{ "Event": { "published": true, "date": "2026-07-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-22", "timestamp": 1784764982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "02ac4ee0-6049-4dfe-a75a-3ca3f7326560", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410a7625-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757844, "uuid": "4e52a5d0-ffe3-47ca-b5c9-770e7a38d99b", "comment": "Malware payload (Mirai)", "value": "0cd9ff95f53154b23f0af65334ae5e3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757844, "uuid": "781668c7-d9c3-4068-902f-a67a49299ef6", "comment": "Malware payload (Mirai)", "value": "0098ea36c6295429a874ee13e707c1e05c573f18290f035fac1a64b74c8c2ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757844, "uuid": "cb44f666-6af1-47b5-a4e7-c9cec3dc2217", "comment": "Malware payload (Mirai)", "value": "b842fdde09502ad46aaf044fac6161c472d20787", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757844, "uuid": "423a1279-6974-4589-b4ff-a358f1ac72f4", "comment": "Malware payload (Mirai)", "value": "a44b24a40ab1d594fe55388b74dfca938e37c8030481b89c0e357f2e2ad28cef025c29b67bef9961f7685147a5e754e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757844, "uuid": "95ce89d6-7984-472d-9afd-cfc52282aa0c", "value": "T188C2F0689228D072B1B45836FD6F0103A736CFF8DAEF362622144334E097D26D6B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757844, "uuid": "773b7015-fd01-4cc1-b309-fae3b88574b0", "value": "384:XH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNaXhymdGUoB:myNUQUfhQllxlaH0MFjlOnGsIs3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757844, "uuid": "6609c4f6-cbcb-41a8-b2d5-fb8b031fc459", "value": 27352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757844, "uuid": "b93bfd5a-1ba0-41ec-aa26-415f090b06b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757844, "uuid": "531c7246-0433-464a-81d9-6d8f28b91673", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976c01e7-85a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784706879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706879, "uuid": "59d70ae3-b629-4c94-b86a-a29abc73b8fc", "comment": "Malware payload (PhantomStealer)", "value": "add3502445f13bdd60883121abd1867b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706879, "uuid": "5f12cc92-4c05-42c9-a2e7-1791b93f5b95", "comment": "Malware payload (PhantomStealer)", "value": "00ad2a4a6811ffe57ef26471e0471f036c15ebad8e9526be7c54ae40b9e066ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706879, "uuid": "782bbe9f-113d-49a3-97ea-c18d9f179638", "comment": "Malware payload (PhantomStealer)", "value": "bca4a5bfc30e6cea2d8c62060e1d36fd3411e483", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706879, "uuid": "bf6b5e2d-0fa6-4fcf-b0de-df9ed71350c8", "comment": "Malware payload (PhantomStealer)", "value": "fb909995ef10777e95033df913d578cba81866522e3f877934f48982d85d88271f3c652b7e79e61809b64b46da0d4202", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706879, "uuid": "147926dd-155d-4ffc-b460-03aae9f479a0", "value": "T181F5F8B6A3AE269A6C0C77A460CC43A84F1FC66CCE57F640A0C717D4765B96239C136F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706879, "uuid": "fbf3a270-9dc5-4d31-94db-cb29d459732e", "value": "49152:YSBJ5eXI4uWt+MdOdCfKRw3zX3qUyKvXxn2KIECZacI0BBn48Eneb6JPm4:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706879, "uuid": "6307119f-b8f7-4576-95d5-d008b5a84ab8", "value": 3639413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706879, "uuid": "e2fe5a7c-95ee-40d3-8b64-0a8b5c4a182e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706879, "uuid": "86341b02-a71a-4839-ba2b-80507c3bf8cc", "value": "ORDER_9036pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634d71cd-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714952, "uuid": "14b90712-a4d1-478e-a1d6-1e251b0e0884", "comment": "Malware payload (Mirai)", "value": "0b55a399b418d4d68eb7fa1f79a3e13a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714952, "uuid": "5ca9c28b-7778-4ffe-9583-87d5f33c0acb", "comment": "Malware payload (Mirai)", "value": "012f125c303c8f6c5ae5721e92c4b631233c5c95c05f585d94ce6605af66eb39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714952, "uuid": "4c99fbbc-a8e5-4780-a6ec-58f17a0a198c", "comment": "Malware payload (Mirai)", "value": "180af2b6791656610c71c3f4803f520bc09af4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714952, "uuid": "8f9e9eb0-a259-44aa-b19a-6c79997fbb3b", "comment": "Malware payload (Mirai)", "value": "7e48b0a3d788ff9461a599d023c6d40e024fabdeb8c7c1e8478683e3ace1ecad8397551c472c902b30f8445d5ee7ea9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714952, "uuid": "e3dc5ed1-99a3-4b75-80ff-371942d392ed", "value": "T11323E135A80386158E21983CF85B4A406E158BECD9F27436835473FD74EA2B34ED9CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714952, "uuid": "72f46b3d-bc43-4e91-a15a-d81dcf40c03a", "value": "768:t1LmPdMRrITER0IiQ/Ww+Y0Ptvd+2eSh5VihxJ+zJeA3ybxZR8In29q3UELr9oqV:tJmVC0QRtnt0PtVCxG30znL5t8Xzh65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714952, "uuid": "e5ff2344-44b3-4f55-bb1e-9946409a56fb", "value": 48732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714952, "uuid": "f56b9d3a-4023-4340-9101-e3eba85858a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714952, "uuid": "7d3a6bbd-a1ed-4718-a92a-b329bcbe475f", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd22a5d1-8600-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784747423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747423, "uuid": "e627c569-1d31-429d-a752-16e00de3e02d", "comment": "Malware payload", "value": "1b568b9c350082f1b1f3dee144039889", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747423, "uuid": "a60a05f0-46fd-416c-9176-75686ce4bb33", "comment": "Malware payload", "value": "020207f83ca789ed36beb3a220d55c6b0ab43916b4c6d400bea6f063f387d713", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747423, "uuid": "75ab85d3-1dfb-4b21-90dc-85bc1f128f04", "comment": "Malware payload", "value": "4652e4cac76d7ef285a1ddb1df12b307370eaa55", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747423, "uuid": "a7f974ff-a199-46af-9e8a-89d06655dfb7", "comment": "Malware payload", "value": "a7b4b90666c2b835dabff1d1df10630216d73cf6835bef8459a4503af60be0b8e0b6ab58daab1d6d0ff460d88b51498a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747423, "uuid": "10dd0012-bd71-4cce-9600-488e70f84cbe", "value": "T1DB137D691A953C259E9989371D7E2F0CB9AA83E1300851DDBFCB3CF28C45ADCE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747423, "uuid": "1fb9101a-9c17-424b-90b2-f33f5222236c", "value": "768:SdVEJVIhtM39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:SzEJ2MAco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784747423, "uuid": "a3fa6670-f399-4443-9e5c-c176e08ca419", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784747423, "uuid": "f209a5ca-bd17-4481-b815-3d967283b6de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747423, "uuid": "86960efb-8a98-439a-a5ad-a0806736af44", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c546547-85a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784709357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709357, "uuid": "23e9c579-0f25-4c62-bfa4-c2698d9688d7", "comment": "Malware payload (AsyncRAT)", "value": "1feea0cd98782c360bccb06de3dba76b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709357, "uuid": "ce5249c5-87af-4675-91fe-a14e2a54585b", "comment": "Malware payload (AsyncRAT)", "value": "0316a0534beb4e367a15ed8406c1ad712969211d0dc58bffa8cf2948768c888d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709357, "uuid": "6a072905-529b-441c-83b8-7ad934d5b6bf", "comment": "Malware payload (AsyncRAT)", "value": "43d4c1256cb09868d86a702571d19d09b78c6a87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709357, "uuid": "bd123353-8e64-4dcc-878b-1405cf29e465", "comment": "Malware payload (AsyncRAT)", "value": "979db3c81c0178b34434f787b199d7bda2e2c79caf66873a61075fab04fe1db80226e60d60b82617911ed3833c9e2561", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709357, "uuid": "26190118-fe03-453e-a950-02234677da95", "value": "T10945548FA351FB465C9B26831506B4D7285DCC62526B3C4DFE38B9C9F800741E2BEA5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709357, "uuid": "c1fe7f29-383f-4f6f-8c4c-a589cc0e398f", "value": "384:CoHx5TZO/Xku/iOk+ykpFejktnAAPkjpFe/kN/O5OIjktyx5TZO/XkJFkc/IOnA+:/B3ruorlpTCo2+e0ma1Jml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709357, "uuid": "d2e08ade-6478-444c-9629-8f53749317fe", "value": 1168943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709357, "uuid": "fd055e42-ddf2-4b08-bab8-91f334fabb1a", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709357, "uuid": "c8bbe138-5ed3-4fcb-ab7c-ec999da76c72", "value": "Purchase Order PO3157.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a278ab-8595-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784701375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701375, "uuid": "1f07781f-3f16-4289-a039-b44160a5d652", "comment": "Malware payload (VIPKeylogger)", "value": "92ac731149b116bf0ee16e0aced6e729", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701375, "uuid": "40891390-46be-423f-865e-a0584c903fa1", "comment": "Malware payload (VIPKeylogger)", "value": "05248d08863389f04097330e73795050bdd88ec34c28a14d77bd8e1c6018e26d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701375, "uuid": "b814e38c-ab64-481a-bd73-e3573c681924", "comment": "Malware payload (VIPKeylogger)", "value": "424b1fa6217cc581191e44cdd5c439e20465d091", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701375, "uuid": "d90ab378-711d-43c2-9bba-b99b99a6ac64", "comment": "Malware payload (VIPKeylogger)", "value": "24118e8ae2bd0b385a36a7033f6636fd4351ad2a2d6c023252c82bfe5801e364f0fa92eb39e02ab703d6ad43064f1ff6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701375, "uuid": "c2a0107d-3a0c-4b35-a0e0-7256433e1ad0", "value": "T1F1957DAD26A4A10857736753A6024603F833F0269503D1ACAA5FA5D3F8C1DB47B7BC7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701375, "uuid": "00904747-6324-4a02-9108-542b121417c8", "value": "1536:lhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhO:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701375, "uuid": "05cd425b-dc66-4dab-ac2b-05ca87439dab", "value": 1883672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701375, "uuid": "802f946e-6e95-4a43-bf91-0ac44b9a5e71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701375, "uuid": "065c548c-36c0-48bf-ba1b-dc00bb7e733d", "value": "LIST OF INVOICES 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67451b4-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700462, "uuid": "f79535bd-1ddc-42cb-8f9e-6f1849cd3be3", "comment": "Malware payload (Mirai)", "value": "ee8515de7cb7fab3df3c2fb4e51c52f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700462, "uuid": "fdde61bd-4379-4f5d-b0f8-4d1df5628761", "comment": "Malware payload (Mirai)", "value": "055d5fa74449f75ad1801a5898836ccdd71cb0c3cd9b05db285d3cf0ddb3a500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700462, "uuid": "3a28f9de-dc12-4825-958d-70743dc7955a", "comment": "Malware payload (Mirai)", "value": "eb040ee96fcb5781c1f2abbf69f1de28703ff3cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700462, "uuid": "03533c3a-2cfe-4875-abe2-025812e8985f", "comment": "Malware payload (Mirai)", "value": "163e2e2537a83a589fd5d111b32d85c22884ef1c618371c73f1415f17a13920918dda2846fd070228f07f8b86e24f4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700462, "uuid": "5c0501eb-6a38-45bf-bf26-52e361227004", "value": "T1C9E30A45FC909F22CAD616BBFF4E429D372A1768D3EE720389255F20378A95B0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700462, "uuid": "c5c2d2c3-7f37-4fd3-9fc8-9c7a9cc2b73e", "value": "1536:YsVHEeTxa/OcS4Po0Yy9+wrsJymfP/f6wADcrpTVXiURucsEO1cKIx/YNv6lbQjb:Ys5TwWcqMUy01AcpBSURB5YSUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700462, "uuid": "897e1231-5dbc-4b0e-87a0-c5eff9a90fbc", "value": 154320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700462, "uuid": "667206ce-c627-4488-80ef-314c9eb919b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700462, "uuid": "a1fae6df-d5ce-4d42-8592-6c1d0ef6d8ef", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e5c53f-85a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784706289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706289, "uuid": "b4d9b15b-d212-4633-b8c5-f3ec5d7d0564", "comment": "Malware payload (Mirai)", "value": "37a794cdb78acdf123eee860885cf0a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706289, "uuid": "6c1e725f-93a6-4e43-bfae-1cbb8f72aff3", "comment": "Malware payload (Mirai)", "value": "05902f6f3a0cdd62222c6bcfe0a5920fe275f0b5033da195eea1a3194a76cf74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706289, "uuid": "3c02eb4b-a53e-4ff4-a83a-ef574475c3ef", "comment": "Malware payload (Mirai)", "value": "03b9b8871e7ff1e1f037ea32cfa626062322034e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706289, "uuid": "63096df1-385c-4ec6-acc2-63c61b3e43a5", "comment": "Malware payload (Mirai)", "value": "377fe092e7dfd6e3b52e05a38b79c73cfde4145c94157af80a35cd07295e2ef4c822adefaec527dc823ff693e8342768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706289, "uuid": "9819b06f-6245-4cc0-8757-5b4bcf11bce0", "value": "T16614A81E6A229F7DF278873047F74A309B6923D617E0D685E2ACD1105F2079E542FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706289, "uuid": "ce5744e0-323e-4d21-8a95-42c69ae8c4ba", "value": "3072:1oCKHPSnbF76FPc+dvihiu3ZfjZ28F2SqShv:1oCePSnxKHd6h5pfI8FwSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706289, "uuid": "0c87c3bf-d77d-4423-b6b5-611248ad849d", "value": 195560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706289, "uuid": "b8c2bbdb-fed5-44db-9a7c-41c7ecafc553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706289, "uuid": "a0812269-3cac-4cd6-bd52-2afb5bd31c85", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bb3865-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784704942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704942, "uuid": "9fd02fbb-0387-487e-9849-7754ec4b00b0", "comment": "Malware payload (Mirai)", "value": "fdde8e684014a8fc5b97b2d25d4b049b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704942, "uuid": "c9013894-80f2-4db5-9034-5f2a4f75984b", "comment": "Malware payload (Mirai)", "value": "0598a96b99f007259ce05bd31a5fc0571ee9057db94855679c7210909d3a56d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704942, "uuid": "066f3fef-f970-42c2-8a5f-1a57e077bc4e", "comment": "Malware payload (Mirai)", "value": "72665de761054344dce6964b1c838f904b6b2875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704942, "uuid": "13d18221-0162-42e0-b85e-19b135f729ae", "comment": "Malware payload (Mirai)", "value": "5217819fb63abfa7882d7b730ce32c379933fd9ddb5c9ccb3fe1a050ae7c1fe529b52fcdcd671206fca1917628647642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704942, "uuid": "32b15e3d-dfcf-4c5e-966c-54d1d57e02ec", "value": "T1C7E2F2E7CF860C28E62E2633289F350A4E94DA40E3C152E3EDD47E67C486F755B35608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704942, "uuid": "5d6476b8-a49d-48b2-aaf1-487bf4005d59", "value": "768:BdeCMBxvt5n6BEpQpTUYobNVOHSVtvI9mqSkf3pHnbcuyD7U4/2f:/cvP66CQbNVObmCRHnouy8Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784704942, "uuid": "cb45bc71-9978-4de8-a3ad-780454ad921a", "value": 33672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784704942, "uuid": "c7a58ff6-852d-43b4-9acb-3d4c20f3bf08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704942, "uuid": "4e4be991-b565-447f-b761-99ae91a648b6", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0288fcd-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784705740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705740, "uuid": "97036d05-b2e5-48b5-bc93-e99d54d31f53", "comment": "Malware payload (PureLogsStealer)", "value": "4b3a16ad9e1e502aae805211f2bd25a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705740, "uuid": "3b2ae22a-0327-4fa1-9ff3-e34b2843d692", "comment": "Malware payload (PureLogsStealer)", "value": "0826368434cbe294a9dd842f70a0f7e25367d0319179ca9bc9d7f13fb74ab9d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705740, "uuid": "8da6948d-c7e1-4084-9c1c-e17c21c1db9a", "comment": "Malware payload (PureLogsStealer)", "value": "02c379fbcfb03089cb879baea6c46ab92b8280a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705740, "uuid": "145bf579-4049-4dc8-ac84-624dc8473f9c", "comment": "Malware payload (PureLogsStealer)", "value": "e71f616224bce275b26acceea96566be6796bc16649efb4c8e2d03c0b0e768bf7ff072bbb2b4e67b9b3758c519d9c434", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705740, "uuid": "134889b0-d0c4-485a-8def-2d541a6aca7e", "value": "T1B5759EB66ADE716571F5E29499FC01F434C33347EF3E548B6BC92A1C583288DA16A323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705740, "uuid": "d7e82dd5-142b-4d22-855f-1cc18e4bdf5a", "value": "24576:S0qgDw0BdxKZPACrOLlm1Q56YUyX8GoSe9dMH8FRMV+zaf7pu2ZsDh4HB+rXYco8:S0qgDw0BdxKZPACrOLlm1Q56YUyX8Gov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705740, "uuid": "fae1b21f-aca2-4d23-98b1-7c5241657d2a", "value": 1558650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705740, "uuid": "d9d34147-79ef-41e5-8a9f-1384bcb61658", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705740, "uuid": "0cba96ba-1e1b-4dad-98f2-4ccf882e8224", "value": "PO-O129867-0721_Issued.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902e2745-85cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784726194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726194, "uuid": "81dd9e31-1b01-41c4-8039-dad99f37ff03", "comment": "Malware payload (Mirai)", "value": "b7f32652ecb263dddebc24731cd34d95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726194, "uuid": "c994a82a-a08e-4b34-a2b1-11a368abdcbd", "comment": "Malware payload (Mirai)", "value": "089a06b6a293e6bd165d35f0d5b895b0522b73dc4ab50eaac0e002cc7e872466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726194, "uuid": "ef09e66b-d812-453e-a565-b31c3f43cb45", "comment": "Malware payload (Mirai)", "value": "50083104c9a8cbf51add2c0799bf81f6f2078d3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726194, "uuid": "340021c1-ad10-45ae-9024-129fa65742a0", "comment": "Malware payload (Mirai)", "value": "50152632441c80d21427b23addcd8ca2882d6a37a5bc758f2f620ca50d2dd0a04d75e74b49ee3123446d5e8d96d29f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726194, "uuid": "d761d738-ca47-49fb-bace-b84db1d47f4b", "value": "T154830859F941AF15E5D625BAFF0F414933634B6CE3EE7202AE205B2523CA91B0F7B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726194, "uuid": "c9c3b596-5895-4f37-92df-55d6e737a425", "value": "1536:jxniJlIK4RiiITYRWaq6GlluZmoTulIuGircZbjqKrZ1YgVRy:Q7IvRITYRWaq6GlluZYjcZbjqKr/ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726194, "uuid": "5438219a-662b-45d9-abd4-538eed16dfcd", "value": 81856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726194, "uuid": "4e0b1e4e-b3d2-4f33-a8e3-f8d1a86abcd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726194, "uuid": "206aea62-0da8-4498-8cea-9fe1109f7e29", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23906936-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784729448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729448, "uuid": "b3b71fc8-971a-4820-b2a7-ca24b14718ac", "comment": "Malware payload", "value": "b839281ad75b1f996eef9d6db80d34ba", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729448, "uuid": "2e0b0c03-10ba-4a43-9d38-59b173210d25", "comment": "Malware payload", "value": "091b35d487c4172e888a0276244dc453332f2152f837b1500ded3591c7d9846a", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729448, "uuid": "bfb4a0d0-f013-458c-9f7b-35a94c4d3346", "comment": "Malware payload", "value": "1eb99bad0717fa435164f2f50c420e4859f95488", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729448, "uuid": "0426acff-50ac-41fc-aa0c-5f9136e61cf4", "comment": "Malware payload", "value": "17e1d6dc7d490431d18176867b4738ad8c7e81d17e7383de62cc3aa5012fa481d3f4f25f8a1937ce1ca2fdbe6d354e1c", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729448, "uuid": "f2967c08-29a6-4216-ae4c-8d583d9a60b9", "value": "T199D5239AA9F21978C837C7B1DF93E46DB02977D94A708E8337CD29118A231D86E35731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729448, "uuid": "44a48ac9-6668-4cf9-875d-76627cf0ad20", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729448, "uuid": "15f4e53d-06a3-4fd2-af2a-58768d4a5855", "value": "49152:Me9APH9lMgzMGyg6qCYal2M2vRLMSqSZ19G29uWZendNr2BHHxRAwZa/gy6cEWtz:b2/93wnTYcD+Rnxk2Mdp2BnN1Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729448, "uuid": "817b9b40-b606-4bb5-8bbc-27ae6ba02b91", "value": 2946048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729448, "uuid": "9c947505-19c0-4eb8-b1cb-7783709754d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729448, "uuid": "9b15f447-f969-479f-98bc-099002a53d95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb78ef94-85fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784745165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745165, "uuid": "acc148d6-4d04-4540-8d27-71dbbac7ac48", "comment": "Malware payload", "value": "33fe65d510f7a9b6d5c7c85c10360585", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745165, "uuid": "a12a330e-86b8-44d3-995e-9036a8db63e1", "comment": "Malware payload", "value": "09308880c6b8e1ee5d6cc2561d25b49929af75ab9007c018c18c998a30732cc8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745165, "uuid": "929778bb-8762-46fd-978b-ab9310c76199", "comment": "Malware payload", "value": "d8a844106d3c3a7b217ca818468d68d5d4a8e2e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745165, "uuid": "604307f8-33a2-47ef-8154-0800d5a171df", "comment": "Malware payload", "value": "d328570b8287336f86243a8e759ea18d85547ad3370e22c72f690d193982e647e45f7e8e4295dacb0bd96bbc3f264b6d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745165, "uuid": "ddea6c21-78c2-436d-a57f-0a4dc3469ddc", "value": "T1C7824B0FB9524726C0E210749275877BCABA6872338414DBF7D48DA90B686D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745165, "uuid": "891101ee-22a7-4c17-8d15-6087336af804", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745165, "uuid": "aff846d3-1f6a-4d2a-bcab-04d05e5a1e17", "value": "384:KIqQVVaFrxefUyJvBu94gXTcFv4av8U9c2nkF:AQUyxE9C4a0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784745165, "uuid": "225e70f7-5b7e-4c6b-9c58-ebbca8d4fb59", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784745165, "uuid": "2c290c32-88bf-4fba-a83e-ce2c14c02aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745165, "uuid": "916bef0a-310f-47c0-bb91-82571569234b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71041256-85a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784709821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709821, "uuid": "0864d6c8-dacc-4aba-8241-0ef2c133829b", "comment": "Malware payload (XWorm)", "value": "134db7ea93e75b49cfea4147ffc7c644", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709821, "uuid": "31c03c0d-5983-426f-922b-26f36674acdb", "comment": "Malware payload (XWorm)", "value": "09edc26a677870826648f171934793b831705359b356e7436751aab956921fd9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709821, "uuid": "306e78e3-1453-4ecf-a2b8-1bfdef90d6b3", "comment": "Malware payload (XWorm)", "value": "849884f00e7aca1af4131ec5bd81290be47cdbe0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709821, "uuid": "d51d2c4b-c2ce-4b60-8c32-f2b2072235bb", "comment": "Malware payload (XWorm)", "value": "6780c1534731fdbe6d34674ce238cd840f16212d38f546b57bba8ef20f2fa682271818d18d1e158949cd3f2c02532391", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709821, "uuid": "01c9cd47-9af0-4925-a64a-e341bf2fa7af", "value": "T17FC529108768A5716A2DD32CD13BAF284C0E600734D9DF1D397D9624BA69F87A74CAF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709821, "uuid": "0583aef3-ec06-400e-bd8a-fe1713dbd754", "value": "49152:MpyLiI24xIMXRSU5s6Zcb+FQuzjeLyGswPCZhElVBeWSFm2rYT5rjFTrs:MpEiI/2MXoU9cb+FQkeLyGWZhUP1SFmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709821, "uuid": "96cfe07b-3f53-4ec6-acab-4ad868cccb87", "value": 2607095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709821, "uuid": "d0fd930a-ef71-4f1d-99f3-12abd07e3f22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709821, "uuid": "a934346c-ed04-448a-86a9-a3d65f370012", "value": "Payment Advice - Advice Ref [A2sv8yynp3xe] ACH credits Customer Ref [2011001664] Second Party Ref[REM-204169].JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b508333-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700282, "uuid": "05bf0283-9726-4f46-9d97-146f35178fa3", "comment": "Malware payload (Mirai)", "value": "1c0bd9f8b34556ec9082c8a2a2b1461a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700282, "uuid": "90f781cf-bcc5-4d9d-a73c-f1bd10430ea5", "comment": "Malware payload (Mirai)", "value": "0b56e2e0acd430b6ea2cb5efff388e08542b5cd656b09d6f4aeac92def5eeb65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700282, "uuid": "6d3e6e1a-845f-43b1-a59f-7c93bb52fbe7", "comment": "Malware payload (Mirai)", "value": "1f72b0ad75b3e39293ba285da56ff44fa10a29ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700282, "uuid": "a366b5dd-349b-4da5-ac22-f306ad9accfe", "comment": "Malware payload (Mirai)", "value": "5651dce9003106a271453b67923252f926e56ce07f4ad0d23f08c6d950afec04321559206bd6439b2114bec290e1d0e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700282, "uuid": "3a721c1c-82dc-48a7-8589-a8ac6727e9e3", "value": "T15B14C80AAB610FFBDC7FDE3702EA074525CC655722A42B763674C528F54A90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700282, "uuid": "9fcabd89-f9b9-470b-bd29-bd6a53e1048e", "value": "1536:IZ/qnEGiZB5a+j2i0YLNu6zmVJ9xcPY9XvYjEXUmB2t5Dl2VyZGnaWqELTyGsr2A:I6q2+jxvnjEkbt5ayW6xr2kW71/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700282, "uuid": "b5978045-a14b-4d8b-b6d1-4161b1c1ea13", "value": 207032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700282, "uuid": "eb845610-b878-45b2-858f-60dcd36bb659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700282, "uuid": "a50e6979-d8c6-40a6-b409-d6a5ad54055e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20916f3-85ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784725875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725875, "uuid": "1dcdbc85-a622-4f60-bf61-b9ef220c4a80", "comment": "Malware payload", "value": "a284ad5de58d03aebe2a33e751d3f50f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725875, "uuid": "8f3b39c0-cd27-4488-b378-470c35880d5d", "comment": "Malware payload", "value": "0b5f12c44318ad9d1ed909a2c56463ffe5de7f3627402140de7ae75fc3462a52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725875, "uuid": "86ed5567-9486-45cf-ae96-ac507151dd7a", "comment": "Malware payload", "value": "28ab13979855be6dbfd177eb7b6651cb58dbb659", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725875, "uuid": "2c124b47-0f57-4da3-bc43-8bf715691260", "comment": "Malware payload", "value": "59dc080c7847254d53a00eca49f1be2205271d0c28a2ddf9db2d3daa1aae0015bab58bb1df646371b9105d01b9649e2e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725875, "uuid": "7ad4dda1-02e9-49a5-a826-a9195e975acb", "value": "T111016FC9E2109540415AD56E66D651D0F431C3C7454B4F78BFEC982DAB9CD08F036FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725875, "uuid": "70762f98-11d7-485a-a768-69928a6d4c7b", "value": "24:kXCKysE2hi0ziQvZohabnoFa4AEUTmk5Y7:e9Qp+MsboFa4nU6b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784725875, "uuid": "e4da8267-f2a7-413d-a0ce-873f724bf9a6", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784725875, "uuid": "8ea2edfd-e37e-4014-b309-58bc237aa9f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725875, "uuid": "4ad270cc-c3c5-4836-aabf-c87dfaad68a7", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3784fe8a-85d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784726475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726475, "uuid": "4fcf95fd-8b25-442e-8c86-b2f06d628d30", "comment": "Malware payload (Mirai)", "value": "cb06d4e2cd98ba32557fd92738f3b86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726475, "uuid": "1039b53f-eaa7-45cb-a8c7-eb25cc482bbb", "comment": "Malware payload (Mirai)", "value": "0b7e85caab29260857bc36eee7f78567217627020375dd4053eb7fb84596e98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726475, "uuid": "45524b31-ecc9-41ee-9aac-746f2481c444", "comment": "Malware payload (Mirai)", "value": "8ee200873d0224081ad37fdf0e3925ecec7ec3ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726475, "uuid": "5fc03a6f-0531-48a4-a783-3894facdf1c8", "comment": "Malware payload (Mirai)", "value": "7afd4f74a67bfaf183baf53eb5a68dc692d8f66b5f809676220664c95a855389494eb807cd1f4b78931345df4d5b549b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726475, "uuid": "b9d909a2-394d-4f08-87ae-4b287e5bf33b", "value": "T16023F158D2F46FB6CF8B52776488C1D613A1DFE7D367DC8230CEE6603155A02B1D9A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726475, "uuid": "e1d1b589-30f1-4453-9460-0b5c3dd9aa0b", "value": "768:0mBrN1oPOSI35TzozdYvuP+3zx8QnjL5JnK+08vKOfdx/IA/k6xt6/NC/ydWgMen:0CrN1oPO5KzdYvuCNPnjLvnKxoKmXIAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726475, "uuid": "e302cfaf-bbb6-408b-8a69-69887bc24646", "value": 46952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726475, "uuid": "2c99c1aa-7db1-4f3d-b467-08d54555fd2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726475, "uuid": "4d5717bf-17e5-4f76-8442-dd72ca24f6a6", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283bd652-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714853, "uuid": "26c3a536-0bdb-4d37-a892-803e11c4301a", "comment": "Malware payload (Mirai)", "value": "900a668a36c15d55de13d580c69e08c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714853, "uuid": "2fe00872-a070-4f89-8a6b-6cdd50dad7f6", "comment": "Malware payload (Mirai)", "value": "0d5980eb75a9f9527e00520cbcdafe42eb91f45348b51c6d5c56b3c17a868a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714853, "uuid": "c29422d8-fe8b-4922-92c4-80e87dac97b2", "comment": "Malware payload (Mirai)", "value": "976e018592e46d7e85cd046b5a4a32b697c82f36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714853, "uuid": "f761397d-b59e-45b7-90b3-0fbfd9810953", "comment": "Malware payload (Mirai)", "value": "b2280af8f2175ccee2816014469ad03819077d0d8039e4e49d068e86cea3556661385d2edcd6effcb9d434cc4b8f1a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714853, "uuid": "00ddbb83-2e43-4e6d-8a52-7616e403b630", "value": "T168337DA2C16DEDA8E1118A74BD254B789713E100865B3EFAD7C4C65A8047EFDF2487F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714853, "uuid": "b938667b-fc7d-4c2e-a4c1-3f16e6d631a7", "value": "768:qvgRGwtamXt5vxkxbeH9+tdvmGmwGwyWfs3IClU/UOWCUoeBQCj:UKGwtXXE1PuGmwGGfs3LlU/7WwiQCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714853, "uuid": "56fc3a1f-84c1-47e1-8354-4e2c51dd05c6", "value": 52644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714853, "uuid": "321f7396-1c6f-4fe2-9463-f3ad79503644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714853, "uuid": "1a32eb29-47aa-4ea2-bcb9-c449e93845e1", "value": "phantom.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d697b7-85d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784726974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726974, "uuid": "05af1747-a91a-45e1-8dc0-625f2c3d2b31", "comment": "Malware payload (Mirai)", "value": "96edcc81e11600547593e72a9ef5a065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726974, "uuid": "3bfc8357-da2a-4ead-9e62-4a923d82abe9", "comment": "Malware payload (Mirai)", "value": "0d7be42f1c780a95ba36742e5206341cfe05a164ee5f331efb9e85b8cfde48b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726974, "uuid": "4f79cd10-d6f5-4bd6-a189-2fd19c5a07d2", "comment": "Malware payload (Mirai)", "value": "3c0d6082a8ffd85ef883479a24576a1e83196d5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726974, "uuid": "0ec46c72-b5b6-4277-9071-90fee33a13c1", "comment": "Malware payload (Mirai)", "value": "70fa141196958ec06e6ec69dbbddd5a7f93deed0a5302b254b28d223dba9f2be411e78b7f24cc6ece32ea54bae10e55b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726974, "uuid": "22097318-503e-4ef0-8734-65bb9aaf3079", "value": "T1A8F3C80AAF510EBBCC6FDE3706E9064635CCA45722A53B753674C628F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726974, "uuid": "d809cccd-4dd7-4a4e-9c96-060dd051c3a1", "value": "1536:tumzI+/tW7nS3LTa0zx/aiYIhKuAFJVf/1TT3qby9/bzZLU/fo18l4qGUc4MhXqy:tuEI+/AnACwlKbJT3/y4Tqs4ggv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726974, "uuid": "1e8edc5f-bd98-4e46-b919-63e1ea07530e", "value": 168936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726974, "uuid": "b76addf2-85cc-4484-81d9-5f7bf79f2ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726974, "uuid": "1fb5ac03-02b9-4c0c-9c14-2fb695b22fb4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecf2360-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757841, "uuid": "d7dfe01f-3599-4bd1-92db-b6522037c55f", "comment": "Malware payload (Mirai)", "value": "211c39ca1eec1cd38a9cdbfb80669e8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757841, "uuid": "3e562e78-0763-4f0a-af10-b6013bc7e6a7", "comment": "Malware payload (Mirai)", "value": "0e1d15e29ccec3c49b646470a7a483f4cc5a533787c9e91ee8579be0115167fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757841, "uuid": "920f875e-c87a-44d3-bd1b-f50b20bf902e", "comment": "Malware payload (Mirai)", "value": "68a43009ccd4eb2989f9fbaaede5b09f7fef736e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757841, "uuid": "050b1b7e-e001-4abf-a638-6d920e3a8678", "comment": "Malware payload (Mirai)", "value": "4c8715ec1d5792f6ffe31c4865afa42147f5cd0b08dd549132b8c4efcd2c7d3b6b2741c9437b7a435bb9f539d807d497", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757841, "uuid": "ed0691a1-cba6-465b-bf9d-8787f41a822f", "value": "T1EFC2D19394A98D06C862423B6E1F159B61242539134DFE2E373BEFDC63464B8A135DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757841, "uuid": "801036d2-639d-41eb-8add-eed45cc92509", "value": "384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlgT:45+Kcrb9VDJe5FLTYTlPFnz/mRNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757841, "uuid": "df58c0e4-b739-4cb8-bc24-c47f315ba8ca", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757841, "uuid": "5e4d3103-2da6-4834-81ac-eff13ea24483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757841, "uuid": "e3e9d09a-f6cf-4b95-823e-e7b41f5d1cab", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26544796-860b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784751787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751787, "uuid": "51786308-a0c4-47d9-bb8c-736081757dc2", "comment": "Malware payload", "value": "a94933a4a8fa298ec1e238fbb755de26", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751787, "uuid": "6ef2391c-cdc7-4af5-b93d-ec98cadf8c94", "comment": "Malware payload", "value": "0f80c3794028f18cf3602f2d12964b1fa740aaac3b38767bbb981851f88b4966", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751787, "uuid": "d6d9ef66-731a-4c8f-a305-f059ba517b32", "comment": "Malware payload", "value": "7aacfe8531aa268a218cec56aad2f52fbd65fac7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751787, "uuid": "6ecdc9e9-db07-4721-9a75-cc0d30d1f44d", "comment": "Malware payload", "value": "3e81c31413f33c1a2b434ccc98005796e545ab77b3cd31da3a74181d14e915d90a77cb52d07530da5b5262d7a3736a03", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751787, "uuid": "edb6c349-911c-4cdb-92b8-ab4a5a503165", "value": "T1C2D522D9FCB202B0F476C7BB968724AD712A774186B04C1B36C98B601D539293D3B77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751787, "uuid": "0d8e04db-d542-4932-99d3-1ba3b583027d", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751787, "uuid": "02471d50-7277-4ecd-b1db-207188b3fe8f", "value": "49152:Qpq4rA98WCmFUMjxMHQ+bLU3r4D5wYP0CnPN3uel+mEJ+8efbgf4B+KdQusu:AqoA9pFUMx9iOcD5hLnNjEJ+8MbYYfad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784751787, "uuid": "54340f58-2037-48b4-812f-89f64dff801b", "value": 2983424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784751787, "uuid": "92aa6dbd-4646-4936-8c9d-afaea590923c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751787, "uuid": "3d6acf2e-e3db-4ac0-9a4d-52adbe6045b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8068c26b-85b0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784712854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712854, "uuid": "0e824b7e-f77c-4f54-8876-a040ae87b919", "comment": "Malware payload", "value": "c9616bfec0d8601d578da18d4bc0b005", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712854, "uuid": "bc2d4d64-596e-4878-953e-1cc19d1e78a7", "comment": "Malware payload", "value": "0facd1d275cf1d28de2de874f29b19ab9a220e7d9437274728f1311903418320", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712854, "uuid": "ec68c7a7-d698-4675-a641-35fc8e297642", "comment": "Malware payload", "value": "0cec7f3d5a8115a5ad6b68be66384a2ee4268d18", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712854, "uuid": "d332298b-f14b-4852-8d36-a0e4999bdf28", "comment": "Malware payload", "value": "6fa09b3a0de761e598b4b5ea4c606d9797d96b012d91b4249450b80f5c68a172745f8aa97649032dfc0a433455d28574", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712854, "uuid": "3b10e0a3-d972-4b0f-966c-5c34b1886b8c", "value": "T1C5E4232BF459837CC9EAC29DC2E84405C991B02272722F7FE9F21E5A9B1D7D431ED648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712854, "uuid": "3195baf4-f63d-4b8f-8fe2-728c809b8cda", "value": "12288:Pj3KAHq1eUJZSmLS9wE/SKffkM+60tvTtbxVlC7O1oQlinOYydAgBs:Pj3P4eUJIp9w2SBHblluMPk25s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784712854, "uuid": "945411cf-9072-4ae6-acda-6e0189bab223", "value": 659301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784712854, "uuid": "1a3cfda9-fafa-47ac-8841-3acdf56a58a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712854, "uuid": "1cf11b97-47be-405a-831b-af0269e94760", "value": "TransferenciaXdeXpago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a629bd-85a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784708671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708671, "uuid": "bcad1022-2098-4bea-9c02-8033d9ad788c", "comment": "Malware payload", "value": "6495be64978a1008d12e2cb6e2871f26", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708671, "uuid": "b74161d4-9a16-4ab7-8cad-08f87b87e334", "comment": "Malware payload", "value": "104447278779517e2b397a18d501685ae61a9da84abe1c180ff9bb67a5a0f0fc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708671, "uuid": "35b27c70-9cf9-4d19-b0c1-0bde414d1574", "comment": "Malware payload", "value": "591a2df183f3e377b81a50d5ef70224bb01fc0a5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708671, "uuid": "29dec27b-c7ec-433e-ae23-b112566da90f", "comment": "Malware payload", "value": "00f864c459c4a8011160e585b92096bbfd8b6af336faf6143262fad3c15063819fb52c56bf1ec10b606bd8ab0b5f3793", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708671, "uuid": "3246072d-38ad-4bc3-af36-51f725219aec", "value": "T14EF61202AB474C36DC7A51353EB7076136375D46AA838F4B2149B67CBCF32C45A9ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708671, "uuid": "d3afe80e-9750-4cfe-8261-a92d7fd1e540", "value": "393216:hE+LTRu+ztXojVddxHkyo00/I+ZNG0aOkRsIE:hEugEojrdxHkMjdvCIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784708671, "uuid": "3d039059-57a6-4c90-8563-6696546fa701", "value": 16469857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784708671, "uuid": "b06a0244-79b1-4fd8-8524-fea75ce93fcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708671, "uuid": "b7101c46-78ab-4a38-991a-1b4a068ed82a", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d884ef-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784705695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705695, "uuid": "a20a725c-73ae-4604-a9cb-64c85a39a52f", "comment": "Malware payload (Formbook)", "value": "71d7459d44d8e6017b2bd14542a71c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705695, "uuid": "36d771f7-d58b-45ab-9687-a93b20fee44d", "comment": "Malware payload (Formbook)", "value": "10d403fbc19c7a382127a50eda809cc020fbabcabb7564d311d7de99935e01e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705695, "uuid": "d10a389d-1236-447f-98fa-2c4da2e88580", "comment": "Malware payload (Formbook)", "value": "b01c3e22af610b4c91c54ab80573481ebfbf9c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705695, "uuid": "cd931210-a35d-4a9d-8c96-72bdfce65e85", "comment": "Malware payload (Formbook)", "value": "ed095a801bbfa671450edb9c1d20a4020329b9b5594d5c0f9244c904ba1673e3201027b7d223f6ab049e7aab69e60b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705695, "uuid": "51d526f0-d2e6-495e-9440-7c2a9fa3bb15", "value": "T19D2512396611C51BC9562339CE72F2F8137C2EA9E901C607AFD9BDEFB933701A851642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705695, "uuid": "a003c288-fa63-49ca-8719-fa789a77b50b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705695, "uuid": "1f9a70ab-20c3-4338-9e60-2bbff2ba1cb2", "value": "24576:jpW6pGX0rLxLeD0CWvpEcFb7ATVv4H7B5SxyXxe:J4QLlysp17S8B5wUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705695, "uuid": "a15e376d-7cac-4eec-8440-acf32fcdaedf", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705695, "uuid": "5a409e93-5096-4d89-b529-5d19aead3c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705695, "uuid": "74d58d11-5289-4181-9cea-8a73716b5aa6", "value": "REQ Quotation Order Requirment Spec YchVUJNC6CXvqC6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa40db0d-85a7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784709192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709192, "uuid": "f523e3c0-8935-482f-8c3b-eacb65014d49", "comment": "Malware payload", "value": "137d77c69e300e9dcb264eb0e84f7364", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709192, "uuid": "0dbb45a4-8cf1-4050-b53d-cef5bf20563c", "comment": "Malware payload", "value": "11acbf4c2b33fdf4ac22fd6e906ec5349e054462ffefd783789b704fbf006dfa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709192, "uuid": "667acbb1-2042-4478-99b7-52d6fc13c4e6", "comment": "Malware payload", "value": "2a6a0f90092eaec35e6bd719843c28c6a04e7956", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709192, "uuid": "b821b057-5b0a-4e48-814f-2a5ac29d0983", "comment": "Malware payload", "value": "44a7fa6ef91f46d22b2905427b6385b8b70b299168865e8fa5a281bee230f0a5bc681b163c442a1b60f652466a5b5f3d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709192, "uuid": "2d903537-b517-424b-87e8-3967a6340726", "value": "T1C0F39A58D78F41A1CF80A23B432A8E8815FDB73AB24605B674AC877137EDD3E05A657C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709192, "uuid": "7c7e3f43-9e19-4a74-b68f-064ddb3106d6", "value": "768:efmRu37SkOcsIPZsfjm0vtY9crKX11emD:MmRujFZsfj1lWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709192, "uuid": "93590570-8108-480e-95d2-4854b8417328", "value": 163602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709192, "uuid": "54acf88f-1b49-450e-a86f-a5eeb6eb196b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709192, "uuid": "861e77be-bea8-41f8-86c0-02ccb7c79368", "value": "2606291ATC.pdf.