b39ed0bee58a08f7f0fb0437e34586734c9cec7433d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780427827, "uuid": "3f57e124-fabe-4e3f-ae5d-8083d1bf71e8", "comment": "Malware payload", "value": "50134ff5027a5a17b2e1424b859843589091c053", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780427827, "uuid": "bc4d4d46-c292-40f1-bbb8-50f10d035373", "comment": "Malware payload", "value": "3140762fdbed7f7765ce2d5389cfbe9cf80d8d774c85a3ed768c48a806f061ee3577ee4208f3813f32a21b9e6380d61e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780427827, "uuid": "7c119a97-dca8-4776-85e0-3dbee994a964", "value": "T11802B9B6D472B4D0836B339035D1D8C60086CA93EEE72FA4A51D44A52FD0B2DBBE9548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780427827, "uuid": "2cc21a93-e124-496b-82d7-71e089c2cf16", "value": "192:tIR4cHrJ981q2fCsTUHbj3gAXcTySljJD9ry9bIIJ2IthcVV5bbnQL6:KHrJ981tCSEV4ySl3e9E42Ith2V97s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780427827, "uuid": "91422200-cfea-4340-8989-216e4e6497ff", "value": 8883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780427827, "uuid": "812ee3ab-099f-4d4e-97db-739bae0c1dc3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780427827, "uuid": "b91ccf13-e635-4330-9e45-391ad9194038", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea7094-5e51-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780383745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383745, "uuid": "0a23ab2f-c789-4f85-ab66-2ef3db2d0daf", "comment": "Malware payload (RemcosRAT)", "value": "6c4f1a73b3640ae20060603819b2828b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383745, "uuid": "0e92426f-e32f-43c5-a59d-b258f21e0cf4", "comment": "Malware payload (RemcosRAT)", "value": "d5f349c9d03f81158dc1aa5c015d991741ef0871cfb4f20fe8cbdaeca9710ef3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383745, "uuid": "b75e6d11-7122-41b8-8ad1-1d651eb8f2dd", "comment": "Malware payload (RemcosRAT)", "value": "ee51dcfdbd03d7d0c135a9b10fdcaa82b85f4669", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780383745, "uuid": "bfbb5497-84e2-4d2e-ae0f-c893fc3e9d7b", "comment": "Malware payload (RemcosRAT)", "value": "ec9f0ef4a0b532259f0fd64f83823ef135cada476c1787af0607a44c19a726af98cd3cb0ea6f41a2ab5017f9ab356e7d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383745, "uuid": "86a56236-de96-45a3-ac68-b03ef97052c6", "value": "T1A2833920DDD007B95F4307BDBC98261196BCCB69413680FDF58AA30D611A57CA7BEEAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383745, "uuid": "77f73980-cdae-429a-8cde-91deab6a3e0c", "value": "1536:3c4LsfrWEDnyRqPQSsJAhLmJiQlxMUPooeDS0pbOXn70:M4LsfrWB+QSsPJ3xKoWSg6370", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780383745, "uuid": "85719539-0c65-44e9-aa76-57502370c97c", "value": 86001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780383745, "uuid": "02837db8-68fe-4076-8928-55cadf563708", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780383745, "uuid": "e4a16d28-0520-4b04-bf76-e17b7764d41b", "value": "Germanistic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6ece9c-5e86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780406682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406682, "uuid": "655580c0-811e-4c14-9c92-97528bbbaae9", "comment": "Malware payload", "value": "f222320cc0b165e0b5b9cb2eade7476a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406682, "uuid": "fb284c93-6edb-494d-9d41-ff2a5c2f8145", "comment": "Malware payload", "value": "d6108bad599622cf57b9da2e7046a9ffe28ef1ec783e92d4a38c3fb7d91728c3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406682, "uuid": "9fd48360-84e0-4946-a39a-e0ddc3885a25", "comment": "Malware payload", "value": "bdb36f62e20d17b1183a99a4f001c6bb7c7498c1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780406682, "uuid": "f5263e21-9e78-4adf-ab73-bef8271cc1b2", "comment": "Malware payload", "value": "c0059a2e21bcea9f9f90df909a2e345e2005d2253b615fc15e95e0cbe18e872d889c7bad4cd10d5585e79a9aaa3c30a4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406682, "uuid": "db9dfb09-d118-48e9-8b31-796293479d68", "value": "T107E6123BB29B653EE06A5B353A72A210593B6E6155128C52DEF4F44CCF3E0701E3E687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406682, "uuid": "1ac56b34-e11c-4480-8a36-c9ac0c4d958d", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406682, "uuid": "787067c8-814a-4d95-9716-b498539d83e0", "value": "98304:15/fB8sSvTEnVJtVn/RRTyDxWIFu7vTrovvW4dqsS18FSl1GxGbtgf:nnL5tVn/nyDZFGEG4dxq8MuxGxgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780406682, "uuid": "a194d4a5-f028-45ea-ad53-10a010c2163c", "value": 14519111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780406682, "uuid": "2bcf5e4b-03a1-4203-aebf-7fcea9849651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780406682, "uuid": "e004c689-7f61-47d0-b267-553dbfc52877", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747f6f99-5e58-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780386942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386942, "uuid": "2d7c116f-3ebf-4c1b-86bb-0978bad29941", "comment": "Malware payload (AgentTesla)", "value": "78bdb7fb364325c22919ab26200b61ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386942, "uuid": "d85af32f-c7f7-4a36-b443-9b73f06f5c1d", "comment": "Malware payload (AgentTesla)", "value": "d6c0e9af7af53fb665d2ec03e2e5b68c80501e97885d2dda31f0e2d38fe3bd04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386942, "uuid": "205da6f0-3b3d-4e4b-b5dd-5ce0526008ae", "comment": "Malware payload (AgentTesla)", "value": "809c3c87cb0103fb9e3d9cd9bbc3e76871b7a5cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386942, "uuid": "765944c0-e455-453f-b622-23e72efade0b", "comment": "Malware payload (AgentTesla)", "value": "bcfcdfbb377fceefc4b2c15bb84234e8c9ec5bc3971f154acd27251f1f8326da1a900ae54e8dd523484f1ffda2b32bc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386942, "uuid": "9ba331f6-0a58-4007-8f31-1dd4aa7360af", "value": "T102D42244B291C513E92688300E79A166BB5DFC60ACBAC72F13953FAF3B323455A0D76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386942, "uuid": "a3262c9a-f188-40fd-8425-fd2fc2cc63f4", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386942, "uuid": "0180c124-af9f-417e-acfe-14951b758d52", "value": "12288:n8RX/0POO+p9iiyquwiXqDbs/mQNPHcmRXQC4:nI0Pz+p9iipuwbs5umRXh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780386942, "uuid": "f49b9d96-aa56-4b8e-a9cb-6c1c287dbdfe", "value": 625384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780386942, "uuid": "57b95cd0-6453-4b2b-9372-12a3b4524ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386942, "uuid": "e29ea624-3e94-4f1a-b36d-65c1c9fa8110", "value": "PO10045_2026-06-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420bbf13-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "bfae60d8-cca8-4583-9086-4144d27c2b3e", "comment": "Malware payload (Mirai)", "value": "5f44857769bdd7d5a231710796cbd128", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "73d4e201-f7da-4876-97bd-87f910c7b7b7", "comment": "Malware payload (Mirai)", "value": "d7a290f060fc5af062cbf417685961c4e2188f9a8ea9a523b2e8bb54e1256bce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "13cc6238-cced-4c47-8534-79d658d9edde", "comment": "Malware payload (Mirai)", "value": "acfb9e762683b6928a9112bd5ceb8f2878752251", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364524, "uuid": "dd0276d6-8f1e-46c2-97f4-430aa5fc7399", "comment": "Malware payload (Mirai)", "value": "31884ec502b38299cb77532366265a7d7b0cd6394de22c5c78d44dbbe240f8e7cf65f08df59e0dbc2ecce73dd1154dc0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364524, "uuid": "51fde01d-a675-4098-bc0c-f22c5813b47e", "value": "T11FC4CF93F2305EC6C41E4BB454BDE2344B49E29717C73181F7BE82052C6B5AABE5EB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364524, "uuid": "61b9070f-862b-4f7e-ba6f-8ce0557b9e32", "value": "12288:a1RDmest9CPvrnRN2U9Ux7V3IrLsoQvC/s17QpIzt3c:m6/9CbX2jZ7v39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364524, "uuid": "cc24dec2-40cc-41bb-a156-4b84255a68c0", "value": 594600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364524, "uuid": "4348a12e-42e8-4dd7-abc3-482c081c5b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364524, "uuid": "8817e928-9070-4ad4-8151-fb4661d868f2", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c1b888-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780399620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399620, "uuid": "cabe0a8f-52e5-4025-8031-e75fa7fadd61", "comment": "Malware payload (RustyStealer)", "value": "2f34934bcdf8c2b60b84c2431839a304", "object_relation": "md5", "Tag": [ { "name": "DissoluteStealer", "colour": "#80C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399620, "uuid": "0b6ad437-85f5-4426-8611-5970ea1aec72", "comment": "Malware payload (RustyStealer)", "value": "d7b4f9e10c306aa74ed49f99595c5924b380dc8ef1fb601ca6733584ae478580", "object_relation": "sha256", "Tag": [ { "name": "DissoluteStealer", "colour": "#80C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399620, "uuid": "f4621c26-b975-4714-bddf-e5d64ddcce9c", "comment": "Malware payload (RustyStealer)", "value": "3b642ad05a232f1338ba69ddbf4a7b3e958229f5", "object_relation": "sha1", "Tag": [ { "name": "DissoluteStealer", "colour": "#80C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399620, "uuid": "c12cb4e6-8882-4495-8bc8-f748de8ea6c0", "comment": "Malware payload (RustyStealer)", "value": "679afbeb579722b1a386f4cd962097ea80ded86d8c1c772e9cdb08b59abbfddca1ef759b7f21311f1a63e340b0629b86", "object_relation": "sha3-384", "Tag": [ { "name": "DissoluteStealer", "colour": "#80C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399620, "uuid": "a280ab2b-e2ed-4c48-8495-aaa087278673", "value": "T1BF668C03E38481FCD49EC179C7469B32EA33B4990620B6DF17E55B203E6AE945F1E768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399620, "uuid": "eb4c9a91-3ef3-4005-928d-08854ceca3ca", "value": "ba9ab26b86b92b043c0efe04bf81983f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399620, "uuid": "42135c05-e9b0-49fb-beda-7d7d7b8baf86", "value": "98304:PC2bz7bXpuXmwMrpV18D8UF5Y2t+XKjx+N:Zba2V6D8UQKWKYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399620, "uuid": "eb7b7468-5a12-4532-a3b6-f0896689c14b", "value": 6583808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399620, "uuid": "ee63d23b-b2c0-479f-9f88-2b4da1599a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399620, "uuid": "f1429a08-7545-4944-a586-bbba6cf6e3c7", "value": "d7b4f9e10c306aa74ed49f99595c5924b380dc8ef1fb601ca6733584ae478580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6b6502-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780382850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382850, "uuid": "778e3c3f-d459-4208-b3d4-02295427608c", "comment": "Malware payload (AgentTesla)", "value": "528afb6b1ff64c9f248bd83e072419d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382850, "uuid": "9f416dc0-9fe3-400b-95f1-c84780271b52", "comment": "Malware payload (AgentTesla)", "value": "db2eadfafabbdab410e1f4ceb9e6470c19eb9a357f9fc6fbc22bcdfa3b34b3af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382850, "uuid": "9923e6cf-e606-4dce-96c1-67f194d0fe4e", "comment": "Malware payload (AgentTesla)", "value": "f5c909e507026b7d1c2357e45d96ea9e95bcd2bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382850, "uuid": "30c4696f-ac60-4b06-959e-1101b9de1a96", "comment": "Malware payload (AgentTesla)", "value": "c9c49110f823ccbc6deb9fdf2880d793bfc25e4a564915380c2ce8047c8542f04645bf44f6f4a1bc3f9b232b172da3df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382850, "uuid": "f5101292-3851-4346-b338-351f84b079fe", "value": "T1BB250168770BDD03D9D65AB41560D3F94238CE88EA01E3139EFABDBFF87A5053946290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382850, "uuid": "9529a057-75e0-43e4-8085-e592dab76232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382850, "uuid": "14eb51c3-1982-4f4c-8602-d090994052dd", "value": "24576:M4TS1NCWeDbz/H1QhjxjpqkZYbLnkY7csC:M442yVgkMss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382850, "uuid": "c2360ce1-3168-4157-985e-a5848c00d822", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382850, "uuid": "75ae98e6-3212-4a58-8880-243966115683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382850, "uuid": "9700b36b-c209-4184-a7fe-0e08576c096d", "value": "mm3LtcU2YbK34TX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b41671c-5e21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780363251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363251, "uuid": "e965bbe9-d75f-4e56-b545-2436f1a17181", "comment": "Malware payload (Mirai)", "value": "2af9e706c49b2281e9e1076ad39dfc69", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363251, "uuid": "786ba40a-dac7-4d29-9014-3e90c7339201", "comment": "Malware payload (Mirai)", "value": "db43f4e4713a9f7629b68589d5a9d087541012c414667a900429997fd8961c06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363251, "uuid": "1a57d5d0-4897-48e5-b4ff-4230f468e235", "comment": "Malware payload (Mirai)", "value": "d945f8a98262872414f031305c05f8b3a46d2a3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780363251, "uuid": "a7b31f93-a0e2-45bc-8cef-c09074da4d19", "comment": "Malware payload (Mirai)", "value": "87c0a3cd3a86eed8add4e34f63e836e1ef82b0e5c94e80499723f8cefde3fa26f93e1a0b0f63f4b588a57587e7feb740", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780363251, "uuid": "bf78331a-93b6-4ba0-9beb-7826b88eb9c5", "value": "T12A5171C9124256382C6BAE6EB7BB044CB6D190F9DDC47EE4A5F83AB8454EF0931C8743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780363251, "uuid": "fc9bf156-4db6-48b8-b3cc-041a56fdcec1", "value": "24:ItbKuh1xyikWyMKbPhU/DxqIiRNUgD+sfn:ibKuh8bMKbPhU/9pivUgDRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780363251, "uuid": "f3ad3b56-29f4-473b-b119-32afd3499fe4", "value": 2647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780363251, "uuid": "d21d8d8e-3c4f-4301-b50f-17b0419adca0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780363251, "uuid": "ed0684c0-23bd-46a1-acf7-967468f57344", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592cedde-5eb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780425122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425122, "uuid": "d352d0a3-5949-4714-9a90-80afe7d3cd60", "comment": "Malware payload", "value": "3f3e3f23d934ae571b097d5a6516456c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425122, "uuid": "8ede3703-200e-4749-af38-325dce957537", "comment": "Malware payload", "value": "df038e02242237d76887422b36cfbccdda497949ff254a717b8ddf82cebdfde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425122, "uuid": "987b7aef-6e28-49ab-a91f-0db9566586a9", "comment": "Malware payload", "value": "a886da5f9983f8c4f4bdb5c5eec99cd170d5a7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780425122, "uuid": "25ef2100-0916-4c6c-b785-a053b3b18d67", "comment": "Malware