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0319e10f-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729394, "uuid": "4725b9d4-a100-4cbb-8d59-47b9c8cd75fc", "comment": "Malware payload (Mirai)", "value": "4fc9dfb31a0fec3c1f5fc6595a4d6c61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729394, "uuid": "77117942-a6f8-4d40-b8f9-60728c3afa0b", "comment": "Malware payload (Mirai)", "value": "11b14be274123b9abde915e70fb9f5692059ce7f368b09b678f31d4921c8327e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729394, "uuid": "54a87da9-7534-41bc-a955-fb94c83c17a2", "comment": "Malware payload (Mirai)", "value": "09ef5181f4d54371213a347c50ed98e41a136102", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729394, "uuid": "4e3e23ed-b11e-4c75-b0a0-1ff768f2686f", "comment": "Malware payload (Mirai)", "value": "39264737a2f7ff2bd9d8ca99ad55852f3ec13e0c3e15b15721f190becb61034e30bb9bb8c28db845b396d053b7f6c3b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729394, "uuid": "8af12d38-d4ed-488d-80dd-5bb73ee1cae3", "value": "T194D32A46F8824A22C5D722BEF92D218E331327BCE3DE32129E245F6137C659B0D77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729394, "uuid": "e71418e5-2101-431a-9a60-979337e4e622", "value": "3072:ghno1dzzJI8WseML4d7dafrDyxCKCqR/oHPR:On4JI8Fv4dxaHVKC8oHPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729394, "uuid": "d8074997-c590-44c0-8d92-df502f92d9a7", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729394, "uuid": "4b92516f-9a31-47e3-bcca-2924782e2c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729394, "uuid": "b03b1efe-44c7-4ee2-b706-f0af8d980c52", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b766ab-85ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1784711069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711069, "uuid": "7ef4e6aa-7a2c-4232-b8e5-f266bd7ad4af", "comment": "Malware payload (RemoteManipulator)", "value": "e323310e015a3940b81fe089d81664fe", "object_relation": "md5", "Tag": [ { "name": "pw-592085", "colour": "#B91F7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711069, "uuid": "14a0a7ad-c1a6-4e50-ac29-cb9a31a5dfe7", "comment": "Malware payload (RemoteManipulator)", "value": "13419cf94bc9e65e4877842fefda98420f1a82cb3a6b7c10ff93f9f0c8a35f35", "object_relation": "sha256", "Tag": [ { "name": "pw-592085", "colour": "#B91F7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711069, "uuid": "51e4c3a7-2535-4bc3-821f-40ebe9affd36", "comment": "Malware payload (RemoteManipulator)", "value": "71f801d0c446138b05c51387ed7f9b468f430742", "object_relation": "sha1", "Tag": [ { "name": "pw-592085", "colour": "#B91F7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711069, "uuid": "3d12ad59-4d1d-4ccb-8e90-6b5f1206040a", "comment": "Malware payload (RemoteManipulator)", "value": "8343f9b0cbeeb45f1fde3c8a1fc8828243b3d8b7cabb8806c58605ea5ca5a948b4f51905899d89b28173d555fe12ac52", "object_relation": "sha3-384", "Tag": [ { "name": "pw-592085", "colour": "#B91F7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711069, "uuid": "c1cd1bc5-add8-4a79-bd2f-bf3f4e45a2ce", "value": "T1644733E0385C9B618C9D8597F7CC2CF35B22AF5937972CF026DE16950ABC80294B572E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711069, "uuid": "92ae20fd-2155-43a5-a568-b33be5dcdea7", "value": "786432:gJ8yo7m+eYa1vREVIPj2tOPR/hh3XGirm/2vJN:gK/uvR6AEOPR/2iMAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711069, "uuid": "d0b1906c-a873-43f4-8cca-7de7e4114325", "value": 26213934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711069, "uuid": "c2d03c49-af84-4b68-8577-344ee286d2ca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711069, "uuid": "398e98b4-0388-4049-9549-07eace5f2a61", "value": "Safe_privet_documet_22.07.2026.113674.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef17e31-85aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784710328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710328, "uuid": "4183f94f-2b17-4afa-b3ac-9859d83d51f2", "comment": "Malware payload", "value": "cdc01c1d721ae59ccab42fe8389f1435", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710328, "uuid": "1c6b75d0-6306-449c-9a79-891037cfbc52", "comment": "Malware payload", "value": "144eac3a8a511f00cbe62fb4ed52b050a8c189a89ac6c7d3228391777076abae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710328, "uuid": "b6430b84-2bc6-44f0-a056-46e2cb1783b1", "comment": "Malware payload", "value": "1b5d21189ce58f4cc457a2ad9a88bbccd12d72c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710328, "uuid": "0acd8165-bdc1-4edb-b2a6-9b5adb4c20e6", "comment": "Malware payload", "value": "0b9fb8520493443195717d85bbc5bf5c283204d691eaf03c6818f8206bcf1d959bcf22191b6538decb4079d9384cebf1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710328, "uuid": "32183825-dc6d-42b0-99e0-63ae39e4180d", "value": "T1F026331DE227B50F4CF58FB825F0E9BB03BA5AEE07865C9CE139E6F565DA3780161018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710328, "uuid": "16b1912d-89dc-428b-99a3-2ecebba83b02", "value": "98304:TL04Pi6i2UFCKa9kUTk7wO/q+c8KN9keE+UWLpcHMOOGcKPPv43+3cNPLI:TL04Pfi20aKUBIq+c8KN9kfspqXcKHvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784710328, "uuid": "4deaa080-af1b-420d-9062-f7fb1029ebeb", "value": 4436432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784710328, "uuid": "d6287d39-6c10-4a3b-84ae-ed22602223e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710328, "uuid": "fdb63ad9-a090-440a-a08f-72e31a1e2966", "value": "07.22Document details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d843b21-8576-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784687992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687992, "uuid": "83e72a60-a3e6-4cd6-965d-5fa02f9ce664", "comment": "Malware payload", "value": "58911b28ea02eecca641d17ff7e1e264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687992, "uuid": "5cb03517-705b-4820-88e8-3b04472969ef", "comment": "Malware payload", "value": "1490e65be0e21b946e6128846e30dba08b7f8efbd4a1f8f1adf863c5fc93f974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687992, "uuid": "71762b43-2400-415f-866f-01bdc1c6dc8f", "comment": "Malware payload", "value": "58bd88564e96dac078f10f671188afa2fc26cc93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687992, "uuid": "11ebd9ee-9963-440f-863c-4180484dd6d0", "comment": "Malware payload", "value": "96e93463697e7221075873b5c21e7bb80a0355b35520f42c91b8f696d0f4afa3aa1ec3ecd523f039b35f9fbb7b99c4ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687992, "uuid": "2547370b-70b3-4748-9405-25813a106a64", "value": "T19CD52399FCB605B5E032C3F68893B0BDB11937868E748C4E76CD6B102E526186C7E776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687992, "uuid": "21075cbb-dfca-4d5f-9f3e-3c794989b599", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687992, "uuid": "63a8f515-ff90-4938-973b-8b9fddbec3dd", "value": "49152:Xti3sFkPT+LpHIHI6IMerwcTnJbXFGruuNWjqzcuH5hqJBIn7t:di8GPTKHIo+rw6uuNWkZht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687992, "uuid": "56a6640e-cc9c-42d6-aa9d-2072d8f53dae", "value": 2937344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687992, "uuid": "6bdd2382-fb2e-45ea-98f7-c69e37dd886d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687992, "uuid": "2d385b8a-87ad-4384-b2dc-7eab51359c35", "value": "SecuriteInfo.com.Win64.Evo-gen.85894993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d7a104-8606-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784749929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749929, "uuid": "77a24769-4566-4392-a9dc-8aed9eee8be9", "comment": "Malware payload", "value": "290e1071d4a6f35cdabdb5ed4af14c84", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749929, "uuid": "238de432-2d8b-45d9-8f7a-5dfc5b08a707", "comment": "Malware payload", "value": "149ab46739ca442762502a69f0960365a7c5e7761c76f2e6c2997bd43744a62a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749929, "uuid": "c5f306ef-3df1-4097-afaf-d3aee51f4383", "comment": "Malware payload", "value": "205525d882c032ac7c5cacbbd666080fb0dc62d2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749929, "uuid": "a384e329-fc03-4e96-829d-e1d4c6767270", "comment": "Malware payload", "value": "13f9eab56738d3b68a5b07741e2331345899565c15152c3179e5a6453432e60dbc7d329cb535eb57b7b59ec5209c89e5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749929, "uuid": "493c9887-b3d8-4b1c-8e0e-b0a3dc4f7fa3", "value": "T169E6331CA6E113EFD9A3043C76A041E1D93170786B71CDDB1BB44BA3AE532908D7A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749929, "uuid": "c974a588-a489-47c9-af66-0c4b55b323b8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749929, "uuid": "94153aff-0999-44b9-9462-9930586c7a1a", "value": "393216:BwlxAIOSBLMo+er3NMFWXMCHWUjXTcuI3/PGTAI:BwlLxBLMo+erdMYXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784749929, "uuid": "4476a08b-e679-44c5-b19d-b5f468ba21c3", "value": 14303174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784749929, "uuid": "248b8bf1-557b-4c07-a6d7-eafe1488a573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749929, "uuid": "34dd1b25-037e-4124-a6ce-20478219fcb5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc277d54-8602-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784748226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748226, "uuid": "677904c5-0cfb-4e08-a9a6-8efded623933", "comment": "Malware payload (Mirai)", "value": "f76085ea2ea30c090fde590156919ada", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748226, "uuid": "324f3b54-8741-464b-905d-7fd2ff1b138e", "comment": "Malware payload (Mirai)", "value": "14efac7bacdb63c750b2c9b227b41a2057d0b79b209e2932aa312dae5936337e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748226, "uuid": "471b2711-4c5c-40ee-906d-f695c06a54e4", "comment": "Malware payload (Mirai)", "value": "8397762e225cc0d48a796331aaf9cc5cab07f4f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748226, "uuid": "2cb5a3ab-32c3-404a-ba8d-52544ae13392", "comment": "Malware payload (Mirai)", "value": "6ecda71f02472bf6b559a9dfbb6e2ee048db62cc5f84e3d5332a46ca0b90e8ebd91e4d1471b93043edf8b6a8950d57af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748226, "uuid": "a59b4f33-3ab3-428e-b50d-a7d70e19ae90", "value": "T1C623F142C1B10C61EEEA1BF58D55479C93E22B2E00C219B632EADF604666E758E2DCD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748226, "uuid": "eb7f4449-0b16-444c-bbd5-3e9fb3521b5c", "value": "768:doodpoYb0fc3VVItqN3oLz7fPJN2qIoPTqYpf+NPm/rmoW8T3Mu4uVcqgw09U:dood+Yb0fGRN3oLf/2qIo5pf+NOm98TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784748226, "uuid": "edd0e118-38f8-42f6-8e1a-e3a37842a2c4", "value": 46944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784748226, "uuid": "659f5621-9430-42f0-9f81-bf4ed8764010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748226, "uuid": "8a2ee03c-8e53-4364-91fa-68109d168c07", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d106c1a8-8561-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784679059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679059, "uuid": "04eaea52-1ca5-41ff-9450-523a87e54cd5", "comment": "Malware payload (CoinMiner)", "value": "a998a470d68a17d1912685639320fd3d", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679059, "uuid": "cc975d7f-d436-4f42-b3f0-60576ca62af0", "comment": "Malware payload (CoinMiner)", "value": "1501fb778e9ceefc0dca1f8cfe8c9fdd1738db5f6dbb0032348f3e161391d016", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679059, "uuid": "a693362d-d0a9-45dd-8379-861eecdbd2ea", "comment": "Malware payload (CoinMiner)", "value": "85ba9dadb71f696bd751ad5a031801f6704a34ed", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679059, "uuid": "c86d9144-e96f-4463-9731-9158e7195804", "comment": "Malware payload (CoinMiner)", "value": "5581d47192bd6ee9edeb985e90285f68a500af306824494143199f1486684cc549309dfe0ecea5cce8f873f085c13338", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679059, "uuid": "12ce9cc5-b0b7-4e78-b6d3-5556978df64e", "value": "T19A3633E63CC97474D81AC7B88643646CF23DFBD08965BC173AC669115EABE24293E3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679059, "uuid": "b960e383-9b78-4360-96e8-de7d7cb884b0", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679059, "uuid": "923a6260-9d78-4bdd-a1b4-10d946c1ba53", "value": "98304:A/FwkMheyeKI1AwoKQz95RM8PE768V67qIk7VdJ5szd8h5UlmYRtm:SFwI19M71K6FqVdJ5sz+HUlPRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679059, "uuid": "f8c93c87-8cc2-4772-8597-93be1ac7454a", "value": 5295104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679059, "uuid": "f67baf28-3e33-4cfc-bcde-7f82b1522e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679059, "uuid": "5197b7bf-30f9-41ee-8e8f-0d6031937f32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d433e02-85a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784706728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706728, "uuid": "b1b02488-37b6-4f5b-8dc1-ded5c25bc673", "comment": "Malware payload (Efimer)", "value": "02d713f4c3b31e93e1d21a7e071950db", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706728, "uuid": "497daed3-9daf-4340-927a-dc4ff63b54ad", "comment": "Malware payload (Efimer)", "value": "15788c62947475684edd84228a6167f915b68bb8ca81e9791a045995d72db38c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706728, "uuid": "69123f9e-0fdd-4faf-9f90-594caa21a4f2", "comment": "Malware payload (Efimer)", "value": "b69d457a1e0a2f96fec11d371dca46d53117d9b6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706728, "uuid": "f5b252d4-82a5-46db-88b6-24d208b4f20d", "comment": "Malware payload (Efimer)", "value": "22c6d91ef0ba8124301c0054f366c513529c144da640efb5cc2b7814ee9d3b18bb174c06b2aaefbed8fbf72149f1e412", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706728, "uuid": "9fe20588-66ba-44d2-b30b-02e4e5e9c16f", "value": "T1CAE63308A6D112FDDEB3413DC9721251E4A7747A1B71C6DF17A883256F672E08E3EA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706728, "uuid": "5b5a6d2d-c71d-47c2-b166-92d8e9696b0e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706728, "uuid": "ced6689c-72c2-4d51-87e4-3d6d445bed76", "value": "393216:tDMyYRpsbS+57mj4Je3/E+xJATsMLXMCHWUjXzcuI3/PGTAI:t9Y6SWe4I3/E+xJXMLXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706728, "uuid": "011e64f4-69a9-4f2c-ae10-37426fdae526", "value": 14318344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706728, "uuid": "650b16e8-a386-47ce-828b-56663afa3ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706728, "uuid": "e00d7337-b28d-4be9-9b0c-b4612f731766", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f767055-85bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784717925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717925, "uuid": "1203cd63-5216-41b8-9696-ae9f1ede0dd3", "comment": "Malware payload (Formbook)", "value": "a884db1caf9d0de30012b2563019eeaf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717925, "uuid": "198bba2a-96f5-44f4-849f-7585250507a1", "comment": "Malware payload (Formbook)", "value": "1589a8dd5dcd02b2108df3c839715185b865e0c34afa0bc566f11ee4b4955af4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717925, "uuid": "e3c12bf8-5fe8-4f30-b1cc-eadf45c08538", "comment": "Malware payload (Formbook)", "value": "6a474f205be92ac0309531190f8fe6059afdf86d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717925, "uuid": "d5b87075-5d65-4f71-b058-297521a90984", "comment": "Malware payload (Formbook)", "value": "31792c68ca0e9e8e6a91481659e979b82a2caa6adf68ad28fd51b7ac801f1200631210ade47089b568449f6f7dc5a94f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717925, "uuid": "6a60fa5d-de82-4b7e-9c28-8650897c9337", "value": "T111A175B15305E6AD53AE3E14E2BEDC891CF51E6505C19E98B5F59A099C23D4C033CDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717925, "uuid": "54e5362c-8a0e-411b-a96f-5f360f82e83c", "value": "96:e9BZgJ9LGtMa91fqjfaazhzT/eFKJVjJDJkJyPJNj/ap6Jum6ZsJyzJXTAaJ/JDb:c3gXGtMvjPztGFOVNtUUl7uzewXrxDSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784717925, "uuid": "fcce8126-d1ef-4592-96e9-e1465b51895f", "value": 5019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784717925, "uuid": "9645ea0d-1ee6-4d84-88ea-5818af5b9bd8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717925, "uuid": "c54e1c41-ff9a-46b0-b97b-f0f3d55ced1f", "value": "ANMODNING OM TILBUD\u00b7pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2f503d-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763103, "uuid": "313c4ffe-8ded-4ead-a3c8-14d9ef762bf3", "comment": "Malware payload", "value": "b776f99c3a7e91e18dfdee62b291bac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763103, "uuid": "ae44b7a7-c72c-47dd-9dda-2a4c60f206fa", "comment": "Malware payload", "value": "161fb327ee8679b318533e925b958e2c8ff32dd32afc15be3f426a6c5a21c83e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763103, "uuid": "cfc29969-ff34-4b5c-a3e2-3414cb4593bb", "comment": "Malware payload", "value": "80a23153c61b0db60a5da7307de73bd9c15cbbcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763103, "uuid": "aacfca91-0537-4ec8-9a9e-6a5d962445a1", "comment": "Malware payload", "value": "96d03a1ccbea5350b8e79cbd05932c52d008790d90e6692e4b2dd27c646a78eece126b6f47cbb789bc1aeb7533e1b81c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763103, "uuid": "a78012a3-20b1-431b-b95b-52eac9d0b046", "value": "T19C367C88E793E0F4E25308F0599BD7F761201A355053F6F2EF8A6E65B4327416F093AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763103, "uuid": "0dda767e-7e07-4d97-9d70-27a84f33f8d8", "value": "98304:DGesR9kNAQAM6nLKMZqpJuEh3cgF2T5HLlPdotgBU8f9zSA3j5Qn:DGN3kNMn+MZYHyLIu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763103, "uuid": "cb79e82c-9451-4366-8b47-96ef5fc025c6", "value": 5234332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763103, "uuid": "ccf9019f-d702-429a-a72a-816c9dc72ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763103, "uuid": "8f2dcceb-8241-40bd-9759-9e540a686f72", "value": "b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e8cbeb-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784711576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711576, "uuid": "6d18341d-7d29-49bb-b365-3e33b788f0f9", "comment": "Malware payload (Mirai)", "value": "eef6cc06f43712760c321159f2def25e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711576, "uuid": "e1ee8d4d-1878-4e59-9a4d-98bd1f3fe054", "comment": "Malware payload (Mirai)", "value": "183fb8e38eeb1160f392f6d3c473752bc5b183a5c744f23a31dcc5ae2fda87f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711576, "uuid": "f265198d-636e-490e-9d68-40949d0e32f7", "comment": "Malware payload (Mirai)", "value": "98f9f51266c386e966ed829e6e952b9088f526b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711576, "uuid": "6851feb9-f7ae-4ef3-9116-44b61a7dce90", "comment": "Malware payload (Mirai)", "value": "1115404a28d7acadfccf209a394fd41ddd5aa0dcde7606e65b213ee28dd62d7bcb97f77f9c6dd9c51ce3f63c23e1dbc0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711576, "uuid": "0ab2392f-fa87-43cc-b206-a39f396879fd", "value": "T1BAE1C286F15198763DE39D6B23A5C40072967832EDD26E0570D838FA8E8DFD278617B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711576, "uuid": "cf25a7d1-5052-4b40-8513-0119a31df8a4", "value": "96:i/XYz0zy8BJF1KZMpJGNsnAAxzJzO9CLCshhD4s1fd96VYLk89Q:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711576, "uuid": "eca06bac-0f24-42dc-9300-9eba6fb16965", "value": 6799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711576, "uuid": "e9dc4bf0-a715-4e0f-8078-bed897c8b89b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711576, "uuid": "5663753e-9376-4463-acbf-d87009b63d5b", "value": "183fb8e38eeb1160f392f6d3c473752bc5b183a5c744f23a31dcc5ae2fda87f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843ebe53-85ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784746790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746790, "uuid": "bb7f29c7-1c16-495b-9748-97cd6b853fd2", "comment": "Malware payload (Mirai)", "value": "0df01020afdbca23f1687c15b5508f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746790, "uuid": "a3387f29-e94a-4e69-a23f-c0304a20dbbd", "comment": "Malware payload (Mirai)", "value": "1859dec6d71240c2ca46d3016d44e9fe6151d7b7616cb5ced7221ee18cd81efa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746790, "uuid": "3d4b3dcf-e86b-49b6-9258-66b5069a05c3", "comment": "Malware payload (Mirai)", "value": "ec561b8bcf9917cc9c82b8d2acdbde534a9747fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746790, "uuid": "a5f8267d-1654-474e-96ab-3672746e2f05", "comment": "Malware payload (Mirai)", "value": "750725f6ae36fef259d659e96eab3819c3998cc3aed853e691816eaf662ccb554811f17ab62675b56b505f7412b37b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746790, "uuid": "475d2ab4-4a10-49fc-a220-e3cde5c0b013", "value": "T1A123F12484067A60D7300533E85CCDDCAF69DFBC81EA3678429A23CA75B514628FEFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746790, "uuid": "9c29e41a-dc8e-427a-858b-5847be956856", "value": "1536:rDH8Ctt+HInOH3n/hHg1HLTS4mGOf51KC5uVtTOzL:rDcCtIkO3n/hKS4mGO51KCQVtTOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784746790, "uuid": "7b75621a-9abb-443f-b073-cb961fcdb3e6", "value": 49296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784746790, "uuid": "b377971f-0a40-4cde-98fc-9621f455653e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746790, "uuid": "018927fc-5706-49d3-b794-38f86b7324e0", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389c18b0-85d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784729054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729054, "uuid": "c1de6f5c-29e8-457f-b892-16e097f3519e", "comment": "Malware payload (AgentTesla)", "value": "7e6b6175bc28924622ed392254f97162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729054, "uuid": "28d9592a-2ef2-4b98-ab5c-7434e8fb8fd5", "comment": "Malware payload (AgentTesla)", "value": "186f0da3622d865e6711ac6ec4c9b00bead762b3c8479947f2786f8ecccfb007", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729054, "uuid": "9a518f26-1a00-4daa-a75e-8e4f2710f26e", "comment": "Malware payload (AgentTesla)", "value": "d72301b8c7f2a529d7ff55dc03f4478d3fb29b20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729054, "uuid": "481d8aee-eb4e-4966-9295-27b844e94e21", "comment": "Malware payload (AgentTesla)", "value": "fc7a41bb927efe1475c85a39a6596fd60667670af8060e66a4953f7fd2712cd9c195eed995f1c84fa5ccbfa92b567d24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729054, "uuid": "5e98701a-aba3-47d5-b639-84a99b6de70f", "value": "T18A330C95068264806337776FB22BA8E4F7660BAB01501D17B87C7494DFF2D09DEE1CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729054, "uuid": "1392025f-9d7c-4f19-b6b8-e7a15e821ad0", "value": "768:IOyq0Cdv/zZqoAxhBk1hGD5xTFXWLMThClFfhArInCeRPwzMQUB3/sXHDo6qg83V:NuCdIqwCmqOzOcOCobyQxY3f6eW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729054, "uuid": "a593cd71-5a3c-49cd-a45e-4f38b48af401", "value": 54869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729054, "uuid": "24334b9a-7196-4294-a636-def555f02641", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729054, "uuid": "fe04a87f-146c-4af0-bc1d-70e44012d5ff", "value": "Confirmacion_de_Pago_Pendiente.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bca6d2-85d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784726744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726744, "uuid": "81e60d6e-d164-4a0d-bd81-d7deb48ae2b9", "comment": "Malware payload", "value": "16c1473eb46393a4f3321745811595cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726744, "uuid": "06fd03de-6d21-45a9-bf75-93e1c79e4955", "comment": "Malware payload", "value": "1b59c5785724cb34833f6baf069ef2236c6516039367c4600d1703dcebddbd5b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726744, "uuid": "40741352-4a9c-4fe4-969f-ef835a08d8ad", "comment": "Malware payload", "value": "8774965dec75df31650cd23b12dc0c21ed854b14", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726744, "uuid": "34d7ad06-ace5-4e08-be3b-89d567c3f533", "comment": "Malware payload", "value": "ac8633193406e2bf377cacae3ee35161d06e2f02c9ece980a691bffb04238f1026e325cf0d6f4f0e41593d45befc3a1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726744, "uuid": "9476302d-ee28-489a-be06-6975685bebfc", "value": "T135C27C96AA867C44BDC94A3E4CBD2B0D6DF5C3D1224942AC3D9A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726744, "uuid": "e982208c-2dfd-4e99-a1a9-ddd637d1f5f5", "value": "768:h8vCB+25j6es8RBKQ9FYpMSUpi+20qUpi+20YQX:h8l25JB1d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726744, "uuid": "1274d1b8-3248-4583-bd8d-11a730264d78", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726744, "uuid": "75a7ae45-e4d9-43db-9204-99ddd5af659f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726744, "uuid": "7d256b3d-c46d-475c-b00c-09f8c05ed0e7", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32712e64-85d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784730332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730332, "uuid": "d02acdf7-ce5e-467d-8faf-0fab8e186889", "comment": "Malware payload (Mirai)", "value": "7002731e8d55a51b05ad70e4033e70bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730332, "uuid": "22ab97be-5940-4f4f-b5bb-2d2c21a68db3", "comment": "Malware payload (Mirai)", "value": "1b6c6bc28a7807250807b2f7f25189f0504b4c934219f635baf2b664090f1b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730332, "uuid": "33902432-1911-4326-9342-903ce13cee47", "comment": "Malware payload (Mirai)", "value": "42eabcc0a3a2fd4d499c6f8e5b4fb5c10df8a29f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730332, "uuid": "d66928fb-0ade-4b24-ad8a-9094bfbe6be1", "comment": "Malware payload (Mirai)", "value": "097bf46d6b268f877dfab15f6828bfb20716df12563540a4f3911da474fea70e2813dda0ad1c988a518a087de545ab06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730332, "uuid": "e938caa7-4581-4fbb-b87a-3691d0fd5786", "value": "T1EFF3785E2E228F6EF67C873047F74A25976D23D627E1D684E2ACC1141F2035E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730332, "uuid": "afdc38e6-80ac-43db-8fe1-053d3dceaa1c", "value": "1536:ULYM5pdFBBtWYKbgv/77XfbLTMfeQleeEnZFft8kxaTgouGE+YHSJxR9p3:SNnNTKsT7fbLTseQyZFfjJG/YHo9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784730332, "uuid": "3d99af22-4823-4797-8bac-a06c88103666", "value": 168940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784730332, "uuid": "de73a4fd-29aa-4e9a-badd-62fa14122205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730332, "uuid": "ded245b9-92df-4930-a986-2fab67be8097", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec95210-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784700583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700583, "uuid": "68cca99d-1c37-4330-86fb-e13e3b200cd4", "comment": "Malware payload (Gafgyt)", "value": "1764b26a45413e1638d72763b198493b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700583, "uuid": "26ff5f97-d4f9-4ccf-a690-57d2da715747", "comment": "Malware payload (Gafgyt)", "value": "1cc337de48fb1c7eb77c4e4576e3c80c57b5a7140fc1fbfea49e03c0ee6d73fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700583, "uuid": "f2ff7ba9-3684-49f4-9c84-4a849e9a736c", "comment": "Malware payload (Gafgyt)", "value": "c241d6d4b06062012a13fda1e414a6c8f6d34148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700583, "uuid": "e4e4c1c2-cf92-4f94-ba46-b9673d4364e2", "comment": "Malware payload (Gafgyt)", "value": "12518425f680583d1917b47bcacec98b40d47cbac49e324f8bd5791f6938baa5a9acdc031f69d03a7c37e0f05e4f1720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700583, "uuid": "7186b552-a566-423a-a262-ad41023bcdfc", "value": "T11EE32B45FC908B26CAD72277FF4E429D772A1768D3EE320399255F20378A9570E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700583, "uuid": "b011d472-b090-4b9e-8001-33deff60fc1c", "value": "1536:HJtzfHDUUADOsG//gguUpFFGPoReJwS/IPkFTADLHuTt0OaMOPsVOha1+fDTtflm:HJBDSisnqSgWAfuZDaMGLff+557", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700583, "uuid": "c1a8c8a6-8016-4623-add9-e6df7500904e", "value": 150224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700583, "uuid": "856fb8d4-fe95-4c20-8d06-8b872c1f9d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700583, "uuid": "1ff964ef-61ac-4796-87c0-b8238ea4314e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb50f69-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763098, "uuid": "deb88a01-ce39-4f68-8c48-4b567617a5df", "comment": "Malware payload", "value": "a3d7accbdf6ab432a1c6d0a101253904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763098, "uuid": "faaa4e68-b7ac-476f-820c-e1a29db78064", "comment": "Malware payload", "value": "1cf2f74bf9248cad396a233af682232e9c4bd9a4df068db3847ed43dcb543e0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763098, "uuid": "37c602ea-49f9-47dd-a871-1f0e2d130b96", "comment": "Malware payload", "value": "b0acba759a78a76068ed26a520bf07bca93097c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763098, "uuid": "864b919d-bfce-4f8b-bf1f-8b23edc06b28", "comment": "Malware payload", "value": "639ee6b0fcd5e5bfc582475b05d1d1b10ca42c42d56f2f493041f73ad577f9eb3c81f0e46f4ad4a2f5b4d25ffe1f0868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763098, "uuid": "afb7157e-b174-4ea9-9118-f4aa825c8d6d", "value": "T1A4168C95ED0F3912F3C7E23CCF4A97E1721735A4E32390B279D2524DD19E9E4CAA2A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763098, "uuid": "1e7eb9ed-10b8-4d80-85e1-68f2884f1d1d", "value": "98304:qog8R9w6Sl7rFlI+QHUMJfxvWbD/5Pj+4Fk5vv:Rg8R9wV5xNM2LV7Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763098, "uuid": "b2b0ee2b-d989-4362-a34a-ba51199b808b", "value": 4199936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763098, "uuid": "7034db32-a0b2-438b-ab3d-329ab581438f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763098, "uuid": "72e0e812-38b4-4013-b766-979b7114534b", "value": "3edfb02c0e6b2fe4894425cd0d4d2507f7cb11e0958674422729366a0d885c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bb85dc-861d-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1784759619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759619, "uuid": "d58ac8e8-8e55-45a4-b6d8-015724ece394", "comment": "Malware payload (RustyStealer)", "value": "7564553469f8675a41cb1ee014b3dfdd", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759619, "uuid": "ef63e4c9-7111-4dd2-a467-40d239284648", "comment": "Malware payload (RustyStealer)", "value": "1d233362395405a19be5da8fc1f3fba060e658fb30718a47eedc0925a7226e52", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759619, "uuid": "8aacd897-734f-4efb-9529-ba97c1ea1537", "comment": "Malware payload (RustyStealer)", "value": "4bf5f76757cdf2280df61f970246222aa0b8f8a8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759619, "uuid": "8935761b-6f95-43c9-85d8-0fa6c69f29d0", "comment": "Malware payload (RustyStealer)", "value": "1a1470cf1efa05229f9b222ee0d21bbdafab05c176b70390869e2bcd9fb15c67581a9408ffc9f80930ea3dab3a0249e7", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759619, "uuid": "ec2075a5-6c0a-42fd-9c38-c5ea534d630a", "value": "T105E52326738501F5D4AAC5BCC2420752BB2674DAE7A29EFF0374C1741F166EA6E3C728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759619, "uuid": "40b56b60-f748-467e-8c8b-f6b51e855b5d", "value": "d10fc36a7f00b607f09003d3da0040cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759619, "uuid": "8e9c165a-7081-48fe-8bba-110a57cab7dd", "value": "49152:lgpyi7hTuUtEcTuu4XG0nBZYnavokJJaRsj4TEwUCNfgBw9:I/dNuuQnBZ0S+REwVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784759619, "uuid": "ad9c3d05-0f52-47b2-bdd6-4260c811216a", "value": 3067392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784759619, "uuid": "9c73f087-5892-4496-92a3-d91f9ba01260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759619, "uuid": "ece125a2-1ade-4b61-9dbe-9efceeeed094", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e84804-85bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784718089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718089, "uuid": "26ce670f-2da4-47cd-9a6a-1e94293792b0", "comment": "Malware payload (Formbook)", "value": "2ef3065371366c7ef99577f4252b8c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718089, "uuid": "a1eee41a-1a8c-481b-a2a2-76aa4abde724", "comment": "Malware payload (Formbook)", "value": "1d83f7830dfad00877f7582bf2505463ce5f035a70d837d997c4f26852912288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718089, "uuid": "11285fc3-9975-46a3-8720-1388c96e5de8", "comment": "Malware payload (Formbook)", "value": "1659d6a87f533bf3443f11a69c13d05f24ca28cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718089, "uuid": "188c8f6a-6bf4-4760-b70f-8f860fede0ca", "comment": "Malware payload (Formbook)", "value": "e2a25fd001a32be0077e13f2e2b3a413dea500661ae2df73c9719fafbc6adebb84e5ef94d358a13af6e05de3a1e232db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718089, "uuid": "88308f69-04f3-490c-80ff-7dafd95bd1f2", "value": "T17C2523901619C913D2D3A7FA09E1F77A62B82D8CE201D35789FEDEEBBC1AB061C145C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718089, "uuid": "eb95f0e9-bc8b-49fb-85c3-771094389867", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718089, "uuid": "b75736c7-41ab-41d8-9e6e-c10db28da93d", "value": "24576:TToaVFPNn0bf9CwA6j6QaW5jcFJmOw1Hx9sN:TUcFhY9CwA6j6s59Ow1HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718089, "uuid": "bd2f334c-ad09-4c2b-9a5b-59bcd68ca70c", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718089, "uuid": "35cd4f4e-1d8a-45cc-9e17-314c449216b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718089, "uuid": "c377d858-f1e8-463c-ab8d-c6521363d0db", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac6b01a-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784711582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711582, "uuid": "61250eb5-cfab-4a85-a95d-a370eaf18513", "comment": "Malware payload (Mirai)", "value": "0b3080c4dee0a34937921ef90e3c39d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711582, "uuid": "b69e7610-5be7-4d27-8977-ccba636ba75b", "comment": "Malware payload (Mirai)", "value": "1ed8ba8b6936fd378c18a7aafeef6db8575f8ce679ab93ae7c1b36493f7bd65b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711582, "uuid": "c5eede0d-70a1-407f-8eb5-540b86657f8d", "comment": "Malware payload (Mirai)", "value": "7f64f5a177f3cc3e8f9fb366ca186b183f1124ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711582, "uuid": "6cd8e961-1374-4eaa-a431-08ac8d0412c7", "comment": "Malware payload (Mirai)", "value": "a5180ea8f3e608657a3ae74f5b747fa7f280a53321da873d53a2c3fd7cf7bacfe515b8c4df62b690c4a10ce1afb84a5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711582, "uuid": "79cabab8-2a1a-445b-9800-7f58808a7506", "value": "T1E6C2C0BCE5A47F52D20C5D38B1AE63F5A56AB081338EFA0C63126C12B566ADBF250074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711582, "uuid": "a05975d9-e6f5-4d74-a316-c10ee4680f6b", "value": "384:iy2NN08zn8TLEr/FWq2C7SRPqosE1FCEEzy6DHKTWQaIjTxugnxVURWGVCz0NvJo:V2Ny8z8Tq2JdHn1cESy67jdGnxV0WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711582, "uuid": "ed6ba18e-ce7c-486c-8dc5-e745441c8515", "value": 27280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711582, "uuid": "fa7a5bb0-0ed3-445d-b34e-fec15c8914ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711582, "uuid": "dee7c90e-e75a-4c4b-bb05-23b9cfe5b927", "value": "1ed8ba8b6936fd378c18a7aafeef6db8575f8ce679ab93ae7c1b36493f7bd65b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c96dda4-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784753059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753059, "uuid": "5eea855a-f5fa-40a3-8dff-af52d7a628a5", "comment": "Malware payload", "value": "ed0395cb1ca92e2ed1f442c4f306e455", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753059, "uuid": "96338042-ce5e-415b-aa11-f75b12a31701", "comment": "Malware payload", "value": "20ff36aec4494f87dc9515358faef0967fda06e89fe6568cbc31ffcafb895d72", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753059, "uuid": "637fc8a5-a16c-4f6e-b9cc-6a0dc566ef6e", "comment": "Malware payload", "value": "a4fe092c572e5aab1824b66d847490a4cc82f706", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753059, "uuid": "babc766a-1750-4a49-8097-86663cef7cc5", "comment": "Malware payload", "value": "cdbab8daf7d18b15c45cfdddb6d54086b8d71b5336f613dd97e761ba0cc385d7cd452fbf0f495d37a8761777f4cbf24e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753059, "uuid": "57f2e956-abd8-40df-a216-a866e901a1f3", "value": "T1EF469F69B6BC00D5E86AC1BCC2865227EB72B41563B057CF5A548AFA0F63AD01F7F740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753059, "uuid": "6496f3e9-578b-49b9-9fc0-b2d0b1f03649", "value": "5cfba45e972c4f65adaa094821042df6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753059, "uuid": "790ff989-cd77-4ceb-ac8d-e3b9de17b7e9", "value": "98304:gkxn1rxHpJXRjqndqrzvZ8HleuOqDJpmQP+7TQ:gKn1dHp1RodqfvZsr40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753059, "uuid": "d0070765-5ae0-4c34-b31d-140dee940ca7", "value": 5367296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753059, "uuid": "fd8349e2-5f4e-43e3-bac8-b56ee86d56ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753059, "uuid": "09310170-be82-4614-b533-3c86d3721916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526ab5f0-85a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784709770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709770, "uuid": "ebdcf0e9-c924-4733-a13c-0ce885cc6449", "comment": "Malware payload", "value": "5d8bf24e1a2b049d3f98a81db2eebf92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709770, "uuid": "41012dc8-9e50-4f4c-81b8-c2f693e648eb", "comment": "Malware payload", "value": "21796e5def787676275be4ee84a07687f6f4ace6c009cbd394da24ec95b24dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709770, "uuid": "0b3acd99-e185-494e-b862-4755707bae89", "comment": "Malware payload", "value": "b6ab953a19c8535020bac3a100f9313fb114b653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709770, "uuid": "0df9fa16-4972-4392-91fa-5a606d861d55", "comment": "Malware payload", "value": "959b24309129f3147c00216cf1becb8d2807395c710b423ba6a8e97cf61c86518c1f0864a31ff1bbbdf696588d966051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709770, "uuid": "68840991-a913-43b0-9f26-0603e06e1312", "value": "T157D5239E79F21E30D437C3B2CF93E56E7229B7844BA18E9275DCA9009E535642D39332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709770, "uuid": "a9cb3822-f5f8-4cf5-91e7-d6c49c9c5dc3", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709770, "uuid": "87530aaa-e052-4595-9922-5a191876a85c", "value": "49152:FkQIXucWPjQ2NPSPGNuZVOENCVUfqhnKcbP+KTf2n+Lfo0ixP/l5Tm:GdXudE2Bw+LICtKcbP+H+Lfolh/vTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709770, "uuid": "bde9f54d-d414-4b05-a88e-a5fe5dfc9c7e", "value": 2973184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709770, "uuid": "fd9cde95-9514-49ff-8674-b430707c3fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709770, "uuid": "990f543e-ac28-484a-a5ab-a9c60f9bb877", "value": "SecuriteInfo.com.Win64.Evo-gen.46246823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c44538-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714950, "uuid": "e9ad0c5b-48ac-4097-9273-d4e920f9b43f", "comment": "Malware payload (Mirai)", "value": "d607558e974fd484380d1fca02310ce6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714950, "uuid": "8a70358c-adf1-4f1e-a353-d3388c4217c2", "comment": "Malware payload (Mirai)", "value": "223cf222289d57b21cecdbb3417c2d46b36c889d36e599971a46d3c64ec3e425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714950, "uuid": "ea3f7e46-79bf-42a0-bde0-78a3940b3068", "comment": "Malware payload (Mirai)", "value": "2c9099fc6ffb9bdc68123fd075c5bb92bd7ec8a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714950, "uuid": "e85c73c0-b82d-488b-a929-3e64d7d55afa", "comment": "Malware payload (Mirai)", "value": "d5b58c1f51d7e19f12cfd2f263e3d12e10e29ef27f76af71256375b1468c6eda45709b61ded45a27c4cc6cdfd37fe4bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714950, "uuid": "85a6bfd1-32ff-4950-b60f-2113a033caab", "value": "T117D2F13BEA529768C0206C77F6BEC5473F8A26FAD06EB01216204777F6D20135A716CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714950, "uuid": "baa6651e-7416-418c-8a93-e033283f1545", "value": "768:NonP0fMESnpKjt1zHEm4FdRvfKQF9ODpwRApzV9q3UELQYE:6Pwi81zkm419ODzpzoLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714950, "uuid": "07d0cf69-57a2-44a4-a83d-47b4be21be48", "value": 29560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714950, "uuid": "dec51f16-7b37-416c-9935-a08438a5283c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714950, "uuid": "8cd4d78a-44ef-42d2-92be-75abbac50e7f", "value": "phantom.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c999c0e-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757837, "uuid": "1b93d001-e4e8-4212-8dd1-e37a899e3cbf", "comment": "Malware payload (Mirai)", "value": "311b75e11aeaf34d28cd09f3c1df3434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757837, "uuid": "358f5d47-b5ed-4bb1-b6ef-d92b008944b9", "comment": "Malware payload (Mirai)", "value": "22967371fd7a84e18a2c3551c06d244fd94b747d9e61eef5282c3b04af645f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757837, "uuid": "186b5e91-1c40-4060-be46-b9b0d7ecce36", "comment": "Malware payload (Mirai)", "value": "f84ec702b20711e96713f6a21dcc5250077f3441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757837, "uuid": "6b24f4bd-22f1-40a5-9257-af6c8e5fcfcd", "comment": "Malware payload (Mirai)", "value": "778886e3c429bb67b0c08da782bf0154f5f7167df66bf238ab3a6fdb10010c01600b053274e31269fcc3d89cc866fabc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757837, "uuid": "1fbf8e3f-bd26-423f-bc5d-46639bc5c8eb", "value": "T181C2E0A1E1F62E86F73A6E601B65D2C177B04E9EA777CCD2255C9F0804A721B07096C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757837, "uuid": "7f20317c-9186-4013-a2e5-4fac34f9877e", "value": "384:lQez9/6Jgn9yMGEGHV4u/DT8HgPEt6seDYc/OzM4uVcqgw05VxJc0i:yG959yM0HWubJsWDYcGw4uVcqgw09S0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757837, "uuid": "142f25ed-c72c-4cd2-9320-af0af192b499", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757837, "uuid": "763bdd46-b9c4-48c2-a962-40ef169e2ceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757837, "uuid": "d128f44e-7a4c-4830-beb4-2031261f21c6", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226f7337-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784701529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701529, "uuid": "24c62f1f-0b5c-404b-a1b3-c522d2049308", "comment": "Malware payload (AgentTesla)", "value": "cff2ae2d3fcd13d8a38c134acba130d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701529, "uuid": "829edc81-dc95-4b85-b4c8-66a7af2d0362", "comment": "Malware payload (AgentTesla)", "value": "230f067b275052608eaa60e748f8dc593fbe4095040c0e74d8519d600bca02ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701529, "uuid": "e9c09576-f705-4fc2-9a49-68baeecd4e49", "comment": "Malware payload (AgentTesla)", "value": "c3168dfa0419cda533954af5074db8ecb1b473cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701529, "uuid": "5fdb5c74-1f3a-4f3a-8509-31c719dec951", "comment": "Malware payload (AgentTesla)", "value": "8d8a78d61ffcdcb90b6d3160e1e91253097ed7b889271c73755413c6506641ed454d055afc160c0a2aea7f5b0cd62aee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701529, "uuid": "42b962d2-cb2e-4f0e-b3db-446c92c0bc85", "value": "T1AE63518D73C1F44443A74FBB392BF1D1F49A4CCA65A84507E240F8A4F8A0619FDE9A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701529, "uuid": "5b4f7193-6b7c-4e0d-aa76-4aaadfd2c676", "value": "1536:r/X/FvR6XOkF2h0yQeOVFvd3zbH+mZH1i:zX/F5+ppyvyBdjDFZVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701529, "uuid": "3eb65957-1288-47d9-ba22-7bbb20dd6f34", "value": 67048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701529, "uuid": "5d645147-88fe-491d-a131-6cf0971e8ba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701529, "uuid": "6775be23-bdcd-44fd-ab68-41c5f697e0f8", "value": "Nomina 07212026_N0021226#2.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa637c2-8561-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784679048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679048, "uuid": "5c4b0350-fabf-49e2-a2de-87503924858b", "comment": "Malware payload", "value": "5d241d1444068af963f3fe4bd7f8dc0c", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679048, "uuid": "a7876cfd-a13c-434c-8995-1c104b9b822e", "comment": "Malware payload", "value": "23494415bafe76ea0729d47f7bbd1fb0b91aa747b0c45296713b41c1b63c24a6", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679048, "uuid": "d6ce5df0-6746-43c0-81b0-f5fa8df9c85e", "comment": "Malware payload", "value": "d21e1576c2e510a105df678816b7eba84909839f", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679048, "uuid": "c13ed56a-c06a-424a-a293-6f1ff8ab822e", "comment": "Malware payload", "value": "c95fb7be9818a9e6ec0cd6b685f474d594385c43c388ceeb3eece8b976b67f8efe0d17c02d0f0ab824e7214604a6d2e1", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679048, "uuid": "5fc3d34f-9c65-45b4-bc5a-a44ea8a5d4d7", "value": "T1DFD5239235F649B4D43BC3B1CFA7F15DB07A3B944A628E1AF9DCA900DE22550543B3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679048, "uuid": "aa278027-0efd-49ad-9067-141018296726", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679048, "uuid": "993ed711-1c2e-4dd9-8076-9f5011e2aa15", "value": "49152:f+Azmvcoe6mK80flwgGiiIgoJJsKPNV/RnxmPHuJViSOCEIsijHYeUkIHm8njc:fxo0K8uDGrIgKPXRxGO7iSOHADRIHBjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679048, "uuid": "93dd2344-d20a-4390-9495-fb069cec7f65", "value": 2907648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679048, "uuid": "42d8db58-45d5-43a3-8057-2bbeeba3653c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679048, "uuid": "d77104c8-dbc3-4cc4-a901-2540c1d69f72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af96094c-85ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784724100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724100, "uuid": "9a56464e-fd34-4e14-b0eb-97b377e9b492", "comment": "Malware payload (Mirai)", "value": "dfc97d1d4c1e4b0734eb75798e66f6d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724100, "uuid": "d5106ab8-b620-4559-9f25-18f2259ec242", "comment": "Malware payload (Mirai)", "value": "2402fb7729483433f382d761a57051100faebc8b2e685a84d08fcc2d1c5d7714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724100, "uuid": "45af6205-058b-4fab-bbb6-739d21831f39", "comment": "Malware payload (Mirai)", "value": "55caa139d62fd68b07476ea5ecd6c9b13cc650bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724100, "uuid": "bf33b4f0-b6f9-4d00-9d07-2deb64d977c3", "comment": "Malware payload (Mirai)", "value": "23b1ec90d044942ef27d3d4fa349586133b9293d281b90017274b1228c95560f79edfaa402a1bcb90c48aeffef4bcec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724100, "uuid": "0cfb8933-e968-40e7-80e1-9f713706e4c6", "value": "T103C32945B8829622C6D723BAFA6E21CD336163E9D3DF31038E219F1137C659B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724100, "uuid": "5658f368-8b7a-4f52-84f6-8d6df712dc47", "value": "1536:lKSmAASQ6ei2cdv/Lpl+9RKp1anmmA4zQyCR8PajUSi0CmOlc45PLv7HKt:8PAA/6eedYZAlmPajU3xX7HKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724100, "uuid": "7b7df186-9fe2-4ad0-b779-98584f71d321", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724100, "uuid": "ab3d9917-d921-4304-a2df-e79f497dcd32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724100, "uuid": "b8595945-b35e-4009-9d03-de9442c90971", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455b7e36-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784705024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705024, "uuid": "85019663-5c4e-4c53-b75d-7a3db36fecf2", "comment": "Malware payload (Mirai)", "value": "645cc8496c3e30adb6ed78a3c868bc36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705024, "uuid": "b92712d6-51d9-4f5f-a6c9-4b4ee31c6666", "comment": "Malware payload (Mirai)", "value": "2496e1d86981f91d88568c06eae064494e6c59a2055eabad43103247a765f134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705024, "uuid": "db0cdd68-7ae2-4939-8ef3-f96333ce14f7", "comment": "Malware payload (Mirai)", "value": "7f53c0a0b6770ded48b2a19761541dd0f572eefc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705024, "uuid": "1121564d-597f-4bc0-b234-cad0d14ca41d", "comment": "Malware payload (Mirai)", "value": "55d1935fda3a9b994c1a7ceab17deca4cd9496ef86cf37349645364ced452bcf82e123139354fa075929607771676f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705024, "uuid": "752391da-a098-4a2d-a883-ccb68b48d8b2", "value": "T12533F136D1A5503B87A0EF31693B4581B2284365D3FBB063270F42EFACD612267BE587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705024, "uuid": "98526662-235e-4780-b11a-73650883f0fb", "value": "768:e2y6MVxRLbFaBtA+vzLYdjCIRBJ9g92O1NGGH3oNSfUH8F3vwy5yjOSiYYMlwq8n:e2AVbIBt8J9gEgX1fUsYDYM4mEqHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705024, "uuid": "df252de5-963f-484d-abb8-a6018c4ddcf4", "value": 53748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705024, "uuid": "fdc5bb5a-8db2-4846-bb90-b26f635125a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705024, "uuid": "94d5f3e7-3059-44a9-80c3-2ab3e70f16fb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7ed900-8563-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784679774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679774, "uuid": "c440ff2a-9c6e-409f-a202-fd3776a876ad", "comment": "Malware payload", "value": "39fe596815959429ed70115099426b25", "object_relation": "md5", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679774, "uuid": "b222b1ac-b034-4966-b35c-8e253d69809d", "comment": "Malware payload", "value": "253938f54a9938d1a2d9ce6622f1a3aecdf856961603c3faa6523467af6f3373", "object_relation": "sha256", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679774, "uuid": "ad0ae909-f813-47a0-88b6-e9de8fe099db", "comment": "Malware payload", "value": "363b999a1b003da1d407419bccb382139e45ac42", "object_relation": "sha1", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679774, "uuid": "8625fa53-0592-4b4d-926a-0928e71425da", "comment": "Malware payload", "value": "ae90954a3ed98740556312c110497fad14bf4ac4e3bd0329f7a457e83823fc45ccae4c03417e1cc5f6e86e0056471a2e", "object_relation": "sha3-384", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679774, "uuid": "267e7e8c-9166-430c-9f5d-f9661f9a89dc", "value": "T1E85311094DE3595173B3B0BA97DE945A7AA7C0C74F8B9E203C8D439AEFA103485F85D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679774, "uuid": "15fd1ccd-4e32-4bb3-bc19-59dada89a60f", "value": "768:dsJEryYUeNMZeZr2H3iFF9J50A8XZqP99pJW3gObz/P:MEr1UeNsc2HEBGBZqNigQ/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679774, "uuid": "290d5558-705c-4646-84c8-207aba39f6ce", "value": 63216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679774, "uuid": "0b984008-a2a9-45fa-a6fb-dfad45c10d6e", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679774, "uuid": "447fd9d1-4c35-409c-8fc6-acf28415e2e0", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6366b269-85d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1784726978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726978, "uuid": "ef6267d8-583b-45f9-93e6-6a99a6fee428", "comment": "Malware payload (RemoteManipulator)", "value": "0eb52a1ed797d9686d370160f7a156ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726978, "uuid": "02e8c45e-d869-456f-bda1-38df9b9db05b", "comment": "Malware payload (RemoteManipulator)", "value": "2695cedab056adaa9df1e30ad572d3944bdc09e7972ed757d1039121637b619c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726978, "uuid": "016e81ca-993a-492a-9b4f-a4bbd7756473", "comment": "Malware payload (RemoteManipulator)", "value": "a800b9bac703e99333c932d8861625dece921cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726978, "uuid": "1ae53fbe-9b4f-4bfb-a024-d990cc6e56f8", "comment": "Malware payload (RemoteManipulator)", "value": "6e006c14511bdaf65983a5c5a0b47711b91dada9c2954e37ad8b4c9b950814fad9db41c748c443582c17207886494187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726978, "uuid": "3cac83b7-beef-44f7-a976-8ce393f8807e", "value": "T1A1473359C7556AF5E1728370881348ABEB7338588370E5BFA36859193F13E33B639392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726978, "uuid": "de67631e-2f8f-4557-b925-05d1a5e245ee", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726978, "uuid": "ca6957e2-4a02-46df-ab0e-1db5fd8080a7", "value": "786432:YuSlpLt7wZ6MNIz+rpHw+WHEcWUs+fmVMrg:dKz4Iz+rVw+WkcRsR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726978, "uuid": "c72af485-fd3c-4131-a73f-b0780f1ec879", "value": 26560204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726978, "uuid": "8d125f16-45ce-4415-b670-817b4d8dea63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726978, "uuid": "4b123871-41ae-454b-ace1-b09e89641563", "value": "Kopiia_elektronnoho_dokumenta.032001.22.07.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672f4996-85ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784739011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739011, "uuid": "33f09f13-25c6-45c0-8144-3e049e9b29ad", "comment": "Malware payload", "value": "08a5fece455ab472fb6c900a21d2657d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739011, "uuid": "17f7107a-1903-4a4b-b09a-96f7d435af3c", "comment": "Malware payload", "value": "26eaf074c06ada6319109f04929df85bf2c83f9d17739da26c29b5cca6036d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739011, "uuid": "41a5591b-a2db-498e-9db4-25f5fc446039", "comment": "Malware payload", "value": "3f53d59af5aea85ae616fbb7b07f4f00d1d398ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739011, "uuid": "8d3fb112-0cf6-4d99-944c-2fe06acef77d", "comment": "Malware payload", "value": "9efedf69ca78fe35bf9f4cbcbee19a5984c35a7e979511fe9c9e95277202add838d5ffc452a8d2ac3435b99151cdba2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739011, "uuid": "389833b2-5142-4f77-b8ec-711f38a862e6", "value": "T15708339F3F81A445F59D8277B2D1C82B5DA0BD5C024A80A357A02D790F6B2D9BF3AD70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739011, "uuid": "9f2f8f0b-3b8f-43aa-a340-832cbe06e278", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739011, "uuid": "7f6813c9-8862-46bb-b029-caec88af00f3", "value": "1572864:cKXznwSEqWpgITSJ3P3R8fNknAnZ2yOogqTcaNH21A/lSRK4cNdoXR2J5fGqCCe9:fX7rEqL/h8fNknAnIdA7lxn4cUXRweNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784739011, "uuid": "b739566f-ac6e-462b-979f-10b732fcac65", "value": 83505448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784739011, "uuid": "82789bae-a739-4955-a7f1-48dad613c047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739011, "uuid": "44c1805b-1039-41f9-ae44-6a75ba6c370f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bca8acf-85b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784714134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714134, "uuid": "353c605f-2c92-47ab-83e7-d3b87c7211ef", "comment": "Malware payload", "value": "2e67915e03ae278bc67d6c1d0acfb2f9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714134, "uuid": "dfaf960d-4363-4f6b-b478-234db9cde74f", "comment": "Malware payload", "value": "27ba087eecfcbf5265216a34eba2bb4a39cc52546b6f51aa0d4c4a23e9f9779b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714134, "uuid": "8b014401-8413-43fc-ae22-4572e5def90f", "comment": "Malware payload", "value": "79eecb00049859f6b2dc2b6ff8728566a6db9134", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714134, "uuid": "4376bebc-e39a-4758-8520-4fd3c0aaa8e7", "comment": "Malware payload", "value": "9210416a22027c622cf0f25a6b3bdc40e9a1ea39c5d0a8356fe560d6cef8520112a74875a7e55bd352901abb060a44e1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714134, "uuid": "2a7a566d-b2bc-41fc-877d-467221105fe6", "value": "T1C9D60133A1ED21FBE02A4739597392154E377F316D234D1D96F438E8DB35FA0292AA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714134, "uuid": "188e3949-5a3c-4399-8ece-c88e95e118ca", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714134, "uuid": "2209b2d5-fb4d-41c0-be6c-ceb5a38f7a04", "value": "196608:VWtqBCxAxFMyo8ioqwpRNrKzwyVxN0md:VWJxAxyyHioTbmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714134, "uuid": "8152159e-e5e4-4dd6-acbb-a94007232ccd", "value": 13326294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714134, "uuid": "fe71e998-b0e9-4593-82ce-c89d71694b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714134, "uuid": "95c0e65c-808b-4de4-8a18-6a7d61038eb9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dc83a3-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784711578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711578, "uuid": "9881546a-a320-41be-81ea-483ca6fef740", "comment": "Malware payload (Mirai)", "value": "e59ed9392c2bb285fff6377d4b4efcb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711578, "uuid": "f1f975b1-fffa-48dc-bb23-bdfdec32ba80", "comment": "Malware payload (Mirai)", "value": "287962211de7bcadb39f7576732438b43ee6aab420ec23c29a9d12a8151a547f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711578, "uuid": "a285a253-c42a-4837-b672-c5354c35a636", "comment": "Malware payload (Mirai)", "value": "d3fa4b2d9bcc45c34eac5bc4d8b2f0355648d0e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711578, "uuid": "2cf64f05-e29f-4b4a-bef5-b95140c93e0e", "comment": "Malware payload (Mirai)", "value": "fc4b9a9d041062922d756c0bcb7098adfa3d80324cb78c51bb7f6ad0424fad9c13522b511db661859a7a25b1af92061e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711578, "uuid": "fa6febf3-8fdf-42df-83e2-e31cfa762312", "value": "T176B2F17C9D4F9127E033C3BB67174E2B753465E1938EA23332CE80B856C91932F65998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711578, "uuid": "988db396-de73-4c50-8e12-12ef242be144", "value": "384:Mi7moy6+jH+dv9tKcgRT2QpID7sd3ZgNzJbEq06bfp0rQoLq6u9dJeD79tUmv09c:1ioc+dv9FiHy7sd3Z6Jbd0ktoLqt9PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711578, "uuid": "fc1a556d-9cea-40e2-b519-a24cb63e169e", "value": 24828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711578, "uuid": "9ddd8e33-1553-4cec-861b-24910250163b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711578, "uuid": "e4169b5c-b7bf-4056-93e5-e10ed7641e8f", "value": "287962211de7bcadb39f7576732438b43ee6aab420ec23c29a9d12a8151a547f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3197cf-85ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784712046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712046, "uuid": "0146bd21-2ec8-48fe-ad27-7b8034c95c22", "comment": "Malware payload (RemusStealer)", "value": "c1bdcd152d0a396950b8996ab1c5c239", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712046, "uuid": "98cea4d5-957e-42c2-a585-d03abbcd4c1d", "comment": "Malware payload (RemusStealer)", "value": "289c17c4dec8773aca593e4801b1c32a560df755af602efc54f0d5b7155f3eb5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712046, "uuid": "4daa669d-0fe7-41bd-9c4d-7e6287b05e52", "comment": "Malware payload (RemusStealer)", "value": "6d201b633274a78169bf511bcd4dc4e0bbf12a6e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712046, "uuid": "092bd21d-cf5d-4532-af6d-0d6571a310f7", "comment": "Malware payload (RemusStealer)", "value": "aa09125a97cca5f0c100251b498edf2be352980531e73ca2dd4c17bcfc3d00d14a3666399fc4daf14986ffe218c03289", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712046, "uuid": "cc6eca84-219d-4d15-91c5-4f16c4acd7e0", "value": "T106D54A17ECA148F6C199A231C9739652B775BC081B3137EB2E90AB782E737D09D3A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712046, "uuid": "7abc550f-3e9d-4f03-b2f7-76629f7197ba", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712046, "uuid": "cf2ec1a0-0485-4c78-b96e-832f8c5a997c", "value": "49152:A44Zowwil2chLCdp8C7kdcxEfDSgCg82qc1:A+wITODtH82d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784712046, "uuid": "8b6a7d33-9e51-4cd7-afbd-3c521532fa7a", "value": 2913104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784712046, "uuid": "9e0569bd-df21-4875-99f9-f3915fcff440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712046, "uuid": "805f13dc-e52b-4a7f-a5e9-85874d9d872a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb634862-85c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784721972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721972, "uuid": "041b893e-aa54-432a-9638-fc2b5792b7fa", "comment": "Malware payload", "value": "df91ecffffcfd66362d598a16e7296b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721972, "uuid": "86f514cd-a6e8-453b-a60d-0ee52a2ec7ec", "comment": "Malware payload", "value": "29a205f16b69212478252f34d3c9f82537735b318a442069930013ccb346c28f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721972, "uuid": "2e5057b2-d23b-4759-b03e-938cdad0bc1b", "comment": "Malware payload", "value": "af870794069ab3189a3a948fadd3e998563318f9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721972, "uuid": "97b462b5-3845-4087-9aaa-df5b0d6ee144", "comment": "Malware payload", "value": "50992c841ab196b268b29bac8c5fd003e47ce9a5878294c72bc6bdd857ac0e761e8a3aec07da49144731681c4b0eea16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721972, "uuid": "2b521f16-3bf2-42ef-83e3-d7de5471cee9", "value": "T1BDF054E9517160387CD70BA71378586C39F966E4B4E1EE889BD7E070A564C5A70CC0BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721972, "uuid": "410ff4bf-84a0-4bf7-8c7f-7e44b0a84885", "value": "6:lOnFfl1wcTV4+cTVB6cTVBigcT5OBV2AIVSgcTjsi8uszgcTKtkgcT5OZ2AIVSgx:iUnzXVRfvJRlzKUKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784721972, "uuid": "eeb55aed-eab8-4309-a540-717f4ee5eb99", "value": 547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784721972, "uuid": "d5f62042-15a4-4feb-b480-53b3d6c83910", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721972, "uuid": "7489bb3e-79b5-49fd-a97b-6453c477e242", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e77aeac-85fa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784744445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744445, "uuid": "0b93cbf0-c9e0-416b-ba49-ca9259ed3804", "comment": "Malware payload", "value": "3f664dee6ad90fbf94ec9b4661d9a85a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744445, "uuid": "33baa154-5ead-4589-b255-91ca9a370136", "comment": "Malware payload", "value": "2b1511f1fb3dc2af912fada33ec289f4287ef0c5eb47e512d8ae7c2d7eeca9a3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744445, "uuid": "8ce2f213-78c5-4186-9f92-91d24c0e0811", "comment": "Malware payload", "value": "9665b71d9871c40691b6db8db30766f98a617256", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744445, "uuid": "e56784ea-a67c-4fd4-9961-6677cc16cbe7", "comment": "Malware payload", "value": "7c73fefebdec65192973ba6299e921b977b9ddba532d6c1456a1fe655593268fb27cb58523d3ba4e06317db37942f941", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744445, "uuid": "b24585a7-81d7-4419-9979-e81677040d2c", "value": "T1BFC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744445, "uuid": "82c20bb2-3bbd-401e-acc0-2dadff9fcbfb", "value": "768:v8vCB+25j6es8RT9FYpMSUpi+20qUpi+20YQX:v8l25JVd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744445, "uuid": "1e0b2afd-1909-4dff-ab0b-394546dee97a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744445, "uuid": "46c8998c-0761-4f6e-8d30-b4b842498dac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744445, "uuid": "62595868-8496-42de-97ac-13fd0e802110", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e54a37d-8598-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784702488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702488, "uuid": "ab47559e-0321-4782-97e7-9e1db13a6c12", "comment": "Malware payload (Formbook)", "value": "ffe0afa7675e83e125d2bf93d3f92b90", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702488, "uuid": "311cfa0c-80be-470f-b84d-3b3ad14cd235", "comment": "Malware payload (Formbook)", "value": "2b1a87cc1f95d6d79ba39d26a6b6b918c5b7359569ca1b71aa1d4c7233d4201c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702488, "uuid": "9dc3ba20-f0db-454e-baee-6815b1fe7407", "comment": "Malware payload (Formbook)", "value": "2011d82fb9e93f2fc705e110519484e169a54e0a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702488, "uuid": "dad31386-69b5-46a8-a872-648e020497d6", "comment": "Malware payload (Formbook)", "value": "5eeb4e55ff23561806f87fef78282c3ab55eaaad1cd4ff1da4d87ec42a07fc9d48dd65d4d2032841f4d13c836e646df6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702488, "uuid": "7226cb67-f574-4d46-b79f-75dc13b20d82", "value": "T1AA1455A9D75F04A9CF98A73B025B8A4946FCB33EB30151B135AC83B433ED82D596647C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702488, "uuid": "27b19c2d-be8f-4154-8c09-867aeebf3e80", "value": "768:4QUUirnrN+omRBCMtoI32ut3rHsUlWWre41:Drir3QsMtPptLsUlWWrx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702488, "uuid": "83396a71-2424-4560-a6b2-a72c0701a3b9", "value": 191648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702488, "uuid": "8c5088d8-1ea0-47b6-9728-946bb82346e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702488, "uuid": "1c64ac1c-c996-48d9-a4e2-ed70c78671b6", "value": "P019846645.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e5fd47-8612-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784755133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784755133, "uuid": "a070fe5c-83b1-4c24-9f43-a478e4eab0df", "comment": "Malware payload", "value": "bf747d1ddb73c3a6cc737894c1742e46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784755133, "uuid": "2d54ddae-87c2-4f69-aaf0-c2eb25f53b83", "comment": "Malware payload", "value": "2bddfd2a2be55a42a621a4c234f39e2a5756557f6ec03ef72eb7d1880e1a02fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784755133, "uuid": "1c5c7a25-7fa0-49a2-a4b5-40172330efce", "comment": "Malware payload", "value": "48d4045f002ec7faf93853a02f92ccb440e7f805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784755133, "uuid": "b7703684-4091-4a21-8497-18d4ff89674a", "comment": "Malware payload", "value": "01da58c37d4fd8c439c3a038905ce5ea7ffdcd17b0bbcd73779f69e1d30bc32621bcbb45467d8434e03ef69a2502e605", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784755133, "uuid": "b927b591-36ec-452d-aef1-03451387dbe1", "value": "T11457CF7792467CEDE9B98CB4D01015816DA878874778E3C7BAC870E666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784755133, "uuid": "380ca2aa-90ba-4320-98ec-7056afe5c74f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQa:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784755133, "uuid": "e92b9a93-5fad-4b0c-b742-8f0999c6e47d", "value": 28540928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784755133, "uuid": "94973dc5-721c-4c8a-941b-7fe29bdcc020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784755133, "uuid": "39764f47-6ec2-46f1-b953-095a001c2dee", "value": "2bddfd2a2be55a42a621a4c234f39e2a5756557f6ec03ef72eb7d1880e1a02fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff84d2c-8575-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784687727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687727, "uuid": "376e26cb-714e-4b4c-b938-55cb9f07f827", "comment": "Malware payload", "value": "6ddbc6c25176e1b5b32f242f1f336e6f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687727, "uuid": "e0fcb2c4-f29c-4cc0-b405-7c5ffe733b29", "comment": "Malware payload", "value": "2cb2ced283d72a7323be7e4c95c1563ff5f26546794e602e58c2701f2b3c623a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687727, "uuid": "42d83936-2cf8-443b-9de3-17325ff9c1a5", "comment": "Malware payload", "value": "0778c4b49cf9f1931a81200574d6e4a4448804f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687727, "uuid": "88f056d9-78cc-4de5-bc2f-7f24ddf34253", "comment": "Malware payload", "value": "d6919d77761bde7eaa677284431751c591c5c9f755a2b0be909ad95744c01cecce15043429bff1b681a464988ac4ae06", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687727, "uuid": "ebee6551-4b26-4880-98b9-704bb4d71121", "value": "T170D38095F2D61CCBE66592BC42D5E222763DBCE10213CB574A246A374F9AFC37AE0143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687727, "uuid": "17049de7-ac98-40fd-838f-ba8bcb1ff259", "value": "14b2c1037c7b350f17a09784b21d3824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687727, "uuid": "3d562bc7-ce2a-439e-94d2-4d9efd294a73", "value": "1536:SgmN86v2wtsHDvqh8bYtChC+PeAHCMgArhByuy6aif/D50TIpIvSUbmLW/KfABkA:SgmNlymybYtChrIMgArXyVi1sSsmLVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687727, "uuid": "a009ddeb-9e9a-4d03-a705-4c78958b245d", "value": 133046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687727, "uuid": "564ecfec-72c7-4462-9ff3-86265205b6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687727, "uuid": "4e15dcbe-f1f8-4aea-80a9-9a0ce4f2b0d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a15cad-859a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784703459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703459, "uuid": "89ef4a14-02b1-43bb-8c06-a3ce055943c2", "comment": "Malware payload (Mirai)", "value": "e4c4313efdbd3cf64642c526d11b90fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703459, "uuid": "fbfd9910-4031-4709-9e79-eb5f596a6a59", "comment": "Malware payload (Mirai)", "value": "2e4418d02692320e82e685f2dd67935bb25642f6d60fa3674be7f7c193817ae5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703459, "uuid": "b3c26942-56dc-466d-b66c-8fd59faabb1e", "comment": "Malware payload (Mirai)", "value": "8c59bcae0cd9ca74de0319507c1293c10cab5b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703459, "uuid": "f599a70b-b943-4d24-82cb-dd12916544e9", "comment": "Malware payload (Mirai)", "value": "1fcfcdd24de9f2efba1a8a6d44dc2bca6341060b8086b693be2aa6a7d35cf255386b795543fa4631c002129f59c3e2a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703459, "uuid": "1a1ff480-fb1e-4776-bc98-bba71e418faa", "value": "T156E32A45FC509B26C6D621BBFB4E428D372A17A8D3FE720389255F34378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703459, "uuid": "b293a631-c9fd-48f5-be3d-b6167f42de27", "value": "3072:mXUQ4m6QiHPAjuCEX79Rb0bJ/d5xe04A:JQX9SPAjZ67Lb45Z4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784703459, "uuid": "a2974f2d-46b5-4ae9-9ef2-149fa11d4123", "value": 146096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784703459, "uuid": "3f3c97b0-b718-4340-82dd-e44da1c58a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703459, "uuid": "43f73a69-76d9-4f29-b26b-c6f99d7f5729", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2e32ff-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757893, "uuid": "2954fa53-5de2-4dfb-8295-1a1a644caba6", "comment": "Malware payload (Mirai)", "value": "856e6f37b2093319b4ec27b8f5dbae84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757893, "uuid": "3eaa93b1-e940-4ac0-8f42-43cd7aef2592", "comment": "Malware payload (Mirai)", "value": "2f15c07433d268f50a0e9ba7aa41dfa5f0fd4eeca03b77ab00c222bea1e6f73c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757893, "uuid": "97d2e51b-bd69-4962-9b46-09b2fb3819f6", "comment": "Malware payload (Mirai)", "value": "9f24921d2fdcf6f96ccd24cdf20a89a9ff12a1d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757893, "uuid": "9dafb165-c0ab-4b7c-ac77-84741932650c", "comment": "Malware payload (Mirai)", "value": "926f2b9661be08ed5ac1612c90c0b047aa4878cabd26a449c2bd2862dfa2473f20e007d53cd1b8666efcfc435f8566f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757893, "uuid": "c765ea5e-8683-410e-af96-5b66de32ab57", "value": "T16C4349C4B183F9F1DC05017C306AEB326E33F0B6713AED9BD7E455B3A855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757893, "uuid": "16a3c039-5234-4502-9a27-0e4d7c131804", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbVGoPCdgZl7dbFfGa:xzuXndFq4ZthB/VUfOWhGoPKgj7dpOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757893, "uuid": "eed1c843-080c-45f5-9ac2-a6d13f43ca6c", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757893, "uuid": "30356d65-296d-4f33-9084-674bb1a93ee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757893, "uuid": "bf0a36a4-9942-41ba-80a9-9071b6561c1d", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662530ba-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757907, "uuid": "b0f5a9b4-4f95-4fd2-906b-4f3c3f1d95c9", "comment": "Malware payload (Mirai)", "value": "4fb89b83c275e07d01a74b238850dd1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757907, "uuid": "4428d023-6201-4e19-815c-b9de0bb8e912", "comment": "Malware payload (Mirai)", "value": "315130dbde6535e561ede03e614340a5bf1ce0a1ca83f89c1a65e8594c1af657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757907, "uuid": "23b498f3-e03c-4f65-affd-fa9482cee11a", "comment": "Malware payload (Mirai)", "value": "0b39866c491389d0ec8bab7eaf6b642737ad2443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757907, "uuid": "757817c9-3109-46aa-97c6-df67f7cc2806", "comment": "Malware payload (Mirai)", "value": "cfffad67ed09433d5084708a61ecd63b7cf535fce6c4431b858e7f3d1df379d27875c73388a4fcca03ec1c375ef70961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757907, "uuid": "909f718d-3627-4c82-a03f-13bae6c9cb42", "value": "T1C3730A85B9819B25C6D513BBF91F018E331657E8E3DE73129D201F607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757907, "uuid": "c2a56f60-62b3-4953-8fa2-56927cc8f030", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757907, "uuid": "758b8cc8-1b5a-419d-b7e1-56cbab0b8fc1", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757907, "uuid": "ff5b2db8-746c-483e-9adb-214ba3dd659a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757907, "uuid": "d4d054f9-189c-48d6-8f63-86d9aca70125", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbab4202-85a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784706994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706994, "uuid": "9298f5ee-cd24-4970-8e3e-c8d141e2feda", "comment": "Malware payload (AgentTesla)", "value": "96b460bd6ce50b055141047006ed31fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706994, "uuid": "7805334c-4359-4a4b-bd3a-e2e7abc83866", "comment": "Malware payload (AgentTesla)", "value": "32226374322f5fcb0e89320e8d42fb9070e6410a0ac522946b0d61c29253d0f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706994, "uuid": "fc7bbc86-9c55-4f83-afbf-ca831eef66ea", "comment": "Malware payload (AgentTesla)", "value": "434da636770d91cecd841788ef4415bbac2cfc4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706994, "uuid": "4b6cf788-1b1b-4fe0-98b3-000eb844b442", "comment": "Malware payload (AgentTesla)", "value": "327c7ced3c0a1fdf7b094f906ca24cc9f565864ba728ef526374ab1484cae28e3bc5f61683aec2233e4a772caf64b0ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706994, "uuid": "33ea54ee-688e-43a4-8342-c9d92a800ea0", "value": "T1D2E5060087286871692DD72CD43A9FA8054D2003619DEF5D36FD1728BB9AF47A78DAF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706994, "uuid": "e254d9f5-663a-4ad1-8293-f939fa3a0605", "value": "98304:8V7oBvnKzsQwsFHBQYgB4KKh8JdnyWdngJ/FDHZgeNrnCtL0:8V7SnadeHBO8HnLGJ/FDRnCtL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706994, "uuid": "8b2e841b-83da-4ab0-aaf0-b82403499524", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706994, "uuid": "485256bf-7703-4f6f-8eeb-a3328afd668b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706994, "uuid": "185f6e54-c133-4359-b2dc-c247c51debdd", "value": "PO NO. 2401555.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7aa108-85f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784743232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743232, "uuid": "16dfae3f-def0-42e9-b00f-a9c95fd4795f", "comment": "Malware payload", "value": "6385a1d7725f79287694881a5206a412", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743232, "uuid": "70aedf30-0c2a-498d-be81-25fdf26f5b19", "comment": "Malware payload", "value": "32a962439ec0fb5559e494fe1ea6be039815d3c4c1cceb95b16dc123e5abde61", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743232, "uuid": "1666a2a6-fcec-40bd-87e4-8ec16fb0d221", "comment": "Malware payload", "value": "3ca0b3f83629596bac5e7f2cb8be1fc0d0fe481b", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743232, "uuid": "bb0fa14e-1782-4067-b734-5e94bb5afdfa", "comment": "Malware payload", "value": "c5d3a0608fc4d62e664a9809bbaafa72db115263c2a92c986bc3a916a1f313636589aab6a27a0edf1af5aee283a7a46f", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743232, "uuid": "62ea1918-cf73-4ff7-9346-c40e5a96ce32", "value": "T18F930202796627F6FD251F3F5AD076198CCC7C02B6A602893191629F31FDB6A8C34D27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743232, "uuid": "95c96748-7e86-45d0-8ac8-84667a2b6a87", "value": "1536:n0vwCMHua9U3ubbQo/QoERo2VYbw1Y4gKfYqyunokJVUAb74wBGGC4laZSuQ:0vVtubkojDbw17IDXAbcwBJ88p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784743232, "uuid": "e92c9e4f-d8c2-4885-a592-191a852e5a9e", "value": 94101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784743232, "uuid": "5f2d0686-1e98-4c0f-8943-45884837940b", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743232, "uuid": "c701449b-4241-439f-bf23-3dad6679f2ea", "value": "Pro-vyznachennya-obsyagu-strategichnoyi-ekologichnoyi-otsinky.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02485be5-85a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707917, "uuid": "99cdd843-e881-465a-bc8f-dc5d89c43472", "comment": "Malware payload", "value": "5e8337608ddfcc8db454619639098501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707917, "uuid": "6defcd06-fa9c-45e4-b25a-45fe2bd6384a", "comment": "Malware payload", "value": "32b222165a61978b9d981cbd77eee2c24d7d366021ad3abfcfcd052d7a6e8d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707917, "uuid": "d07ce0ad-b1a4-4474-b338-489ebc4d0267", "comment": "Malware payload", "value": "c7e5add4ba47088a6ebd3ac7c8c3cd3f619d4e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707917, "uuid": "ffa06b17-d1db-489f-8078-58f3840f2e06", "comment": "Malware payload", "value": "a42d7447a24f92379a0e72e58aded7880850ecd5c9902b5d1e85537b0306bacc22e02f3f39f5d716000fc7daba63a021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707917, "uuid": "ac27b128-3b91-4d27-bd3d-b21af215a74b", "value": "T195D533709370569CDA014937A821BCF78784BD2BA407F82E17746D14772B3CA9A7AF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707917, "uuid": "00b2ae8c-ffa0-4c0c-94e3-fcfd67e8f1e8", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707917, "uuid": "91548e64-0ec8-4066-86a9-37739a30f8ba", "value": "49152:4oiPj+/yE64TV/PS1c4c/G/nIRDRGdLRcoknjz8BMi9ZEEdqRHp7AR3pY0+AAtNa:4owj6tzVH4c/GAbGdL72jzl2fccrYtA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707917, "uuid": "0d959054-8449-400b-b7ca-8349aca67f90", "value": 2883715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707917, "uuid": "ff891c1a-3f44-4c5f-8d5f-2a74ad4f4319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707917, "uuid": "6cbb55de-41c2-431e-894f-7af761684cbe", "value": "SecuriteInfo.com.Trojan.Gozi.2177.22380.17981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c87af31-85b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784715317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715317, "uuid": "a7006f9c-35fe-495e-b737-b213f53b8a7d", "comment": "Malware payload (WannaCry)", "value": "72ff3b17e97c7dd4f88bba3e7b7aa2e2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715317, "uuid": "e751c17d-54f8-4f59-9834-db967885825f", "comment": "Malware payload (WannaCry)", "value": "32c9bf96fb8c0d6ad0d3a3d2707a8a9ae0b95ccefaa26ad0e33b518d9fd0a608", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715317, "uuid": "a8854404-20ac-4d3a-905c-d1e1c620812a", "comment": "Malware payload (WannaCry)", "value": "f4918cc9dd1ed3ae3481ab7ed1617eb6f7dc98d9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715317, "uuid": "f4cadd71-e201-4df8-ac00-23a1af2694ac", "comment": "Malware payload (WannaCry)", "value": "806847dc41bbad791a4991b9834ee9eb97e077c75ba897f732f8b9bb79b7e61056d995c7f729a471dead0f3de7d7f570", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715317, "uuid": "9b600ea3-967d-4b76-9977-7a0198904322", "value": "T12B36121932AC81BDC516523494B34E36E7B3BC9A527D930F4B588B6B0E13390BB79B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715317, "uuid": "a6e20127-1e50-4a3d-822b-6bc9cbf9fcd8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715317, "uuid": "c1c1bb1b-8595-4573-a847-7579ef255439", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw:jbLgWbLgddQhfdmMSirYbcMNgef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784715317, "uuid": "9063f2bf-567b-402d-a8f5-f4ab814ba70b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784715317, "uuid": "0cc73e63-bb43-4fee-90cb-ac241de1714e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715317, "uuid": "877f3314-89c5-44db-9797-34febffa95e5", "value": "32c9bf96fb8c0d6ad0d3a3d2707a8a9ae0b95ccefaa26ad0e33b518d9fd0a608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b228da74-85bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784717661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717661, "uuid": "dc0ae9cb-ec7f-4f73-aefa-0b9bc1ea115c", "comment": "Malware payload (Phorpiex)", "value": "2e8485c56f8045122064cc3cd30679b9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717661, "uuid": "d4d5c1e3-fc80-432c-a9f9-b9d914da1f01", "comment": "Malware payload (Phorpiex)", "value": "336b57387bf7f74d2b707d2908e21c26fe75a7acc0d0471ba73fc606a6f6a777", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717661, "uuid": "973761f4-f23e-40d4-b3cc-ee50c9e8ff94", "comment": "Malware payload (Phorpiex)", "value": "e429531543547497acfbd74e4b322c32aa4e6974", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717661, "uuid": "e71430a3-0f59-47e3-91f4-e3fed23e30f8", "comment": "Malware payload (Phorpiex)", "value": "0890debfc3a836e250fd7c5f362321ee797e1b31c49776b8963da4b33b86f34f01ffee7bfce2c269b54f579e6e073935", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717661, "uuid": "96e1f016-8fe0-480e-b346-d230d702f248", "value": "T124B38D2034C1C432E567217988EAC7B58A6DF8310F7566D7BFC406AE4F276D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717661, "uuid": "15c49145-b73b-400e-aeae-a7314cdcf0a1", "value": "cf1136126b3340920376499ac9490ff7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717661, "uuid": "3d47fd55-8d8a-442c-a86e-5450210680d3", "value": "1536:L3L/ED9LEo5D+ZPJ4m6G+zZTATLu3dKVI7IYM5XDd4i5cAOy:jL/cl5Mi9G+zhWLqwZ5Xei5cAOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784717661, "uuid": "03fadece-c614-4e5b-b2a4-5f7c2e111027", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784717661, "uuid": "acfcc02d-c446-4fbd-8645-bb05b4c36177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717661, "uuid": "0e84c86f-2450-42c3-a081-5ff68ec79f8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f51348-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729506, "uuid": "542a85b8-a981-4d29-a16b-7a981bf1f237", "comment": "Malware payload (Mirai)", "value": "54f121bc526ab064a051c03e7e3b8307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729506, "uuid": "3b100352-e339-4947-bb42-3a238f34ca7a", "comment": "Malware payload (Mirai)", "value": "3405c54d4dd1b08db43c2254666062620c4c4e24e5e23aba74f4cfddb7985114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729506, "uuid": "03168262-14ae-4702-980d-4e621150b675", "comment": "Malware payload (Mirai)", "value": "5457562f9d4ef19f0820daa0b7e2b2674809f0a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729506, "uuid": "acc80a30-7ffa-4e94-8a9f-c13673de6a00", "comment": "Malware payload (Mirai)", "value": "fc8968b0e5218458b540feaac4a272b118d92102fea3974395a142a64a2e31a95efd5f7ee0c27a5806b4bc421acd76e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729506, "uuid": "16104c24-6da2-4515-b68e-3d3390e423c9", "value": "T15743012B8218F6B9E4B73737BD9958C4F992A419B3045E0B144638E4D69AAD0FE11F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729506, "uuid": "3a2e5469-5135-466d-a5ff-1945c4965092", "value": "1536:BTlOq0cr53PjJ477U+757b7p5vsfq5bj+q:VQM3Pw57dU8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729506, "uuid": "ef33e001-32eb-4a57-8f84-727c4f82fcfe", "value": 58028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729506, "uuid": "5b803951-f17b-4d70-b99b-fd686eb81214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729506, "uuid": "b9fd753e-3457-4cad-be9e-188458b8e28f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88296f98-85d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784728328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728328, "uuid": "9a01f189-3970-460d-9414-57e47f74b459", "comment": "Malware payload (Efimer)", "value": "5da2221dcc82bfb56f16b525b13f8c4d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728328, "uuid": "13ad584e-63ff-48ec-b3f3-ba7847bb7770", "comment": "Malware payload (Efimer)", "value": "34c1dce15dfc0dfb9f57bb48cdcb0c31c400206647b58ad6c4ebc64f25caa06e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728328, "uuid": "6e138ece-6082-4676-9a16-1e08cd499b7c", "comment": "Malware payload (Efimer)", "value": "4421f6f8c14373aae099a681ca351d02227f97e7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728328, "uuid": "dcc2b172-b94c-4895-bfa5-05752dd3b18a", "comment": "Malware payload (Efimer)", "value": "1436e9954189817398075a54ef1c1fb2edcafea52e13a940f66d8ea328796c259e49525afba1a173dd6a88ce2066ab65", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728328, "uuid": "ff4fc063-1fae-4f75-936e-11d9a1c73088", "value": "T189E63388A6D046EEF5B382BCFDD482C6D4B578725B72C9DB4B60DBA11E4B0D04C3D1A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728328, "uuid": "37e1f5a8-e202-4158-b91f-adefeac77400", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728328, "uuid": "a9c6ce4c-4ed5-49b9-b85e-7346249a354b", "value": "393216:ct9s51D9XybdCYJXHdXjCicm/56B4pZXMCHWUjX+cuI3/PGTAI:cgDVuYCjCA6GXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728328, "uuid": "4ad2eab8-16df-4126-98c6-8e00a54e11f1", "value": 14265636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728328, "uuid": "e271ae4b-3325-4318-a6a0-b1e302e455a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728328, "uuid": "23f61fde-37cb-46cd-82d7-f42fdc50ce70", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc74b7db-8599-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784703130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703130, "uuid": "02ce6c0c-8aeb-4a95-8de3-f9e2b5381ff4", "comment": "Malware payload (Efimer)", "value": "05841816e5acb11f3c46b0bf992743fb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703130, "uuid": "aed3ac02-394b-45b9-9ec3-a325c055e0af", "comment": "Malware payload (Efimer)", "value": "354bf39ac11e66c61d8236a4ecdf7231e9b458d2943b7868e01b03c267e90096", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703130, "uuid": "3c3b0db8-22f7-47d4-99de-bc50907c93f3", "comment": "Malware payload (Efimer)", "value": "15ca284e6855ee736443a9c7dd1a624da929c42f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703130, "uuid": "562e8d78-5808-46e3-9360-5e9dc16100d4", "comment": "Malware payload (Efimer)", "value": "ecfb5f3a0141b9e21c99485b52090e978984d68675d5b7d9b0ffbd8a3e75abc1dc81ecccb5a63fd2aba4e962e3e87ec6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703130, "uuid": "912098c9-053c-4c4c-88e1-3acb27029340", "value": "T18AE6335852D015EFF767803DE8A79262E479F8720B71C9EF6B5917A1AE432E40C38327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703130, "uuid": "59ae47b5-2c6e-4f68-bbb2-aae35e0cbeaf", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703130, "uuid": "2de26c98-3fad-4ee1-8aec-eec6bb559c4a", "value": "393216:ieXI4bFjhO+P91oXMCHWUjXgcuI3/PGTAI:igxc+PAXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784703130, "uuid": "94793ccf-8b96-48f2-9ab1-147d46a69566", "value": 14300226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784703130, "uuid": "5538539a-6a14-4827-9193-983988f68c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703130, "uuid": "e01b3e89-f7d6-4979-b860-cd0d2dbf61b8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddf0dfc-8605-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784749249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749249, "uuid": "e557c90f-59d6-4fe1-b169-0ee37f1f3b53", "comment": "Malware payload (Mirai)", "value": "0b6bba44736962066c6a563a90b832fb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749249, "uuid": "fa4864d2-2dd5-4cdb-892f-5fd599396674", "comment": "Malware payload (Mirai)", "value": "35d220d4bfeec29b788e018405b60f42f63d8003ba673a09465b2be8a0456667", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749249, "uuid": "74757fe4-96dd-450f-8d7b-fe0c11db6641", "comment": "Malware payload (Mirai)", "value": "03c636c614a88dcc68e6b5c2ebc2bb1080b6cd36", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749249, "uuid": "a68a0da3-599d-4bc9-a30e-67ac478d3c0a", "comment": "Malware payload (Mirai)", "value": "64a1b60643f11438583a757dd4ff9866a22a676a5998049f37bc2d15b682f07c629f77efbf5e34a06fbc338a602f11c5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749249, "uuid": "dd14489c-1667-4296-bfa5-131148d4a340", "value": "T1632533C672E5F683D7302E32ED68FFB55B24A74E5654162A3C22E5395ECC3103292CD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749249, "uuid": "22420beb-9764-44da-a920-5ec6c10569a0", "value": "24576:vJbBXBgfDQlDiZYEQZyZaK4pvyBRKDLRLKDLRAT:vVBRg7QlDiuOavoeHROHRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784749249, "uuid": "14dd0629-4375-404f-99fb-3c9d8205473e", "value": 1000634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784749249, "uuid": "2b00bdee-0263-4ee9-a33c-ea5e52cd615a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749249, "uuid": "0d46ee68-9b73-4e42-b788-bb6dd045a8b0", "value": "35d220d4bfeec29b788e018405b60f42f63d8003ba673a09465b2be8a0456667.