payload", "value": "03dbf60cd5e10fe5d9a5e65bf6aebf94d34307ef9f0afd61fff3a975288a702f93a2ca4bc1766fe5eb587d7e5f5f7d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425122, "uuid": "4ec13c74-71b3-4112-986b-482bed1c173b", "value": "T1EA08339A0F69D62FC5DE927865F0F335AB01D2FEE6064DBB7F1D76683110C8428B4268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425122, "uuid": "5e7fe104-7769-4aa3-b6eb-98fe042bc91e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425122, "uuid": "41ccf792-fa0a-4263-92f3-e145925bf15f", "value": "1572864:kt9IKPuiiRkXCRWY4CjFHcftGYQhNafvZjlZGkhx+ZSJ7:kUKWiiRyCRWijF4fJfhZlJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780425122, "uuid": "fccce844-ecf9-41fd-8381-5815883d2b3a", "value": 77431000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780425122, "uuid": "4b96a0c5-1191-40c6-84ae-bd984b70d722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780425122, "uuid": "6de52e05-0ca4-403e-9000-7a52b2bd6f88", "value": "Voltrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644ce689-5e45-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780378755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378755, "uuid": "baf49b99-0766-40da-9c06-8af3f6b065c1", "comment": "Malware payload (Prometei)", "value": "045e17c5d3c197ec2be4ec12e9db1104", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378755, "uuid": "fc2caa59-36c8-4460-9240-9004fb470db3", "comment": "Malware payload (Prometei)", "value": "df205094a085d7e76a6ce26e257d7f47ecd77699eb57df9b99c664ada7083edb", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378755, "uuid": "0fb08af1-ed9f-4b93-90a3-d66622aedcd4", "comment": "Malware payload (Prometei)", "value": "655bec1caaf783029d7802d95aec0a60d48426df", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378755, "uuid": "22888e77-e6d5-4127-9290-887e62b7da3d", "comment": "Malware payload (Prometei)", "value": "68a96f51ddf63b654266442debc64dc5ccb28f5af6592cd707c5cc006b2cc22a59799ff81c1bf7a997f05ea79403be11", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378755, "uuid": "0731528a-0093-456d-8052-a13c803f19f1", "value": "T134A0020996B66136AC980C49734177850F4F10155D60AF62F0706509709EDFD37E77CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378755, "uuid": "f69826fc-94b6-4b23-ba7f-a4d6897158b3", "value": "3:6EWaDNuw6dK6CGAQJAfaCSDMIEjye:6EW7dAQJv/GX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780378755, "uuid": "a6abc5cd-c184-4978-988e-8df0ac7c3b18", "value": 70, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780378755, "uuid": "edad6314-1651-4bc2-a158-dd4154b8d079", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378755, "uuid": "3facaa0d-981c-4163-979d-1d1fa96b6f36", "value": "df205094a085d7e76a6ce26e257d7f47ecd77699eb57df9b99c664ada7083edb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02315be0-5e58-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780386751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386751, "uuid": "9858e9b9-0d2c-4c7c-a758-e50c799c781a", "comment": "Malware payload (Prometei)", "value": "68ed7cf2b3084225d40c502cae57f175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386751, "uuid": "e6dd1863-01aa-4a9a-9237-1babfb73e5ea", "comment": "Malware payload (Prometei)", "value": "df249293c0f1e0c87b5b0eac79221e04e4c6d1a7f91fbc1940ffe29619bfd07b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386751, "uuid": "c4e6b9eb-ce0e-4cbf-bf24-def12de9eb3f", "comment": "Malware payload (Prometei)", "value": "a61128de79308e36dc2282e75968da1ee3cc8482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780386751, "uuid": "89a57c11-11e1-45fb-b409-f5c01df44e58", "comment": "Malware payload (Prometei)", "value": "a90e86961a05992c85fa4fda958b09ab91e0cfb0fcfab31579cbbb41643d597f3f7606576882af8ba3d800f0155b18ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386751, "uuid": "6eab5563-0d5c-4bb7-8188-dbad62f54b06", "value": "T104A423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386751, "uuid": "3d09c83f-a22a-4ea6-83f6-536ab702427e", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdI:Fs6pyCC/Ya2hpi6T6N4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780386751, "uuid": "1b92f1a4-7f91-4fae-b12a-cb00d3bbf17e", "value": 449081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780386751, "uuid": "1399d012-ffbf-4366-b825-4a4ba086a688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780386751, "uuid": "9ce06395-3859-4c5e-b19b-bd46cb93f307", "value": "df249293c0f1e0c87b5b0eac79221e04e4c6d1a7f91fbc1940ffe29619bfd07b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412cea28-5e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780364523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "33cfa7e1-4e43-41ec-bc90-aa7ec08dc09f", "comment": "Malware payload (Mirai)", "value": "528646b7bb5e38404cfc35030822c1fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "7bfd13d7-8bca-461e-b83e-0a27cc4088ea", "comment": "Malware payload (Mirai)", "value": "e1271774df0f0768474fa2972f5b0c7811c8d1e122180dce99d9b7d2d0cfc31c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "89a90385-89cb-4833-b47d-a3017ecb4184", "comment": "Malware payload (Mirai)", "value": "ee35538b2d616be68dc07fd59bfaa9565a263571", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780364523, "uuid": "37c0aa3c-c7ba-4b6e-a886-c0db99ad9388", "comment": "Malware payload (Mirai)", "value": "01f8219f65fc196db0728155e882fc4925b49bcac5553713e62f3c75def9e8f173226b2bac041b52d7cb9663e8401e6b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "1e0f6c65-6fc0-483e-bc0e-43daf11c58a2", "value": "T1C1D4BF41730D3EA6E376743E80920B166F18AF4095832F2761F8B65A6D735AB2F3C587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "27e19550-0605-4cab-9065-8838d9ea6f88", "value": "12288:5D9lpYhXCv1XRViV1rowgNKN+TE0fhVHhIWV:LlpEkE65TJVHhIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780364523, "uuid": "035e6479-3011-4548-8637-e1e8714daecc", "value": 600076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780364523, "uuid": "fe0c530a-c56d-4cc5-8b0a-8601c1b2c07a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780364523, "uuid": "c75a9a5c-c0b0-454d-9c29-e910dc8f47c9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5376e21f-5e73-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780398483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398483, "uuid": "c9a1dcc6-75c3-446d-9bc9-3ede6903eac2", "comment": "Malware payload (NetSupport)", "value": "446abc44557e3b4f94402b13af3e7915", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398483, "uuid": "6da494f8-711d-4283-8669-6d4c38144768", "comment": "Malware payload (NetSupport)", "value": "e2f6f6ed64516ac9e5c885e9f16d5fd55c0146886ba9e526a4dfba2632dee1a5", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398483, "uuid": "41d31bd7-3360-4d24-bcff-758b5771555b", "comment": "Malware payload (NetSupport)", "value": "36f48b6aa782b8d8d9bda1ce19f3fa6856387ab6", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780398483, "uuid": "4a2fc1e8-a599-4ec4-a0a4-f1dca713005d", "comment": "Malware payload (NetSupport)", "value": "08e8c6858baaf0a0e9b3669bcad09b54439c61835f6d691171542bc65f0d5ef6864e276dca27ac1c0d2ec012de473747", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398483, "uuid": "18cec4e7-53bf-4cf1-850b-4c0a6520e06c", "value": "T14F1182CA84FF9D68DDA743BED4B8B41CE804BBCA206B0D67C115C1CB69930841C82527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398483, "uuid": "05f9dffc-77f5-4e4b-b1d2-0a67c1d3053c", "value": "24:9Vppnb9MvtUvE0DCcyqR7pK285DtKV4869/Dw9o/OOJDX1bxCT+rfpT/l:9VprM1mlRTKYYDw9o/jJZrfpLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780398483, "uuid": "598e0fca-ac0e-4612-a9e3-bcaf5be8b668", "value": 1079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780398483, "uuid": "2492033a-4b1c-41c9-addb-5bea846f5bbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780398483, "uuid": "6bf42a86-981f-4871-acd5-1b3e53ed067a", "value": "NDA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65afcbaf-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780415264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415264, "uuid": "2ed3f2b2-cf15-4a88-aa8b-3a5a9a69d0e6", "comment": "Malware