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4304d4-85c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784722535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722535, "uuid": "a988b322-5291-4c9f-8d6e-7fd3869ddc85", "comment": "Malware payload", "value": "322b31863b476d6071fd178df6ecad38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722535, "uuid": "059df1d4-59fb-4d11-b55d-b3a70c2b6437", "comment": "Malware payload", "value": "361f66e84ea607001a839d856e8c4b864bbf3c183c71f0debdf812de7c4853a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722535, "uuid": "77f3a26b-2416-4944-91b1-2b97339f3e9f", "comment": "Malware payload", "value": "6e1b8139033c8d3d86700fb43514311576815e18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722535, "uuid": "56861fa7-c7cf-4228-81ba-228fca91f285", "comment": "Malware payload", "value": "17d59320db232436cf20f0581b3c21a67ba6c51cbadf2d81ce1908a93d0679738cfbc8cd502a82da1d44b480a8064f29", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722535, "uuid": "11b61b00-f0b8-44df-8e44-833d4596c3f7", "value": "T127236C652A817C14AA98D4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722535, "uuid": "79d3a9a6-b40f-4b81-8d4c-559889fcabeb", "value": "768:wXOGVvp9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:WLqcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784722535, "uuid": "f06fbfa2-5889-4da4-b12c-413d734b7aa9", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784722535, "uuid": "40b1432c-a209-41dc-a840-e695b6f3fbaa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722535, "uuid": "f369012a-c487-4895-9022-974e6a4a5fbf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cdd75e-8595-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784701186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701186, "uuid": "0b0e7e45-e771-4f9f-8fc1-d415673eae5f", "comment": "Malware payload (PureLogsStealer)", "value": "baf04b7fede5dba9777f68c602a0c79d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701186, "uuid": "1c996478-670b-435f-ab87-56bd2c6e9c0e", "comment": "Malware payload (PureLogsStealer)", "value": "3641be410d5da53702b6b8376e2b58d5ccfe78b90e97f6feb482b1a8855b5850", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701186, "uuid": "9bb0d7a7-a9fc-4aee-9a86-76211e984a9d", "comment": "Malware payload (PureLogsStealer)", "value": "b10c2af8804516c86d079b55a7e791aca2559cef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701186, "uuid": "c9859971-5cf6-4197-9abc-e78f58c53222", "comment": "Malware payload (PureLogsStealer)", "value": "30f2cb896e65b3e211845285c40ddb6fd0a5f0312b83858be5130e835b739dad4efde04028ec70df0844e1ecdeb0904d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701186, "uuid": "df8dda10-fcaf-43c3-94d0-979f34c90867", "value": "T14BA59024D9F1A4DA4B00CAB556189DB9FC769C62C22646E04EDF6FC879F8C4D39D808F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701186, "uuid": "20ef0e24-bc35-4c5a-bfa4-ce6be460698b", "value": "24576:HmpJIQkQcYAY/Nldu2/jctbJGlnzfTigOJvPsnNO3v8/G/l190mfjQbQXShk+VVQ:Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701186, "uuid": "8027bcef-8767-46ee-860d-e33e1a4b89b2", "value": 2118057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701186, "uuid": "1db33d83-2fec-498b-879d-7222b3be3811", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701186, "uuid": "44476c30-4364-424a-b30e-5d38ab53afe9", "value": "Request For Quotation 9505ADC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcbdb31-8606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784749601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749601, "uuid": "e70789c8-839a-4768-98f5-22d070e4c0fc", "comment": "Malware payload (Mirai)", "value": "f434838270b4705f1223ed26d8b96609", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749601, "uuid": "5f3e5a94-d6ad-4954-808e-5f793ed96537", "comment": "Malware payload (Mirai)", "value": "36d65e0266d599c53f1ed30ca7f473b9532b7a4ef197a7f1ef55493234d83f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749601, "uuid": "a0cdf4aa-9a22-4b30-9475-5ceec84955f7", "comment": "Malware payload (Mirai)", "value": "96b4d08a88238c84061b458bd8846f15baa4c52c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749601, "uuid": "bd75f47f-6b26-497c-a32f-a9406423f58f", "comment": "Malware payload (Mirai)", "value": "5bae7578a0539f87c9c0e0ee2beae704c5bd3576d6fbfbdb7b203b5fe90f4a172e7cf52554c19f85cc0d686239b1dc72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749601, "uuid": "b68b2d52-85f2-4a2a-96cd-fa14560de8e6", "value": "T168B33BC4E243D0F9DC560534213AFB379A73E5BF212DDA43D3A49AB26C96AC1D80679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749601, "uuid": "8db2561e-2916-434a-b429-30ae6bc269a3", "value": "3072:pd5qGekwumbRajd24W4ZV2M5Jfebx/S3H56g:z5qGek6bRaj48V3GJS3H56g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784749601, "uuid": "37e568f6-bf1d-463e-82a8-2228db4c4a6b", "value": 108148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784749601, "uuid": "8f55ae2b-9200-47f1-8948-fd5ea769382f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749601, "uuid": "7ef91298-546b-4205-bf3d-2555c69ce98b", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a583230-860b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784751793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751793, "uuid": "87f8782d-2ee8-4f41-ba5c-ae2e24538a03", "comment": "Malware payload", "value": "2f803e34e71884b45eb914580f121397", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751793, "uuid": "e3734883-a287-49ce-848a-6eb6ed00773b", "comment": "Malware payload", "value": "371d61eb559b29638bdd41d9574704a5029b01d201461e3ae4c3fd05590fe2bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751793, "uuid": "ee6b37b7-0580-45d9-9dda-ce1950a860df", "comment": "Malware payload", "value": "c0f45f0a0a460275cd4f3c86efed769ed02efe0b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751793, "uuid": "e5aa178c-f14b-4b82-8ed7-d40523b91cc1", "comment": "Malware payload", "value": "b0584b62f86543113f889d60e00a1113a1f12662c4665a53191c35ea70ff0f28adec1650031fdbf55845487a3b860f5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751793, "uuid": "33a4b0ed-a293-444e-bceb-57fa986dc6fb", "value": "T161D5239975F21974C4B6C372CF42E0ADB16D3B848B218E5BF1CD2D109E67294683B3B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751793, "uuid": "f9120668-d191-40eb-8f88-271a33b27de2", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751793, "uuid": "811e7443-59d1-4ddd-bc94-23361bd00990", "value": "49152:1d91hUW8aMG8kvlvgB+UC/p0UGleuKGfy6fWLbX/wbujlCMwNNU1G5m3BuVE7D:1d9fUwMgY+Ugp0UeKGrfc0ujlXwNqIPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784751793, "uuid": "8e6751b5-85dd-4fab-9a8c-642e709f8a76", "value": 2924032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784751793, "uuid": "94edcbb7-1ba4-482a-a08e-c4a507813f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751793, "uuid": "b0f7e3d1-0e68-4ad0-afad-604fc9876d42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1efea2-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784702213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702213, "uuid": "84501360-135c-4e99-bb8c-98eaf0004bec", "comment": "Malware payload (AgentTesla)", "value": "2cef4231ab7d67d77a97b3f333a71f8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702213, "uuid": "f0e47c4a-3d51-4e44-b12d-b56a15e42f94", "comment": "Malware payload (AgentTesla)", "value": "37dcda4f7f83ad6818cef4a3dc36e661ceae049b0f3394bd89a4cf909699078b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702213, "uuid": "05b43bee-6eb9-4fe4-9a38-197d78e4445f", "comment": "Malware payload (AgentTesla)", "value": "d22288d1a033b715900812016bb285f93e7c4cb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702213, "uuid": "b144276b-e4c9-48b9-9014-50b0e39e53a7", "comment": "Malware payload (AgentTesla)", "value": "f09cd5fd05a3294a1aad3cedc1c224ddcae8d835f71aeb8564262c083cc1bf93bf9311c635e997c6547a78844f7d10e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702213, "uuid": "fba0f566-c121-4e9e-9bb0-172bc4d18005", "value": "T16D051D8422C1B4A48397DB7B3A3BF0D6E16E0CDA66A404CBE214FC96F565707EDD1A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702213, "uuid": "d28ede81-f4c6-4891-92fc-96368c6517d7", "value": "12288:jyx6tlYkJWkcFdCuLhPn31BMw0jYDVhOLYE1CsIw2AuHInYSEUG6x:jyx6mPyYbxEVuHQa6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702213, "uuid": "b8ceee9a-09dd-4d1d-b84f-128330521c36", "value": 805665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702213, "uuid": "03d1f4a6-a794-4fc5-abeb-889a359c4718", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702213, "uuid": "e6d48c00-6718-45ac-b524-2ec9709aa135", "value": "Shipping-Doc-CI-PL-DBL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2773c8c0-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714852, "uuid": "05caf302-ff77-4b25-8d5a-fc67e4111b5d", "comment": "Malware payload (Mirai)", "value": "5a0d8e0d654b8fed207fe44673ebed21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714852, "uuid": "2e875b2e-bf36-4bcb-a859-0d54ce4d13d6", "comment": "Malware payload (Mirai)", "value": "38b78f0f6a2346f5672ee2b8d45902516f53803b5e8f3cac101c42b13fc03619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714852, "uuid": "94c5c25d-0f66-44c2-927f-53564b9e68bb", "comment": "Malware payload (Mirai)", "value": "4d43a9388899da7559db602cefa7fae83a74ac8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714852, "uuid": "602395f2-f020-4340-a900-886bdf668b2c", "comment": "Malware payload (Mirai)", "value": "7a11116259e99bcd387b3d79bdf463f19116296467aa7689a07708e305adcc5e5db3ce22d70fd31fd37232f337602812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714852, "uuid": "c62bc37d-3b8e-4af7-a4cd-5e4ba88e558e", "value": "T16BA2D0AC92A846F2D0661475FE70060367A32FBEF2E932BE316415E4D3C2579C6E10CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714852, "uuid": "faccd741-75d5-4086-b3bf-b20d7dcd71c6", "value": "384:uaRugoCxL2z6QZj7AmYIC65l7vt3TbA7/QgizNo/kRHwhymdGUop5hX+:9RuTw2GQZHAZ0tLnh2s3UozJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714852, "uuid": "c51684fc-830c-4408-b16e-4b039e4b3d37", "value": 22212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714852, "uuid": "ca03b999-3856-4d67-9685-f23092e0f292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714852, "uuid": "cbf83b61-e651-46ad-bcd1-80db9525f30d", "value": "phantom.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a333b09-8628-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784764329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784764329, "uuid": "637cd9ef-943b-46fc-9751-a43c30b7612f", "comment": "Malware payload", "value": "c27853c766cd4c75f096f9743f73b346", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784764329, "uuid": "470f48e2-003f-43bc-9840-933bd478e192", "comment": "Malware payload", "value": "392571c5abe8c58b631fd44b1c2924f7854914754848cb2479ec6889ebce6b4c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784764329, "uuid": "abb765be-0ec7-4a95-81e0-d12c56234d83", "comment": "Malware payload", "value": "b37211397a942956f5e79712f7870c5a33b66cc0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784764329, "uuid": "9fa97aab-0cca-491d-97ff-987a29d2cd45", "comment": "Malware payload", "value": "d266b407d48b87b61f74787da1adaef3a31525d95c592d8e63979d388c7e9c5e4842704f4bd6472df5bb893a29cbbc91", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784764329, "uuid": "6ab38a96-bc2d-47c7-9bf5-e0f191b18229", "value": "T127E63349EAD102FFE7A7413CEDE151A1E5AB74610732CAE747A493D1BF272C09839A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784764329, "uuid": "3f791a23-2769-495f-bcb3-050c48808b46", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784764329, "uuid": "8f305a34-f1f2-421a-9969-a6773ef2014b", "value": "393216:pqUhd6PX+V0uHPUOGUN37Ez8XMCHWUjXZcuI3/PGTAI:pl6PX+V00UOGqrQ8XMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784764329, "uuid": "9df72ccf-ae89-4017-b6b6-398778041299", "value": 14314049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784764329, "uuid": "a488f76e-92b6-4540-827f-d5606b667a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784764329, "uuid": "85613ba4-9ac8-4a3d-ba17-93c38482fe9e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dd059d-8595-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784701342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701342, "uuid": "537f3924-a75d-499f-87ed-0225dbae473b", "comment": "Malware payload", "value": "2d1042cb4c0097cd78f520d149c2d55b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701342, "uuid": "3c878db1-a34d-4705-a502-a4ee81cdb4f8", "comment": "Malware payload", "value": "396263a91ecce3c38b06b1fc3a03f2292c1e57027d3a849cffaf720f488052f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701342, "uuid": "c6b4f647-1548-47ff-972f-f0aa4798702b", "comment": "Malware payload", "value": "f4aa2ce42c924c4c04a1c4d42ea402db9e49ab2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701342, "uuid": "63641d55-9f5f-4616-b503-da443daae6ce", "comment": "Malware payload", "value": "fc74e287877f9baf1d0bc434d2005ae1f376a563a3a50930a913b599a271626995f490ea96aab3ca9e8aac32f043b4f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701342, "uuid": "71323129-5888-446b-a392-9c4d9a9f7012", "value": "T157C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701342, "uuid": "42a5a79e-1bf9-4f51-8766-50616f0c1a07", "value": "768:q8vCB+25j6es8R89FYpMSUpi+20qUpi+20YQX:q8l25JKd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701342, "uuid": "b8df754d-c08a-4782-9ee4-95cfd582c09d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701342, "uuid": "9350b4e1-72b5-4182-b58a-864d94c077cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701342, "uuid": "3546a0ac-5253-4358-ba1b-e17094d2a0d2", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b664640b-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784706072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706072, "uuid": "cdec44a1-b252-45ef-aa41-60f692be9c53", "comment": "Malware payload (RemcosRAT)", "value": "019c1dd13f42adb118a702702757888e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706072, "uuid": "cadd154d-eebf-4c4d-ac78-5933f7ff695f", "comment": "Malware payload (RemcosRAT)", "value": "3a94276e9b770943b12bf8f39aafe3428d9ba385d153134f8056f1c6d9f6e09e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706072, "uuid": "6eb3e2a7-7f0c-418f-ae2a-bb5360b760ae", "comment": "Malware payload (RemcosRAT)", "value": "e0a75c8a237e29a161b6373137be22f9ab1d6d35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706072, "uuid": "732df421-0aaf-4c3d-8bb4-6b0373bb566d", "comment": "Malware payload (RemcosRAT)", "value": "91e8c7b36bcbf820a2c9a2a2e566e21f88cbcc985aa8d7db98b3e774d62efdefb74f32fc7a111cf2638fc3d9816d1a9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706072, "uuid": "6213bfbe-10de-417f-b574-8182a7f3b49d", "value": "T1E5E6F583CAA128CBFA913A10F91245D09936D1407D1A4987AE7B4BBF4D573B06C737EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706072, "uuid": "4305e9dc-fa69-44b7-8536-cc4334a1957d", "value": "384:ciM0JiFtFHdgZgw6UDW/l649ZdnfyCjkub5/6fceSlPw/qrLyODwn2wHvmRZq7hc:cx6XtuwFUFO1LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706072, "uuid": "7e6ffacb-3657-454a-9801-8d28a9f54c08", "value": 14567484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706072, "uuid": "b62251e9-5d33-4b93-8a79-13748a5629f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706072, "uuid": "30852f31-10fb-4f6b-bb66-ec93c90b7677", "value": "PEDIDO 6500280576.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebab296e-85ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1784711315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711315, "uuid": "6ae87102-dd69-4a6d-ab2b-e56ccc98ef9e", "comment": "Malware payload (QuasarRAT)", "value": "c8721acf9aa56cf82f4846d4134ab818", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711315, "uuid": "b7d2fba2-0cfe-4509-9115-0166b5fae52c", "comment": "Malware payload (QuasarRAT)", "value": "3af05f96e69e75d243e1ca4e4fb62b31c29ae3eea529e5112a26729460d3e222", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711315, "uuid": "a11402f6-95bf-4b79-8717-4e2b4b9b4411", "comment": "Malware payload (QuasarRAT)", "value": "5e372298d04f45ff0286d9f4413af9123b3d4734", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711315, "uuid": "e75e80ec-661f-4b4a-93d6-413f00da41a3", "comment": "Malware payload (QuasarRAT)", "value": "fdc54a48b75ecf5b8fd1e5bac1f4519a18a6370537f25f9387517b90e889d55d3a30f8d78ac6e70e309c44c90b84d662", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711315, "uuid": "b5ad34f4-8b88-4ae8-8574-0bde0b6229fc", "value": "T124136A89CDF287CE3D3A252C233C669AF9D51A1B0925C21172CAF5084FB96C88DFD6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711315, "uuid": "d238d20a-efa2-4605-917c-afe802a27978", "value": "768:T6YdLKILgMjN96YdLKILgMjNC6YdLKILgMjNR6YdLKILgMjNNtc:GYdLVTjNkYdLVTjNlYdLVTjNYYdLVTjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711315, "uuid": "273d78d0-e515-43e4-b1a6-17ff4aaeb341", "value": 43945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711315, "uuid": "f135fbf8-51c8-4a8b-89af-897f5d44400b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711315, "uuid": "3a23e2a9-9a33-4ac3-ba1e-c25412329fb5", "value": "FACTURA (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f62c54-85a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707595, "uuid": "7f4b0d45-0bd6-474d-8d4c-ddfcabe5c536", "comment": "Malware payload", "value": "e702e8163c3924f4bbbe20118b64a62a", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707595, "uuid": "8fccde60-d7f8-4885-ae89-69b17172efa7", "comment": "Malware payload", "value": "3b366ac5bae87508a67dc2a4c6c452aecc6e3af54210eef77f9d9d1a3d18a9ed", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707595, "uuid": "9470d689-ace5-4e09-acd8-1468201b86d8", "comment": "Malware payload", "value": "292f8eb1157ebba294d4cfc2e603689701022ccf", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707595, "uuid": "1b7a7dae-f05f-441c-89b3-515328b63749", "comment": "Malware payload", "value": "56dad09056f326644d36f603180ee26ec4e67a5d639f5a8f29373c8c6e408d2ac0aa0a27028bb1f8ebf1a21c2d8725fc", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707595, "uuid": "e18b43c6-68d5-4d16-8a7b-39ee629de4fd", "value": "T12C7430842AD1B4940B479B7A3B7BB1D6F43F0CD966E40406F218F8B7F565B06EAE1630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707595, "uuid": "125b9ee4-84fd-448d-bd5b-9434e3259926", "value": "6144:l2F3gXZkekZLcRxugAClDa73mU476692uOSvlOl27jvVj3M1y31tzN2:2CAgA2G73mU4LBjvd81O1tzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707595, "uuid": "2a4db7e3-26bf-408d-b99f-ef6a93ef034d", "value": 368419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707595, "uuid": "0ca9c338-5be7-4745-9096-9bff4b1c1567", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707595, "uuid": "684bad3a-0adb-4f1b-b6e7-cb64fb54a936", "value": "RFQ-SHRS(E-5274)-DDG082.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa05ff03-859a-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784703609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703609, "uuid": "07bd74d1-f2ff-4d27-a59a-6c84a933ca13", "comment": "Malware payload (XWorm)", "value": "fc1c6800c77edd0ba0bc6b195900630d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703609, "uuid": "a7f6cc2f-8ca1-478f-a362-bcd58713cb0a", "comment": "Malware payload (XWorm)", "value": "3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703609, "uuid": "83aca14f-c87f-460e-b4f2-d665370b3cff", "comment": "Malware payload (XWorm)", "value": "81ec5cab8148bcef6849be21457808d1bafaa273", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703609, "uuid": "53a56bc2-86b9-49ae-8ec1-1cf06bb9a483", "comment": "Malware payload (XWorm)", "value": "86f193523e6c749d4e47366b8e2efc23bf72492b52f9fb71767e6c3a94d7bc255011a92014bbc1da710b46529782f80c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703609, "uuid": "0fd48364-3166-4044-9698-ebc2e9344bc9", "value": "T11F3594FF052AE7AAF132FF393CE9E8659E533002115BD0671A16B4BDAA5661270C05FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703609, "uuid": "201576a3-da4b-412d-9956-5643636d213a", "value": "192:KunDXukimSO7ATOmiCmoow9eeWOFE0q13cqmRVwTbM6+6RUMYTO2+h87jAkmk1eb:Z6371nImE0q1s7RG8Z6RU7zbD1fNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784703609, "uuid": "00f78751-652c-4f8c-a812-02be0e2b1461", "value": 1143344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784703609, "uuid": "f6cff709-8562-49da-8455-7729791fd390", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703609, "uuid": "c6f9d87f-6695-4cc3-8840-0d679e664d5f", "value": "z1PaymentIssue07_20_26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3029d2-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784723106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723106, "uuid": "a2fc4522-edc5-4530-b1f7-6ae81ab2cc00", "comment": "Malware payload (RemcosRAT)", "value": "2518408638fffdc14cd1561cd551eb0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723106, "uuid": "d5dbb707-2a5e-44fc-9282-04e8837aa3b6", "comment": "Malware payload (RemcosRAT)", "value": "3da8da1092e93b77f43a2769fbceeac273f3252cd6c298de746618e45356b1ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723106, "uuid": "dd607af7-7f10-42a6-8bc3-28687aba632b", "comment": "Malware payload (RemcosRAT)", "value": "8783ae2b2156bd27c8ce3257c74bc3791013df50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723106, "uuid": "54d4654a-fb82-457f-8074-2fb336eb6b4a", "comment": "Malware payload (RemcosRAT)", "value": "1cb5fd5e30603a019d6226955a171d9a032e13d5ec6c397939b53585c3b09662b2a09a5919d0065c680f939e7b5abe8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723106, "uuid": "a4cf8679-1177-41a3-b1ec-20b9efc37a8e", "value": "T1B5A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723106, "uuid": "b61ed366-ee3f-4a03-8f7e-2d2b33320c05", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723106, "uuid": "2c9f6538-a5c1-48c3-bc8d-4169467824bd", "value": "12288:T13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ7S:Zak/mBXTV/R0nEF76gFZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723106, "uuid": "7a909973-aaf7-476a-972c-5d0ae126df5a", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723106, "uuid": "8f0c95ee-37c1-4176-b2ec-7f5a07e930b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723106, "uuid": "3f9c00e8-b4fc-4546-a1a2-148d0a507c66", "value": "2518408638FFFDC14CD1561CD551EB0B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53b2810-858e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1784698312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784698312, "uuid": "db3f1b50-71af-4e6d-9c9f-99dedd46b7dc", "comment": "Malware payload (ArkeiStealer)", "value": "5b1204b44db0ecd0d72fe97adbbb1c5e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784698312, "uuid": "e1d001ab-5806-4980-ab2f-fd93911996cc", "comment": "Malware payload (ArkeiStealer)", "value": "3db527a58b83f8422fc10029f337d5663005d2ca1a1667fb221e6672ed5ba360", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784698312, "uuid": "fd7f33ee-0191-4263-835b-d50faefe13e3", "comment": "Malware payload (ArkeiStealer)", "value": "9f9304bdf288fa5ccab32a837fa5f94bd7b7be15", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784698312, "uuid": "dafba6a4-df8a-4cff-8ab4-fb3e2d416682", "comment": "Malware payload (ArkeiStealer)", "value": "b16e622e47163c3f40642a52575a8d0187887dfb4119d17782c62e715c80865a14822284956c532d6a3d319ca9ac970b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784698312, "uuid": "ecc0e567-da67-4ced-ba10-c05ea3dc0e0d", "value": "T1EF56DF47BD9048EAC49AA23189B7569A7B70FC080B3227D72E50B7793F327D06D35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784698312, "uuid": "7697b7cc-ef64-44d1-af12-1078c18d718b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784698312, "uuid": "429fa1ea-2f66-482e-a44c-45b75de7ddf8", "value": "98304:oTwnFVyxREZNIzztT68icw4rjgsbdnJMNCloy+PAcI6wSOicDM6:oBxvE8Vw4PnSN5ZPAPSOi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784698312, "uuid": "3dd85ef6-acb4-4895-a8ef-8d039ac1dd40", "value": 6331744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784698312, "uuid": "de8a2673-41eb-440e-8490-39c9a9d83fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784698312, "uuid": "bf0235a1-771e-4137-ba68-9173b25ceafd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb4b031-85d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784728094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728094, "uuid": "5ee548d8-82ae-4d1d-b733-ea7808c5ec40", "comment": "Malware payload (Formbook)", "value": "3612004b9ecbfe737a8558faaf517df8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728094, "uuid": "f3189248-9510-4274-a870-3db0dd2c1d88", "comment": "Malware payload (Formbook)", "value": "3e1f1295833479b39e87da6b8dd1516bfe95a03f2d3cc28978ca70a25fe75021", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728094, "uuid": "62c3b7fc-300d-4e35-afa7-f546261d0c56", "comment": "Malware payload (Formbook)", "value": "5fe22cd7c9ae16922c92918b207ccbf4d3cf59f6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728094, "uuid": "0b2b7a2d-1ea9-4e3f-b783-ac22e88bf190", "comment": "Malware payload (Formbook)", "value": "e92f68989f161cc839859b1fe47fec0e16a0e07f8abe5f59209fef6b429752fe1506aa2d19d9fec39f40fa2be51aa933", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728094, "uuid": "396d916d-ddfa-4a79-93fb-3b3364b0b382", "value": "T167E5F9E636ED2645AE1037A6E984684D4F5B9161ABC317C4F0AF4AC4478F0133FA1E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728094, "uuid": "50f04072-d06a-4f12-a926-1a271c88f3fe", "value": "49152:plP77v1l8oTkAPRwCk6olEGo289bFLEAAr8tsFK30T6shJXakDG+Nwl8Ff+ONs7Z:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728094, "uuid": "c011dd15-664a-4174-bdbe-18984534295e", "value": 3155158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728094, "uuid": "c9e2c8b8-e5c6-4d08-a001-ebe5c9d88cd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728094, "uuid": "08ee4261-f3c3-483d-a23a-767485b0a162", "value": "shipping documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bf3178-8606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784749583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749583, "uuid": "f5ddc20d-5ce8-482f-8130-45201f18a676", "comment": "Malware payload (Mirai)", "value": "415b9f5d5ca31b56d3df6efc1ded335c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749583, "uuid": "b11237ac-d6d4-484f-90e8-300652df940a", "comment": "Malware payload (Mirai)", "value": "3eab3901798ec748895b2dca4b8762aec553d2966112999c60061d4599b599a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749583, "uuid": "065b7fab-7429-4765-a6e7-f815cc553d00", "comment": "Malware payload (Mirai)", "value": "7bcedc7c220edb6dfc24808423aeb5283c1893fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749583, "uuid": "6380fb35-79af-4df7-9686-434ce4128e9d", "comment": "Malware payload (Mirai)", "value": "3c0f10087c5d85cb8e889584f8488addbe59ae89ee15778bd1c5b6030c05cbf6bf9d5366a34f2e14605de62a206ece1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749583, "uuid": "ec72e0b9-f1e7-4044-aa2b-bceeb619ab7b", "value": "T1D62302D3A48A4FCAF15DE2BA188A760F0A51315C7B354BFEB54C24D388B9F19AB143C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749583, "uuid": "cc9bbaca-a0fc-4c86-ae13-e50abccf5be5", "value": "768:zkIZRy9tAFAHzZp7mbLIF/4Yng1nZ+A/mEu1eO0qFVjHQUewc7QXP3oS1hVupnbG:zkIZk9j+bLC5g1ZhfYSAVb1ewcg4eupa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784749583, "uuid": "e153c57c-e576-4b1f-b120-3ba45ff9bb55", "value": 47000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784749583, "uuid": "e1cced42-acc3-4595-888f-e1d4d264f6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749583, "uuid": "c4241a90-f613-43ab-b8f6-120f9f4d3070", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7a691d-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763075, "uuid": "6868b0b5-26d0-48e9-b0b0-a42d674d5d6f", "comment": "Malware payload", "value": "1383532c32f7ff9655428c9ab91018b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763075, "uuid": "fe3ee831-32de-457f-9e2d-de6e66a52126", "comment": "Malware payload", "value": "3edfb02c0e6b2fe4894425cd0d4d2507f7cb11e0958674422729366a0d885c7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763075, "uuid": "5e3bf066-c136-4079-b405-fd2ba04ecca4", "comment": "Malware payload", "value": "1d8d4703a4cdde85bef57582b15599c9f9cc4718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763075, "uuid": "f8571915-1a6f-474e-8cfd-ed33ad4879ac", "comment": "Malware payload", "value": "819442d34ba64512466862e7fbb5bd72a07291585c629341dddd76ec1c1cf984d244beefd1c88b47be7fe71e1ece16c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763075, "uuid": "ad79f806-363b-4483-9acd-0bc63d20ec2f", "value": "T174753392B4C1BC38641605AF4378437C15B82C59ADA1C3A4B1A95AFB3D93A30CADDFD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763075, "uuid": "4fe2b1b3-e6c0-4af2-977f-03a5217c508d", "value": "49152:h8zhvElbdD+IHxGFdVB0hW3g9zrXdP+pLN/biA49PQyVkgS:8vi0dVKhW3cr9+pNH4YgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763075, "uuid": "bd92b544-3603-4d70-9fc0-130b48ecf4f5", "value": 1692512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763075, "uuid": "66f96da8-0a31-4bb7-b155-740725475b9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763075, "uuid": "9e2b7b63-385b-49e7-8d73-912d2d655f7e", "value": "3edfb02c0e6b2fe4894425cd0d4d2507f7cb11e0958674422729366a0d885c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad22bcf-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714992, "uuid": "244cdc42-1c71-493c-a141-4b6bfbd56f3d", "comment": "Malware payload (Mirai)", "value": "699ef8108b998ed15ab5142f7f015460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714992, "uuid": "94432aa0-87a2-4f27-953d-17df84122684", "comment": "Malware payload (Mirai)", "value": "3f389b83df0083418e053d37ac6f6e5c7989cc56fe05870b824d2f40af63d7de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714992, "uuid": "e7c63476-4ee0-4de5-85d4-383ea17ceb2c", "comment": "Malware payload (Mirai)", "value": "31488e3a949a9d816c3dbaebe7ef409facaed6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714992, "uuid": "d8517bf9-26b3-4342-a698-bd0a5b047adb", "comment": "Malware payload (Mirai)", "value": "4a734cbde1bfe1d4b5a026fdf13cdcef739c4b882e15213eb7cd78dc93737f37c000c6a0ff1028b468e3c983e65f7530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714992, "uuid": "279e28e6-bd18-47d6-8db0-a56fd328cc8a", "value": "T1F5332B42B22C094FF9E65AB0343F1FE093AEE95024E0B685A54EEB458536F771486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714992, "uuid": "e081a66d-b30f-439a-8325-73f790a08e19", "value": "768:SjZpE98U613gtWfL33RiMuIwPf/0GwSvFEwWM7zjr7aVUjdNNX8GG6:Y8iU613gtWDHE2eWwWM/TpHXvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714992, "uuid": "9f891b02-a25a-4b02-b222-9f422669e048", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714992, "uuid": "31cb9998-7759-4244-87da-869000b710a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714992, "uuid": "b0c7f9c8-cf1c-47df-9c8c-0a6ee67aa690", "value": "phantom.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae2ca69-85aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784710214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710214, "uuid": "a06c8277-418e-4225-8445-2a699e0217e9", "comment": "Malware payload (AsyncRAT)", "value": "a7b1c14b2ab638fc017943b01b739c60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710214, "uuid": "8966257b-05ef-4b4a-a762-3a0892349495", "comment": "Malware payload (AsyncRAT)", "value": "40b95ef52169126b3732d14479f1497715ec0f5bf1bc6fd0104188f7911f5fef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710214, "uuid": "187f8e71-64f5-43fb-8de2-68770f45fb9c", "comment": "Malware payload (AsyncRAT)", "value": "f7d847beafb523257f36b88e2f9529fe9f1c6833", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710214, "uuid": "8a0ddcfb-9aa3-44f2-9839-dd6525db0eeb", "comment": "Malware payload (AsyncRAT)", "value": "4b824e1a05ec04357418616a263d6c960f5a51fe3dbfa2bc6cb3407639506af854db28e51b4068b3e6d21f3d3812d234", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710214, "uuid": "374cd6ee-0ae2-4af2-a2a2-96162cc191af", "value": "T191F41AF323CF694B7D1573AE510D2E98CB59D0794E82A9C0F0EF02D45B0B15E9AA09BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710214, "uuid": "62f0835a-2522-4ef1-97b3-fedbc9099898", "value": "6144:249cELb31C2LTRhSt8eBaz8aQDY0oNXgqsLveNzltxCFzKsKMUF5/Qj7zHfAdlTN:J3M2J+aKig/qPMUFhQj7zHYdVB71Bn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784710214, "uuid": "2b19102a-cd5b-4708-be5f-0c2108d88f5b", "value": 790530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784710214, "uuid": "2e850402-7d72-47b1-8056-968c82b9ec84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710214, "uuid": "ffc3c087-be12-4048-bba9-6b38276545ac", "value": "HSBC CONFIRMATION SEPA 22.07.26 ASY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9b2499-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700444, "uuid": "2e88bafe-04a5-48f5-b6e7-2ec4184eca3d", "comment": "Malware payload (Mirai)", "value": "e60cf5f3876fa2d4f693eef1bca0b057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700444, "uuid": "f52a209e-a025-40e5-98ad-33b8aff51938", "comment": "Malware payload (Mirai)", "value": "41b303e84513e5597ed6988c2f967276f83f0cdfdf7b91f7d1d8543aad8e327d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700444, "uuid": "7a19918c-d94f-402a-b666-76cc7c0e680a", "comment": "Malware payload (Mirai)", "value": "687e2e92aadbf7a7a83d92a97067eaa54e344dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700444, "uuid": "cfdf9e23-cf55-4f4f-b4c6-2fd64cec0570", "comment": "Malware payload (Mirai)", "value": "67aec9f391a22d52bbdfdbfbafa9466092853bd55b797f437f8518098a99fc514853684e274989df4fcca6f9c63bb58c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700444, "uuid": "8c6c45ae-a621-48e0-a846-fb42ac7bd4da", "value": "T1CE4302A2420B6AADDDA10E77F822E477370107AFE5F2F47194000B1A64BF91576AD5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700444, "uuid": "353235c8-f99f-463b-a079-feb03d77d8c2", "value": "1536:bbhEKuTZkHfhD6aybEQUj4AAJ2L55pBa1Ha:bOD+RyYQUj4vMfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700444, "uuid": "f983adbc-2a6a-4d86-b3dc-3b0ec5cdc434", "value": 58016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700444, "uuid": "83ad5d13-e8f1-426d-9cfd-93f8c7778a7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700444, "uuid": "96c3632d-b4e1-4734-94e8-4b14d10e839e", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f323e4d3-85ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784737957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737957, "uuid": "771cf1a8-3e56-4438-b348-5cef601e0209", "comment": "Malware payload", "value": "15083a24454fd311a411e388256b9d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737957, "uuid": "b35872b1-8577-467f-8ca3-eb61860786ff", "comment": "Malware payload", "value": "41fc136c41e7d0a88b800fa82ded8145e4fd01e80c1317c96d772cf7b9313b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737957, "uuid": "da46f588-ba6e-4016-955d-c6186894447a", "comment": "Malware payload", "value": "eb31da8239bad28ee2acb6ed7bd7c7de91355145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737957, "uuid": "04926c5c-3721-4dee-bbea-94fe095e38a5", "comment": "Malware payload", "value": "10679b6db7a64f20f5892ec4acaa84abd6c5bc9b7d2e13e0422f53dacf4eb542e11aeced2f0d4a468366d27fc4c52a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737957, "uuid": "14945913-863d-4e12-87eb-311f6a615c97", "value": "T1992833192909665EF24C9332E2E1C8677AE334594765C0EA1BD58E4B0FBB1C5FE38C63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737957, "uuid": "4f42eca7-87bd-41b8-a5bc-f20f388ba9c2", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737957, "uuid": "adf580d9-b519-4b2f-9394-a870651b4631", "value": "1572864:w9z7wSEqWa2TSM+dy2J0f0/rBdsG7bpip0WW7SfK4+K4cNdXXR2vgZUAdT9LUucq:w93rEqxKI5BB7tE0W0474czXRZFL5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784737957, "uuid": "1e72f254-0fef-47b0-b09c-31d063d8ad02", "value": 94901303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784737957, "uuid": "7a4db946-b53f-4df7-8148-812bafab4bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737957, "uuid": "992900f9-25d7-4877-b243-330b27953637", "value": "svchostplayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc936c25-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700526, "uuid": "e4b50900-447d-41ef-a3a4-b92c5f6480ca", "comment": "Malware payload (Mirai)", "value": "13791f68f458a78a0bca16ab0aedd4c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700526, "uuid": "f9d3c6c0-655b-4378-97e1-cf9bb08efed4", "comment": "Malware payload (Mirai)", "value": "435a6416adb091bef4e59eb10d6846f0d1194c88380d84175efc073f1c974d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700526, "uuid": "3aa24d8b-86ad-4079-a0f7-7794f1b856ed", "comment": "Malware payload (Mirai)", "value": "c75601ff31bdd231e075e808c54a960fe8af4e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700526, "uuid": "de95fa46-dbd2-4861-afbc-aa2a4eb4d363", "comment": "Malware payload (Mirai)", "value": "25370e1663b608c1f535cc3afc24ad1940a83be01b7025ff7bed48b4407a7df682ea5c382078279bfb54fad256adc28c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700526, "uuid": "2d0d718e-552b-4b54-9d1a-e327daf9cb99", "value": "T14F430100A8F8DD14E5B75D33B4600C08138B8279E6ABF5F76A598E1CA5460D2EDEC38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700526, "uuid": "f61187f0-f032-4165-8302-8102238b9858", "value": "1536:Z94GQ29649VbYc+4q9BpXvCuC7i7N/1txEIegTCWp3CZt:42/9p7HofCuC7i7pCrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700526, "uuid": "92562dd3-d295-4adb-881b-ce38011532e9", "value": 56220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700526, "uuid": "20a2843b-a0f8-41d0-ac64-1e4a186af497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700526, "uuid": "a747dd79-1c04-4314-9147-f873113fcc3e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584f7055-8604-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784748864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748864, "uuid": "01878183-9618-455b-a1ca-4b428d13fba8", "comment": "Malware payload", "value": "d120c3be19efd6471f91dcf801fc5d8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748864, "uuid": "8ea5f23f-004d-497e-a732-327d3b0f9165", "comment": "Malware payload", "value": "439f16970216d388246b290ebf445e20866ddd73bcd32e86b6b5b4f7404bb84e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748864, "uuid": "c115f93f-b1e1-4562-8ef0-4e3c6cecfa0c", "comment": "Malware payload", "value": "86e17387d78c1f3d11c1754429a0756c7730b33f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748864, "uuid": "6ff15b70-964f-4fd7-b5a2-54fd061287b2", "comment": "Malware payload", "value": "2d4f4555474ecff0ebf926a59311eb99c54f2395c3e6e73dadcc3a2b9926a8e1b55fc1c2899963ffe8005a7f12ffe24c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748864, "uuid": "c07d7549-9bc5-4fe2-99f1-b7dc9d9e6dcd", "value": "T1CE0188CAE110A940819AD4AD26E76094F420C7C7154A8F79FFACA86D9B98D08B03AFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748864, "uuid": "01865d1c-4762-4bbd-9035-b676e147b1db", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkabCSmQn03FCvBnmXCxLEChMa11QC97aX:kXCKysE2hi0ziQvZohabnkFa8+EUOkaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784748864, "uuid": "31ae198c-b110-430a-8964-fb10706a24cb", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784748864, "uuid": "316c0006-e427-4a89-806d-c32830b9f27e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748864, "uuid": "5c5de17b-d7e5-4032-90d5-491966ec63e9", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89c931a-85b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784714693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714693, "uuid": "504664db-38a0-4f8b-8178-443a43116357", "comment": "Malware payload (Vidar)", "value": "3e1c17a4235847b047e56501512a0af9", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714693, "uuid": "3496669d-21b3-4643-8002-c610e5f20e9f", "comment": "Malware payload (Vidar)", "value": "43b112c2bf170cb564047c064e9604dec8b28872e3171ec5c9c41f41baf92f53", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714693, "uuid": "02bc21de-6433-4573-b2cc-f16972b2de9d", "comment": "Malware payload (Vidar)", "value": "d079e715f7d64fb847b02701a9a376d5f88f7197", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714693, "uuid": "a602ba1a-6d15-4660-a950-df85f2b76f31", "comment": "Malware payload (Vidar)", "value": "6542d5bcf354b303dff4863d449d5405522a514b396539cc7f53aaba6e0b0d82c5c3738a928383d7d6624031295cad93", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714693, "uuid": "0d4972dd-9e44-4091-b738-fa71c4822793", "value": "T137068D07FCA188F6C199A33189739542B7757C091B3677EB2E906A383E727D05E3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714693, "uuid": "a40e7ea2-5da8-4541-97b5-943cba2a3819", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714693, "uuid": "6a352b18-c2de-4e10-b07c-b9112163f13a", "value": "49152:k50+0aDRz7d/7t8aVQOJNInyWOQm5oQeHFnUImPrS2Cu8BNLo:kZZhxqpoirlUI6/x8BNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714693, "uuid": "7b734420-46c2-4af5-adf0-686a6d44d5d1", "value": 