payload", "value": "1917d2f43d22d88133dab21fa0dbc555", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415264, "uuid": "3d10cefe-ce42-4c51-9a06-e3fe0b897eb9", "comment": "Malware payload", "value": "e80bfc2d39e4f366e1c75be050ffaee77c3e84b5da324f8b812e4e2e3a35445e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415264, "uuid": "f489537b-9797-40a3-b13c-f9fbfba4ca52", "comment": "Malware payload", "value": "9390cfec50c9dbc0567e1e875f2f6ce458e4bc72", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415264, "uuid": "d3546efe-a9c9-4c48-b893-271bd21a0d2a", "comment": "Malware payload", "value": "a24910348cebb18c89620d64ad093ba204516a0e6bcb7ad5c317e59ed844d0e7c76d1baee4c545216aea12ec1b2f3fc7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415264, "uuid": "8670cce6-6160-4f17-abc2-c629b350523b", "value": "T196C31350025BCC24181D0DF87E5CC66A1ECFAD4A921F54E04A4E2BB3A1D72CF7ACE761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415264, "uuid": "35c1a9cf-69c2-4630-b89c-f31bf1ea5ecf", "value": "3072:vsWrHHSeSKFuk3hpY3XrT4g2t8SKy8jFM6piFRhEYQ4:ZLmKzxw7Caljy6pImY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415264, "uuid": "91fe48de-6717-46cf-acf2-6ef8ff6e6ed9", "value": 122329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415264, "uuid": "786c4da9-35e5-485a-9c9e-a0eff9263168", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415264, "uuid": "330c171c-aa3b-44bc-a59d-f65b5215582f", "value": "REQ_For_Payment_Invoice__FER9079900530981016230-800119_pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e12caf-5e90-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780411215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411215, "uuid": "3074ad45-2e00-4b7f-aca6-a359adfdc7df", "comment": "Malware payload (SilentNet)", "value": "7e2ad52d2c30518c3592ef5520a1b971", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411215, "uuid": "74f98179-7461-49fc-a8bb-58ac37f0a3fe", "comment": "Malware payload (SilentNet)", "value": "e88851e10c67090c442e46b1b989320268a842f4668ea72d26ae7738f2598b48", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411215, "uuid": "e8cc9aa8-7078-43bd-9764-f660b497537e", "comment": "Malware payload (SilentNet)", "value": "0916e2a1d570f6eb1e204a488eeaad2ac2564df5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780411215, "uuid": "4628092f-d8c5-4bc6-bbda-a2ac905e4caf", "comment": "Malware payload (SilentNet)", "value": "da9a3d837f032e5942e80bd7e67b3be127e565fa75feef0bfaa573dd38a801390e93f2088608a0c300d72a9b80656a4f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411215, "uuid": "a2466915-ef1a-4b2c-8992-772f8bbbe42c", "value": "T1F865337C0F8C4AE926D19F6364EC360A364F17C176D4F78519FC9E6382A90588B85BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411215, "uuid": "00c35706-9853-4e55-ad7b-813c75534dde", "value": "24576:lRQhQFFxTO8eN3MvfU1/inkuYC1Mbt3ajKvTWEwnwZvRJW3VdxbAsMxtXWo:lRAQpKB0ied1St64WEwnwZvRWVbMsMxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780411215, "uuid": "6bc9ee41-174f-40d4-aadf-0e5a3fa24165", "value": 1518119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780411215, "uuid": "d6431019-100a-41a8-918b-a0fb881b26a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780411215, "uuid": "9116c817-d261-44eb-9d72-d4b97a88c449", "value": "Dupe-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9574ac-5e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780360894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360894, "uuid": "647e1d07-fa00-4766-8875-e291d1c4422c", "comment": "Malware payload (Mirai)", "value": "d5427bb01d3fb33903484513bf16c7a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360894, "uuid": "2962b955-d7be-4400-9938-e2cc6ba0f0bd", "comment": "Malware payload (Mirai)", "value": "ec72118e58a55c1ebec13caa01dfe41dee17bb337a1f2a93e7cd566a995c590c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360894, "uuid": "dacc3caf-7fc9-4cd0-b381-6db9734a4e13", "comment": "Malware payload (Mirai)", "value": "60e9051fd01fe156fa805de312faf62aa3ebae7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780360894, "uuid": "d1f233f0-ebf8-44c5-af97-3857f2d42718", "comment": "Malware payload (Mirai)", "value": "ed837b365afb6adb6d46a6c562dc51bd0dc5394c9e66bac9722a1cb0ef94ae62bce8bdb36a6f6a68f54bf93efb93ad0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360894, "uuid": "1e3392ac-d89d-4e64-a5ba-d75247721bf1", "value": "T1E6337D35E02A9F94C55600B4B49C8F741F23F1C883532EBB2AE946F5A857968FA05FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360894, "uuid": "4b581954-fdd5-4692-849f-85262c66adb0", "value": "768:qaEfenkSqCYeztdLr9yUZf+atOhqbN9of7w2CXoixXBvLCHxw:qauu2ClzZfbARf7w2ri3zCHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780360894, "uuid": "79ebf2dd-da3a-45d6-bad0-ae479a47d313", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780360894, "uuid": "b0a50dc3-4a1a-47ea-b7d6-1ce2746452f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780360894, "uuid": "7fe0b342-5df1-4df3-ab33-14bfdb420592", "value": "OGz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ec0931-5e9a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780415260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415260, "uuid": "efd4ae5b-05c8-4b4b-816f-f5f2912b7bf8", "comment": "Malware payload (AgentTesla)", "value": "63deb82c05e509f872166cd06dea15ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415260, "uuid": "86429cf6-0c16-4452-ab00-a4fd2e66298d", "comment": "Malware payload (AgentTesla)", "value": "ef2d3beb60a0fc121aea1386af55c6eb50a15c9313b7a0a7f2726be013af81f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415260, "uuid": "a47b6610-1706-47b3-a145-a34360f3665d", "comment": "Malware payload (AgentTesla)", "value": "498a01e1371adcb1c32cb21ae7f094669d476793", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780415260, "uuid": "907ea10d-17d4-4d91-8552-872a05465e50", "comment": "Malware payload (AgentTesla)", "value": "bf6bc2d46c0d9c7048a65c6f3cf864140fea86f4e0ace3ebdb9ede2bdfa60b6285d974ba628b1dca6813daf3d9c1ee35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415260, "uuid": "e91783b0-4eb9-4168-87d3-66e9671e82e4", "value": "T19B653359F4E1E26343C0088CDC7BC465F9B1DF6DB0F9099A7B20C4E5A5B7E2A422A352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415260, "uuid": "9d67e3d7-d351-4fa6-8229-d061a812819d", "value": "24576:Ev3xHMYirKGjXi545veBsfLsQZczNvJKOTsvRCA362v7CCDhTspnwRBwP37JWIJP:EPxNirKGjS5nBsTS/KOqdvWwRWPrJOr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780415260, "uuid": "a541822e-14f9-4323-ad57-9f55229603c4", "value": 1532644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780415260, "uuid": "3ccff079-b7ba-49b6-9dfa-65ed8f13ada0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780415260, "uuid": "799db880-8b0d-468b-8675-87ad4a884dc6", "value": "Bank_Slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffbe341-5e37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780372681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372681, "uuid": "37a6d73c-3dcf-4e04-8f8d-b009721da892", "comment": "Malware payload (Mirai)", "value": "4971ed084da47b6f25543466810f70ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372681, "uuid": "fb4e8e38-65da-4041-85ab-e42979c5a091", "comment": "Malware payload (Mirai)", "value": "f0d5bbec893bf516a36e88d47f249b4e8a5724127d3ccb1128f33b57e55c45a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372681, "uuid": "4b0942aa-cc65-4535-a6b8-f7c6b6b10c6a", "comment": "Malware