3779432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714693, "uuid": "b20836d1-9c46-4136-a32a-e0f318442e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714693, "uuid": "d0a844c3-9527-499f-8775-b12176bbbe43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c489584f-8561-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784679038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679038, "uuid": "b6398e05-53c1-4fc3-93aa-7f9be7b67ad7", "comment": "Malware payload", "value": "8051c2c784ca3897c5f3937edd8f887a", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679038, "uuid": "73becc36-d466-4be3-a82e-90a170dc26c6", "comment": "Malware payload", "value": "441a9bd8a0f93eae564b2e4397990f5d91479e18601ddcb5241afa7d559b4e77", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679038, "uuid": "101c2177-9951-47cc-8323-1025c70b934c", "comment": "Malware payload", "value": "c119d46007b11ca666ccaa399492d832643cc861", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679038, "uuid": "79f29e92-a165-42c2-a382-451b5f2e56f1", "comment": "Malware payload", "value": "80ba0079c2e0252a76f800d4dd580f396ec8e32fa3201319096afaaa1767c74856dda04712af149d80ea6b09a7b5407e", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679038, "uuid": "92e88300-c57e-4c78-ae7f-8581fe072926", "value": "T13BD5239DBCE21034F432C3F78383A1BDB12A77459BB14C4665CDAB50AC529286C7B77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679038, "uuid": "52ca2b92-14bd-440f-8a86-bbf3a7e934a7", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679038, "uuid": "c6abe2da-f819-4501-819b-0f707dfe3c46", "value": "49152:8SqyanGD4rv/0ElX+lrlP1msT0GvT+vYmddW807ji5bVMixoMPdW9t/vub:8yaG+v/0E+NV1msT06IZwf1ird8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679038, "uuid": "a4f42130-e52f-4cbf-95c1-83b69a138fe7", "value": 2976256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679038, "uuid": "05ce53dd-aa99-4047-951d-d9c1d50d3b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679038, "uuid": "cca53134-ba71-4d41-ba64-5fdd15743226", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8692a11-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784711632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711632, "uuid": "0fa8d3e4-e03c-4006-8a5b-7fb48b37d2a1", "comment": "Malware payload (Mirai)", "value": "76b4417673a071e388c0482d9b56daf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711632, "uuid": "49e6e2b1-180e-437a-9979-5d9f822a0543", "comment": "Malware payload (Mirai)", "value": "44b8a51312efa33db3223307630d60e1d00d3c24033bac6f47cce1b84cc37d69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711632, "uuid": "67f737f6-ab32-4899-9647-55e76c95a93b", "comment": "Malware payload (Mirai)", "value": "f39f3ed7eed2a55ec183034f36f73ee2907d7b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711632, "uuid": "aed77acd-be2f-4548-8fdd-81c7bae14a90", "comment": "Malware payload (Mirai)", "value": "92249cdff12c3c57df1e50e5b40af4112a6e76a0e94044a0400907560d28e7f300b0a23b6c736ddc6543f6ac03498556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711632, "uuid": "da0c4deb-5d4b-4017-b11b-793a7a28b158", "value": "T1CC63B406BF610FF7E8ABEC3745A92B0524CC650B25A97B75B930D818F64F24F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711632, "uuid": "9c4313de-1b90-4a7b-97d4-9f9851cb29cb", "value": "768:kJnll3Ge/oH8QxRtzDevTJNYiXwLX3XSCg66PNAK0UH5Y4ePePseNJZfgDSAXiSF:kxll3GcoPSXwbdg5PQUHpamsoJZf5+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711632, "uuid": "31d8a3df-7510-4d71-878f-e6c25f2ece52", "value": 72952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711632, "uuid": "5d3a5e71-0b7f-4be2-adc6-d813cd6e1437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711632, "uuid": "ac263051-e9ea-403b-87a4-fb84c42d2c20", "value": "1ed8ba8b6936fd378c18a7aafeef6db8575f8ce679ab93ae7c1b36493f7bd65b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8445d8-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784732555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732555, "uuid": "1787f762-5f11-4d0d-bc7e-4f24368dbae4", "comment": "Malware payload (Mirai)", "value": "efd041b954571222d1fab2051b0dd272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732555, "uuid": "990b48fd-41a9-4b56-9807-af5ee11363b0", "comment": "Malware payload (Mirai)", "value": "44de5b0d118d40d5b021838e295a14832f8999911667807dd9e6e3f162173a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732555, "uuid": "6b2e1e8f-0054-4330-a306-4554c5955547", "comment": "Malware payload (Mirai)", "value": "52858a361155f96f176207ba3d366bc83e25ef2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732555, "uuid": "7a1c7aac-eed5-4afe-a028-d0fe5801ab2e", "comment": "Malware payload (Mirai)", "value": "48ec11f2b4c7bdd77d7fccdfcad2944b0f160084683a07f6b2379eea3852e43f54fcdd7e17536974fbfa3d1737e953a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732555, "uuid": "568afdc8-b760-4aa2-b9a4-54de59883a75", "value": "T13C63196BB9418F15C5C1167AFE1D938D331327B8E3DEB213EE142F642B8B56B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732555, "uuid": "d62f0471-29f3-4585-8819-d37d6f41569a", "value": "1536:F2nsO87D1j5Uy2QlJAQJYQAD1ZRC9iDRD6PHxpsAGgi1MNOruiYEJv:jO87f2iuZReawPHxYLMNOru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732555, "uuid": "ff775ad9-25f9-40e4-9803-38dd9b5e2248", "value": 71748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732555, "uuid": "5e4ab93a-50ac-4407-a469-13c01cb055e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732555, "uuid": "8b54fc50-d9b0-421d-87b7-db6c53d9acae", "value": "5F5E", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c8d6ee-85ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784737577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737577, "uuid": "7db64440-9367-41eb-a88f-f35dd52dae7d", "comment": "Malware payload", "value": "1392491dacd81c37231a129db85d3208", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737577, "uuid": "35772412-f147-4c7d-8ec2-2d3f0403c3cd", "comment": "Malware payload", "value": "46f61eee6e2ab0bbbb1872139ea56d87c2427bd4fbfc540329fdc7530914a160", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737577, "uuid": "ae4f701b-fe8f-4c32-ad6d-886ba15f0ff6", "comment": "Malware payload", "value": "09a0c4332c5d4b2df1fc8c04a9668467997fe115", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784737577, "uuid": "9aaaa7f6-8e8e-4993-a111-14cb1eae221d", "comment": "Malware payload", "value": "590c4312353ce7fd4df0dee3d6660f3ce218717b6c8cfdeebace80e4779c9e8611dd53156d1f5d947e989da3a06eeae4", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737577, "uuid": "358dfc86-d5fe-483b-a66b-4d046e14c0b1", "value": "T13825CF2A72854E25D146A272D6C7C53143A55E076A97F30B31C42BEB3D8A3FECE46387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737577, "uuid": "60dfcbe4-55f3-49ed-ae0d-7305c0bd5d28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737577, "uuid": "e70ed7d0-14f4-4d66-acc1-d22fcfc921ff", "value": "12288:4qZjP/ZO2SvYaoy7YWwBEHyTMk7XQx+Lc2+EbI7nPobG3PG1SEUQ4kMBVMY:FkHA87yBI8fS+t+EbILXO1hUj0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784737577, "uuid": "fad00e90-b2fd-4d9a-a342-4d8ac5441490", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784737577, "uuid": "a5e6554b-c5b6-4a03-866f-4441f671b492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784737577, "uuid": "663746ef-4027-4119-9d20-0bbda227b609", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa45a9d-85f5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784742488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742488, "uuid": "7d26aee3-4637-485f-bb6d-910477c7a428", "comment": "Malware payload", "value": "63b434710ffa9492e244b90d851bcca5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742488, "uuid": "aac95232-736a-4b9c-b232-51723ec9cd6a", "comment": "Malware payload", "value": "4750c67455431d01ac505041e0e439c73afe57bd955ac323a51c96439fb4a748", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742488, "uuid": "ff4b5a76-7a4d-415d-923b-b12ca28c000c", "comment": "Malware payload", "value": "8424285500d48b22df8d6f85edebe59148831795", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742488, "uuid": "70f0a8a2-346b-43c2-873c-f6ff1a61dd75", "comment": "Malware payload", "value": "991c1f2eba4093ec896dc76e4f7d033e57717cdbb02a7296a106c48d53b5c1f65ffbf8287cc1941a65b05250aca898c5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742488, "uuid": "b4612405-1772-4898-846a-b6192291b3a7", "value": "T13AE2CC3435F8012DE1F3FD316DE496D89E6FB66BA931124D8881031A4D11B40FD16B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742488, "uuid": "88aa11b3-92eb-4a1b-8bcf-835e9d3f9ee6", "value": "24:8d/EdeqGJPPJWInZNutySp+UOi+Eu+njVHq34G8MGy:8l2eLJPBnCtyy7KEu+njtyl8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784742488, "uuid": "cd57309c-9b45-49dd-aaf8-8317b21e8106", "value": 34048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784742488, "uuid": "57dd1d85-117b-439f-aca7-a80eb3d5ae0e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742488, "uuid": "9e2c58ac-366e-4a27-8b41-7323bc69e09e", "value": "Rozrakhunok_vysluhy_viiskovosluzhbovtsia.xls.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cf3b2e-8572-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlackMatter)", "timestamp": 1784686212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784686212, "uuid": "1155373f-5bc9-408e-859b-488819d2f00f", "comment": "Malware payload (BlackMatter)", "value": "4af3347681b6ef41b4d8a444c03ac6ce", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784686212, "uuid": "bbb92a81-0a25-4b26-80e2-e6c3b63304c5", "comment": "Malware payload (BlackMatter)", "value": "47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784686212, "uuid": "c813d56b-73dc-4bac-8035-3177f122aece", "comment": "Malware payload (BlackMatter)", "value": "ac22c26cae3ae7842b8e60eb3ec23a0cdc16b88d", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784686212, "uuid": "f7f7a43c-02a7-486c-9cb8-e698f230b1f5", "comment": "Malware payload (BlackMatter)", "value": "30b1f9828a5c88aafb16616a72547ad38c1418fce02263ac58e8f05dac679958daa161a29d961f2525aabf36bc839562", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784686212, "uuid": "d7ebcfc6-12d4-49f1-9aa5-c12540a430e2", "value": "T12AE36D21F212D0B3C8771CF12736B572B39E8D2C19A95817EAD80F5DBCA58236F45A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784686212, "uuid": "0d920ded-f846-4e7d-b34b-c535e851ba2d", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784686212, "uuid": "194708dc-8cec-4cff-a4df-22c5848754ba", "value": "3072:E6glyuxE4GsUPnliByocWepngstnC51HOfbZ:E6gDBGpvEByocWeTtCDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784686212, "uuid": "cfeb1b86-280c-4bd5-a530-d793d333b5b2", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784686212, "uuid": "9da9119e-55ff-445a-a0bb-54149b7a4ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784686212, "uuid": "cb5413b2-9ad2-4d7c-bd82-6fa1b4d92239", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd574aa-857e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784691561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691561, "uuid": "1457c1e0-2f5c-46bc-acea-b2d0ad91c655", "comment": "Malware payload (Formbook)", "value": "e8c5b5e6688f1b2ff4d72025e94e7b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691561, "uuid": "c49e3c68-1e05-485e-ab1d-3b24997d23e7", "comment": "Malware payload (Formbook)", "value": "480bdd66621a0869dff575523f7e4ad5b7528744c1dc40f6f80bc85233433186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691561, "uuid": "7eef3776-a6aa-4a76-97ef-e7718ce64778", "comment": "Malware payload (Formbook)", "value": "1f76ccce7f9bd948bfaa9e8fce0932951fe6e10d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691561, "uuid": "4fa6b2ce-a790-482c-91b3-aa7617cf7234", "comment": "Malware payload (Formbook)", "value": "cfa88b3edbbf33fc9c24a6e1e56c2fdd3e32fd9b011d3715aad7a5980eea661a5da350a3731e342fa6223f2cc3484ea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691561, "uuid": "a91d32ba-6ec2-44dd-839f-6d2444c10eb4", "value": "T1E8C5BF15E3C865E9D467DA78C714A232D2B2B8534B76D1CF0A9AC30A1F77E918F3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691561, "uuid": "0cee26bf-45cf-44da-b23b-10c8b2106ed9", "value": "46d844d880996af2766416e3e2079244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691561, "uuid": "397f8704-529a-4686-9aca-1a4fcb289f2c", "value": "49152:/FuIkqh6ecsNpqRvtZzt1aWD0SCZn3gGQsBLWsZuT9t2HiWqFG:/5NgCZn3gGQsBLWsZuT9t2HiWqFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784691561, "uuid": "5d14b0fc-a71f-4af1-b3cc-093af4ad2d11", "value": 2676224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784691561, "uuid": "8b15c171-28c3-4976-b5c2-c6aa774a14e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691561, "uuid": "18318045-f328-4d40-8b30-aa8dad1fd2d5", "value": "MV.LOWLANDS.WEALTH.VESSEL.PARTICULARSpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b0aee4-85cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PySilonStealer)", "timestamp": 1784724600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724600, "uuid": "b91efd4f-c8b3-4547-a791-9a6934a53c3b", "comment": "Malware payload (PySilonStealer)", "value": "26f9a4ba4f6cd4f95129d7781ac3d739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonStealer", "colour": "#840C07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724600, "uuid": "41aea3bd-2d7c-4180-b112-7e6e1585f711", "comment": "Malware payload (PySilonStealer)", "value": "4814838500d5650f8ef755e26ca09cc09808209519a18b8758aaa2a3864c9601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonStealer", "colour": "#840C07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724600, "uuid": "c7237a37-e5a0-4fda-ba91-2d8d31297317", "comment": "Malware payload (PySilonStealer)", "value": "56b25d2847b96a3fc63dcf7fc0b38593c25538a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonStealer", "colour": "#840C07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724600, "uuid": "a11a21b0-fc44-4092-8366-935633f468af", "comment": "Malware payload (PySilonStealer)", "value": "fe69a78b92cc11add02751043901323f629292da82acf14e7612f26c5a3951d3013ba2a08a5d70d554c4dd7187e0b36f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonStealer", "colour": "#840C07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724600, "uuid": "b4657b06-db54-4074-bcb2-759987fe9f3a", "value": "T17597332C97D84DEBC96304394665AA80C7F7B5206F02E3F7076285206A679E1FDB43F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724600, "uuid": "d1923bdc-0731-475f-8917-7d4e4f62420f", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724600, "uuid": "b684f9a5-c2ad-43ef-bdeb-2f2c72d4db41", "value": "786432:O4EzkociZ8nk/Ljwz6Vr9W9qmlgzZPWBV5bnq2lFUzYDRphDo+RKdvFg:O4QpZl/LjBVr9W9rlsWZbDjUzYDPhzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724600, "uuid": "38aed3bd-54dc-408d-b466-04d205aa30e5", "value": 41840886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724600, "uuid": "91c0b994-b09e-4af1-beed-046bdaee36ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724600, "uuid": "f2dac7fa-a04d-471e-8604-e13e423a48cd", "value": "word.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692f8d6b-8595-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784701218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701218, "uuid": "e3086436-02c8-40d9-ac1e-038c1319f39d", "comment": "Malware payload (PhantomStealer)", "value": "c2c558ed74aba174e56ca8a33bd59424", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701218, "uuid": "3c2ea29f-abff-4efe-961a-c0d20ec2f9eb", "comment": "Malware payload (PhantomStealer)", "value": "49a35176ab391f750731f57ab10579dc1a83d8da76226c6e72d3ef938a1e7802", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701218, "uuid": "15a341e1-a4f1-4fed-849b-d94a4919595a", "comment": "Malware payload (PhantomStealer)", "value": "bea9ed2116123a6aaddda97b5df85e5b4bf266d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701218, "uuid": "54ec420b-9674-4f42-b17a-823ad7aa674e", "comment": "Malware payload (PhantomStealer)", "value": "e0a9bfba7e10cea67bc61b1850d2c72706c45f02fd5bc7a1d6b253876fea132d64b872ff349b4f28d043fea9c2f759cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701218, "uuid": "c1f26f07-088d-48f0-829e-8a3ea88edbad", "value": "T112B501EBF98680CBA6FA2BD7DD1487C0DD7934355CE1828D326459E88DE1C23512BDB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701218, "uuid": "ec066b14-f73d-4548-ba5d-3491b9045ebd", "value": "192:Iggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggz:Qs2nB8pWZalTNDbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701218, "uuid": "f9ea776d-0943-4141-ac26-911d73ac2f5d", "value": 2425677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701218, "uuid": "b2138793-3491-4f60-b0a0-e8e0b8bb88ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701218, "uuid": "7f6cbb2f-70e6-46b9-86ac-f13ca84bb81f", "value": "eBil CUKAI TANAH _ PETAK WILAYAH PERSEKUTUAN KUALA LUMPUR TAHUN 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21652dba-85d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784728156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728156, "uuid": "5704d0c3-7958-490e-bfb0-a31ff19be579", "comment": "Malware payload", "value": "088bda105b10156997cc51931344f0b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728156, "uuid": "6e73daf9-3b63-4c40-8203-aac4e2d1fc1c", "comment": "Malware payload", "value": "4a78f9ae5eba036294ad5861004c73537b3ae9774672319bec4a837523ff37ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728156, "uuid": "d1b3e625-de2a-4d69-b7f5-8a6e86c11f37", "comment": "Malware payload", "value": "8228aa531006a8a5a6187881b74b155c7e17ea86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728156, "uuid": "2c262e15-348c-4511-9faf-85582b4ea58c", "comment": "Malware payload", "value": "c3f0abe15a16be193208f6352a5a3132e9a5a6b4f4e028af2272b1e113ef5a57bb092c6b0cfa940d0aa346811838d59a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728156, "uuid": "b0182bb6-8c6b-4119-88a8-b5a027116435", "value": "T14C6271F1F96D98363BCCB478F29D980CAAC31C3F1AAA3620501BAD65041D769631DB7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728156, "uuid": "fa565022-5e69-4d1e-974a-1db8f320bb4b", "value": "192:11gso1gjix8Sj1VAEBUADGP/6B0i1gh4BuWKTT5GqkgO:zTiWqA4UADAZdhQuW57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728156, "uuid": "94bc7f51-faa1-45f3-89be-bc06fb3f2cf7", "value": 14698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728156, "uuid": "9ed93a76-bd7d-4e45-b659-5d3bd4263246", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728156, "uuid": "ebe537cc-fb02-4ea7-b3ac-1290c3e2079e", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d6e0fc-8601-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784747469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747469, "uuid": "392d5eb7-2c18-4d35-8233-6d1ece6a6f49", "comment": "Malware payload", "value": "963fb90a2417760d6779d2577c0f46f4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747469, "uuid": "fb6d54b4-274b-4e03-b0fd-90785d877fef", "comment": "Malware payload", "value": "4aa2d4adb660e621aa9a4a473aeb54825b0ef64e0206e3e85833f09b609bae32", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747469, "uuid": "424e0d26-6ad6-47a6-84e6-bde2a8ce92de", "comment": "Malware payload", "value": "82738bc7d7679a5e7a2214e66e15ca7cb6705554", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747469, "uuid": "43d2ca11-ce91-47bb-87a0-f9aadb240abe", "comment": "Malware payload", "value": "9552cf283b1578c66a35ac3ddc0e9eff73481bb6bc6c0c00140805e153235436cbc9f4a374812d9952cbef77bb927d7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747469, "uuid": "b52176fd-c7ef-4155-817e-9066b4a231a7", "value": "T1FE825B0FB9524726C0E210749276877BDABE6872338414DBF7D48DA90A686D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747469, "uuid": "e2283ccd-03a3-42c8-adfe-10c809ffdae9", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747469, "uuid": "5c18576c-0d18-4247-8126-9c5cc4f6a752", "value": "384:WIqQVVaFrxefUyJvBu94gXTcFv4av8U9c2/F:EQUyxE9C4a0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784747469, "uuid": "fc93bd3d-684a-4f73-bd1f-14555ae5fc13", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784747469, "uuid": "31bbee75-59d1-45fb-99c8-19e8383f482a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747469, "uuid": "87e5aefb-d6dd-48a2-b9c8-a740e23e417b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6968b0-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784753381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753381, "uuid": "8b754474-f6d4-4788-99dd-ec1b810e4583", "comment": "Malware payload (Mirai)", "value": "19526700283455cdf983de8725af16c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753381, "uuid": "a37cc816-dda8-4e09-948f-a426662348d6", "comment": "Malware payload (Mirai)", "value": "4b05cd307e64425075f3f651d3d07c381e87a8846976ca241733a6e1d7f892db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753381, "uuid": "6b191382-f4f4-4723-a210-f8e5bfb1e074", "comment": "Malware payload (Mirai)", "value": "257eeb914631b62cc0dae82be2abaff71a77fb2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753381, "uuid": "fc024f79-0a63-4b1c-ac45-7bb9ac1473d8", "comment": "Malware payload (Mirai)", "value": "9b999823ed98f052ce5081da2cb486b40954b1a6cf4bb9eacd378c1cc7b3867080dc782898032513be74721b411264d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753381, "uuid": "39bbed3c-a14c-4c48-a90e-4392f9f74045", "value": "T1D414955E2E228F7DF678C33447F74A24A76D73D626E1D684D2ACD1052F2024E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753381, "uuid": "ffa3e48d-25aa-460a-b895-1b950cdedee5", "value": "3072:ZviBF3Rd1KZpEI6r9QMUtWuEq02rBZXSgfnzW661DRh82LUlvRiElzK1STpgnuqc:ZviBZY7wYlvRHlkSTjqSuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753381, "uuid": "6e5ccaba-754f-4f35-8ad4-4c252ab791c2", "value": 202068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753381, "uuid": "c1f33fe2-73d2-4342-ae85-adc5c1105dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753381, "uuid": "fe8e1f2b-0ede-4830-95b8-7e52ffd3fdb5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec2f410-8616-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784756472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756472, "uuid": "6a5097bc-d3ef-4bfa-be12-af766cf8a877", "comment": "Malware payload", "value": "bf4c2ad3840b56e8c8707075a94536dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756472, "uuid": "a5fe0dd8-d60a-4a3b-8667-c403e7a16386", "comment": "Malware payload", "value": "4b8af5466ec8215e85333376a4bceefadad95befd9cbb8008567f5cf48fec6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756472, "uuid": "9419555b-59d9-4b66-8747-9b0e3d1f2292", "comment": "Malware payload", "value": "ae88399b2da5e9fc310f3c6f490a5e27928b6313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756472, "uuid": "504087a1-a3f4-40f9-92cf-2890e98a74ac", "comment": "Malware payload", "value": "1a0d8c774b8cc9721517a4054843c03d32c3502e491f9fb326fed123e614e292fdc707ba7e08edea44035a1e0e045422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756472, "uuid": "e7e8eb8a-8133-464a-9cae-404334d2411e", "value": "T1DAF6AE39E411E5A8CC56C434BA0AB2215EE03A17CB6695FFD29DC8652E276FD0F34B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756472, "uuid": "bf7c9e97-9217-4ad6-9f79-6483465b61af", "value": "a7d6882576a765d46604db2074aaeafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756472, "uuid": "8c1afe97-7d5d-445d-b796-659bf1e59ebd", "value": "196608:9B+qsJo31B4DCIxZ04kQs3NSNKlNjuLd0L8RWQO9K:vrsg34DCIf04kQs3NXw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784756472, "uuid": "d4eb574e-9710-418d-85f7-74b5230eb73a", "value": 15926272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784756472, "uuid": "be2e808d-173d-4255-9cde-686046974b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756472, "uuid": "7921374e-3746-48af-ad7c-1cd6ef2b7f62", "value": "4b8af5466ec8215e85333376a4bceefadad95befd9cbb8008567f5cf48fec6bb.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ffa98-85f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784743418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743418, "uuid": "f531c978-57c1-4fe7-a86a-1d9df8a08467", "comment": "Malware payload", "value": "487f1e858064bc5941918176e10c5e70", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743418, "uuid": "1ddfb67e-89b7-441f-b86a-c147848e1855", "comment": "Malware payload", "value": "4c3745e2987bbfffac357c45416ddc2f58086923e440faa16db49f64007f01fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743418, "uuid": "7ef45d25-92e3-4322-bf44-29bf45a20005", "comment": "Malware payload", "value": "ececf6e3daac13db1928191f7fd6d2dd59ebe217", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743418, "uuid": "969b6ca5-46a4-48ec-b5c3-58acf53330aa", "comment": "Malware payload", "value": "dacd3594285b6bd783034ea5ffaee492810e12e59d391358e5ea560a6dbb832e962007a2ce71540904b533f2c190e6c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743418, "uuid": "f4037f1b-48a1-4991-8de7-550c7164fde2", "value": "T1A7C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743418, "uuid": "925737b8-bc55-4ff5-909d-ef906d367e56", "value": "768:i8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:i8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784743418, "uuid": "492e03b3-22da-4d50-9fca-52ad4d3070e1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784743418, "uuid": "ca1870b3-1b6f-42e4-b282-484d22c0e0d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743418, "uuid": "d8a32f11-549e-47f6-a42f-bd1968a0be8a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5807be69-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784705914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705914, "uuid": "bb01cb91-37cf-4c36-a78e-3a62ee59146e", "comment": "Malware payload (Gafgyt)", "value": "9ac5fcc6cd9e6f328adf2261b359500b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705914, "uuid": "8333659f-9747-4288-86be-abea1d2b28ea", "comment": "Malware payload (Gafgyt)", "value": "4d226ec1c4a2857d30ac3ada531cbc68d60c56d8bac354cf99c345f6dff4f66b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705914, "uuid": "6dcbcf47-2294-44ee-9eb0-a8bf5196cc80", "comment": "Malware payload (Gafgyt)", "value": "1305f72a769b55fcc8d117a310c3564f8a61a092", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705914, "uuid": "29cdb0c7-b352-4e8c-89d1-b7f6f3794b42", "comment": "Malware payload (Gafgyt)", "value": "e00cc9fc4225ec215475641988add331dfbc9c7ba1c8d1f867f366f1e2c0345509a2d002f6eed166434aa26fa0cd0639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705914, "uuid": "fc701ad4-f4e3-4b67-89b7-4b4cd9bbd9e2", "value": "T1C314D80AAB650FFBDC6FDE3702E9060539CC645722A43B763674D528F54A90F0AE3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705914, "uuid": "c1c64cdb-f13a-4a61-b8e6-783a2294c7da", "value": "1536:AgnoJ/wigFicZxGBcMgV5bxITuBa+X6XfPaJuorPrNlLaKmlgZxIMNxL76/5SLsX:toavZAcMSYK9PXLabgb7ci3fbhJ3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705914, "uuid": "0b6de707-56d2-4000-bf88-6204050d29a9", "value": 199656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705914, "uuid": "abb6e4ff-92b4-4819-9953-d3b3873463c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705914, "uuid": "91661f00-bc1b-4c95-b1ca-2f4fc3551dc8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e1553c-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757849, "uuid": "0de0a201-6d0f-48e5-b001-9d063a0f2276", "comment": "Malware payload (Mirai)", "value": "8c864e7ffab8423349c54fe2f6ff3441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757849, "uuid": "c1a073d0-9eca-4c19-9582-bafc58ab418f", "comment": "Malware payload (Mirai)", "value": "4d4df29c04bfaa7e15f0ed6d6183375aec20e06115da16e6577aa869c0bec081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757849, "uuid": "872daecc-027d-4fe2-8056-76d82bb8e39c", "comment": "Malware payload (Mirai)", "value": "d069dd7eddda00f7dd032f4d0c9acdf1426d5bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757849, "uuid": "d19bf166-4fde-49d4-a480-2d27c43ef8ad", "comment": "Malware payload (Mirai)", "value": "08e78755cd2615c033a417892bca2017f91cf91866ecb36640dac7f48433aa633283a63e28dc70144fe12fc73a3ca513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757849, "uuid": "03286e18-5abb-4c37-9748-194d86f8f271", "value": "T139534B99B4028E3DF88FE97984160E05BA2023D112931F276BAFFDE37D331659D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757849, "uuid": "fd91e792-3696-4508-a4f5-7197868ad495", "value": "768:2eY49YE204qEkRf/36fmODeiuQlJZvTgFHq1euk8B8vpG97ErlfXySJ1oXPo7Po:2Y7EkRfPh3iDx8Fq1Xk8B2aErlfiSJpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757849, "uuid": "1f85a282-e699-41c7-a474-fd10e300a46d", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757849, "uuid": "94354403-6ddf-4eb2-9a97-e3b6de686095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757849, "uuid": "8751f0a7-3faf-4157-a883-d09e93c88e45", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7746b148-85ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1784711120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711120, "uuid": "ab202ad7-935d-4bb7-a165-1d070234ef94", "comment": "Malware payload (RemoteManipulator)", "value": "69a80c661490fc3f54873eda9f678b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711120, "uuid": "ec8c294a-f9b9-434b-bd34-f6990564fa7d", "comment": "Malware payload (RemoteManipulator)", "value": "4d94c1c41fdc9d7c77a4cd2eed5d03bebade3bc7f916f75c76fd5e3503f2df2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711120, "uuid": "cd9fc312-7a12-46f6-b14b-ff26c197dc1d", "comment": "Malware payload (RemoteManipulator)", "value": "2be4360b68af437d52e127d2881f96191e239878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711120, "uuid": "fd93da63-db55-4e53-8057-c7ee936a939b", "comment": "Malware payload (RemoteManipulator)", "value": "4051a2323aef7bb8c54c0bacb52af88fd0fc1859ede908cdcb7ba0e70af8d78c6140a931335ef34af23014feb44a6ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711120, "uuid": "5c9be43c-de74-44de-a81f-178e7265b1ed", "value": "T1F8473359C75569F5E1739770881388ABEB7334588320E57FA36869183F13E33BA39392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711120, "uuid": "c4c59afa-672f-4e6d-bf1f-4bf66b440565", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711120, "uuid": "57e0b1d8-2ecf-4502-aec0-ee3c0bbae053", "value": "786432:Y3lpLt7wZ6MNIz+rpHw+WHEcWUs+fDOVOs:Kz4Iz+rVw+WkcRss2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711120, "uuid": "495d34e6-8752-43bc-b57e-5a87e1091b33", "value": 26560793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711120, "uuid": "53903fe1-2e32-4793-876e-cd36ca79197a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711120, "uuid": "4a0c268d-0ca6-43a7-a458-6e5df5c34711", "value": "Kopiia_elektronnoho_dokumenta.113674.22.07.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de72cf6-85b9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784716527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784716527, "uuid": "c87ceb4e-b24a-4ea8-8cca-6286dbd8f4b3", "comment": "Malware payload", "value": "58581d9307babd92c785529472a1016d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784716527, "uuid": "de45cb5e-3e87-476d-a777-874343286f8f", "comment": "Malware payload", "value": "4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784716527, "uuid": "05d68843-0bb4-4ba8-b908-5e98cc0c50a7", "comment": "Malware payload", "value": "e57f9c82ba1479441856f5ec8b601f100d73fdda", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784716527, "uuid": "54b697dc-2966-47c5-b061-11084956e37e", "comment": "Malware payload", "value": "d63da750d1da2f4c8190606b3cad99d0e15f7f991ade276f01bf62f876ee70eb1e84bc9e5bf5f1adcd0ac16d423e91d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784716527, "uuid": "41387837-8544-4232-99f6-e8bbac7c80b4", "value": "T1B901ABCAD2209E50512EDD5E339652A0B421C3C6594B4F78BFAC983EEB98D04B066F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784716527, "uuid": "056976b3-661b-4a0d-b6b5-365e0d3a98c7", "value": "24:kXCKysE2hi0ziQvZohaCcmahqSX4g3DlzC7:e9Qp+MsCRaIS4MJ27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784716527, "uuid": "2aa04a6b-5e00-427f-b24a-a1ab3a52f1e0", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784716527, "uuid": "84016ea4-3390-4289-a927-fb2565f9ea36", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784716527, "uuid": "d65d27e6-ae80-4aad-97e5-aa57ac44b099", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab5e624-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757914, "uuid": "57990df7-81e6-4a73-8c4a-df3a47b4818e", "comment": "Malware payload (Mirai)", "value": "e5bf617e06722cb363ec2b5b53b967fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757914, "uuid": "a6b3e0d4-e8f4-4881-9568-e0ceb6ecf546", "comment": "Malware payload (Mirai)", "value": "4e96f12945b9f21345137e7873cf6ef06e64baf5d73469e8b7db7c083479bd17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757914, "uuid": "8441a829-101a-439b-934b-b932ed20dacb", "comment": "Malware payload (Mirai)", "value": "f8042e7078b3334f2ec1b3620764b3fe8d733e40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757914, "uuid": "c15913fe-e637-4b01-af0b-2bd04601c72e", "comment": "Malware payload (Mirai)", "value": "817d015467615d9658ff4991482e99835efab72cd6b9341e0483940d1ad29c43ec0c20ff9df585556a2a82283d5ff254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757914, "uuid": "6e04308e-f7d8-425b-af96-b04cf2bb72e9", "value": "T1B793D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757914, "uuid": "aa7b3dcd-e880-4325-9796-967251897ddc", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqIhK:NFjXYyCEx0NhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757914, "uuid": "fd170893-6ca5-4c2f-a893-4f2c20b9b307", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757914, "uuid": "21a451e3-b1ce-4786-a40b-291ad5ee301c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757914, "uuid": "710b37ee-99e5-4ac6-abfa-3bcfa6c05281", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa581e7b-8575-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784687718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687718, "uuid": "ce37788f-a5fb-446c-98b6-a77e2461b466", "comment": "Malware payload", "value": "250ab84cd2e77519bb7ae2800551f313", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687718, "uuid": "bf865412-acff-463a-9643-4675f84ff7d7", "comment": "Malware payload", "value": "4f09b4b24d59d2db69f9fe5b4b7b1fcb4f65e8412728d1c9d8ceb636358f7207", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687718, "uuid": "b46e14f9-2eed-4657-a58d-40d35d16798e", "comment": "Malware payload", "value": "17dc28450826ff0d8f500102e1cecb940699f034", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687718, "uuid": "d251a3fa-5896-4c95-b5fd-e92267f7341e", "comment": "Malware payload", "value": "c14af8b1757795ab0984f6135ed4737bc0449a9ad8a2777b11c713068ec5c3a1f5c9002ee42794936b391d8239e8c9a3", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687718, "uuid": "7c94c8e2-f316-4f6f-8d7b-fb59fef78429", "value": "T19775239386F846B6F7F777B9A9F2026362763C5457B767EF060046980D237C29231B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687718, "uuid": "2df1bc5b-f10e-4deb-b320-22c6f4c57c26", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687718, "uuid": "07a69a1f-63c3-44a9-aea8-7e1f80bf30ba", "value": "24576:qidlODrEVSRTxQ3H+IQmNAqRLWFeM9Drx8CK0X+QA+Jv9hGVFpv6cuos:qi2DwaxCH/WmLWoi3xS0TASv9hiXScH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687718, "uuid": "478b5a5a-a2f2-41d5-bcd3-c375b66f746c", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687718, "uuid": "223582e6-7fd1-419c-a719-fa4292ed51cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687718, "uuid": "b9bc11ab-8afb-42ab-8f3b-4826a2842d79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ef99ac-85bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784718018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718018, "uuid": "6f82cf6c-1899-426c-a1df-f6ea839d835f", "comment": "Malware payload", "value": "d577e00d83444556f14015d368e6815c", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718018, "uuid": "2d42556f-5ab6-4bb8-8bdb-eac9df253d08", "comment": "Malware payload", "value": "4fbb1ebdae240e9a784ff893b113fe3244945ab322b4e733baa13a1a309ee4bf", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718018, "uuid": "32e17713-ffd8-44da-9675-70066fde5741", "comment": "Malware payload", "value": "9d554a321001513dc5365632b7cf31939d4efa9b", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718018, "uuid": "343fafcf-28fb-4351-9f09-2d5d34fd12cb", "comment": "Malware payload", "value": "9d990a33361058f6826e5a84823be0ff007c60c711a1d3cc0c91f6b4d895316b8d2c3f72d55aefaa773c9a3137645b32", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718018, "uuid": "877cd44d-881b-448d-8259-9e4eeb21feee", "value": "T17095330C02DAF36AAADE7F80CDC9B8F41CC626F551857DD29A1DB4758F3A4A720E5D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718018, "uuid": "481ec610-22db-4b78-83b7-5df9023d8b76", "value": "49152:ks3VLh6Yg8mAug8Hzi3HPWHvCyQME/ewgm1pmvcxOqhVN1oTHDdor:p3j1g8918IWPVQMWEOiOOKSTHDdor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718018, "uuid": "c34693a9-51a9-4c6c-9e4f-bdad6f156814", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718018, "uuid": "7c7d8f0d-dfec-4f1f-9dbb-64b59d616e32", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718018, "uuid": "2575b210-3a8f-464e-8ee1-ccf11e9b03b1", "value": "4fbb1ebdae240e9a784ff893b113fe3244945ab322b4e733baa13a1a309ee4bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7939ebf2-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714989, "uuid": "41ac35fd-c946-47fb-b81b-2869b7057450", "comment": "Malware payload (Mirai)", "value": "51cd01f2edffda68010819dbd33d6c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714989, "uuid": "17a24338-3e7e-495c-8578-583754666df4", "comment": "Malware payload (Mirai)", "value": "5079102fb1452c54c93b51e70fe95e3297e321d3463e87afdc6d4d33c05b3813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714989, "uuid": "09ec6394-7132-449a-8297-8fd3b92268ac", "comment": "Malware payload (Mirai)", "value": "f5f39824ee5f241119c387040790a20e008e706e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714989, "uuid": "50773c7c-2e7d-46bd-a7c6-80de7040d9d7", "comment": "Malware payload (Mirai)", "value": "6a221d0cd13089965e185a3c0f3b0412b0dc0952d9df814118176d19dcf1301bd7398b1de8304fe3cdbaf675910760b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714989, "uuid": "6a096c2d-4cae-4d6a-9c04-ac11ecd3dbcb", "value": "T1E0631985B8819A25C6D553BBFE1F008E3316576CE2DE73128D141F647BCB91F0E6BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714989, "uuid": "397f7cab-6e12-4f00-98e7-800dea1efdb6", "value": "1536:5InB0sYwqT2fRSBKl4iAr5FpEPDyAMW1/M1E6LeI9ibIRIKWg:gzY125SViS542XWhnIRIKWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714989, "uuid": "041ca9a3-3187-4c9f-8860-816a4d3fdf35", "value": 67416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714989, "uuid": "2c438ba3-7305-404c-be27-e16d7e20b93f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714989, "uuid": "c0a09301-ed74-4c95-bbc4-488298a94ffd", "value": "phantom.