payload (Mirai)", "value": "c68a3511e67ec98e1eb01415b8e61238fd8e821a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372681, "uuid": "f361a97a-a2ad-4fcc-9ba7-252e37032460", "comment": "Malware payload (Mirai)", "value": "4bd2820f734a2308a400a30ade3e5e5e8ed864a803f1b2e699a041e80c0a641edc2cd23a209ba1fe9372c9a767d9f82a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372681, "uuid": "729e1f0a-703b-4709-abbc-2989648385b5", "value": "T10573178678969A1AC6D0537BFA1E82CD3B2573CCE3CD7207CD119F6136CA92F0D6A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372681, "uuid": "eb343013-a8cd-4d31-ad8a-b8c4257499b2", "value": "1536:PVuza8aam2uLd70zAR3rWrKCdqkZFPK6:9UaZa80MbW+yP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780372681, "uuid": "fe855b27-43eb-4fab-8f7e-166713021e97", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780372681, "uuid": "065520b9-4417-42bf-9651-f5b889bff515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372681, "uuid": "9f97c038-995d-4dee-8f47-6ee99336f832", "value": "azsxd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41671b18-5e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780372683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372683, "uuid": "ebe53b94-108d-4e1e-85fa-e1131ce8e738", "comment": "Malware payload", "value": "46a13bf1d5be4b730cff423a525d52fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372683, "uuid": "6bfeea4f-11de-437c-a3ba-5a8e611beaaa", "comment": "Malware payload", "value": "f1542012866d855ac0bf2346907d2c4ad9965db72eedf8ee7300dac730357055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372683, "uuid": "554f6541-e0dd-4429-940c-ef5c31ad9317", "comment": "Malware payload", "value": "2a770a5647844031e4bbe4a8e0b6c12ce02146b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780372683, "uuid": "417cca45-2d48-4212-a7a6-f3a6af297813", "comment": "Malware payload", "value": "0eb60dd37e4304edae9ac72a15de04b718aa6b388047706aa4f0244f0d7aabe7f349cf805131b302e1ab80775bd2d0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372683, "uuid": "03c7b2e0-f096-444f-b164-fc698b7971cf", "value": "T16453ADA6CD2E2D98D8040578B825CF7D9B23DD18C9531DE58A72863AD007DADF89C3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372683, "uuid": "b7991ad1-cb39-42b4-8184-f11ec6e83139", "value": "768:VUcvrVYPytXW+F7W+F2+FW+FnXZJ86Uh3DgVneqacoawrV/eYtmDHPYn6c1y8oCP:VDvruuthhqhzgWjVtmDHA5M7CDJMCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780372683, "uuid": "b4a37f2a-b0fd-4248-a315-f01c1511ae6c", "value": 62588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780372683, "uuid": "d72fa9ad-afd9-4846-8d7e-dac01251c65a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780372683, "uuid": "7418aabf-4e26-4242-a74b-ccb37980e20a", "value": "azsxd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f6f5c8-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780382863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382863, "uuid": "1c2506bb-5531-4343-bd03-0647e37f7f2a", "comment": "Malware payload (DarkTortilla)", "value": "810b7bf6c630551b2c9f93ed71229cd9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382863, "uuid": "a381d8db-5e8a-41c2-950b-07ec20aa2e24", "comment": "Malware payload (DarkTortilla)", "value": "f217d0dd5b3a9665d075eaed2b69ead2de65eef2a82ecab4bbb4c4fc764335f0", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382863, "uuid": "085f9e6a-0737-47e0-a4f0-1bcd280c80cd", "comment": "Malware payload (DarkTortilla)", "value": "5726100615a96fb88bbbe1800e077ece978ad605", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382863, "uuid": "b7594bcf-bc24-4f19-a545-63573d790788", "comment": "Malware payload (DarkTortilla)", "value": "f32865aeb3d8685167349943e41f0ff92e542c01938143d804e5b0d817a6220ed3058d2b10c6bb7b792f47783fab3e08", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382863, "uuid": "84fe988c-eafd-413f-907e-6c6432e65f1e", "value": "T1E275C00117D85F24E1BF9B30657A0022C2F3FD1A8E71D75E2A4AD9E96532B05DB92B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382863, "uuid": "e31fe2d3-8d7a-4e35-a36f-43b9d1524927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382863, "uuid": "8e5e291b-2e97-448e-86ca-efece6587db5", "value": "24576:gO7L51pC1nbbAfKbXpZllWXETG30tYDWzocEuei+Zcyr+Xw6E:A1bl7poUH9zNEIo6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382863, "uuid": "1b1d1a87-8023-4238-9485-923e58316c01", "value": 1693696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382863, "uuid": "052e1baf-c0de-48b5-833f-fcb5a9229fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382863, "uuid": "d67ad8b8-ff7c-4895-a1d7-fd1504b09511", "value": "Shipment of Original Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b03027-5e9c-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780416308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416308, "uuid": "7db5f269-233a-4a2c-8662-713acede91b1", "comment": "Malware payload (NanoCore)", "value": "f99d7b60f96379d13d54ef51d8914904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416308, "uuid": "1feedb0c-df71-49d0-9c31-d60ba8dc255a", "comment": "Malware payload (NanoCore)", "value": "f328ac4d4662fb2a9b2ce2ad9961c795404f62b73d4315cbcafa5779da2cb4c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416308, "uuid": "2000e2f2-4ae2-440b-8aca-d89b85e2f69c", "comment": "Malware payload (NanoCore)", "value": "ca02fe114c682e2a65c13abab67bbfb82ca2e0af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780416308, "uuid": "2a45b5eb-2480-4dbf-8b31-f7a4e5c271c7", "comment": "Malware payload (NanoCore)", "value": "8664f195ebf8c762def1a4e27b2ef496aaec719b7e4b4afd94981f6b1b47c5ddb7f323cae47a54faa330b97b62b95b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416308, "uuid": "c18b0312-3679-4a57-9acb-7471d08ad7f2", "value": "T12614C05577A94A3FD2DE82B9602211438378C2E399C3F7EE28D864B74F263E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416308, "uuid": "b23b8442-af5d-4bac-a29c-4371df5c20dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416308, "uuid": "bc29710c-263d-4407-97ea-27611c58c470", "value": "6144:MLV6Bta6dtJmakIM5mMBrwBJnaMC8xFev7y4QT1tg:MLV6Btpmk/MFIPHPe2Dtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780416308, "uuid": "8e46c381-1b2f-46e2-953b-5376672dc57c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780416308, "uuid": "95b7fcb1-dc4e-4a78-bd55-9fc66177e869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780416308, "uuid": "92b632a0-92c0-4f91-889a-b00cc83d168c", "value": "onrealms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16d03d0-5e75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780399607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399607, "uuid": "4521cb43-114c-459a-9018-caa2ce7260da", "comment": "Malware payload", "value": "32212d7660dabba11c69efe5283030fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SFVerif", "colour": "#29D970", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399607, "uuid": "d8e58986-c281-41dc-9635-97cbcf401259", "comment": "Malware payload", "value": "f4feb4b8de80f857932025b16a6a164569be6f23613cfd7786fd5171c13562ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SFVerif", "colour": "#29D970", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399607, "uuid": "90a6e2d8-a296-450e-9cd0-9d8906c7532a", "comment": "Malware payload", "value": "f78194780efa45339097480328a189a18bce7f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SFVerif", "colour": "#29D970", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780399607, "uuid": "00f50d4f-a169-439a-938d-5a23795e100b", "comment": "Malware payload", "value": "b0604cf5c413d72cef0983dd15f23787b01a37fce204d39c4ed2caa332be9ad186b166d38bf4bf42f5e82e005e412826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SFVerif", "colour": "#29D970", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399607, "uuid": "0e7d97a2-2386-436b-aa79-6ee37a1ba160", "value": "T11D46F13AE715045EF02B827A8652D3A2D5713E80E73566F706B06F53BEB35C14FA9E80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399607, "uuid": "5501216f-d1f9-421b-abc8-63e1d57cc5db", "value": "56c03c4c37f0f8f3753c3dcf603109bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399607, "uuid": "8f9c3a40-68f7-40a2-b75b-b258735628ef", "value": "98304:75Jh83Eofnf7TN+c8Wl6B+Ip9L1P00wbPRTiZfI8E6dnH:NJh83EkTTN+c8WlIxhP0VROZAR6dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780399607, "uuid": "75d5bb9f-953c-4071-b4b4-8e3fb269432f", "value": 5570048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780399607, "uuid": "bea1cd95-af73-41e7-80ea-9b39e1d6d2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780399607, "uuid": "14b1b944-3c0a-4473-a8a0-12ddec9e5e1f", "value": "f4feb4b8de80f857932025b16a6a164569be6f23613cfd7786fd5171c13562ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e4808e-5e55-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780385744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385744, "uuid": "2b355b45-ca16-4c51-96fa-5a0266192e6b", "comment": "Malware payload (AgentTesla)", "value": "11c71a3de7c1cef2d2cc4d7bacc7ac51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385744, "uuid": "55dd7c7f-6cb2-4a35-9e88-91f6ce7387a2", "comment": "Malware payload (AgentTesla)", "value": "f7246cc01c8470b5c6fe8efb5f2c18ac5a981510b007b224d789a717e15a6ccc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385744, "uuid": "860c6c30-19b6-4e04-912c-a42e022ef9a0", "comment": "Malware payload (AgentTesla)", "value": "415b872434aa9ccffbbfeac9272e0b5b79c932d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780385744, "uuid": "b0d93511-ff3b-45e4-b5f2-695f97d3d655", "comment": "Malware payload (AgentTesla)", "value": "8f2972970043392841244296d90dba5e6443ca07f93ac3a15203403469db523f134414d767d9639e86b9a490cb7a9e08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385744, "uuid": "4e0a5093-02d7-4bc1-bcd6-dfc1bbf15ee1", "value": "T1D1D42304B6D08593FFB8CA34186AAC269634BD116EF5D2D72B70BE1B3D77A24454F30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385744, "uuid": "7365457f-6c90-497c-b91c-566d22d60489", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385744, "uuid": "59e23b4b-5fb0-48c3-a276-56dd8b5f24ba", "value": "12288:Q4yFnzcPEqj6sKqOn18Dgl/i3r/lEt8ARuQXQD+0:Q4yFnzcMqGsK718cqbl2Pg60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780385744, "uuid": "d6dd2f1e-246b-4f7c-b953-dadc7d5642e3", "value": 637544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780385744, "uuid": "4e791f65-6c1e-4d01-8b6f-1f4cf29d209a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780385744, "uuid": "310c9e76-3173-43c5-85cd-d9f7050e7ef4", "value": "New-Order75688687A0012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9708fd-5e5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780387632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387632, "uuid": "6d6a4db7-d7ca-417f-83e2-9552c5497439", "comment": "Malware payload", "value": "44b0e909b120864de8bfe579cb97e265", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387632, "uuid": "18ec2845-e4ed-4afe-8be3-019d754efa1e", "comment": "Malware payload", "value": "f7d98e451b7acb40adea1b84e5df78431e8bf128a7d48dcb5222e4150dd2e805", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387632, "uuid": "f2f7b9f4-e1c6-458a-a7ca-fd5a3ce2dc3f", "comment": "Malware payload", "value": "d5a50ce7fd9bac71baffc5c1ac442a2d9e67c500", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780387632, "uuid": "3b6e7f77-2199-486f-b02a-286ccfc9ce85", "comment": "Malware payload", "value": "0cdac172705f63c81afaa51df8b2bdbb930687b7b4719681ff9932defacccf3fb000cbeb6cf333a656a3c7e816ba1735", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780387632, "uuid": "f7c3ae29-d555-4bfc-9456-1854ff05c591", "value": "T194016FDAC001DB508186F85E739756947821C3CF19414BA47E9C043D9BBD658B116FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780387632, "uuid": "e1eacd86-3eec-42a9-9d3a-5f2e3f9f90f1", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkahIX6sZIakpThvIFk01ICW/Xk1Iit9uNaa:kXCKysE2hi0ziQvZohah8644GDWM1o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780387632, "uuid": "00b00852-c020-4d1d-a66e-d442822f447e", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780387632, "uuid": "b5c28846-69e7-468f-b464-0ca6c57ed4ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780387632, "uuid": "e40a3448-e971-49d9-8d21-d926d5548757", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dda83ee-5e3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780375415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780375415, "uuid": "803d56f4-9703-4ed6-8894-3aafc5bb23f5", "comment": "Malware payload", "value": "4f7c0f5299a529570ab34c02d2914299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780375415, "uuid": "61379212-b532-4afc-a1a2-87c33d8c768d", "comment": "Malware payload", "value": "f8c2d5f3bd508bdf2fd39f8940e03ad29a4d679d62f670810cfac0d9b125123a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780375415, "uuid": "b1c6380c-9f3a-4716-a956-6cf20761ca46", "comment": "Malware payload", "value": "d1162e7dc47a50ce96d3dfb609922a887d464a20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780375415, "uuid": "f37992ee-cb5b-46c9-a825-6feeaa1e4e68", "comment": "Malware payload", "value": "0e4a46ee4c87c53185698f33005457a5582d9d40204aae9f150fac8e75e5f914a97c98110d1d1df1c226eb2f2833ac1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780375415, "uuid": "522607d5-08d6-47c5-be00-59bc4813c19b", "value": "T1F2B3D81E6E618F7DF369C73447B74E22A39833C726E1C645D16CE6045E6038EA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780375415, "uuid": "069c19c0-0fcc-4de9-8ba1-f70a6d9828c6", "value": "1536:dwo8vNcRTe/fEmgiTSrwP8D4Y51oxaEeFgdrp+1YsH6eraXFJsb:dwXGTe1S6o12eFgdrp+VHs1J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780375415, "uuid": "a71c1b8b-ade9-4b49-92a4-3d7031e81d04", "value": 113196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780375415, "uuid": "fc6389cd-bf32-45cb-9f7e-d7940e440a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780375415, "uuid": "afc66962-e9a7-4741-8b91-79c6630b593f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1763e3fd-5e45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780378626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378626, "uuid": "a5f39484-c4f9-442b-97da-a156828295a7", "comment": "Malware payload", "value": "77b1217ee8d09f2e580d8e91a17ee99d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378626, "uuid": "e4f0b19e-33bc-4964-bdee-2af4f963c5ec", "comment": "Malware payload", "value": "f9348db80c31a66494d9aff4a875bd49aaa7842604dc95a132b8aed136d693ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378626, "uuid": "ff3de8c1-9e42-44f4-b0ef-43e9ec189630", "comment": "Malware payload", "value": "b27ae5ca7529500e83288efd9b9b659602a1a760", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780378626, "uuid": "1d68780d-15a0-43e8-af77-1b67ac79e6f9", "comment": "Malware payload", "value": "2b2f8db5a0481b4e6873b74fd0ff29fdfbc5e5b98e85ea247e1aa4272475183765996206c0d2bc8d292971a87da681b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378626, "uuid": "c0975471-ac76-4782-b9fb-39d5a9498ead", "value": "T15EE6123BB28B653EE06A5B357A72A210583B6E6165164C16DFF4F88CCF3D0701E3E646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378626, "uuid": "07aaffeb-ab23-48bd-b0e1-8900d41dbd95", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378626, "uuid": "2b865392-f139-4133-bd20-531af745c419", "value": "98304:r5/ltzCAascrCXGjiTybEq2DH31mAawogmzrMMMjtapudBg1e50caIllV56z:FaAXnybEqCX1mAawogXMMgpyBlyck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780378626, "uuid": "327fb177-46ab-4450-bfd5-68355fd2236f", "value": 