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a41c735-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729567, "uuid": "23b94cdd-f37d-40eb-866c-77625aaba878", "comment": "Malware payload (Mirai)", "value": "7ea7639b3ccd43ea88e0cb7a330dac35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729567, "uuid": "87061744-98a6-4007-8c95-95d658131887", "comment": "Malware payload (Mirai)", "value": "50c39fd48a07c3131f868039c42db2db17ad1bd081a7d157202ab97105f3dec5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729567, "uuid": "ed759598-4524-4246-bf8a-2deb522f5916", "comment": "Malware payload (Mirai)", "value": "376b72b4174880b6590d1cf1e1aac235c83f8b49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729567, "uuid": "661e487f-b097-4ec2-8b33-5c123ed992fb", "comment": "Malware payload (Mirai)", "value": "ef7f4afd00bd1673d2e1bc3ac8385e1943fc174ee014c42e85448e01d27fbb16a07689d2693f497973fdfaa680bd8876", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729567, "uuid": "85894387-e543-499b-910f-1f33ad5daa9b", "value": "T1C4E34C0AB4C198FEC4EAC1744F9AF537D971F42C5138B25F27D5AB622E4EE205B2DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729567, "uuid": "4de715cb-0086-40ae-aff4-f80e4cc49735", "value": "3072:/9O4T6Lhha4purv98XNwEZax2t2N1PbOJqMkN:/cg6sTEcEt9/kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729567, "uuid": "32dd6916-375d-4dcd-b396-e55594b86f56", "value": 151632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729567, "uuid": "a2378df1-344d-4c7e-a9be-6df04eaf2075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729567, "uuid": "b768ac22-23ac-4f08-b917-b12fc47bb38b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d0aabb-85d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784728517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728517, "uuid": "df40676c-d5ff-4090-8794-e4cf1bfeeee1", "comment": "Malware payload", "value": "6b0746a8257a29eec757269a4dd4dbfa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728517, "uuid": "d0d86c95-6db8-4a6d-b273-922193ab3af5", "comment": "Malware payload", "value": "51546e66a0995f40ab384d7ed24b0ca765d3fb55d044d13c9c9eb62e87361756", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728517, "uuid": "5a38ac93-7d1f-4917-81d5-d5a2d238220e", "comment": "Malware payload", "value": "3997fb2c262dbed861759fcc32d419bf8d757195", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728517, "uuid": "a283a600-29bb-4e65-bb72-982c5bf167fe", "comment": "Malware payload", "value": "62775f09f68851a7e2d3c1532ae49e6d107ed83146c348d232adfe9ada62b89f4978c347c2ee17d210cf94aa3c120138", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728517, "uuid": "4b12397d-8d81-47ec-aca6-f8b940e78317", "value": "T1D8C27D966A867C44BDC94A3E4CBD2B0D6DF5C3D1224952AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728517, "uuid": "74932393-70fe-4f0b-8c8d-42871066286e", "value": "768:Y8vCB+25j6es8RIp9FYpMSUpi+20qUpi+20YQX:Y8l25JIPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728517, "uuid": "1e045fd8-a7c8-43e0-a68c-e0476e2d054d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728517, "uuid": "37e64554-1cab-41fc-99aa-8e6b373b6b55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728517, "uuid": "777e4ec7-bc36-4371-aad2-6371af29d08a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d488967d-85bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784718149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718149, "uuid": "37548497-4b50-4ad1-840b-c55deab17855", "comment": "Malware payload (MassLogger)", "value": "961911371f15f1dd2bea7a38e32a724d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718149, "uuid": "db604ee6-ce27-463a-b1d1-41ad7bfdc8b0", "comment": "Malware payload (MassLogger)", "value": "53c6abd14ea398644a2c803516eae7d3004bd21bcb04bd53d5cacce67ee66cae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718149, "uuid": "3b1af982-2e50-4bc1-8ac8-bc618b4ef96b", "comment": "Malware payload (MassLogger)", "value": "b7c196064e153fa4a2f54d392961fbb9209d7f19", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718149, "uuid": "0749678a-1638-4d10-8d32-06b0b820b01b", "comment": "Malware payload (MassLogger)", "value": "826e202c1c5379b7ab9716cd75804bd8e2fdf11c6c00d809e914bf7a9b63ff1e9d7c254121658346fb48828d5dc4af9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718149, "uuid": "143d7dcb-eb89-4968-8805-f12ff577c3ff", "value": "T1B3F4E10107C0EEAC8BEB8B2D647FF099F2950D9B1A50544EE321FD81FBB2605E9576B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718149, "uuid": "592bdd02-d27b-4a73-805e-c6f4389668b8", "value": "12288:QPv7Qu3jV6ebCbSLL3k0ECDpWhaSQE1a/RRBpPQBZi12u:S6Za3LilQLHBpPtgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718149, "uuid": "80c24196-371e-47a8-82ef-f730a2ca1def", "value": 754508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718149, "uuid": "03fbb92b-43ae-4cfc-96c9-a4e808f76ffa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718149, "uuid": "a296651e-d488-4521-8b38-6ce56004aa90", "value": "Solicitud de cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407eb22b-85a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784706733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706733, "uuid": "e0ca2b00-2fa6-47da-ae2b-7e86576dd1bf", "comment": "Malware payload (RemusStealer)", "value": "213a13d658d47d269c6409eae79a9545", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706733, "uuid": "4344d89c-ddf2-4874-9fc1-5f2b4992aaf5", "comment": "Malware payload (RemusStealer)", "value": "546315806d197b8abeb8cbf024001c993b3ce347650eef8629b1f9b568cb8d86", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706733, "uuid": "6d928e57-f501-4d7f-af6a-d2aa01e3817b", "comment": "Malware payload (RemusStealer)", "value": "61464c72fdacc7c21a4238685546324131d760bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706733, "uuid": "c09bfaa9-53d8-4039-ae2e-d932ab761090", "comment": "Malware payload (RemusStealer)", "value": "3af89014f10aa32b2f4eb9af803c79c100970a9fb11953d66e9c9c1a85745806dd9a2768fcf4afb50de1158fe548e70d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706733, "uuid": "86b26024-ff39-469d-afcc-8d9e581534a5", "value": "T103D54A07ECD148F5C0A9A33589B6825ABB75BC481B3233EB2E90BB782E727D05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706733, "uuid": "1cfc7c03-8e2e-46d5-89fb-962a32280263", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706733, "uuid": "1643f545-356a-4edc-b2d6-3f9168b9305e", "value": "24576:hJTEUhJxb65nmC9C7DGqPx114ZHQjMfdaW1k5fkvAoBele5I9DwKqnKsJfnWm6:hJTbvxSnT9CtzOZHZda3vCDnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706733, "uuid": "facd98c9-03a9-4f9c-ad03-d52157c54d81", "value": 2948944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706733, "uuid": "7cacc170-c377-4d5c-a9bf-37b848f671f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706733, "uuid": "10366219-b305-4e65-a6d1-cceaa8b3ce0a", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4524d286-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729504, "uuid": "74612d63-b2ed-4d86-9691-054890e33cac", "comment": "Malware payload (Mirai)", "value": "8a6764fd28ba15989643c6dacd00b3ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729504, "uuid": "b7b8a97c-acab-4bf0-b7d3-7204850cecd7", "comment": "Malware payload (Mirai)", "value": "546d7d0b166ab91a89df06387f7bca1d946bbfcbeeea757f492fe3e758d25c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729504, "uuid": "ac8297fe-5438-4549-b5b6-28a347703845", "comment": "Malware payload (Mirai)", "value": "74e87491e4f807dca41feea5d8a4cbc3ebf33b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729504, "uuid": "cc875df8-1ded-4b69-aed5-84ce1cbfeb96", "comment": "Malware payload (Mirai)", "value": "8828f9cd681b1bb429217559ec956f3c761ce813324b0f80f67af49bf2ea6f86110f26e9f4f766a9c2183accfa73b77c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729504, "uuid": "936de45a-c92f-48c1-be48-d44d56ee51b7", "value": "T185F3C70AAF510EFBCC6FDE3706A90A4135CC945722A53B753674D628F54E90F8AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729504, "uuid": "79058fc3-3c0c-40e5-b681-4896991088ad", "value": "1536:pLCIIMlNy7FgH9dk4uLX5ha+QVXrIlbTJ/vg6XuycMSq/7CTlAxIfubHg1kTmhr9:pLOMlMFmbWaXORvgspUrfOgIsrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729504, "uuid": "c1e2a1ec-c0e6-4603-be5c-4dafb7d2c014", "value": 168940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729504, "uuid": "f867d539-9837-4908-9e82-df72302e8c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729504, "uuid": "905db130-918c-4871-8aba-89f7bf2f702b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6072223c-85cf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784726114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726114, "uuid": "a6ce58de-5de7-4730-ba67-331a3af441fd", "comment": "Malware payload", "value": "f82f80e41f0abd586fc5a5fba865fda9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726114, "uuid": "23137ed0-49f0-4f60-b380-42a4394416fb", "comment": "Malware payload", "value": "549a4ea56831ca21b844acda71cab1228870de9df9d0c8a292f54d4205974ea1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726114, "uuid": "36883719-ed16-4aa4-8e87-13be6e726fb5", "comment": "Malware payload", "value": "278cfa4088e525d5f50c89ddf94df01447612095", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726114, "uuid": "86484c09-2c35-4ad4-a082-299331a84551", "comment": "Malware payload", "value": "49985cabf325582cc8b17b496e32dfff1409b51195276fd2e1c3f813b9913c0183df8dc4d350aabf9bb7c9d8a0bff61f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726114, "uuid": "c5446bfb-300e-4d82-8283-83aac7bb1945", "value": "T1D4C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726114, "uuid": "ef0d14c2-2b79-4c9a-9296-1ce99046c042", "value": "768:r8vCB+25j6es8Rt9FYpMSUpi+20qUpi+20YQX:r8l25Jbd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726114, "uuid": "67b77187-1d7c-43de-adcd-978c58897b8e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726114, "uuid": "c349a6fc-0752-4be9-a1a0-9cbed0ee176f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726114, "uuid": "6db1cf06-7762-4685-ba6e-83799a4f3364", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f5dbef-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784701773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701773, "uuid": "2dfa5bac-b7b4-42ad-9524-06088c1ae755", "comment": "Malware payload (AgentTesla)", "value": "2670b1bd0eb4f3abc8a60ddeaaa60114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701773, "uuid": "dba3ce78-1440-4647-b246-8cb618c26c78", "comment": "Malware payload (AgentTesla)", "value": "54b9d9759b027948b92071a241700d5dbd6af84e170b9b9ec169644999a27758", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701773, "uuid": "95b5c18e-e113-4691-b3e8-78bafb6c08df", "comment": "Malware payload (AgentTesla)", "value": "8ff4f43a9fe9999da92489d5413c6010d72d8006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701773, "uuid": "b321ab2c-4f51-4d6b-9790-ae2bd151adfa", "comment": "Malware payload (AgentTesla)", "value": "b992d4d740abea70e5652374fb52c07ec973bb4b3b3fe8ed32f17597af0cbc1bd7a7476dc53a36858a2be64d29b174e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701773, "uuid": "0c4534d2-c686-4d47-b04f-d7f95b6a268f", "value": "T17253859463C6B4A853D75B7F3A2FB0D9F16E09DA2D804487F188F8A4F93421AD9D1B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701773, "uuid": "78ba6619-853b-4c0e-a081-6f03dc4954f0", "value": "768:iUpDU4ZqQxcZaVph473QeRaTd2d1bcl7N1cOwJ32KL30V5npadqMdHRK9BeobXaE:XjeoTdylc093NyUIfEHk7EM0L1GDsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701773, "uuid": "d9d05d1a-4c9a-4433-97cb-12e8da874eee", "value": 63363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701773, "uuid": "36dce2c7-e0d8-4ebf-a52c-0aef9959bc4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701773, "uuid": "78e91c81-f593-45e3-b8bf-73925ebc1d35", "value": "Nomina 07212026_N0021226#3.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c06dd53-85cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784724792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724792, "uuid": "689dfd21-da58-4a1b-b507-4ba409ac2fcc", "comment": "Malware payload (Mirai)", "value": "a3f6f521683fd747ada28ba3d467a6b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724792, "uuid": "f9baaa68-b158-4c7b-b01c-75a757e42690", "comment": "Malware payload (Mirai)", "value": "54c224d856e7b47d05fbc68bbc69346e4f652d5a892195020f0c471007106693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724792, "uuid": "fabb4f66-806a-425d-86bd-1a2c3d15a422", "comment": "Malware payload (Mirai)", "value": "330371df6c7d563830b9635257f1a4e6c74f14ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724792, "uuid": "138cf9b2-b61a-4880-baf5-b5e156c822ac", "comment": "Malware payload (Mirai)", "value": "1cbd8136508016001b9a12357eb18dddaf6e8fe4a6da4eb3f3fe97f277e6e5c990d1b3c73401ac7f51d3962ff9b1c7ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724792, "uuid": "0cab6d99-10c9-47c2-9aa9-034822592c3f", "value": "T1ECC34B9AB4019D3DF94FD57B58632D1ABD20A3925183272A639BFD93AC321F47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724792, "uuid": "8cb90c96-7793-40e1-8e2e-0c0a81b46aa1", "value": "3072:XjXiHb1ZoCGRs0rBlpUjeZ5JqieX8KJFLOfs:TSHbPoCGRHqCZrquKJFLOfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724792, "uuid": "23eac562-c9c1-4e8d-ac37-0826ee9b2c39", "value": 125920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724792, "uuid": "542ca582-86a8-4ca6-80c9-fdcfc479af9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724792, "uuid": "c382cb25-f664-4a99-ad41-ed97cee68876", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21495511-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784732451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732451, "uuid": "2196a77d-16b3-40c4-b4a8-559abea24ca3", "comment": "Malware payload", "value": "c0bcf41f4f52b2edb0eb51ce04e3d54f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732451, "uuid": "d00f3a5d-f9d3-4dd2-95d4-c3cfe477eee6", "comment": "Malware payload", "value": "557819ae8a9fbe20d7318a396bda128c21d4cf14ea9babc56b4dd4ba9e429896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732451, "uuid": "15b02ca0-f8cf-400e-a21b-d53ef47e99d6", "comment": "Malware payload", "value": "1831b6a3c7a1135bc15eb6a3638cdcb2a86abbd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732451, "uuid": "2d294830-c2a6-49d2-b1e6-8df2e9615d0e", "comment": "Malware payload", "value": "d837a080f7c56b9545d89ad1894a9a0bd24adb6673a23de12c714460d04db1041a166fcf32bdfbfff1e76b58f97dce8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732451, "uuid": "d54cccd3-5363-4723-9b24-18b2a672b63a", "value": "T1C7631A76BD859B27C1C5267BFF1D8388331723B8E3EB7113DA152F65278B41A4E2A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732451, "uuid": "979e972c-60f1-4709-845c-134c10ed518b", "value": "1536:Ks46brk6qug4Kac4Ztq770WtbKC1fG/T2rDFYwZc6pEs+Fm1zP5bIMl8B3:Ks46/kl349lS70+N1fG/yrDGCb+Fm1z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732451, "uuid": "a50da1a9-1368-4f8f-b2e2-a4d0d901692f", "value": 71524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732451, "uuid": "19766b20-b182-44dc-83a6-ac59d94aace7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732451, "uuid": "2d1462fc-7ddb-4d19-a86d-1783acfd3534", "value": "D1Qd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af21611-8576-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784687987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687987, "uuid": "d9f66de2-e6eb-4f63-989c-0b3d0ca25734", "comment": "Malware payload", "value": "b55e3e76c407170c3c6b8193989c83d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687987, "uuid": "d97d572a-2492-40f6-977c-885b88bb5120", "comment": "Malware payload", "value": "55a47a54228736d7dad743a053f6c7a832b06efe94ae2c6645d5f0df034cff58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687987, "uuid": "0f419a96-c09a-4c41-8ba7-ae0dc2ac32df", "comment": "Malware payload", "value": "9549f4ae06357d7fa827878d46aa7fc1e375dc80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687987, "uuid": "ee3fc639-3083-45fa-b970-45fa167fd132", "comment": "Malware payload", "value": "48ccb897d6921116ad7a09b5427bde375a802fbadf6f7c3ea8fc7417f016eb51aa4eef4130d167a50b614e23c1b39c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687987, "uuid": "67b7df6b-988d-45ad-8e5d-9cb8a17eeb78", "value": "T185D523CA78F21974C432C7D68F93E47DB16A7B954B358E63BBCD6A108D528891C7A330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687987, "uuid": "14baf989-c80f-4a31-9799-a57328665bc7", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687987, "uuid": "aeda1f52-8dc2-450f-918b-60f222d8efc7", "value": "49152:WYDW6Ybz1gpk6XiVt4+KdKn45UdqQnej2t4LUupHxKpoBlBgNLfuAzI3Z7SnX+n7:CGtXiVu++2GUHeS2L9CpoBlBYL8bgSD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687987, "uuid": "d4b3df19-013f-4ef7-b528-36dcb66d231a", "value": 2945536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687987, "uuid": "d8bea3bb-9837-45ee-a1dd-77758da525a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687987, "uuid": "ab2e317f-e352-443b-8f8c-5dc98f8df699", "value": "SecuriteInfo.com.Win64.Evo-gen.65237985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde6f489-856f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784685147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685147, "uuid": "c24af218-14b2-48c6-b95f-0bd9503aa1cd", "comment": "Malware payload", "value": "2688dbe613f744f03b334524b6357eb3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685147, "uuid": "cfacc12c-8f5a-46f7-a8ba-5847b5c7d6e0", "comment": "Malware payload", "value": "56819d1e3fb265c80e117800fd1df93744135ca391a311250d0221e7ecc9fd81", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685147, "uuid": "9ee7be5c-8579-4c65-9d24-dcdafe9114d5", "comment": "Malware payload", "value": "45dae35f1a1312dfc4d4cccb18c0f23e474e209e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685147, "uuid": "645876d2-214b-4937-b1f6-547200ca48d5", "comment": "Malware payload", "value": "73ef40b6db9c50b145d5be30ac632c2d05ff1722774c66a7603fe6ea906a82f32be35c9c893e20584b5e37190437d1b6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685147, "uuid": "5578f59d-c34a-453f-bca4-1583aa8b4a2a", "value": "T1B1C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685147, "uuid": "4de1cafe-bc28-4043-b7ea-acbfe75c02b5", "value": "768:q8vCB+25j6es8ROf9FYpMSUpi+20qUpi+20YQX:q8l25J+d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784685147, "uuid": "d9af02bc-d068-4ff0-883f-ff9a3c611844", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784685147, "uuid": "07c8161c-3fc1-4125-9e31-295a64dc9593", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685147, "uuid": "b381bb6f-a00b-48e3-98e3-48add559bcd4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0302708c-85a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784706201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706201, "uuid": "ec5c5fa4-38dd-4d48-8fa4-9722503dfaa0", "comment": "Malware payload (Mirai)", "value": "19ec90d476ee7056a2cd584ac853841f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706201, "uuid": "8f4a2da2-204d-4e36-b1a5-cf70cabf7ad1", "comment": "Malware payload (Mirai)", "value": "59248a9227798a74b68a1c7fd42b418fc74214d409be03871e6cb0a38f959722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706201, "uuid": "d2dd4184-0ea8-4ef3-a80e-c7fd50214fd4", "comment": "Malware payload (Mirai)", "value": "dbce1869c23a1dfcbb01dd200b2a80ac469fb15d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706201, "uuid": "c9f8ddae-245f-497d-8650-0d3619055e88", "comment": "Malware payload (Mirai)", "value": "d10df54d43bc97694aa5ad17391098ec31dcead188809b8bf7d29b8ee2339eed85419ae418f3a09dbb6a0a419e4dba3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706201, "uuid": "ba416fa4-2ce7-4195-9d2f-7f19ec49c2df", "value": "T1C653023522188167D454C4BC977903D986736C1FE147995E20EE34EF17FA90C76E2BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706201, "uuid": "3f8a4cb5-c35b-4bde-b7e6-ac834eb47e5a", "value": "1536:TjsR4VpjvcDjqyCRbCa7dgpv57h/dieJzVEmcmOTUKVEWZ:8s8jcGh/dPNiHmwVEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706201, "uuid": "e440d1c5-a795-4877-bff7-683baa27e9a8", "value": 61348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706201, "uuid": "1d05cb0f-1437-4461-87aa-a84ba0b9f321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706201, "uuid": "c54d62e6-66cc-4485-8b01-59d4dce91044", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62883f84-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714951, "uuid": "9739fccc-4e17-43a3-b5a6-7fe57839e995", "comment": "Malware payload (Mirai)", "value": "5784c9638c350580639b46fa19ccacbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714951, "uuid": "f07a832b-a545-4d86-8b4b-7b16295e3daf", "comment": "Malware payload (Mirai)", "value": "59a84ea9ed8976871de84e0ec9b8662d07c65558ad0c593cfd94bfc6e298c903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714951, "uuid": "f8a89d85-549f-4ec0-94c6-02b5a0659949", "comment": "Malware payload (Mirai)", "value": "ed4af6f23381ebdbb63545635fdcd214aecb9d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714951, "uuid": "022251cf-f052-48f1-ac78-23c1ed2d14dd", "comment": "Malware payload (Mirai)", "value": "2cc4571fe9d15abb51a1d2490dcd3d49164ca5314530f0090eed68c1c0739ee26331d6110ef95bb1db3c01059fa527b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714951, "uuid": "449bda9b-f70b-4c17-a4bd-9dc624a69900", "value": "T15FB2D0E9E1979AF7DE9E7D7509CA95C23BE88FD835228E122190AF82025641B1A05FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714951, "uuid": "01677bcb-1c90-4648-b5fb-0a274ed3ac5e", "value": "384:MQ+EYgpIs0QiReRy77S2O68RlH74L796xn1BmSki6E4xikanj31hM4uVcqgw05Vs:MXY8QRUS2O68I6hiSkREBhw4uVcqgw04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714951, "uuid": "da007c4f-df2f-4ed9-bab6-9ac01b98d083", "value": 23944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714951, "uuid": "14384eca-254b-4ce1-a327-923fc4e70c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714951, "uuid": "8550f59d-ace2-45b3-bdc4-afe293742556", "value": "phantom.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6455eecd-85b1-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784713236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713236, "uuid": "c7e55d4f-8a77-43b9-815b-2fb7db095d99", "comment": "Malware payload (PureLogsStealer)", "value": "2a3379120119c12e6281193c3f864c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713236, "uuid": "0f76e0d4-2813-49eb-9c7e-c03208197d71", "comment": "Malware payload (PureLogsStealer)", "value": "59c292aaa6b81e0de85fd7f463c7042f680c49e00f7e0027e6d0940a0fc88d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713236, "uuid": "2e39f6e1-cbb6-4b62-bf4c-f3dd35186188", "comment": "Malware payload (PureLogsStealer)", "value": "65da6850d086d2fbeff693f9c1499fda09f91895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713236, "uuid": "6208df64-209c-4c61-9ff6-5b8c1e070210", "comment": "Malware payload (PureLogsStealer)", "value": "2e2e0466853d568f6ca630488b1a90897759f5142fdba52f45b3d9a600843a55657c83822eb3fc128134cfe9caecf305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713236, "uuid": "8b2deb2b-4ea4-4f0a-80b8-328b65e2d6c3", "value": "T10205BF3B72958F21C24A4373C5D7450097EA964776ABFB0F72C813D619427FECA0A29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713236, "uuid": "68c30d87-4007-4c1d-a79c-1c161b7778e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713236, "uuid": "d2d35668-37f7-4684-b69d-d50a40bbc560", "value": "12288:1ByztY2aSj3MXu3/JkC09wlvGiKKkUkcQGek0S2ZMQGYqX:QaKOuhkZKdGakVnk0xGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784713236, "uuid": "5180e856-976d-4bcf-8d57-0e2f2b348373", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784713236, "uuid": "65b0c350-49d9-4b32-b7f2-70f355276eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713236, "uuid": "5db010bc-5909-40e0-bfae-cd9d36606f77", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.33844698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ec804d-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784701971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701971, "uuid": "02a73ab8-29ef-4855-a301-b77769a6509b", "comment": "Malware payload (AgentTesla)", "value": "adcc48bf2c4ef10eb3338b1a3528cb14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701971, "uuid": "0dca7169-3dde-4734-aa3c-812a91ec0f16", "comment": "Malware payload (AgentTesla)", "value": "5ab72e32ef36ea8da0a00c6e1959ad1750a379d007763292ef0fd8709250d78b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701971, "uuid": "a58efc15-5c54-4d6f-b4e5-1077484ae16a", "comment": "Malware payload (AgentTesla)", "value": "e90ab5e6bc3d906c0f6ddb5cc7d2c6852a7c3023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701971, "uuid": "315513f6-7094-46e3-81ef-bc27af33064c", "comment": "Malware payload (AgentTesla)", "value": "4c86c26a2609c3966265a7d7a6d36daf7d8141019f14058431406334218234c0d2b0907e7b3e4126d851a11b9b1a03ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701971, "uuid": "62b51ef9-b96d-4f5f-ab21-cad6c7653701", "value": "T16543648532C1FC84439357BA7B2FB0EAF5AA48C9AA404847F798FC99F5B1305D9D1A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701971, "uuid": "938359bd-b603-4e8e-815b-7dd611b99990", "value": "768:7nOOII+0tKjauMWzYISL7NpsfAshSt/7JpVHKFxxHbzjfY9qdvT7ND62HGa2P3jS:QqiyhzYKGRqnmHfkLK6IQsgYWOzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701971, "uuid": "8e402c66-90ae-4e6f-b7f0-8cff7e0c460f", "value": 57156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701971, "uuid": "a4e7c98c-c65b-42ab-b1c2-1f9dae6074ec", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701971, "uuid": "79b5b503-3e70-4055-a7f2-e5cbc12f00c0", "value": "Nomina 07212026_N0021226#4.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de87e96-8585-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784694300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784694300, "uuid": "bfec38ae-2593-4287-9942-d942e6e8685c", "comment": "Malware payload (RemcosRAT)", "value": "1924caa6592899f1cf84977090fe1ad0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784694300, "uuid": "3ed176b9-2359-4215-ba4b-b6c827e8eeef", "comment": "Malware payload (RemcosRAT)", "value": "5b0109c57ad109a1608daf28f45d7a28166404fa7ffb9c9344a0e57c665e1c27", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784694300, "uuid": "1d3bc2ff-f0d1-427b-82d4-40b714eca26f", "comment": "Malware payload (RemcosRAT)", "value": "6d27275b25c6418303f0e745f69c4f75ff96e3e0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784694300, "uuid": "2d0757f6-2133-4844-9c22-bcdb7db6b889", "comment": "Malware payload (RemcosRAT)", "value": "7e6b48084b659927f63155151eec6382c1f1625d1d36a8573420687c63b3caa1ac9ece006f13762d738c2fba62e93421", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784694300, "uuid": "32490890-23ec-4a25-b8d0-b33448f455db", "value": "T1EF132D12EAD4093A0DC746DEE9690B6588FCC92E4222ACECBA9D771D800365C577B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784694300, "uuid": "75bc82be-1f5d-450e-bf73-564898fae615", "value": "768:xQBCWUYsrJeBVBgiSxVD3yXWkqcV9p1E9MmMMTpLN15ZH/93b:xQBV7k9ONV974MEN159/9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784694300, "uuid": "17514b6c-3659-4906-af53-c320a3821f0b", "value": 44674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784694300, "uuid": "278d14b2-fc9c-4b81-9bb0-00249d5f516d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784694300, "uuid": "500c6d8b-e92e-46d3-88e3-2c73d6b79f97", "value": "RFQ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd3daa9-8611-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784754346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754346, "uuid": "ce5dc06a-f50a-44b7-bd10-06ad66cc92bf", "comment": "Malware payload", "value": "8a39789b544c9fe848a679ac094f620d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754346, "uuid": "6d84edb6-3801-4306-8f18-86a3889d28fc", "comment": "Malware payload", "value": "5b0f66b45f70e1976a61be44739d0e1f2a554a6b314ae4237d670a02e4614fe5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754346, "uuid": "08795814-3460-4fd2-8ecc-7362193fa002", "comment": "Malware payload", "value": "1881ec168b62ad8b87ada9a3e61cc7da760120e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754346, "uuid": "063abe31-3cac-4afd-9a69-c97d2ee510f7", "comment": "Malware payload", "value": "3cbc60915c9965c3d19d6582263778ad162be04e17036df4f14a8ca42578fb3696a39098f4e933cdc94e2e01bdcfc70d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784754346, "uuid": "e3b453ea-7d81-44b4-b554-266c8aeb8741", "value": "T14D01A9C531907FF3EC049F08FA72466950C7EAE9A2CF07E094C66E155D9D644F917A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784754346, "uuid": "94f2e957-bfe6-46da-ad07-bff10490ca53", "value": "6:hZAU0CiG8pKgOoShGSbTgFGpjo9yXuiG9yZJNHu6WKofVxaGfPkdVkCf9FLGERBf:ECinwHBPcyjeyZCAQy24fL3+pH8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784754346, "uuid": "c519c5bf-4ec7-409a-8ac2-4f29b3f762ec", "value": 793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784754346, "uuid": "fcab0032-055f-4c3f-8929-59290706a11f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784754346, "uuid": "5fa23c8e-bc94-4c06-bb8f-6a69e0f12044", "value": "peak.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba84fbb-8601-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784747447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747447, "uuid": "15a277ec-b55f-4fcb-93fc-8a113c530748", "comment": "Malware payload", "value": "423ac93f8fc8a4ce697b5799e9ca93f0", "object_relation": "md5", "Tag": [ { "name": "102-165-46-37", "colour": "#5546C5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747447, "uuid": "7ee02790-8137-4f82-ae08-6c1bd5960000", "comment": "Malware payload", "value": "5baaef4c3aad7d78959554a977f358fb37eae685034df70fa43c4b4618cba3a9", "object_relation": "sha256", "Tag": [ { "name": "102-165-46-37", "colour": "#5546C5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747447, "uuid": "54acce46-6844-421b-9e09-09f3def47a44", "comment": "Malware payload", "value": "bfe5baa89204b8e1306806dd03f2b3300400b26e", "object_relation": "sha1", "Tag": [ { "name": "102-165-46-37", "colour": "#5546C5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784747447, "uuid": "7be6aa28-c112-4342-9993-f1d88d51f64c", "comment": "Malware payload", "value": "81b3ebe86d0286b2c42c01775f2e4f066143ee0950d2fee6606e2bba77d13018ffaba97bbe40d93abdd32d88e0410371", "object_relation": "sha3-384", "Tag": [ { "name": "102-165-46-37", "colour": "#5546C5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747447, "uuid": "ea5ef60e-5622-4f4f-88cb-f32d8c631c3c", "value": "T1FC26CF47FB48DA5BC0FB43F25A334B6515070E5A8B439AC75918363D2DB76C06E8AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747447, "uuid": "caf0e0a2-7e0d-468b-9c59-e1fcb102cc8a", "value": "98304:39BS9lz9nOmrq5Bs0Eo0tA6Wo/KrRXVEgde:3nAlz9rq5BBETie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784747447, "uuid": "1eda5b04-b6c7-4233-b30d-b1c26ccfacc0", "value": 4485045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784747447, "uuid": "5d274dd4-ad4d-4d6a-91fb-5f319361e94d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784747447, "uuid": "82dcee52-8f45-4c86-bcc9-e8656299cb9f", "value": "combiner.watchdogx.tracker.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e2bb47-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784732453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732453, "uuid": "f28b378f-3cba-4156-a99a-8e421fefa656", "comment": "Malware payload (Mirai)", "value": "aa70ffd6ac276c55410ea37d469097c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732453, "uuid": "868fb26a-df0d-407d-955a-15b52a7f4dd5", "comment": "Malware payload (Mirai)", "value": "5cd93b64533e2686f0ff5c1aae2ccc2b73051bed344547c852e74c49c3de6f6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732453, "uuid": "a36d0eda-487c-4b57-9c16-df09bfe71fdc", "comment": "Malware payload (Mirai)", "value": "7663b66cec7f2c0c6ae9af455cdcbd63f5f15f38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732453, "uuid": "f31f6bdb-44df-48b6-816b-33536e960253", "comment": "Malware payload (Mirai)", "value": "97ca4cc03b5e61bf0985cc702e2c9cd80d5663340ad86a6c95ef4737736b980d38d1b6eb8e585f7fb1f5bb17a1b5694b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732453, "uuid": "4f71c23a-b849-42ac-865e-432d81cd7fb5", "value": "T1C183F82ABD419F05D5C526BAFE1E538933535BBCE3EE7102EE101B2427CA96F0E2A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732453, "uuid": "3f81028f-0dc0-4be2-b827-78f2be2e2b0f", "value": "1536:x2npNJBDDafBOejhJYQRF41RRCjffDnz524VGUSdgj1zf+u2FllJSidORUi7mHJZ:GNJBoBv6RR4bF24VGUSdgj1zfWfxMUPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732453, "uuid": "95f15a62-9311-42a4-8088-eee192d57099", "value": 84160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732453, "uuid": "2777d510-c1f8-442a-a3bd-a0450018decc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732453, "uuid": "4ea90c95-cd7c-4b5e-8e82-aa56fc668d34", "value": "D32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ceadf8-856e-11f1-bd95-42010a9c0009", "comment": "Malware payload (KillMBR)", "timestamp": 1784684348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684348, "uuid": "dca74df3-9b41-40fe-8478-0897a7cddc2a", "comment": "Malware payload (KillMBR)", "value": "ef696834a9cae24973bb0d5f42d0d5d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false }, { "name": "mbrlocker", "colour": "#F86A87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684348, "uuid": "37980e31-5c2e-45e3-8705-b0ba11c9e7d6", "comment": "Malware payload (KillMBR)", "value": "5da46290c303a3acb2b8f5ec1792f33728903b7700e742c9e37aac026270245b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false }, { "name": "mbrlocker", "colour": "#F86A87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684348, "uuid": "af382462-b041-4891-9df3-d7b65eea7b89", "comment": "Malware payload (KillMBR)", "value": "218c38724c6d59921894b98c15ed431e1ce17a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false }, { "name": "mbrlocker", "colour": "#F86A87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684348, "uuid": "c2e82f7b-79a5-4f13-9760-b58e626a5103", "comment": "Malware payload (KillMBR)", "value": "917de2c7d4dfe607b67eb18e8ab9e712beca3526ead8b98fef381baf410e80b8becb32bcf43c0ad3d469bb36ff0b0d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false }, { "name": "mbrlocker", "colour": "#F86A87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684348, "uuid": "94cf74ea-e633-474b-8a75-a93feffb941a", "value": "T18D663383D2C300F5DB86297125BF6B3BDA3AC7464B2AEFD39394ED105D72641E03625A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684348, "uuid": "46d5354b-1922-485e-87b5-4a79c77e7530", "value": "196608:JLyWj9MVWw/ZO3HS56RVDeYavZGqaSxCx9/kEfEY0V:7vwh0E2e3vYqHsx98EfEYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784684348, "uuid": "67694309-31a6-42a4-b3a9-4783ac96bc05", "value": 6762496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784684348, "uuid": "e769efb6-66cf-44e8-b72a-af6fa5735f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684348, "uuid": "33ce3192-53bf-4dbd-8fbf-6164d0387830", "value": "\u62fc\u591a\u591a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80693a9-8580-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784692331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692331, "uuid": "ffde37af-4d04-467a-bf4a-8b7192c6bfd7", "comment": "Malware payload (Efimer)", "value": "a5e14e67ed05dd0c1f4be5d923d24cb9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692331, "uuid": "cea64770-2c0e-4e24-9da9-1f97157caf79", "comment": "Malware payload (Efimer)", "value": "5e3f1dfa4b61b2e89c747b24bb8872f3d6aca557c2e89f867fdd3be112b18481", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692331, "uuid": "8ae3acc2-fff8-433b-beb8-394ef8b3e88d", "comment": "Malware payload (Efimer)", "value": "b40d81a2f40e3ddcdac8b7dc8d7f98dfdeb692d9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692331, "uuid": "32a3e033-9747-4f11-a876-db51ac7dd4e1", "comment": "Malware payload (Efimer)", "value": "08a344a0d993a1d0fa770309d5c7306fec2266ec91c71a87e6a44d14cc809de7ff27fbf5d9d00712bb23e4b36fc662e6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692331, "uuid": "c89436a3-8afb-405e-bbbf-1abefffa5b6c", "value": "T1F6E633185BE000EFFA67417CAEA285D2D571F03A6737C7DB0B9897602E131E0897AB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692331, "uuid": "3d8d2060-b3af-48ca-8d99-afaf8758d531", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692331, "uuid": "39fa7fa2-f353-4652-8273-2a7677060809", "value": "393216:7LXLvudcjf3yfktUb/XMCHWUjX2cuI3/PGTAI:7LLudUa1zXMb8XLH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784692331, "uuid": "a21b55c0-37f1-4829-ae5b-44a28468271d", "value": 14296978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784692331, "uuid": "c431f725-fdf2-4943-badf-8ef97432cfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692331, "uuid": "26981d79-ad32-4d6c-b9f7-c67cf7358cec", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f39469-85d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784728056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728056, "uuid": "bc72367f-ef8b-41a9-a3a6-699e2c1af2b3", "comment": "Malware payload (Mirai)", "value": "990e7085cacdd470f86327054406382a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728056, "uuid": "f528a4f3-20d8-4690-a372-a540cabb0c88", "comment": "Malware payload (Mirai)", "value": "5f59358b30b30a34638d93cf3fbe92bfd137756a9811cc854ac3f0f04e3a1195", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728056, "uuid": "6c2825d1-f56a-4455-8183-1cebc807786c", "comment": "Malware payload (Mirai)", "value": "b5fa2ba97f363f931c2eb95aa6c80eedfdb60dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728056, "uuid": "47948591-c94c-4b82-b4a5-01b5c89cef92", "comment": "Malware payload (Mirai)", "value": "ee6cf5330935a54601b29a5e10ed82b764bf9507e93275a0e700f33a2cdb9394c8ac6abe4e1f08694b5522aa7015ce29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728056, "uuid": "01e990b0-dd5b-41fa-8e27-b0f748317906", "value": "T1BDC30845F8519B13C6C656BBFF4E428D7B261758E3EE720399256F20378B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728056, "uuid": "8418e060-0cbf-446a-8e81-21879ac1d417", "value": "1536:3eWc4nrQ+sDq3hpF82b034V2qyF6TuAnBZaWOtHahfLUtZel6Jwyw5BX7MuLD+VE:uWx40LF8N455yAnHppuoBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728056, "uuid": "3b2ee44f-1899-43c4-bc6d-f62141502022", "value": 125292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728056, "uuid": "9fbc5124-9d77-4cb7-bde1-9add5ec46fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728056, "uuid": "970d20bd-79c5-4b71-a9d5-c8195ad7b07f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29219f92-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784723015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723015, "uuid": "0d38774e-46a1-4f97-8f3e-372501ba1241", "comment": "Malware payload", "value": "3340a4e9b69366a45df986c4b45083d0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723015, "uuid": "16ca5965-c6d1-4596-a844-b63924e5fd38", "comment": "Malware payload", "value": "5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723015, "uuid": "2a325053-d82d-4207-b48f-96555d713860", "comment": "Malware payload", "value": "a6e304f88d06c121396d21096486aefa2f02e015", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723015, "uuid": "27a594f2-b987-4f30-87e1-f84174a5b72d", "comment": "Malware payload", "value": "472ab23a63ae0012662d5f24173d551bbdc1cd7791ecff54843271700510d38045df3f86eb9fec5b2b4f9a64e508526e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723015, "uuid": "3717f8f4-4f24-4471-bb7d-663ae847201d", "value": "T10C6271F1F96D98363BCCB478F29D980CAAC31C3F1AAA3620501BAD65041D769631DB7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723015, "uuid": "92e5a228-2c81-46fe-940a-123d6fcbf9a9", "value": "192:11gsb1gjix8Sj1VAEBUADGP/6B0i1gh4BuWKTT5GqkgA:zSiWqA4UADAZdhQuW5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723015, "uuid": "052ec1ac-d131-4176-8f76-1d9c2511bd08", "value": 14694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723015, "uuid": "b2e8d7f1-2520-44ca-88f4-cf0173d9837a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723015, "uuid": "5f718757-8da5-49aa-8a8b-16b62c7d57e8", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff00b99-859a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784703404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703404, "uuid": "1e1a89b9-2922-469d-b816-063ce56e42be", "comment": "Malware payload (Mirai)", "value": "9dea45ae453a484fd18c129f2d09b921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703404, "uuid": "d9417782-e180-4f92-b2a3-96df4ca15472", "comment": "Malware payload (Mirai)", "value": "5fdf310a609462af2dbaf46c16b8b42709d4008ae0abd9caabb4973ee16a3d3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703404, "uuid": "307b3d4d-7479-4edc-8053-65b2e98a898a", "comment": "Malware payload (Mirai)", "value": "c18c58cdce538b8b8679d8a04a61bfe89dfacd54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703404, "uuid": "c5954bfe-87be-4040-a334-95bbba74f88e", "comment": "Malware payload (Mirai)", "value": "905223c277fcddd2b4f0dd0793fadfdedd945a8e8bb410c312c7f208a041a88cba585b06a4d4701cb835cac0a72e5627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703404, "uuid": "2939ffd2-7d2d-4a62-8e36-26faab1a2641", "value": "T1DD4302D14A918067C2A64537FDBF05935E686BFCF1FCAD203214599C67E07127DB2583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703404, "uuid": "f1e60530-aaf6-42ed-88df-07d486f91bca", "value": "768:Sbi3Sc9SKrnNQgmdmA0j3YxmMwzuNoKuiJKvpXIASPr/o/465eLmbOO/3Uhz:S+3SyrWgmdm9jI0MWuNoKHOxkr/QEJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784703404, "uuid": "0e6a97fd-dbf9-4679-81b5-f7fed91fbdc5", "value": 55520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784703404, "uuid": "fecdf2ba-6c6b-4483-b239-73e0277e57ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703404, "uuid": "a2911698-0f66-4ba0-aebe-6e77fd1055e7", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0168e1-85b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784714776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714776, "uuid": "8a7ac3bc-93de-402f-b9ef-80dcbb04da1a", "comment": "Malware payload", "value": "8f3a660704ce397bd176407bcbcc699f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714776, "uuid": "7bc62f8b-44fa-4aaa-9582-3b4b04b9bbaa", "comment": "Malware payload", "value": "5fff61dff1fe18f59ebabe729c5ff9c42de64911248fb424815755fc7e76d5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714776, "uuid": "f04b2170-9faf-4993-8887-7d2ad6dd7d85", "comment": "Malware payload", "value": "dd992befc8ae85a67046e0830f43c638c461e45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714776, "uuid": "7d7a4e02-00bd-4a37-8cbd-097fc0b5b9af", "comment": "Malware payload", "value": "28bcef3455de0cdd2cad69ca4320b15d265f92013a20efa25e87a83002a9cd66ec03d0a666a246ff96a2519c81edac4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714776, "uuid": "ba00049a-a55b-493f-a9b2-1c73078323ad", "value": "T1A9565B16F35650EDC06EC174834A6632FA7178494734BAEF4AE09B622F61FE05B3E709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714776, "uuid": "2e93d60f-53cc-4884-9607-4641296576a9", "value": "2673cbd7db1c8bd9dfaa74fc0c24cde6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714776, "uuid": "551a3987-5cb1-48c3-8e23-3244ec6dd3a8", "value": "98304:uhzq9TaGgStIR4Mo8vO2b2vk4FzIHaL5R+lUFgZ:uQTaGPvkUDoU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714776, "uuid": "b2554cdc-0dca-480e-a7b9-0410e2cd8c62", "value": 5938176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714776, "uuid": "17868fb3-1c82-439a-8b78-0c575dec71c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714776, "uuid": "c0cb653d-c715-4adb-8bc2-a3cf5cd7a377", "value": "dropper-msvc-x64-no-bait-noselfdel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3190a262-8582-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784692964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692964, "uuid": "d1f2a306-e186-4b15-ab8f-74d524f888e8", "comment": "Malware payload (Mirai)", "value": "fe02adc3141fc62510236e680b10d7a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692964, "uuid": "a8f82454-586b-4fab-8b32-5a7a6721ea32", "comment": "Malware payload (Mirai)", "value": "60dfce27376cabcbb50878652f2fdd317a9721b72b0b8042e906b8e9b78a6c7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692964, "uuid": "47868ec1-039c-4b88-9480-c739356fdfec", "comment": "Malware payload (Mirai)", "value": "1103344b230ac2c51a6f696031a7c18857a125b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692964, "uuid": "8752360f-ee6d-405c-8066-8828d29b9f8d", "comment": "Malware payload (Mirai)", "value": "d219be30aebc88a7dbba11552645240455fa57ca872bbe84be85ce765c4f57c7938704e199dca25c1aacd5bb2c7bf4f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692964, "uuid": "70d9667a-2b08-42ee-ab29-62687a0958f8", "value": "T18363092AB9818F1AC5C5167AFE1D538D331327BCE3DE7213DE142B652B8B56B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692964, "uuid": "84148257-432a-4c6d-afeb-fad57ba1c305", "value": "1536:Qsnx7zDrA7kFLsjlkvkc6p3twDyl1GVHfsGYAIUiz9DyrRuYXe:BbrvBz49o+GJfsJ19DyrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784692964, "uuid": "d2231596-ee1a-482c-8784-2c8d7f4aa64e", "value": 71148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784692964, "uuid": "801bb2f2-76e7-4279-955a-f7ec807997a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692964, "uuid": "53141b2f-4a89-4efc-839f-ebfac216a15a", "value": "5YEF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1262cf87-85d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784728560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728560, "uuid": "974600fa-b38c-4ab7-9866-d5ac559801bb", "comment": "Malware payload (Mirai)", "value": "76d5133bcc69a3070618fcbb3ccbc07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728560, "uuid": "106694f1-9432-40bc-b6bc-2ad2debb0eb3", "comment": "Malware payload (Mirai)", "value": "6144da4ce9f1817b03ea7ae137c589846286f4776f80eec4e9b6a9e67eb7f405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728560, "uuid": "ef498da3-73bb-4a53-aee8-884507953ed4", "comment": "Malware payload (Mirai)", "value": "21ef7b5b8ea151f3571632438dd2a53e097058b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728560, "uuid": "c1054972-cf57-4e56-bb6a-7086dbaa6433", "comment": "Malware payload (Mirai)", "value": "0c233ff7a13d12faa198389fa2c1ef9a1818d0679b570ce53e6dc98f1ae29d22550600c0934516514448a8798c576a2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728560, "uuid": "ea054dc2-ec07-4237-95c6-6b5017c23f82", "value": "T156245C46EA814E23C4D7177AB6AF114A333297E4D3DB730689286FB43B8679F0D63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728560, "uuid": "7e1725ea-13a7-41cb-a0d1-437402597885", "value": "6144:eUapcUfSOk+akkDDdYn4txaCGtLHPeLavM/98s:eUayUqOk+akkDDdYn4DaHBNk/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728560, "uuid": "36627310-d358-4c6b-96bf-362c2a517198", "value": 210518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728560, "uuid": "4f732579-dbfd-4aee-9b42-03bea195815c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728560, "uuid": "09b45b63-0753-4392-b340-58f9fb8f6972", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9accf65-85dc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784731928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731928, "uuid": "2af73faa-0707-415f-9367-4ae1634c38a4", "comment": "Malware payload", "value": "dead6592527e9a4648e4ba40856532f3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731928, "uuid": "e70f65b0-4a81-459c-927b-cf8b8e337efe", "comment": "Malware payload", "value": "6146a3981fca566f55e50a40999822d9f2b44a7161d5106a4570d323d575387f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731928, "uuid": "f582f564-bf7b-4445-9d41-d6e8bcfa09a6", "comment": "Malware payload", "value": "1bf109633f53822c5fc3c0bc2badb7d46369ca84", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731928, "uuid": "0c0bace0-e51f-493d-af8c-0215fd821969", "comment": "Malware payload", "value": "5cf89106e16318979959290ea219e157f488d387c5db20fc2044bbb29e356ff97031e657ed708b2538c085b6089fa94a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731928, "uuid": "2c7064a9-efd4-410b-bc6e-329de7f5c925", "value": "T1EEE6332C56D051FFEAB34179AED16914D169F07A0332CAEB03AC87527E672D48E3DA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731928, "uuid": "0d6438da-5709-43ba-af95-885c654b33f9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731928, "uuid": "9a7df491-b0d7-4721-8c99-7e276be16b68", "value": "393216:Am8OTAz/Zkr/0YKxrjokE9XMCHWUjX1cuI3/PGTAI:AmVzKxn89XMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784731928, "uuid": "1e94d29b-46ac-43cb-9eca-9a3d6e8433c6", "value": 14314192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784731928, "uuid": "46bdb5bc-c949-457f-9f09-688d2e5bbb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731928, "uuid": "48bc30db-7ec1-47bb-bad0-66c835aa7c0b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5332552d-857f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1784691732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691732, "uuid": "78cc4b31-4bff-46bc-9b08-13fbef2852ce", "comment": "Malware payload (ScarfaceStealer)", "value": "da0389526f86ac97819f464e3f1e8955", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691732, "uuid": "87af99de-e819-40a2-9527-44cfcd6a1b51", "comment": "Malware payload (ScarfaceStealer)", "value": "6209b9f4af44f71e7b319c5b406603a6f15da3c7d8ca6bd06d434af65269990e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691732, "uuid": "1f953222-12cf-4858-b0ef-e6d7974c4f11", "comment": "Malware payload (ScarfaceStealer)", "value": "c5f87d73051dcaddc335c2afee83178da9c5dc13", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691732, "uuid": "7af96ea9-51c9-4ceb-bc95-4a3874af7a71", "comment": "Malware payload (ScarfaceStealer)", "value": "15ac817d219adfd3b4de5b484d45a4b52c7b8988b749a1a00166919110c6512a08b9cf591857a1e03e1b531b11be54f6", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691732, "uuid": "539e2e14-21d5-49d3-a7d5-0766ac4250fe", "value": "T19D187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691732, "uuid": "f2cd1c3c-e5c7-404a-82da-265af9504d19", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691732, "uuid": "6974a3b2-ee26-49b0-8190-f9c1d4859a9c", "value": "786432:eAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:eAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784691732, "uuid": "fb977853-c571-4c78-85f6-2016dd5f9993", "value": 90263552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784691732, "uuid": "490c22e2-918e-4075-beae-77a17f4d0a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691732, "uuid": "7d8d4a03-d566-4c4d-bf8c-da0b73685a26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76b43bf-85fa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784744729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744729, "uuid": "18ba909d-7894-4a68-a560-c08ff34c9359", "comment": "Malware payload", "value": "2df611638e105a8ebf112cf21f56cef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744729, "uuid": "5c35632f-72e8-4b6a-bf45-3c74ce3c6ee7", "comment": "Malware payload", "value": "6273e1055d54ea87e18a8be72b180047f23fb6baf8a1b892f4cc8b8306a0647f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744729, "uuid": "7c24ff6d-95c9-48c0-8722-63db5034e648", "comment": "Malware payload", "value": "914fbc1d0a774e3ec1b72b95d5d5afbf75c474e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744729, "uuid": "3a3c829f-f4b4-4ef5-97a4-a2e579e34774", "comment": "Malware payload", "value": "3a57871e6c71ae1107d35ef966b011487b3387a212e78f06e0562825f5efce7ab7467e8153645c3a2355c4ae87bc3d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744729, "uuid": "cc253e60-c6a5-47dc-bcc6-15292b0fa541", "value": "T175C3F845FC509B16C6C655BBFF4E828C77261758E3EE72039E256F24378B86A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744729, "uuid": "aaa98199-1ea9-4923-85f6-341c6e6a2b8e", "value": "1536:J612VVQcokJXP2t2pPnU4VfSCTbfIrFSIauOyjLpxJTxgGluSwywcZCTbJwsNSrE:J612qE/2tD4kCArFF9/J9Gb6+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744729, "uuid": "66304050-1b96-41d1-a425-186e54553203", "value": 121196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744729, "uuid": "b2985831-154d-4c34-90b1-acd9be6fe8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744729, "uuid": "e7804ef2-2451-47a3-be86-4a878648f4ec", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba8ea94-85da-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784731072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731072, "uuid": "b5caf024-abc8-4e9a-bdfa-869080f423a7", "comment": "Malware payload (RemusStealer)", "value": "a38781ae371ab82a4a749e14ba04be3f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731072, "uuid": "89e7562a-281a-4f68-bf30-96e507a988fb", "comment": "Malware payload (RemusStealer)", "value": "62ed1c21a6a22ea2a35625659d6a208c8028c009b876e08e8915283b9c578ff3", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731072, "uuid": "ac98fb58-ee85-4b61-b7d0-c6bad43cb55f", "comment": "Malware payload (RemusStealer)", "value": "917fcca0400a24a13bd27ce1e84f597bba0867a4", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784731072, "uuid": "c5c8ae70-a0df-4f0f-ac3d-a2dd95870f6f", "comment": "Malware payload (RemusStealer)", "value": "35027af30929d232a0afbfc454085a369d030056e7d70a18d1edabf906e233c80b012ebb894d1863e0f817c3efd0d6e2", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731072, "uuid": "74c84fe1-9c8e-45b2-af45-7bca969fe03a", "value": "T182C559177C9189F9C09AA331C9B75286B771BC480B3133D72EA07A782E767D09D3AB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731072, "uuid": "7550244d-f212-44fb-91a8-f0ef562b9b4f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731072, "uuid": "543f0973-5541-442e-9954-01bc3bf4421c", "value": "49152:jxpppu49r9SYwGlaBUpfmUIc4GET9+5rO:jxLxwBEYOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784731072, "uuid": "f8086ee4-ecfe-4585-9a83-54ab715b17f1", "value": 2628440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784731072, "uuid": "8246b311-161a-47f8-ae7a-603a8dbe5088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784731072, "uuid": "8c7d3efb-b377-4c0e-a83c-a6b52340a987", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fecc9d-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1784715176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715176, "uuid": "151ade02-b3df-4115-a72c-cf7c8f0313f4", "comment": "Malware payload (SiriusRAT)", "value": "a0599275fcad15252de46f1bffc32a0c", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715176, "uuid": "c1511f22-b8c4-41ac-b2dc-af6a4811f400", "comment": "Malware payload (SiriusRAT)", "value": "62faa8c54f0d300196dc5d4e8e4e5c7bc248c2ec6d5aa667aa76ebd53cfd51da", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715176, "uuid": "c823895c-1c2c-4dca-a7c3-c5454f3bc168", "comment": "Malware payload (SiriusRAT)", "value": "8a345c1839a5e474b0097eb4ffde3267bc98e893", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715176, "uuid": "d56da312-c338-4967-8e6f-2ec27e9042b2", "comment": "Malware payload (SiriusRAT)", "value": "5ce1e7f53d8ef97583eb856d8b788e086524a8ac1911e4eecd2933eaf40a84631f121a6c807d2151f159be83a5804086", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715176, "uuid": "18e4c8b5-7198-425e-a168-97e40ebb2bdc", "value": "T164341278D424FE24C229437A20F2EB874765DEDA6F53D5CD76BE80C19F0D6E1A3A0506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715176, "uuid": "1aec7c63-c4e0-43bb-9ef1-a3a80635cdca", "value": "3072:zC3OAnnPpzwKUTJFU5Omb7ADiseGU2Jk0L0t0SJZw7Dm88dfgyiGk3snT12D:zWPngJ+sQb2Gq0t0aw/+XesnB2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784715176, "uuid": "e1d6a2d0-202b-4186-87d0-c90f64b53ed4", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784715176, "uuid": "1b7355fe-bc2a-4279-80b8-58267af842e9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715176, "uuid": "b897ebf7-a0ea-4946-a6c4-2b5ade517414", "value": "New Payment_2026_07_20_174434.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711899ee-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763079, "uuid": "ba60dadc-855d-4073-95c6-6b19b54c88d9", "comment": "Malware payload", "value": "c22b2bb85a8e54abfac289f336c24444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763079, "uuid": "c2f0864a-c466-4834-819a-1dabc465ca9e", "comment": "Malware payload", "value": "63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763079, "uuid": "43b33900-8acc-4774-8336-2754446ba64f", "comment": "Malware payload", "value": "e47f86d4c08c0674d5315ffdde3e0defc8a4d801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763079, "uuid": "72d68461-e6cf-4fcc-932e-d0badb6f1979", "comment": "Malware payload", "value": "d3d91e4755f3bf03a9cf4971dba165f20350b2bba5a6ab3acbcdfa3952ba44188dd62bda43ba90032ab68e01edfd7c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763079, "uuid": "f4b7c85a-ea5f-4fb1-ba45-a474dea99c3b", "value": "T110953341E03EF59A5411CC9FB74E8E9E1A34306F162EC1460E43EF1E841ADBDEEA9B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763079, "uuid": "8dec82ef-5075-45f3-a475-6960591026ac", "value": "49152:1jTI4Rq1eufIidTa+vTISMkJDiJjUE3zE7YhUfQyRq:hoIgTaYTxz+qQyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763079, "uuid": "0868e9f1-7f3c-4bdf-b1ec-ed7d3927780e", "value": 1986520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763079, "uuid": "c7447ca2-e0c8-497c-9cb0-e0402dd63fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763079, "uuid": "6c5ae538-3556-44c2-bc85-9ce2dbf3aac2", "value": "63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654e0aa2-85ac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784711090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711090, "uuid": "5abc33f6-7291-4322-961d-c563811f1b5a", "comment": "Malware payload", "value": "bb74f9ddd1a5ebe4088933b5a25d2db7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711090, "uuid": "29e9a124-731a-48dd-9b35-bcbecb6e7dac", "comment": "Malware payload", "value": "647e4eb80115dc920cfcdc3f23a5b140af503a69909b059a2508dc97ef47a2d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711090, "uuid": "bf68b693-e54c-40f1-87e5-6e44a44bd4e2", "comment": "Malware payload", "value": "c103d88f9cbe643cd2e6b7eb105cbe09ccc673b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711090, "uuid": "f7ca26b5-33f5-42b3-b179-33c985575d5f", "comment": "Malware payload", "value": "33d4d335d500dcd429e95f6f4211c12acc3930078380c0d78e8e70d62dde38f4de73aa6014ddbc303dab9fde9014a904", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711090, "uuid": "d0489214-742e-4986-8c40-b25cde16bf41", "value": "T1B4237489BAC2B8644352F57B3C6FB0B7F16D4C82B288C018F266FC59FD64B04C679665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711090, "uuid": "1b197cc5-93f0-4fe7-93a1-882c94e96287", "value": "768:CzLy0lRa8vK+7uOkQs7LqrRD8aD1Z9GaGuJlPzcTVQg9CSY6Uerx9qVhERgVgDi8:CzLy0lRa8vK+qOkjCD8WnPYcbsrSVhEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711090, "uuid": "966fc754-1afb-4a7f-b05e-30cd11fe8b7a", "value": 47467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711090, "uuid": "6147d9a9-f004-44aa-82f6-0e4c369761c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711090, "uuid": "e9a6ba01-3c5e-46f9-b372-b4cede2d4154", "value": "Solicitud de cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6e25ee-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784753297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753297, "uuid": "7c21a0ea-ea33-474a-99af-9c7ce8d321aa", "comment": "Malware payload", "value": "65a55f63ed361ab9fef9f2ee7b19ce43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753297, "uuid": "cd1cd15b-1aa5-46c1-870d-d3b8dc154944", "comment": "Malware payload", "value": "6491a2ccac96e64a37a5d18e62575b44ba7704159fbe21d06f83b712ba747c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753297, "uuid": "cc1a95e2-b9f3-4427-b125-df67c6afa46d", "comment": "Malware payload", "value": "51ec4e631b255a000af8ccb11632267f5e4cb506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753297, "uuid": "c740b68d-d73c-4df9-8925-accb638874c4", "comment": "Malware payload", "value": "7187f8b8cf0ea6dd9c346e6bb8240b5860d961987f0073c6855df4fb6b016f755e5b41bdeb8953408ef3d8a4095e9e13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753297, "uuid": "f0eff3b5-df4e-47de-9e2b-2475e102a746", "value": "T1A8E30849F8519F22C6C215BBFF4E828C772617A8D3EE72039D156F25379B85A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753297, "uuid": "210ed191-0c5e-4cee-bb8c-4e54179e3cb9", "value": "3072:sDIwcT87xTb+WeUN2X54S0dYkHwerxJsddSnugE:sDNCATbFq54Sg1wE7sd1gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753297, "uuid": "e717971e-208a-4d00-b03b-8cdd8009b996", "value": 143884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753297, "uuid": "ffcf12f2-96e6-420f-9a01-4b683411cbcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753297, "uuid": "e078f9ce-a4fa-4e4c-b869-5b0088366824", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4536f2-85e0-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784733330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784733330, "uuid": "6f4574f8-b902-4747-bd77-38b1eedc1939", "comment": "Malware payload (WannaCry)", "value": "68258131b3a1b41aa2e21674a602c3ec", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784733330, "uuid": "4fcf3534-4894-4d7e-a3ff-911d470be6d8", "comment": "Malware payload (WannaCry)", "value": "656f08c0cf09e32acc0729536a32da8ad61079d29fee18bcb3a1792e3ee5e5c6", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784733330, "uuid": "1e220ab9-fd7c-4639-b1d5-7c133e1ca7de", "comment": "Malware payload (WannaCry)", "value": "066901444b77479fdec1441cd5bb1d69bb758dfd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784733330, "uuid": "8cd032d4-20dc-4b96-a5c1-cab0d9e9ebec", "comment": "Malware payload (WannaCry)", "value": "df7ac32a3d5a19e43b193f1e5308f01b438b28057f0f2bb96bbd6e304d60d354ac52dcd9c15015957dabd6d1c7c4f1a4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784733330, "uuid": "8d773975-bbaf-43d5-b0db-d0f349a484ef", "value": "T12136239932B881FCD106197484B78E12F3B37C6A12FE5B0F9B40457A1E53B96FB60B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784733330, "uuid": "07de12eb-7d0d-4f01-90b7-77664633fc1b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784733330, "uuid": "aad57e48-d6b8-45cf-8bbb-b2832701ffcb", "value": "49152:jnsnHqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMHqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784733330, "uuid": "5586ac18-f7c5-4de7-a4d8-a38ce69f98a5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784733330, "uuid": "20938aa4-f573-4993-898c-dccfa7206f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784733330, "uuid": "81494e51-b259-47f1-b7d3-aa7af2408993", "value": "656f08c0cf09e32acc0729536a32da8ad61079d29fee18bcb3a1792e3ee5e5c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9066277a-8578-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784688829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688829, "uuid": "0555d61e-0b0c-43cb-8802-d4739582a333", "comment": "Malware payload", "value": "6ad752d93e622d8f4a8daff660a5f54e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688829, "uuid": "8b8f9433-4a4b-4327-a171-44261d76f232", "comment": "Malware payload", "value": "671b70f36717d438960f7d923f5d0a78621aebbb97a403de4496c7633a07a697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688829, "uuid": "f1097448-77da-405c-b14a-bbc617f1dbd4", "comment": "Malware payload", "value": "eaa9e766ef79dba1a17df2d891dd9f13f189ce4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688829, "uuid": "495a7d4b-e19f-4d55-883c-2dec0d716793", "comment": "Malware payload", "value": "75cdf070a5f35fb45094614f7af18c8992f31084bc33364251796a048df33f8ada1bf378e0c7e818565993b47dcae82d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688829, "uuid": "b1de5eef-7c8a-419b-8334-cfddcacf1868", "value": "T1F383082ABD419F05D5D526BAFF1E538933536BBCE3EE7102EE141B2527CA91B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688829, "uuid": "40833df6-9fbe-47f0-914d-d8ec634fc57a", "value": "1536:BbnTFiGHuYu5ks5PynmUXeQhDIzLOP3DNHpUDRRuW5llikiYV0bvOE2:tFimekiwjdwOP3DNHpUDRzsiV0Cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784688829, "uuid": "69448425-54fb-438d-bb7c-651bd2327528", "value": 82528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784688829, "uuid": "0e205c57-4ca9-4802-96a3-e2b20e13b3d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688829, "uuid": "54e429ba-f228-4f04-9e41-d751fd3b28da", "value": "MoO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efe7df2-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784701711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701711, "uuid": "91a7384f-a6aa-4a4c-8999-76ebb113d0e5", "comment": "Malware payload (AgentTesla)", "value": "d306e336a29e98838e192274d806675c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701711, "uuid": "c06874a9-b739-46d9-8dbf-1f7116bd3691", "comment": "Malware payload (AgentTesla)", "value": "6727a54d383dd4e1de52c48cb29b16c0b054e6cf21aad99c7586a8b58ed53ba5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701711, "uuid": "62205eca-fb0c-44c6-bef8-69396cab38bd", "comment": "Malware payload (AgentTesla)", "value": "64db483dc913e3c3f46b9970d783d7a0e78294b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701711, "uuid": "fcb06a3a-81bd-44ec-8269-bac210330f95", "comment": "Malware payload (AgentTesla)", "value": "9e8f4afe9cbbedad7c1440994bc7aeec9780b037cd7a2738a412d428742fed0f6d451bbcfe5deb633decc17c55384495", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701711, "uuid": "f67106c6-4c1e-410a-a2d9-4dbe3e2175ac", "value": "T17DF50870832477B4666D872CD136AF284A1E600F26F8FF0C366D52687654F4BAB8D1E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701711, "uuid": "d9042736-5ecc-47c6-9a37-f08062676f58", "value": "98304:IG0kplPI5SaohxmY2tT6s8OPHknoHQ/k9vlQvDyj8ubT+ueEX/esjdRqix6m+o:f0kLGohxmYgF8OPEgj9vlOwesjnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701711, "uuid": "a882565c-729e-4427-899e-47325ca378a7", "value": 3362575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701711, "uuid": "5e519dff-7262-42cd-9dff-d14a9f44d317", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701711, "uuid": "7232b8b0-4511-44a2-9952-3b1b29e8479b", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c244f1-85a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784709774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709774, "uuid": "4ad6b882-b6b7-4855-a99d-688323f76dd1", "comment": "Malware payload", "value": "9a2ab99004876abd33ee019280487079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709774, "uuid": "8b8eb646-c626-4c1d-a52b-3312ab7f2561", "comment": "Malware payload", "value": "686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709774, "uuid": "dbf1635e-c216-4bfb-a5a6-19c5ad39325f", "comment": "Malware payload", "value": "143954c1c063d8c33dbd8d4e6805f61bb04d9fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709774, "uuid": "13d76da7-d737-43e7-b195-44c96f5ac093", "comment": "Malware payload", "value": "bc96dbf1fd9e92a31342e94a63feb1c1daf7ca1442fa0068ab5923c073193a9f48f0d3e3359db30b913491241c4e3a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709774, "uuid": "9b8bd2ef-0851-434c-902c-d1eb9e461ca6", "value": "T117D5238638F12AB4C47BC7B29F43E92EB06A77454AB48E1BBACC69014E531487D37375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709774, "uuid": "a45b5a3e-6c6e-4a03-a6a0-38c86fdcd111", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709774, "uuid": "eab8ec1c-9da7-4c3c-b1a0-2003f0099e6b", "value": "49152:DznVb6S7gHmckYaZdmU6QyXbwtiByYljbaz4Vnt90Yi5yHP6X3CqlhzNkwQgUNRW:HnV2S7gGckfqhPbwtkywazqVHU/lhRkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709774, "uuid": "5b19ac84-17aa-4460-b5b1-9cc7f0207dfa", "value": 2928640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709774, "uuid": "6ea709ba-e3a1-4e99-8af0-6bb33b9bcbd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709774, "uuid": "4c542857-b0c9-4095-8651-5520a4a9261e", "value": "SecuriteInfo.com.Win64.Evo-gen.56248671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136abb1b-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1784722979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722979, "uuid": "7f418469-29b4-4f8d-94fb-83365b18b719", "comment": "Malware payload (ScarfaceStealer)", "value": "c8881b359613b38e8f99cb389b05360b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722979, "uuid": "68595bdd-1a41-4a02-a8b3-fadb08109e18", "comment": "Malware payload (ScarfaceStealer)", "value": "695585351ff095b744dd04f3fbbbbdbfb40e381730faa2751a8fbc15da26a299", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722979, "uuid": "b80a73f4-8eb6-49f6-a938-a5a78f36dadc", "comment": "Malware payload (ScarfaceStealer)", "value": "1ae5d832d087375dca944865c602924c25a3fa12", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722979, "uuid": "5f50129e-126b-4644-8cee-d87c046e25f8", "comment": "Malware payload (ScarfaceStealer)", "value": "c3ffb252999b5d5c00463a48309f4c0b25cbc4ddc98cd33876b08ebf63b73b5652fe18a7d851eb08432434ecb3f265ba", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722979, "uuid": "f22e20fc-bf77-4a30-82c8-eccf4e358fab", "value": "T116187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722979, "uuid": "153dd3ec-41b8-436f-983b-0c49e62c0a18", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722979, "uuid": "7b34d956-a426-47fd-84b8-99927dbac944", "value": "786432:rAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:rAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784722979, "uuid": "018fdc1c-1e68-44d7-8ae5-c85eb0137fb5", "value": 90285056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784722979, "uuid": "788a7605-40d3-4981-957f-3203049e6a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722979, "uuid": "487d88bd-afbb-4854-a3ff-4c58485011b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44821b98-85c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784722631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722631, "uuid": "52176444-68ee-46c1-b6b0-15b8541a1152", "comment": "Malware payload", "value": "25c90fb79e681d4590f56bd221bdcc40", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722631, "uuid": "3d824e6b-863f-48dc-8911-9db001373608", "comment": "Malware payload", "value": "696960df0d4396eccf76ddb8ed46560636ba69ba4817d4f43bcb6171a3d3cfe9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722631, "uuid": "1e4702c0-b66b-4871-a905-c836e3ea3a34", "comment": "Malware payload", "value": "d1e6297c9eb4393ccef71e9672d01630a7fa40b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722631, "uuid": "3cc5b255-18d0-4d1e-9193-204b43b42acc", "comment": "Malware payload", "value": "d7537b72acb1090089f0af86b4d985a83ecbc6e99179fed598c8482d2ae620dd8316b6db885441068c2afba9cd0fb21a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722631, "uuid": "010db310-54c3-4f20-b775-6d8ebd78dd40", "value": "T17A01CECAD52499004099D41D36E75064F471C3CB1A8A8F6AFFACE83EDB8CD14B0ABF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722631, "uuid": "a00e5855-3fa5-4c4b-9ee0-581426398309", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkac1Cc1uXFKWWCEG/jFyCVZQ+rPC6aQNACS:kXCKysE2hi0ziQvZohaspR9cZX/aNFPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784722631, "uuid": "dc2e8aa7-3a94-44a4-8eee-18c9358cc45d", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784722631, "uuid": "e30ca291-88db-4902-a194-4a25fd9f1a60", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722631, "uuid": "31ce4a42-fd1e-404c-8bbf-9893a3a209a1", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6cbae1-85d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784726515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726515, "uuid": "61a85307-cca8-46bb-953c-d7785a236bde", "comment": "Malware payload (Mirai)", "value": "d58f72ef819dfd5334972b23769b15bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726515, "uuid": "944c20ee-484b-4697-b340-eb8a91d88e37", "comment": "Malware payload (Mirai)", "value": "6a340b3eabd2c804d54b230f34f9a217eed75532844ae3d6935c0f7697e59acd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726515, "uuid": "4c9e8e1a-8ad6-4300-817e-8a092d4fdaa2", "comment": "Malware payload (Mirai)", "value": "1f9ba86697cfcd2fc880d29c58fb6e796feee5c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726515, "uuid": "683847b9-9565-488a-bd72-1b1f0d2a97c9", "comment": "Malware payload (Mirai)", "value": "f1b02543275b1bfe3eac82ba309557cde79f2da4b0b1ad0fbfe2905eae8325783beaf0c0bb433eb09ac1a2445de4ed37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726515, "uuid": "9d09056f-d23b-46f0-9415-2d1ce84bce19", "value": "T1FEC34B0273180B47C5A319B02E3E3BE687FFE5E021E4BB89251E8B564575EB75849FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726515, "uuid": "c08938e4-7b86-417a-9fab-3891440bc047", "value": "1536:KqL5Jj5lED60/rhmvQ+f2evxDNScNGPuFZ+1mWdHKyELsHkI:KqL5JjQ2w5qbDPfFUmLGHkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726515, "uuid": "b832ad0e-58fa-40bd-b9b8-aa39de867680", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726515, "uuid": "07ace0b9-c858-4874-9fc5-a8ceda681967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726515, "uuid": "7b4f88a9-7544-44ed-aaf9-b6d05a83fc7f", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcb8b13-85f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784744390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744390, "uuid": "7e5ade8d-eefd-49a1-ab96-275ee684d7bf", "comment": "Malware payload (Prometei)", "value": "57736774f39c848d7426b8f1ad15fdb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744390, "uuid": "35d46e19-0bfd-426e-b5de-a510431b8ba4", "comment": "Malware payload (Prometei)", "value": "6abcf1b097feb8aa7366560e4cd7e63b27560b4cd35407b04055a1a12582cd51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744390, "uuid": "043fbd89-00c9-49de-b52a-494ac877fe0c", "comment": "Malware payload (Prometei)", "value": "d8b06076b0cfbede65ebaa69fd579e645fd9d0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744390, "uuid": "a2faec97-9a5a-4c7e-803e-33f19518ca86", "comment": "Malware payload (Prometei)", "value": "aa9e7efdafa783667dbe888f44eb83e9455992df905c3afafe8a97ee62bb5903789b16407b6e3bc60bc8734ed73c2634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744390, "uuid": "d790c9d0-f8dd-4a3c-a294-f3d1395ef247", "value": "T1A134BE63A4BCAA9FDDD82F379C4E880713B66FE5D890203E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744390, "uuid": "4ad82159-35e8-49db-8c88-2864d8f5fecd", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744390, "uuid": "1f3996f0-5a68-4ece-b963-b7515140840f", "value": "6144:5GxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOk:5G60BpL8jk1FGjDc8GVdOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744390, "uuid": "1e531d28-904d-403f-86d4-eb32d6a1e428", "value": 245991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744390, "uuid": "c4133930-6180-44c6-899d-6e4c6031595b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744390, "uuid": "199c5d55-1078-47df-b774-4bc34b7b21ee", "value": "6abcf1b097feb8aa7366560e4cd7e63b27560b4cd35407b04055a1a12582cd51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9d8e40-85a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784706294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706294, "uuid": "bcd676f0-3726-449f-b82d-124d2b52000a", "comment": "Malware payload", "value": "8191f150344aa6d9e9f0317750e02421", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706294, "uuid": "0bc3d1a5-6bdb-4cdf-9955-7d1a1775d6ff", "comment": "Malware payload", "value": "6ac1f0f96166b4cd7380df42b5d2f2c91b6a0dc295c0e0511e0c93d2935280e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706294, "uuid": "33290606-b119-45e6-b652-fbfcdde17e9c", "comment": "Malware payload", "value": "ee1fb18fd74f6f1550f4accafaf380a9c8a530bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706294, "uuid": "9c2fa5ab-5be3-4cce-9092-3b004bc1a9e9", "comment": "Malware payload", "value": "3406af95c234d7cddc533a5236411458207ff0c5d34dc0106f72012b15c0145a0a9f642b91ac3a99c4738d8c891d5fdc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706294, "uuid": "e88d97e7-f0be-4778-be54-13a0b101075f", "value": "T171E60DAE18A0720AD2756FBD612E651332775421E47ACAC71C4BC895BEBCBC0D0B3D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706294, "uuid": "cca0d594-af07-48aa-9360-6c5407f6b297", "value": "1536:nUU9c/4azRGPqTIO+6Eb/QT17TLG6EHRUx8O4ft+Wov2uaucoAHxvGvGpZNqZLgU:nUWQoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706294, "uuid": "94ca4f1f-b732-40e9-8700-a6bdeaf27b18", "value": 15104184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706294, "uuid": "48fc1929-4129-4cf0-99ac-1c63c2f30cb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706294, "uuid": "5e67846d-473e-47fd-a629-727f30ef9200", "value": "fedex4577674883.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef00dbe7-85f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784744392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744392, "uuid": "79c72fb7-4373-44b8-8d4a-6e528696fa60", "comment": "Malware payload (Prometei)", "value": "53fe8b730448607bc185628bb6052d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744392, "uuid": "d205bcb9-4a01-4819-9df4-9bec7b7a3121", "comment": "Malware payload (Prometei)", "value": "6bbf532ffeca016e4a4ea2e422369c0a9730e47805b7a3d043bcc2e857449742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744392, "uuid": "ddf175fa-5ff9-4fba-aae0-84557560b163", "comment": "Malware payload (Prometei)", "value": "82749a03b3bad971060093653b22067189b4ddfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744392, "uuid": "d9a69961-eccf-4cf9-8ce6-c37d427474fa", "comment": "Malware payload (Prometei)", "value": "7c0af85d0b38a2e53da6f0781e4cb3bcc32144c2c1beaf3fe13d2ac78970d9bb4da011d8ba7bfe9d6ee3e63dc247b749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744392, "uuid": "00e8f67b-9022-4f2c-bdab-99459aae39e4", "value": "T12BA423B4F9229E8F6DD769B91B24831DE181D172589D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744392, "uuid": "6db22217-5a8b-446c-aaa9-912845ce00ea", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsde:Fs6pyCC/Ya2hpi6T6N4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744392, "uuid": "3f0388a1-d318-4b8c-a2e2-f92a327d0a90", "value": 449079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744392, "uuid": "2a3fbee7-74b6-4849-bd46-6636f8a0b790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744392, "uuid": "f8e955ba-26e0-49c7-b126-49b8a1aab589", "value": "6bbf532ffeca016e4a4ea2e422369c0a9730e47805b7a3d043bcc2e857449742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86ed0a7-8560-11f1-bd95-42010a9c0009", "comment": "Malware payload (WallStealer)", "timestamp": 1784678668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678668, "uuid": "e25e7643-a68f-424b-97b8-b51345e10626", "comment": "Malware payload (WallStealer)", "value": "148c0d6f40d8c3bab6429761dd04fdd2", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678668, "uuid": "d8379784-5ab6-4f42-b6c9-1ab5af6b8418", "comment": "Malware payload (WallStealer)", "value": "6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678668, "uuid": "0eed5d38-85ee-4d98-aec0-ee0cdc86ee73", "comment": "Malware payload (WallStealer)", "value": "bf93fdd033e13cfcc64e7a165210ea239997dff3", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678668, "uuid": "04530728-4b7d-4b5d-8df2-41419887852b", "comment": "Malware payload (WallStealer)", "value": "2f0d1faf7bd1a3e9e04bb0e5d67406274702a6d208dd26c06157bf7288b466d61c363bac8e587aa76221be94037322bf", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678668, "uuid": "77624c96-57cc-40f4-a4bc-4ef477a7bb73", "value": "T10825F112B15546FCE0A7C0B4C2454AE2AA3178960F72BEFF079112262F7ABE15F3CB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678668, "uuid": "34d15556-e510-4d1a-824f-cb6f49dd359e", "value": "a4f5d0326b7d22eae00281de1ea0104e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678668, "uuid": "2addaf3a-6f9e-4721-9c15-e4e199e4051c", "value": "24576:8PvkwoKUW+JireQ5diwzkbY6c8zHj+VLW:2vkQKwOcBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784678668, "uuid": "6e58a8a6-80d5-4eaa-bc1d-150a8a251699", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784678668, "uuid": "8486bc9e-004f-4998-90c8-9d55018649e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678668, "uuid": "70236925-8608-4f2f-a8c0-37fd30c226a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89136460-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784711580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711580, "uuid": "e8569003-58a9-4d75-9e9a-52402e4b7eb7", "comment": "Malware payload (Mirai)", "value": "e329f0aeb466cd058090e152b12fb100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711580, "uuid": "f2c4425a-3810-46c9-b82d-b3a167d2f7fb", "comment": "Malware payload (Mirai)", "value": "6d2b2f72bc45c6276818298de8b5f24140947c808a89c72fcf63d5e48281ada9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711580, "uuid": "ffe78b16-c506-4d11-bb0c-364afe3fb924", "comment": "Malware payload (Mirai)", "value": "ae448d351c6a99b9e80321b91b2e4b49fea61faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711580, "uuid": "89136a86-1495-4972-b722-45645635d044", "comment": "Malware payload (Mirai)", "value": "d081a2d98a993a41a3302c38c0e52e9f978ee0db0b001e326ca14464b0c87a91e015084dce684a114780fe0a52ad7792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711580, "uuid": "8d2cd7f1-de40-41cc-b723-3db69053604e", "value": "T1DAC2D02E330244D9FD5986701A7817886A7205727E43DC12679BFAC3ED874F9B9068D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711580, "uuid": "450a8118-5dce-41e8-a445-4b4df8997ebf", "value": "768:aMLqzcIV/LLwl9eaVT5R4iXNjm4zE1JgGlzDpbuR1Jmrd:O3VXmeaVdiiXNOVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711580, "uuid": "2afe3793-12d2-4852-ac85-06ac0a952d4a", "value": 26236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711580, "uuid": "0954afee-9108-4988-9f5b-21491a09916a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711580, "uuid": "23cc9ad9-9c11-45ab-b3a6-dd43129cfdee", "value": "6d2b2f72bc45c6276818298de8b5f24140947c808a89c72fcf63d5e48281ada9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164b37bd-8561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784678745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678745, "uuid": "a08bdfa9-5739-41f3-824d-7234e3ed0bc0", "comment": "Malware payload (AgentTesla)", "value": "9d59e6476c4022f7dbb738d7207cad30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678745, "uuid": "2025225d-15c1-4837-98a9-f64ca766c1b6", "comment": "Malware payload (AgentTesla)", "value": "6dc941968b3bc93e3f5709972f0ce23395eb65465fa23ddd68b8cb6ca52ddd0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678745, "uuid": "68623261-d594-4ae3-b2de-00bcdc4d7638", "comment": "Malware payload (AgentTesla)", "value": "38a59765e43a7ea47ee773f001742c75670a8579", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678745, "uuid": "318b5ad1-b2f0-4fc4-b1c3-be84b403d1dd", "comment": "Malware payload (AgentTesla)", "value": "837a20f341a7f191c8b87deaaf0c249d626c27cd30056d674b8dd60fa296c07db19710b349fff432ec335a50ab585346", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678745, "uuid": "862ddf0c-8f88-4659-83a0-cda690005e6d", "value": "T1032501541316CA82E0D68BFAB971D73536744DCFB9D2C3924FEA6FEBB8193C02454292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678745, "uuid": "e96b7984-838b-4457-a9c8-898fa6429cce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678745, "uuid": "e29f75aa-75b6-4611-8b18-6317918ab28e", "value": "24576:Gp50ktAhObgc1/+5B8rUdY0i+uZzMHfx33BtD3iU5:GpLWhO0q/nUdY0De0ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784678745, "uuid": "6030dc63-7b6e-4583-9ee7-00352092e7d4", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784678745, "uuid": "d9b15f34-3be2-4e90-81d0-8d0c043c7307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678745, "uuid": "1d6d4342-bbc9-49e9-b8ae-a286319006fb", "value": "PO101-07212006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c65bfd8-8595-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784701277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701277, "uuid": "f7283788-d9ea-4e80-98d6-c3a7d350bc54", "comment": "Malware payload", "value": "6d91f5b046bd0ab4b301fdd570f9cb60", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701277, "uuid": "02a34c48-1cb2-47a2-b421-a81c9ec807c6", "comment": "Malware payload", "value": "6dcf68b04c925f0992b7f69f49caee10204bc53578f676d9d95712698e13a8ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701277, "uuid": "0ef53954-f8b4-416c-b3ae-4929f1e68f58", "comment": "Malware payload", "value": "44d3abae5605ad337f9f8edbe2348e134a910b8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701277, "uuid": "6cf8b6dd-1712-4e85-b138-9a80dc6949cb", "comment": "Malware payload", "value": "1287a033be6b5d0582e08e1d9fa11537d63fe17540ba27d4dea1c71c0d2e82b7a1736cbe09fb202ced86db753ebad839", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701277, "uuid": "986b0039-64e7-4986-bd3b-e09f83a16697", "value": "T14165854F7ADC34E4416ABA7125676A4513AAF7D14558C0F7CEFB4A4E2C4B328B34832E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701277, "uuid": "2fe983e5-69d5-4ccc-b7fb-79cc30fb74c8", "value": "12288:NxbndFa6f5Ubepe75SSK+5MAsE3mYvq7HJldc4g54UQu1luodsYB9G3c4:K6f5B84D+xWYvgl6NSUQu144NB914", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701277, "uuid": "2cbe48e2-6001-43d5-8c28-d3d8ce9fcaee", "value": 1540122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701277, "uuid": "ebd5800a-6f08-4a08-b8c1-ccbef4a3a919", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701277, "uuid": "a2830b51-a3f3-4d1b-a374-6250378ed12c", "value": "output_muue9wh0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a998cd-8562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784679172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679172, "uuid": "e1a53490-01f1-4f8f-bbd9-8416d3df4ba6", "comment": "Malware payload (Mirai)", "value": "99b22d0b1ec5773dcd5995d88450efa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679172, "uuid": "a1526a11-e2f3-4004-8dcb-c5fd6df4687f", "comment": "Malware payload (Mirai)", "value": "6eff7333743c1285e911154a0eb3725c53fd53d954e21419af03ae47e8d4bf43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679172, "uuid": "fb46fb18-3327-429e-b56d-5347b29284ba", "comment": "Malware payload (Mirai)", "value": "93f654e400e7bcdde1635e469a6668ec5b8cefbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679172, "uuid": "33414e26-1dfe-4719-b5ae-6bf90c475b6a", "comment": "Malware payload (Mirai)", "value": "b816e6877c02049a481b10de84ed2cc4821e92f84ac2117a832be6613ecaf91eedd1a523f2f403835126566a430f409f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679172, "uuid": "8798b266-cb1c-4330-a8b3-03212ff95646", "value": "T152A3E90AAF611DBBD81BDD3705AD0B0238CCA617716437793638D52CBB8A54B8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679172, "uuid": "05ac6950-b460-459d-b72c-96a1f9f884cb", "value": "1536:nsloqsj+IlagXA6hZAYcdKou7N3Ub4OkIMfO6m0I/V5g22VTzZU23:aJ4+IlagXNh6YKE7NloVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679172, "uuid": "e798e204-0ec2-4ff2-8bee-81e28944d3b4", "value": 101380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679172, "uuid": "2f11c348-6e00-4af2-8818-c43aaaf5a511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679172, "uuid": "f44feb8d-5a27-418d-8aaa-ed55a8ee1e1d", "value": "MjsG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f6796b-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784705080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705080, "uuid": "b0d982c5-4be2-4d58-b831-c2548371bf9a", "comment": "Malware payload (Gafgyt)", "value": "84f95b814bc039e4aa046819be03a53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705080, "uuid": "be97717c-c088-4a9e-9f0c-60f6c2eb0ec3", "comment": "Malware payload (Gafgyt)", "value": "70014b980ef2018345dffb5784032055c0b330868249be2459fb055884a3aa3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705080, "uuid": "0ea17ace-4839-4f21-b4a4-c3b7315bdef7", "comment": "Malware payload (Gafgyt)", "value": "0b8cdfe350f2c2db98ca2e6211d0ceaa857087e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705080, "uuid": "172f58f5-a567-49f6-9955-86b9f9f375c8", "comment": "Malware payload (Gafgyt)", "value": "fb02d7754becfaa438fbdd68f5c22bc0d80e003e3248b4ad3a1c1f317c4ad30f5b0b28aa86e23a13fa9f9eb4fa8e4cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705080, "uuid": "aa9a2382-4851-4d55-8953-224fc5feb833", "value": "T1D0D31A85FD519B23CAD225BBFB4E428D772A1758D3EE3203D9255F20379A8670E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705080, "uuid": "5ff9b3fc-f03a-462e-accb-25a6bee2412e", "value": "1536:ZEibAjLCmlxDuF3QIDKd7qD28AlRNTADvopTtNpXO1AszOgwSAoSraSlrON6wywH:ZQjOmEWU28M5AEphbXOOxow49J4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705080, "uuid": "7c89af37-19c5-47d5-a19c-38fd659a9034", "value": 142192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705080, "uuid": "ccd02524-cd63-4b85-af1a-a84cb4e03390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705080, "uuid": "34e1eaa6-2112-43ec-9c70-e09169aad648", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6344f016-85d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729985, "uuid": "8ad13f92-6b13-46eb-a88b-a8be05a7fb35", "comment": "Malware payload (Mirai)", "value": "0e111067297b274325683230ce5ca916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729985, "uuid": "5a160c7c-8de3-4a30-8b38-ad0de557b54b", "comment": "Malware payload (Mirai)", "value": "70996d124cc491dbbb5d3ef62b061d607277fed3f312cce391ab3abf69d3deb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729985, "uuid": "9c685c76-ae8b-4ede-be4b-e413dce7c8a9", "comment": "Malware payload (Mirai)", "value": "2fc7651bf44022f5cdfc5b3263d88a47300c730e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729985, "uuid": "74662925-8fee-488a-a251-7fba2069bf07", "comment": "Malware payload (Mirai)", "value": "b37710510440a6e829c9ab30598fe2424d3fb5a662f8c64243d2d4b2e805d017c8ebf67cbc8529e905a4c20146e70f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729985, "uuid": "1880a1ec-fe84-4832-aaf4-0e21375a0854", "value": "T147B35BC5E247D0F9D81609302276FB375E76E1BB1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729985, "uuid": "c12ce436-32b3-426c-b00a-92a159c86d8d", "value": "3072:Lpe9zJgGmi+dkEF5nSMbUXMrDs3SUBNIHkCqB3:Lpe9zRx+dkE5nfg6wIHkCqB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729985, "uuid": "ed92cd43-479d-49d9-a297-d9b43efefdc2", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729985, "uuid": "c190582b-cc0c-40af-b490-70cd453e2d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729985, "uuid": "ad1c55cd-d248-4522-aa57-ecba6c1d0c51", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea06306-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707267, "uuid": "c5e4d1e0-56db-442a-a7a7-5d729aa4a135", "comment": "Malware payload", "value": "3e57aa151584f6570a6cf6c7bae92132", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707267, "uuid": "ba29e1a6-d9b7-45d9-b23b-d7242949190e", "comment": "Malware payload", "value": "719675e94befbcc620d8b36afa9523c3d6814b09328c2cae4f6e4657344a252d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707267, "uuid": "c2f1f72e-d5e6-4c5a-91de-eed48881f52d", "comment": "Malware payload", "value": "265cac8e3262ca0c51012074360b9ab49d2d9784", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707267, "uuid": "b7009889-b5af-400d-8f93-7cae3ddd9834", "comment": "Malware payload", "value": "b083cb4d20b26bdc55bfd121f394b5e17e16ce438847e9fe405dcc18fb809be924ff041e68f0f73201df626fbfef57cf", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707267, "uuid": "603d870b-c4fc-4cba-b3bb-105b372131d5", "value": "T1E2844A343DFA501A7173EE558BE878A6EA2FB7633B27585D1091034A4B23941EDC273E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707267, "uuid": "858ec48a-21d7-4604-aaf1-747d50df8c3e", "value": "12288:AJvW3TiDX7F70BRwijX1/az/CEXw3pHOE61s8o:J3wHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707267, "uuid": "abb7e4ea-eecd-4855-a7f8-23e40665ce3b", "value": 404760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707267, "uuid": "07128f86-5cdb-47b1-8f0a-c52a9847219c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707267, "uuid": "608f6a6a-a886-431e-b94f-e34cef60dd94", "value": "RFQ#1002190#.