15050654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780378626, "uuid": "5330f94b-96a4-4c9a-aeaf-90812fdb343b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780378626, "uuid": "8eb8ad56-59d6-4997-892a-adef5af47a02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf969197-5e9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780417160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780417160, "uuid": "8ce897c9-cc35-4fb3-99ab-1e0715ca0089", "comment": "Malware payload", "value": "f9210dc57b91df84ad8da02f84edc84a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780417160, "uuid": "70ba53d5-2271-4f91-90f6-3a7630751b1e", "comment": "Malware payload", "value": "f9a2e7427edaa1d272652261e371ffebcc2aaf5a2fc81c8a018d7718dffe91a3", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780417160, "uuid": "c92ca182-f4ac-4b76-bd28-65620d1e2a4b", "comment": "Malware payload", "value": "a603ec0e88f525693e74fc4f28847502a373af80", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780417160, "uuid": "aad36a2d-def5-4394-b079-67d8553fd3cb", "comment": "Malware payload", "value": "10834de7e2b3127865d9f9ee43790527fffa0c159a39c2e344d1f8da86f4e3737af72c47a172d29f6ff674a6a39805c0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780417160, "uuid": "d11817ac-d109-406e-81e8-ae725483eccb", "value": "T18CA58C47BC8020B6D5EA923289B552A17B70B8991F3137D72E46B3B82F737D80E39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780417160, "uuid": "30ff921a-9cb9-4a06-9292-b4d9157f1099", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780417160, "uuid": "df979b55-2add-43be-9c67-5241c7de847b", "value": "49152:JX95id16QPhL365rN3mQhvZgRAbmBD1Pr:oPhL3Ur1ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780417160, "uuid": "f1fec38b-946d-4e9f-8c48-88fee0cd19ae", "value": 2233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780417160, "uuid": "1073bf5f-7b88-46d8-9add-cf3d34fcfd8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780417160, "uuid": "9e19a0b9-c897-4116-ad15-e3bc955be78e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26cee3f-5e97-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1780414212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414212, "uuid": "7dd3cf7d-f96e-4285-88c0-60ba4cb91994", "comment": "Malware payload (Sliver)", "value": "29b94f7d822357bce248f2a97b963389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414212, "uuid": "789a4567-c544-4d62-b9fc-f8b42fa0db42", "comment": "Malware payload (Sliver)", "value": "fa5d1b1867e2991ee02255d6cc2af665c0553d3b3874e66a043791951dce4b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414212, "uuid": "dd012db3-05a8-42cf-bfe2-e90b3a854613", "comment": "Malware payload (Sliver)", "value": "1d5da8074c540a9e7b057866e1af1634b85b26d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780414212, "uuid": "5e87b776-f94c-4775-891e-299b87e97214", "comment": "Malware payload (Sliver)", "value": "acfba282843aa088c8317509daf2c87f6ed08b2e5eed2b511919fa9dbc0c87fa90ea13ad346852e296a0843214e7e473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414212, "uuid": "5d6ccadf-4e3c-4b8b-b0c3-9a95708c88e9", "value": "T120774A47F8E21EA4D4EAC274D125815BFAB23C290B3C27DB16A0F7241F3ABD05A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414212, "uuid": "c9ca8aca-1b97-41cc-8066-1e073bee3329", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414212, "uuid": "52359e96-0df7-433f-a530-771d87733d43", "value": "196608:z9ZgOxijkGa7ULdcI1oYGvasztygbUvX2vlUmnpP+Js9bCKqE48a1TjUFl6CeSft:zTgOxB6dXF2NUu+29bCKqEU1TAFr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780414212, "uuid": "6fa0899b-9c41-4547-9c60-23503f2e73fb", "value": 35170816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780414212, "uuid": "675ef54b-604a-44fe-be49-d88692e78ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780414212, "uuid": "d3f2e565-4b86-4fbc-9413-56060eb1695a", "value": "beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679657b6-5e26-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780365446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365446, "uuid": "ce291d3f-9d08-458e-81fc-be1aabf49ea7", "comment": "Malware payload (ConnectWise)", "value": "95fe23dc6dd9ad09a76f58d47e06a21b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365446, "uuid": "490277b6-78ce-402d-90b7-24ca2830cc57", "comment": "Malware payload (ConnectWise)", "value": "fbacb917b4ff93ac23d9d20f8ff08f0cf16147fd28b5b3c14410496d5325dbb3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365446, "uuid": "9b0e0118-dc11-463d-afa6-325db5439f4c", "comment": "Malware payload (ConnectWise)", "value": "6b1f75b4b8cb224ad5e43807feb6ab0caa52ca11", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365446, "uuid": "9853cba0-7118-447c-bf3d-8db70aed84ca", "comment": "Malware payload (ConnectWise)", "value": "7616d6713c61394fb204773d0909f3fa6ead7226dd47e3db43ab368c4fbd0e0d08ead762a7513f3a59f997245b1c0311", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365446, "uuid": "0da0f882-c243-4aea-97d6-5e28aed3b2f0", "value": "T12B646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365446, "uuid": "f034ed8e-f2a2-4bac-b6ac-574a3566004a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365446, "uuid": "13b25944-503e-4a6d-96ea-c47468d9ab5e", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9mPH:Q1iw7gryNkSV1hy1Z1u2JLa9mPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780365446, "uuid": "418ac843-c5e4-497e-8bfe-bb9b6c814fcf", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780365446, "uuid": "9d442e78-657d-4085-a280-816e79e49441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365446, "uuid": "c0f08d75-1a33-4f87-a7c5-c346e2351a6c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3371c6f-5e4e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780382860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382860, "uuid": "146c107f-be12-4e36-b050-a5347f35de0f", "comment": "Malware payload (AgentTesla)", "value": "ec1d4ed4c32774f7472310cc2a31dc22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382860, "uuid": "c4ea1edf-3fad-4202-8a1d-05d535352587", "comment": "Malware payload (AgentTesla)", "value": "fc4ba40128ee5df9caaa25bafe1a3d6619f208b2bd206f564267298a0294328f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382860, "uuid": "6ccf27df-58a6-47a5-a97e-edb433e9f47f", "comment": "Malware payload (AgentTesla)", "value": "cb929d8ebaa0c8b47b5da4e1f12a2312faeb9a10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780382860, "uuid": "566e7c6c-0c44-4864-b789-22344f6e6ae5", "comment": "Malware payload (AgentTesla)", "value": "13dcd4a8a2dd01618506d76dde58e096ed12382efd44d0680af1b5b9ec0af5e82f632690f4ef66d5d1c91fc8d55d8d67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382860, "uuid": "3b9045c2-0eb9-4c0c-82bb-a20de5294735", "value": "T1653501196B58DA01C9BE0B3844A1E37507F58E1DB122E3169EE4BCDB7C353666A1F283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382860, "uuid": "42b1b3f4-85cb-4892-b1eb-cdc9af103a28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382860, "uuid": "46c07fa8-f5e5-47fd-bfa3-d76cc7704278", "value": "24576:zfsNJTnoyQbWKBlzlErpNog3D9FS6K6GQcP8+g:zkjozhBlxENNoGXBcPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780382860, "uuid": "7a0ce6dc-b501-47b6-84ed-c74a837bf6cb", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780382860, "uuid": "68501a21-3436-42b9-8259-a0114f67d5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780382860, "uuid": "40ec2cb6-17fb-4280-81f1-8b7a356e727d", "value": "Required