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e25237e-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784705146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705146, "uuid": "7df4d874-4d28-4606-a7f6-c03dc751c4c2", "comment": "Malware payload (RemcosRAT)", "value": "1cbca52a4190b0e7032d3ce77f596fd4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705146, "uuid": "e0322d00-0a62-44ba-855c-dd6dbd2941d5", "comment": "Malware payload (RemcosRAT)", "value": "72d2dd50b032eb20f2e0b815f68fb208d1985d5549469ced10fd7863b91e3ec2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705146, "uuid": "07917b06-7120-4b17-9f07-4510b176b9ec", "comment": "Malware payload (RemcosRAT)", "value": "0d136ae6f2b3cc6bf0d16441bce5e5970b3d5b8a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705146, "uuid": "d7dbbc6b-75ad-41df-bc3f-739a544aaf3f", "comment": "Malware payload (RemcosRAT)", "value": "a4c04cf40236c0e888229d0e40dfe6c63daf0a6bd9eb9b17c4df48fdd464518c76ae8c928ddf097617611c395e4d8a20", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705146, "uuid": "9eea2a58-701a-4e82-bd64-b0385c308e8f", "value": "T17BC24A277F44068B08CF25B785FC4F674955EA5085363CA5EEBCF64EC88AA1863BC12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705146, "uuid": "11d89aa6-eb31-4969-a71e-3acb4e082cc2", "value": "768:9gkpjaWzSFqsX4xbzrAnoBZgj1j9TDLlur1wC96gY3UOz2:Nx1uDX4hrQoBZgpj9TDkr1wbgYP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705146, "uuid": "a776e505-4560-41bb-ac7c-6c43a85fd9c3", "value": 26147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705146, "uuid": "993ce899-68cb-4955-be95-ab20bf9c3b50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705146, "uuid": "eb4228ec-0e9b-4ab6-a6f4-9fcce17a4b36", "value": "SOA JULY 2026_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cf7bb3-85c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784723593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723593, "uuid": "ef4913ac-b0f3-47bb-a118-f722944cff8a", "comment": "Malware payload (Mirai)", "value": "535dcd308d230f10b2ff09f0346aecf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723593, "uuid": "8dec70cb-6a12-47cf-9603-173db2354b0c", "comment": "Malware payload (Mirai)", "value": "737ec50d03a0fc26c287c45b2be22f2c971870fa9e862814fbae7be8bef0aef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723593, "uuid": "20b31b1f-18f1-4a9f-b59c-36fe72681da6", "comment": "Malware payload (Mirai)", "value": "3174d8f6732a6bf8a7ca920f344fd3292c480709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723593, "uuid": "f4a8a598-31a8-48f6-99f5-ed416270e06b", "comment": "Malware payload (Mirai)", "value": "72f1d760e8ec5aacd30f44089b9e173dbc73c4b2a62b6f3037b2d024098a50099f8776c3fa858d3479a40b6ee74bc88b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723593, "uuid": "0cc6e974-d82b-47c0-82d2-228ddcfc0d24", "value": "T16BC36D22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723593, "uuid": "1407ae49-b1f8-430f-acfd-cca83e2553d9", "value": "1536:qZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnfAlQAQKC1D+tAlPYm5XLxgFxHC:n3IbE/HnQBKC1ySNYOX1FXgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723593, "uuid": "40384f72-eee1-4058-b17b-c759c58c3a4e", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723593, "uuid": "74d4df5c-558f-48c6-afec-f669984de3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723593, "uuid": "529db2bd-2825-4226-8832-dbe677156dc2", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cafe513-8576-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784687990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687990, "uuid": "d7cdaabf-d6c8-4558-a55f-8bf5a0a2b0d3", "comment": "Malware payload", "value": "9bc71a095bfa877ccd3036c8751468f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687990, "uuid": "d978a840-03f0-45b9-b6e3-b98b128fd0dd", "comment": "Malware payload", "value": "73db8e9a1b49daa01f362573eeb79a0b7ac9455f581e79d49a1c99734181d65f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687990, "uuid": "e1e4ba30-c571-429a-9be0-15c9655fb125", "comment": "Malware payload", "value": "5a26f05258240fef106471e5e8ed4557177d8917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687990, "uuid": "4452c699-d490-4268-b0a8-f29e1c612551", "comment": "Malware payload", "value": "c5f60876a529d69db14b6f95ac0170d2be9f12d0f8ed456d2f1c062f4db74f843d067237fea9eb520ea55047204112bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687990, "uuid": "5f8c3e40-6858-4779-aa9e-8f4e46c20603", "value": "T1B4D52389BDF70970D83BC3B58D83E46D727637409BB18E4B3A8D6A108E536685C36379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687990, "uuid": "1426e2c0-30f4-4056-9b4b-aee75435542c", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687990, "uuid": "748787b4-63d7-41dd-857b-3dd7f59407f5", "value": "49152:J+Z00oPVKgcopmQ8m0r1yGShJuJl5y+Ly6qL+iIkKS2MUSS5sJTaVk6A+cMUCcmq:4gcob8m08t+kuq+iIqBssIt+Z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687990, "uuid": "7fb61e43-8ce0-4f89-bf9f-b050bf2b22a5", "value": 3010048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687990, "uuid": "a99de4a6-2272-458a-b987-20630dcd0393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687990, "uuid": "7878047e-e20f-4904-9b17-7357ee47e7a9", "value": "SecuriteInfo.com.Win64.Evo-gen.57653523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911a5302-8578-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784688830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688830, "uuid": "5582a61b-7c30-477f-84fd-7551f2f4556f", "comment": "Malware payload (Mirai)", "value": "2004a9430c33a021a5c699509ee29d5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688830, "uuid": "6257705f-e65e-4ba0-8655-c28162546626", "comment": "Malware payload (Mirai)", "value": "74f0e8132ae338ff8054359b17d9d599cd802d9d0137bab5218137c9ed289f8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688830, "uuid": "b8ce0b62-d8a5-4ff5-9ce3-de1bda48a110", "comment": "Malware payload (Mirai)", "value": "09ad529c0a8928bf3525caf39a211eaa4c521065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688830, "uuid": "58e17844-fe31-42ba-b7a9-f70a90b79abe", "comment": "Malware payload (Mirai)", "value": "01e64735468a3c5259900c0b0f4ec4b73e54fb7e44e9eb92c3f3b99de4b10c456c84c3d7199dc3fff32d08d112790e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688830, "uuid": "75c4b082-49c7-48e4-98af-794091d8f315", "value": "T1EA631A76BC819B16C1C51677FF2D4388331723B8E3EA7113EA196F6537CB82A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688830, "uuid": "9490a6ba-46fd-4862-b860-77b86119034b", "value": "1536:yfjOLmZ6Lqw1TAyKsYChNPSbAb1Sno/S7v8WnBZc7dF21UdlTQB+cuF:yfjOLmQqIcolNu+1So/Sb8grgdF21U/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784688830, "uuid": "297c0ff9-7535-495c-8229-96ebc68ef745", "value": 70980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784688830, "uuid": "515a1ffc-c2c7-4e0f-bc16-ed918ffdf94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688830, "uuid": "45d63edc-f7c4-4550-9e3f-da7eab7ff9a5", "value": "Zd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621824dc-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757900, "uuid": "a36391ef-60a0-432c-9b49-6bba36a2c4a0", "comment": "Malware payload (Mirai)", "value": "da0b213106d0974cda5ba481a8148167", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757900, "uuid": "884fded1-7f38-425b-bbe6-82e534cc3941", "comment": "Malware payload (Mirai)", "value": "751a620ac5101f69eb6e3d208eb4ab08cdcf18092d88b2717dfa975e05b88e2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757900, "uuid": "daadaef8-3486-4c43-8695-ac9fa5b532a1", "comment": "Malware payload (Mirai)", "value": "6f18f1f3ae1af9121d2130cce920f466c6eddb78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757900, "uuid": "2d31a9bd-c58f-4aab-aedf-6fd2ebce0775", "comment": "Malware payload (Mirai)", "value": "0c743f64e0d09be4cdfcdc6e7aae034e43e42137a0404e897e61d4b8a75a359b6bfcb3660f00f3d0ed4deecf50d0e1eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757900, "uuid": "8bf3894a-4515-46f6-b30a-d153f2fde3df", "value": "T1C2630891B881A626C2D1137BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757900, "uuid": "559f9ebc-1195-4a2e-8838-926e37f52915", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757900, "uuid": "fa5065e3-f360-4603-8a7d-49e83d8299fc", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757900, "uuid": "49dcd784-ad2f-4a63-bffc-57f50d3f1012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757900, "uuid": "0c506725-ae2c-404f-9fa0-d059f3b9b100", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b3a36f-857e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784691357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691357, "uuid": "2b8dcce8-3a1f-426f-a475-4f9d601261a7", "comment": "Malware payload (Mirai)", "value": "88b62bf7a3107f0db2db295b77e89bb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691357, "uuid": "4c242948-ef8c-4e85-83da-6405a8517d42", "comment": "Malware payload (Mirai)", "value": "76d7bbf2d95d24046a8ae3a9b64c63ee280700434ce642df02d2530e13bcd8f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691357, "uuid": "15607a3c-0901-4902-b18b-8f8de34bcb53", "comment": "Malware payload (Mirai)", "value": "af04f9eb5b1ae56bf9328685c191e83c5320abb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691357, "uuid": "3a0a3d8c-29ca-4440-a869-71a7e3531837", "comment": "Malware payload (Mirai)", "value": "9621590cb9461afc3188922abc4d3e7fb73b4e03113df9349baa1f50aeb3202535f22145ee8abf1f7e21a46942db4993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691357, "uuid": "48ec6249-1fce-4d1e-986d-221e29b7e88d", "value": "T1BA631875BC858B16C5C52277FF2D8388331723B8E3EA7113EA195F6537CB92A0E2A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691357, "uuid": "72f69ded-8c97-4974-8b75-62ffbfc6a744", "value": "1536:5Vbe7guylQNy3b6yPCbmeT1yO3ytkcrhyfZZcjgFm1UQkdl:51Cgu8ZjOm81yO3ckcrhUDogFm1UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784691357, "uuid": "0a2fbdf7-9103-4d1e-adaf-da91ddff4f93", "value": 70924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784691357, "uuid": "09515aa5-3ea4-43f1-ab57-06023cf0a776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691357, "uuid": "6beb4238-2eae-461a-8403-11a33c21e584", "value": "uteZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9150da-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757842, "uuid": "c645189c-b7f5-46f4-992a-dc5825c54189", "comment": "Malware payload (Mirai)", "value": "b252f1eb128b57b3c1a6fec167b5e7ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757842, "uuid": "0241ceb8-e5a6-4c57-af39-e1ff94966a0c", "comment": "Malware payload (Mirai)", "value": "7779c5dd83ce0188bc3d6de963e2bccedbdb783a79756fd7881a158d67277b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757842, "uuid": "2066070d-0c4a-4f16-87ec-bcd8b4da1184", "comment": "Malware payload (Mirai)", "value": "29fec7b5df2b4e75cbb23b9aec9488e78813ecd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757842, "uuid": "57140fe7-ddd9-49a4-ae28-e93a8fa6edaf", "comment": "Malware payload (Mirai)", "value": "452600292c53d064ca7a8420a59d915a9a9d160b3f2c76fab0723c91ed74912d70baf035d093657da3a48939aa921bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757842, "uuid": "3a956e59-a7ce-4c69-ba94-a050c2ce0014", "value": "T170732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757842, "uuid": "0f9b5ce2-a512-44c3-8ee5-4aaefef4affc", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WR:927jqCt8v3GI/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757842, "uuid": "5103646e-ac09-41ed-8637-98c0a115bf55", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757842, "uuid": "b599325d-c730-4239-8452-4556113a2bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757842, "uuid": "71bf3c67-99d2-4280-8e18-cedff6586f6f", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5aa2cc-859b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784703698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703698, "uuid": "30babd39-36b9-418c-9d14-cc410e7d4e3b", "comment": "Malware payload (Mirai)", "value": "7e925c9d307eb5c263dc2a3d1d1bd19e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703698, "uuid": "134cb6bd-cd64-414c-8946-5f76c0ea2834", "comment": "Malware payload (Mirai)", "value": "789423907f36db97622636bbd573de3e8b626b1c94f360cdb818bb07b722ed47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703698, "uuid": "f3ae542c-3a38-4807-9aa7-6e3f36af746c", "comment": "Malware payload (Mirai)", "value": "f579ae9ba28bb5d234d58ec98e816336c6631aa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703698, "uuid": "9c4cc1df-ba0d-4698-aca6-e53a1ba9912d", "comment": "Malware payload (Mirai)", "value": "0cfe2aa9e77185376c365e893160559a92ce3f99cde501af1531df989eb9facaa08b48cfaeb7987ec6f2dd506e04d796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703698, "uuid": "c7818843-886e-4aee-a662-8cd2787a9285", "value": "T19B13F14BE69A0D30D9D66A380CDF514F5D0DFF498100E8E21BC5B16EA96DB52090EF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703698, "uuid": "0a913024-a779-4400-8edd-62999c9923aa", "value": "768:bcpLjhlif5PYy4ML5eeaxlg66znbZtuOfjo6kTfYzWJlvQwvp4Xng59bOnbcuyDD:ApXrS5kML5eL066znlffjo6GzvpOnou2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784703698, "uuid": "40a9eaf1-2aaa-44ec-b283-d0bee3d1b305", "value": 43460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784703698, "uuid": "76f1cb32-86e5-4c04-8d61-23bed7bd0cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703698, "uuid": "8eb32c31-f21a-468e-8538-11328acd994a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957e09c7-85ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784739088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739088, "uuid": "f28871ef-8755-4b55-b01d-b8e0329194cf", "comment": "Malware payload", "value": "5c0ae91449935c2cb09fe41883f4fd1f", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739088, "uuid": "bcbf3c3a-d6ca-4ca3-94dc-c05c4b08e7f9", "comment": "Malware payload", "value": "78ed13bc09e9890a11d339e4c58c5d8adb72b880baf44d5fbd75a44c64f2b556", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739088, "uuid": "d57dc1d1-00f7-4305-b308-90f3dc3dc7f1", "comment": "Malware payload", "value": "06f21d03e8daadfdcfa6755cb301c5632e494f89", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739088, "uuid": "e0a97478-346b-4b89-9af3-7614eb5f1603", "comment": "Malware payload", "value": "13839aa27cefc84806c2f415112c970bd604e96a665ffd66cfbd1af78e5174ca80ad348db3512a3a27b1a7bf5e0baefe", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739088, "uuid": "d244c767-6725-4452-b328-1623a3472411", "value": "T1F313E15A271307F0D10C7EB8BAF401F16DAA67BE17682E8B89A4059A23C5E3448C771F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739088, "uuid": "2d8a5c04-d485-4518-8d9a-181b0d58a3b1", "value": "768:bg9oKXV60s5GeHho/ARJ30FUNdynfIKDOe65fGKvCnzk0+Eqg6RfRHDMRlLe1N:cqKl6DceB3RJQlIKDd65f5vU+PRHwRlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784739088, "uuid": "ed0ee19b-0de0-4958-a3d8-61eec8a3e9ec", "value": 44548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784739088, "uuid": "e722b3ee-2c4c-4553-aba2-6534e97c22e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739088, "uuid": "283923b4-5d70-45c2-9f52-9c3ed91f0154", "value": "PO222020.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3446b057-860f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784753528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753528, "uuid": "6004085c-12f0-4f08-913c-a0aae1fb1ed3", "comment": "Malware payload", "value": "14217d0f38f74b95dda5f4304ed29083", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753528, "uuid": "251f1dfa-233e-435b-80ce-5d536edd05b7", "comment": "Malware payload", "value": "78ef4cadec54dfda9055668975351cb20566d65be346536fa0f0eb7c8945203d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753528, "uuid": "5180bea2-864e-4647-9ec6-ed71062d8215", "comment": "Malware payload", "value": "1e0342cd9568a3c6060c364ff143ea26887bdb24", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753528, "uuid": "b8ed705f-07bb-46b6-9280-7406510c252e", "comment": "Malware payload", "value": "46eda4355fb78402193c37aa0a42ff19443e9b9f9efc6beb0adc3419840624b928123449218317e9ac3ff50d98383758", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753528, "uuid": "3f206e48-4b0a-4519-88bb-1d26a7a2375b", "value": "T1AAE6332866F001FEFA73503CDC92D396D2A678364732C99F57908A866D532E40D3F79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753528, "uuid": "384ca53a-2e5c-44f1-bd8c-902a1c9953ca", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753528, "uuid": "4fb28465-6487-4eec-90e7-0fbeb8a7e030", "value": "393216:7iL1zK+6wfelCAa26XMCHWUjXZcuI3/PGTAI:7idK1wfeI46XMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753528, "uuid": "4c27c150-0c40-45e2-98a7-019b130bf672", "value": 14305053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753528, "uuid": "07a86072-492c-4b69-89cf-d5644c3cb372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753528, "uuid": "f72e85d3-81b6-4e0e-b444-19f87213bdbc", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf1dff8-857e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784691453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691453, "uuid": "9c4cf97a-4caf-4dd6-8c1a-6904d662e508", "comment": "Malware payload (Mirai)", "value": "afcf2a79b07a3b4975ec6aec72878105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691453, "uuid": "bfeaf06f-d0a7-4a42-b7d5-daefe2bd5153", "comment": "Malware payload (Mirai)", "value": "792c62d5d1c2b14b8f88b6d4f076197c09be903d66b6f882cebffe7be9c0bc77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691453, "uuid": "aebe1341-f3ed-4f1e-ab11-4cedb43e221a", "comment": "Malware payload (Mirai)", "value": "7b8c50db1243b63ab113efaf5644ce9a1e2cfd63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691453, "uuid": "458c87c5-511f-404e-b4a3-0b413c204f40", "comment": "Malware payload (Mirai)", "value": "24d35feec0665abe72c72916c4f63e79f923bd1f9d92819c087f4ddc1b748a69c9a65d1f9328869a4a9445f3d25931db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691453, "uuid": "e6462a9b-8c6a-4172-a991-b4f8c21d4b5f", "value": "T16C83F72ABD819F05D4D526BAFE1E538933535BBCE3EE7103DE141B65278AA1B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691453, "uuid": "bbed759f-507c-4567-b59d-a1293d9538c9", "value": "1536:abn0lQJEGwp8q0UIlkvkCRd3cwqDdGggiHYtNLRMipVuVbllWki0N8zjO6F:fKEH8Jg3vClgiHYtNLRMipsWuN8Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784691453, "uuid": "4b65b32d-6500-49cc-9b8c-9a87026cf5a3", "value": 82468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784691453, "uuid": "90ef0cae-08ed-4120-b534-5ecc5c648975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691453, "uuid": "eed26066-f686-4d2c-96f3-063e251eaf70", "value": "8Mty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72adc32-85a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784709160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709160, "uuid": "71998467-d8c7-48ac-8d03-096b01f13737", "comment": "Malware payload (PureLogsStealer)", "value": "3040ab19daa0dec4f0b683d06486cccc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709160, "uuid": "fb0f2f46-0971-4bdc-b1bb-345b6c923c92", "comment": "Malware payload (PureLogsStealer)", "value": "795ffc434b115a12d6bc2f3bf125e303ae23fc8184a1f7c5739ba6e4cc75d25c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709160, "uuid": "5d41a556-4cff-4119-95b4-4a452ac3368a", "comment": "Malware payload (PureLogsStealer)", "value": "f52d36283f1b2cf5520af9dfdef92f23b5ec9663", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709160, "uuid": "07eb4fad-ab46-499a-a2fe-f30308df3234", "comment": "Malware payload (PureLogsStealer)", "value": "b220311674588986bbde43982626a7c62fae3025c19a4044af8da5b8469b5aadb9c0caff5970896eafc1aacbd937bc15", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709160, "uuid": "48e6ebdd-5dbb-41ea-9895-406643a046e2", "value": "T1F7656DCE385882901CE98E54DAA0B296218E72CB09B2CE657CCC944DDB7B54F95713FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709160, "uuid": "de48f9d7-ee3a-423e-ac80-086c582c3507", "value": "24576:DAV5cbuErtyKL+vPId+3rJe8NRNi8pabxdB4oYW9L9lT8VdfGqz:DATcbuErtyK6vPId+3rJeeLi8pabzio8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709160, "uuid": "3d65af66-3d1b-44af-993f-b2b829b7adaf", "value": 1540060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709160, "uuid": "cb4b352b-17ee-4feb-a0b3-fc3a48d26da9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709160, "uuid": "8557624d-d2f5-4dae-82a9-d6ccfeec3a73", "value": "Purchase_Order_O12967-0726_Official_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ad2503-85bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784717528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717528, "uuid": "2d1b455a-68dc-4a69-a1bf-ec0c35ae0027", "comment": "Malware payload (Efimer)", "value": "3534bb2163564f8326a7af28958fb6d2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717528, "uuid": "cab5272b-6700-409b-883f-e03a6412f6d6", "comment": "Malware payload (Efimer)", "value": "7a3a1ea98dd7a705e7f213d1466aee55c010d418bab8a9c174fa9f46040d1e1e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717528, "uuid": "f5e3c07b-953b-4440-8cf3-35eb5ef86e83", "comment": "Malware payload (Efimer)", "value": "a38457696be516b3df94d5447b18efca897bedb1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717528, "uuid": "341604a4-a1c5-428c-b8f3-7657e4f8f2f5", "comment": "Malware payload (Efimer)", "value": "5ccd44ca0f738a0ad57636162641c44d7a3bbdbdf6c53a46db88d0bc5d6ee67864bb355a85ae9733b8d1969f9e304dc9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717528, "uuid": "304660ad-4beb-4000-9da3-ba7084de6054", "value": "T185E6331D75D406EAFDB32238CCA20645E571746A1771CAAF575AC2E21C272B04E3EB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717528, "uuid": "0850ba0f-56bc-4f7a-ac43-b3fcb8557d2d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717528, "uuid": "643cd886-b04a-4cd5-8a6e-559465411a90", "value": "393216:APFf1eN/9k50FkB6JWci8Z2ZcGYXMCHWUjXQcuI3/PGTAI:oF9QVA0GBoWci62VYXMb8XFH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784717528, "uuid": "1d9d51e0-e8f3-49dd-baf3-78bf94b540cd", "value": 14266106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784717528, "uuid": "29ab21cf-002a-4427-9313-dec4352c4f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717528, "uuid": "adda4fa5-fddd-443a-8e5f-13e33754ca00", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2cd61c-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784701497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701497, "uuid": "ac2f9ba7-7cf5-4996-a226-771addc1fc6d", "comment": "Malware payload (RemcosRAT)", "value": "eae76aec06ed3fad35a0d75ce371b3e5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701497, "uuid": "53fc2541-762f-4f4e-9362-b912a72b1543", "comment": "Malware payload (RemcosRAT)", "value": "7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701497, "uuid": "8774890f-ac67-433e-bc86-d6186f1544b8", "comment": "Malware payload (RemcosRAT)", "value": "36f516c85fb7d3d31e4179086a1f35e59c347e07", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701497, "uuid": "ed9e55c7-fb6b-4c80-b69d-4d3f74d9bdcd", "comment": "Malware payload (RemcosRAT)", "value": "5d8683b68700ad56d3bfe505ec94711e7809fd9f8a9b671603b0c71d6b6a4a04213bef1a19f420940aeb861ada491147", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701497, "uuid": "70f33c09-4a2e-447b-8eba-d318d90b672f", "value": "T146A1650CC73ED2E6B79D3EA2E44F1E4F98A0481C545A5C0CC9B684C91CE1A5D5A18FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701497, "uuid": "a1df3bcc-7b63-4522-8e10-5588ba8896e6", "value": "96:N6+UxuX5r25QCffUQPu2V1KO1Tusi2UyR:oNxuX5rgQCf8ET0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701497, "uuid": "ed1d3adb-47da-44bd-9a30-593528d7c084", "value": 4729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701497, "uuid": "c634c3bd-193a-4217-ac41-564fe13b42be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701497, "uuid": "4759b097-0d90-41cf-b29f-3df57a119314", "value": "modulo offerta-21072026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33d3e7b-85ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784738816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784738816, "uuid": "aea41bce-76ab-4629-876b-d32f99ca4906", "comment": "Malware payload", "value": "a1a2c839b0cf1e06d25f601322122bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784738816, "uuid": "58356bc8-eca0-4b0e-99ef-1b8adc9c16ad", "comment": "Malware payload", "value": "7d12e39e2b0c6bb9b259e1f697e30d9dc9983cd4acc02a847ad6bef75310339c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784738816, "uuid": "b1a14d68-0490-4846-bcb3-ba383a0c713f", "comment": "Malware payload", "value": "74933adcf1dd9709e376650e8fd45da94207cce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784738816, "uuid": "08957cae-efc4-414e-8e49-838d109cf406", "comment": "Malware payload", "value": "920fd704c7e6d3ff416d701c1d1d691ad1fa5e777c9627afa129d153207e0a9fa6b7dbe6be0c3ac6effa370c04666c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "eykrqioydzqaehcektgd-supabase-co", "colour": "#752EFA", "exportable": true, "hide_tag": false }, { "name": "qvyhijngxiyyxodeoeux-supabase-co", "colour": "#3AB953", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784738816, "uuid": "9e4ba732-4029-46c7-b842-e78ea06fb232", "value": "T1070833054E41888BE85ED23692E48D57D177789969A24F8707F009793EEB3C8CE3FE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784738816, "uuid": "7eb3c0c4-2426-4726-9d75-cd11c8833ac8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784738816, "uuid": "bea9f00a-3e95-412a-81c6-f945e0c6868c", "value": "1572864:TqPnddZnV+vWlM9ojCrD4WWJvKSc/JUNny1TadunnM9lzSwgY0odH0piSqjY:OIelKbDSc/iFqM9lipiSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784738816, "uuid": "863aa549-6365-4193-b8d7-61310a783e54", "value": 80327348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784738816, "uuid": "fe1a954b-c8c7-4b2d-86cf-ca68a0e72d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784738816, "uuid": "96116252-0c1c-4f53-8e6c-a8ab2c3e54e6", "value": "panel-file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f9ca6a-85ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784739096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739096, "uuid": "e8d0a014-f6ea-4456-a61e-45542e14e2c9", "comment": "Malware payload", "value": "e0dd155f97d91b6e7301c5dd9f2ba3f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739096, "uuid": "8a12a33d-e358-4f62-9659-6ba5e6ad644c", "comment": "Malware payload", "value": "7e47543e5ffb8cfc4bd70e6baeeabb0a94e9a6817680d80da038baa3f9909b88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739096, "uuid": "6273af07-34d7-4832-8f60-62455bfb6117", "comment": "Malware payload", "value": "217df0f7aff29a3cbea910f9d356863b50fba3d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739096, "uuid": "a4a0322f-abb5-44e3-9ec7-5ceb426ebdb3", "comment": "Malware payload", "value": "a37de5d8d5305e21746a5be514888319152858adb32ba8b754bb7a6cc0c76a0963c5c2b7a9ebc2339bfbef088552e4c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739096, "uuid": "fc8cb2d5-c77d-42ed-a97c-3e10f1dec447", "value": "T146B44A31DA28077F4EA727DCEC501A53C6EE9609842398F597AA074EE106DEDD3BC364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739096, "uuid": "07beccf2-6ac9-491b-906b-0849c41b1af7", "value": "12288:g4YJ4+PRKutS/X1sE2TJI860E4hFHfCG84Jt5DFtIhPDc3cFbM+sFxCdtT:g4YJ4+PRKutS/X1sE2TJI860E4hFHfCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784739096, "uuid": "78d98ebc-f241-4f2e-9155-e24676b52799", "value": 502390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784739096, "uuid": "e0eedbab-d320-452e-9d5b-dacaded89034", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739096, "uuid": "cc86cac4-17b1-442c-846e-c4989251ae83", "value": "Basketagen124.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd83507-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784702165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702165, "uuid": "80eca95a-16da-4993-a190-efd58a1642b1", "comment": "Malware payload (Formbook)", "value": "0e7ef36ab21c28977bb9f91a22322268", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702165, "uuid": "87b86efa-1465-417a-8ac4-dbcce2cd6758", "comment": "Malware payload (Formbook)", "value": "7ecea8415edfd60d7c8cd5f594de5b282e93b3551449f1da88aabea920cf44ff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702165, "uuid": "9bb5227d-e01e-410f-832b-144db4bd95e5", "comment": "Malware payload (Formbook)", "value": "d5de9e4ae7b9240cd44bb81aee37d2ace6fe13d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702165, "uuid": "7694393b-fa9f-407f-9a92-10ba43041fee", "comment": "Malware payload (Formbook)", "value": "1f279d541eec81d03796d0d1b1a548d0b87a48f6ed0a7a37ebdcfed497a8646d9f470eaec46ac88a646d79959216e6f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702165, "uuid": "76d29ce8-932d-4963-9a14-f4435f6332cf", "value": "T108E509F0B7EEB70F960937EDB80C1688472EC9397A4392D454CB8AD1614F95B17A08ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702165, "uuid": "d7c22f34-d847-4611-97ea-1191e1d23be7", "value": "12288:ln9Exq1LkuHnIHK7Q7Pp0l+Qt/ryMwylwkGsAeu9v8q4JglbavGDnFb6RQx2VCt2:19EA1roHK7QqpVBufwRK2oay/OWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702165, "uuid": "b1e38612-7020-447f-afd6-abb5d1bc54ff", "value": 3205230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702165, "uuid": "ec306649-0fbe-4485-926f-0d03e00701a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702165, "uuid": "8c46b39b-a201-4f0f-a0e0-c048de2fb7e9", "value": "NEW_ORDER_IMPORTS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5950cde-8607-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784750416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750416, "uuid": "294df97a-db0d-4c3b-b542-64bed5d55d3e", "comment": "Malware payload", "value": "c5924cc9e22ca328908b9d9628312608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750416, "uuid": "c0356e3e-b499-468b-b4a4-1531c215d920", "comment": "Malware payload", "value": "7eeb49a12710a14273958e8a5c0594987416ce88d46e57f5c28906d9ff892c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750416, "uuid": "b74acdc2-711c-40f4-b1fc-92ab0ff37522", "comment": "Malware payload", "value": "197d3cfbe60e1c617741b25a6f9d75c81ab91ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750416, "uuid": "9cdab3f8-262d-43d0-9e8d-31b0deedf682", "comment": "Malware payload", "value": "485ab08d54aee59864f21d9e4273ecc706b13a5ec9ecb2b0a702a9351b4d586a5e3fd4e937df56ca1696a0def18ae362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750416, "uuid": "625232b2-d69c-442f-95a1-8b2398bab06c", "value": "T17A765B03FD9515E9C5AEE234867292637BB17C485B3167D32B90F3282F72BC06A79790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750416, "uuid": "f2d502c7-8561-44ce-ad46-681e205135b8", "value": "98304:YF4qfLTHVKLbo61pfrsjL1nLGm/0E4T8Amj:YOqzT1KLbTrsf5L97A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784750416, "uuid": "d82e3752-8be0-48f6-8aba-9fcf7efefbc6", "value": 7495864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784750416, "uuid": "7a0c1590-7b60-42c8-824c-f96ebf48dbd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750416, "uuid": "fbf86c1b-0f0d-4980-9d4d-8b30e8107add", "value": "7eeb49a12710a14273958e8a5c0594987416ce88d46e57f5c28906d9ff892c1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9ecb37-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784732762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732762, "uuid": "b04b554d-3e48-42ca-8095-3a26e127055f", "comment": "Malware payload (Formbook)", "value": "05ad802491b5dfa5de9d4703fd584b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732762, "uuid": "d422ba88-6038-45a6-90ab-ffce61fd3db7", "comment": "Malware payload (Formbook)", "value": "7f74240c041dde0a5a11382cd2142e22d7fcea25bc48566c98b1e153388f8cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732762, "uuid": "5b9d71d4-5367-4dc6-9ca4-c20ffcad9130", "comment": "Malware payload (Formbook)", "value": "485c34b1ff7829d73735c7feb467f53af85d18fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732762, "uuid": "aa47c681-6180-403c-b45e-457ae03f0329", "comment": "Malware payload (Formbook)", "value": "f33f94ed9aa424af15d2eb274605d29b92859bdac33f289ef564bc1c55ab71302df4e0d0dedf0be519e913e53d4828fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732762, "uuid": "02034d04-95b4-46c7-9f5d-070ad7185855", "value": "T1E235011513229E42E5E6C7FABD60D33433A11DCE79D2D2A25FE66FE778297802950283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732762, "uuid": "17cfd9d0-73f6-4534-b43a-924e48c16419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732762, "uuid": "c7098b6d-4556-4f1e-9f41-2ab940d711a8", "value": "24576:Prp50cthpXegQN37V1nGzZkipOe2x8ICm04tCVwkD:Dp3pXV2zGyi0e2Sfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732762, "uuid": "2ed25940-4bbc-4670-bd3e-66a98ee12af3", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732762, "uuid": "33235008-4461-437f-a44b-2565fb7e6a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732762, "uuid": "aee5fa0f-3068-4b72-a593-4e18965b0e6d", "value": "#Brazil-098484OBZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3e58af-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714994, "uuid": "d1ac703b-a557-43e5-8a90-ef8b13cd2951", "comment": "Malware payload (Mirai)", "value": "fc3e91050dc1c3460828e071e9bcbb1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714994, "uuid": "ba10d177-68bf-40eb-be40-3978095ff761", "comment": "Malware payload (Mirai)", "value": "807315fc9c783b21107f6b6a1d944d33e478dafe41f388505baf44e16b602a19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714994, "uuid": "e06ba0c1-3a3b-4779-914b-ed5ddec2834b", "comment": "Malware payload (Mirai)", "value": "432eb97b1a7a4d4027a4e423e6a99f3bb5c87ac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714994, "uuid": "caec88ba-6538-4ed0-b71e-63d8d86347ad", "comment": "Malware payload (Mirai)", "value": "1b7b4eda94cf43428a5ad84e552663a7bb71c5ba65c9f0de6b878220a662d136f72854ac5df2d50b47886b8a667b4c62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714994, "uuid": "0cd1a6be-baaf-434c-a0af-73fa3c8bafa9", "value": "T184D32B86EB418B13C5D6177BEAAF41453322DB54D3DB330689285FF43F86A5E0E53A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714994, "uuid": "2cfca03f-b909-4a59-a4d8-64ba5fa4c0df", "value": "3072:nJA99VEwh3nXXm+2ZE6CIANCHkQmWTW0M/9AySa/:nG99VEwhXwZE6CIoC4WT5M/97Sa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714994, "uuid": "ecfb62f6-af99-4d51-8ef9-068245ac4738", "value": 130018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714994, "uuid": "92d0e26f-273e-4978-9905-15287a4d655e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714994, "uuid": "2a5d8154-d8b1-4ff2-9c6f-95a802c7f39a", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095244ad-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784705782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705782, "uuid": "d64b8f51-4d3e-4fe2-8de9-76b728c4cb18", "comment": "Malware payload", "value": "155bff056cf02ae7704f1b3523f9ee74", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705782, "uuid": "3705bb68-3f59-49cf-a3fd-1a42edeeb68b", "comment": "Malware payload", "value": "80b9704f4191f71b66309f9a61b2ebe024b324c079571db67e22b890f8945224", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705782, "uuid": "dba65691-69f3-46f4-895f-4cc7991e442d", "comment": "Malware payload", "value": "2f92e435ce2514ce2fd53fe82d4ba97cd50f34fb", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705782, "uuid": "6483146e-6d63-4880-9cdc-5570f1c6a0c9", "comment": "Malware payload", "value": "c21243f0ea301d4d99a2d33a443a4e50eb0bafa52631f6f90bf94e87c600cdd67568008c70180181cf27eda1304a56c4", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705782, "uuid": "046f1d1a-0cb3-417c-896d-8cf0d89fabae", "value": "T16A3401A585870079D22266BB2F5C456E20EDD3C75AB23CC218EC76E5CF4363BD970C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705782, "uuid": "6ac3491a-0c65-4237-99bd-a144718f91df", "value": "6144:CBaHy/mqrDfW0Wvv8hzcuCshFcxNtl7ix6ByTx/JxP:IrD+XvQzcuz+xN2x6ByTx/JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705782, "uuid": "d80ff546-b4ae-4b79-9849-fb76cdbfe97a", "value": 237012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705782, "uuid": "832acd7f-b37d-4b3c-88f1-3d88b9a63b36", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705782, "uuid": "6817358b-5ebc-469a-b3d0-42a51457f167", "value": "BillXofXLading.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a82283e-85ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784746747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746747, "uuid": "af264764-251a-4a63-a3af-5a0c5f0aa520", "comment": "Malware payload (RemusStealer)", "value": "dbadbc45d2cd71b8ae3ab990a578c87a", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746747, "uuid": "e8c1868d-6d32-4a8b-931e-e1016370ba37", "comment": "Malware payload (RemusStealer)", "value": "80cfaf9a9d39e106f520bab31f5e1455838fe74a49eef34751e1cb38c8cb805c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746747, "uuid": "a5270323-cbc2-4964-97c3-686dc2b816bd", "comment": "Malware payload (RemusStealer)", "value": "3b1708260c1c0f1c573c82e1eeec9f3d167e97aa", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746747, "uuid": "56c462d0-3c58-4a90-9995-6e3a7d005028", "comment": "Malware payload (RemusStealer)", "value": "6d9f1a45ae2979907062960e458f25048ddfd2057d4370fa904c4825423c1c0cc3f4e5764d1ef38d2573e8d3a047e30e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746747, "uuid": "5bff69e3-7f95-4a89-9b6a-ec742cab3875", "value": "T1C3C53907FCA148EAC09EA33189B752567B35BC081B3227D72EA0B7782EB27D05D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746747, "uuid": "900296a2-aca5-4887-bb64-cbcc3857e7d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746747, "uuid": "df5ea8fa-517b-4b0a-9c11-27821306c0cc", "value": "24576:TEFRumld5eXxfgh+eOiHybbrsoCA1uD/BEGdNOblTqgJbRfeH3N50vAoBele5I9x:TEFsm75edgPOimns/tHObIgDq33JT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784746747, "uuid": "ef73a522-c510-4ce3-bc64-9e037ca4792c", "value": 2699088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784746747, "uuid": "fe4f983d-b67b-4620-9e6d-43b214579de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746747, "uuid": "4cc0e628-ee19-42e8-bc95-4f1081f5c01a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308aa386-85f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784741496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784741496, "uuid": "efacd928-4418-4737-a0fa-aa78f6cb5f71", "comment": "Malware payload", "value": "9dca0954ddd120503f49b50a7d9bdfe8", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784741496, "uuid": "4733e516-d169-4e07-96d3-82c74d3415ad", "comment": "Malware payload", "value": "83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784741496, "uuid": "40134a6d-7a06-4e1b-a5f4-721bd63cde8d", "comment": "Malware payload", "value": "46e55809cf49588d057a7a6135fbb1cc5ec5a635", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784741496, "uuid": "f26d894f-a3fc-4d3c-b46f-9d97488417ff", "comment": "Malware payload", "value": "68114c4fd8d9e4ca1700f9ba29987fb512180f35d6dbb4e9ef86f4816e0b8bfe94ddad41e3fa20ae519a1e98ca3c3a2d", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784741496, "uuid": "90f6fb0d-33cd-4426-9058-e52323bc758b", "value": "T1CA17F06DCE3E09658D7635F88CCB17C7AC485B9906209EBB5B7E8C66630453EB0A313D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784741496, "uuid": "3bde459f-3cf0-479e-8ece-c018722089f5", "value": "ba470d911d996b80541ffc849183463b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784741496, "uuid": "fd360b57-3dd5-4f94-9310-a475d5616eb3", "value": "393216:Te4ixM5E9/ILKAvTyyzrwe1tO8MDXi8+uDvcSxpZZn4gyXUMMFnweN5sTu+N6lJY:Te+E/I+wTHH1tO8Mbi8VDvckgU9au+N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784741496, "uuid": "f1ca5598-7be5-4c37-a2a6-4211e711e505", "value": 20260864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784741496, "uuid": "00d61ce3-2432-425a-af50-35db47291b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784741496, "uuid": "56c076c9-2f00-42ed-ba5f-1b6180c1f918", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdd2055-8576-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784687989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687989, "uuid": "bea326b5-93ab-4d71-9c7f-37f44fccd50b", "comment": "Malware payload (CoinMiner)", "value": "eba7c112a3522d28fc665e6384945ffc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687989, "uuid": "0b9c3c87-9713-49b8-967e-10a853179489", "comment": "Malware payload (CoinMiner)", "value": "85142e27e44b83ae26230454694d1666652e718e3764e57a1d6539c83e448402", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687989, "uuid": "3d34d2dd-16ee-44a0-969b-45fdb6af8639", "comment": "Malware payload (CoinMiner)", "value": "69ecc978c6058b4c17f68693228c72a198757635", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687989, "uuid": "cb32a5a2-c8f5-4dfd-b5e4-850ae91af1a6", "comment": "Malware payload (CoinMiner)", "value": "ae67065ca9d95e025edf3e7e2fb0eeee5888a76788db0e4551656335d91f3e4d4a702735d0f4bce88c6e801b17627a66", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687989, "uuid": "ac7d7342-3b26-478f-9036-daf64100fe9e", "value": "T19236338ABEC6A574D067C37D5566606DB23F3BA4DAA03C4A768C2E0C482BF0D497D3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687989, "uuid": "cd459c2d-631b-4de7-97a2-55fd91c8ec2d", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687989, "uuid": "6545863f-7a40-43d6-9930-4bc9805a0b97", "value": "98304:8CycSycpRtQVRurwGALKrbaAZh2+sopKUGDI081Dh7FDHIn:rc7Qurnz/IopKU60DhpDHIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687989, "uuid": "e4c2e2fa-5c0f-4e95-ad24-1dd34d96724a", "value": 5250048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687989, "uuid": "70747dde-05f7-4cd3-a7df-770e0898f4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687989, "uuid": "5781811a-78c3-4350-8