documents 0023781149 __ 01.06.2026 docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa3b589-5e31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780370310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370310, "uuid": "a2e370ad-d2eb-4a64-a268-e10ab562b9c7", "comment": "Malware payload (Mirai)", "value": "2dcf3b18f37135bb19ac9a2d1fdf057b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370310, "uuid": "df247505-a3cc-4186-8a37-8df122dc6af7", "comment": "Malware payload (Mirai)", "value": "fc5fff5a1ca57f1e8c8e4cd61a37001b87c02462054ef0237409dadecbba05d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370310, "uuid": "108f06fc-cc8c-4403-af81-134794f022cc", "comment": "Malware payload (Mirai)", "value": "94cbae82195fc96e3fd16654ac0ab2ecb4547b13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780370310, "uuid": "86b70e2d-3475-44da-95d5-2ec37f56e69b", "comment": "Malware payload (Mirai)", "value": "68a581cf9d21a28902915509f0d20af311afd15c472cad6084005775604d2a2f04b530f2bf4753ead67cf7f310ebdfcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370310, "uuid": "bdf4b354-91ac-45db-a313-2eb13e6fdea0", "value": "T1C153F1E5A570A8658EB07D326798588B2F3C87A8D06E734153410E686ACF357C6F28CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370310, "uuid": "18b466ec-1126-4ebd-a520-97761ffd8081", "value": "1536:jBLTVfOC19v6S14D5WqiOTVm7b/VL2iZr6gxLDIgmn89lyb4a8hGpx:dLBmC1gK40qiOTVMbnDLDDm804a8hGpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780370310, "uuid": "ccc850ee-b217-4623-82ba-cb0d1b67c0a7", "value": 65204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780370310, "uuid": "e219be6e-77f6-43b4-97bf-f86ff24c447c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780370310, "uuid": "23110dc9-a512-485e-96e4-6c5c148973d0", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8674aa0b-5e8d-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780409736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409736, "uuid": "8f016c16-503a-44c4-b54e-86ac1c1d5f8c", "comment": "Malware payload (WannaCry)", "value": "56264ff7061aaab3e2e4c837e94001f6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409736, "uuid": "8b9c6a9d-fe2a-46fd-8b98-415e55e8f165", "comment": "Malware payload (WannaCry)", "value": "fca285e18772b675c138123f7900050a81b24f13e708f76d43eaa6c5212cc78d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409736, "uuid": "5e17ffbe-4a04-48e1-9211-4348283e24a3", "comment": "Malware payload (WannaCry)", "value": "18c5eead3c7633da07a5ec1df057b4814246d8fc", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780409736, "uuid": "c3b0d0af-0987-4855-9bdb-9d02e9d6aea7", "comment": "Malware payload (WannaCry)", "value": "27ca91d37c2edc6735f2aacfe554538c3261be9c52e1e67c5e6ae64e7400be40b0f2ef5ec38aab8d869d52d75c9b4337", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409736, "uuid": "d3bc0b45-335e-42af-9ca6-820179d56474", "value": "T1E03633A863A8D1BCE149167444E38E1AB2737C5153BF1B0F47544ABB0E537AFAF90B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409736, "uuid": "5cd9333a-a252-45af-8907-1c074d21e3aa", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409736, "uuid": "e8ef8726-2dc5-4db1-a0d6-86653cdc1a2b", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:DXDqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780409736, "uuid": "69e05dfa-d882-48b5-bc98-e778e9c00194", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780409736, "uuid": "eb09a121-f65b-4195-9a9e-3b7f7d540882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780409736, "uuid": "2ccf12e0-fd58-4979-918a-47298762cca5", "value": "fca285e18772b675c138123f7900050a81b24f13e708f76d43eaa6c5212cc78d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f23b6bf-5e26-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780365459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365459, "uuid": "e9692e55-bd43-4326-9f7f-ee31902db485", "comment": "Malware payload (ConnectWise)", "value": "0f542a85a3a411791b3ef83cefa7d30b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365459, "uuid": "57eefc42-d552-4d43-a6ce-d6079db56b2f", "comment": "Malware payload (ConnectWise)", "value": "fe514c54237c1978d00d9315eb1e329b4e70cc31ae88adedeca60d7d7e3338c5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365459, "uuid": "b578b6a8-f87e-45d5-b58f-e3113ce81642", "comment": "Malware payload (ConnectWise)", "value": "5b963180117e80c032688a207b316be51c7fc133", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780365459, "uuid": "dc16a6af-f30c-4075-b31d-3a3b9093f435", "comment": "Malware payload (ConnectWise)", "value": "918d74a44cea6af9e9141aad7c060b1584007b15972b549759485668e387cdba3c63e2a2758bc35357b6326f70c6d69c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365459, "uuid": "a2dd5f89-5b9d-4cda-8841-612178c9e6df", "value": "T18846E003B3D599B7D07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365459, "uuid": "80db5c5b-2863-4128-a55c-bed5be261176", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365459, "uuid": "2c9ea531-feb8-4870-ab44-7811caf21844", "value": "98304:zzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:zhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780365459, "uuid": "71d2cda1-4bb7-466c-8654-ad66aa09c307", "value": 5687240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780365459, "uuid": "522e48c2-5b3a-47a3-9477-52caba95e425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780365459, "uuid": "adde454a-abe0-4da0-b3d7-20e87cfbb272", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1020cf0d-5eaf-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780424140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424140, "uuid": "1260e7c6-6d0d-49cd-a1f7-5270fdd911f9", "comment": "Malware payload (WannaCry)", "value": "c43b17f9fd67e0cf36085d764497aba0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424140, "uuid": "58d13843-58a9-49d1-8fc0-18e6751962f4", "comment": "Malware payload (WannaCry)", "value": "ff28966fd236b12f88c3a6aef0e56e467259560a5aff0edce5a3c9823767bbb8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424140, "uuid": "14402800-96f7-4309-abc9-a2f0f9f8efa7", "comment": "Malware payload (WannaCry)", "value": "9c888790d23ac42020dfda8b993ce8bf594e9440", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780424140, "uuid": "2f6a5689-8e89-45fb-a7b5-a57c22ee0154", "comment": "Malware payload (WannaCry)", "value": "695b97cbc27b6c0e96aae4a777764977105fc7d93496400623c813cb87f4af39cb49266d0dc4c31227f3497c6affc5ab", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424140, "uuid": "b65678b5-4fb3-4a0f-a3bc-ba52faea1c37", "value": "T1B736CF39A361F0F7E7C5C5B890A3C727D50B7FA06381E37DDA0376593A8319AA624613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424140, "uuid": "2b04355f-05c4-466c-920a-726f1305c387", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424140, "uuid": "c5728958-64a4-4497-ac3b-0d2e11a99bb0", "value": "49152:jn2nAQqMSPbcLINRx+TSqTdX1HkQo6SAARdhnvxJM0H:DyDqPoLaRxcSUDk36SAEdhvxWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780424140, "uuid": "34131c55-c0a3-424c-85c8-ad1214e5fa2d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780424140, "uuid": "ace462dd-8b69-4038-a6c3-a2c3a45c874b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780424140, "uuid": "0b72786c-078f-4a96-972f-a4a62d5582c6", "value": "ff28966fd236b12f88c3a6aef0e56e467259560a5aff0edce5a3c9823767bbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }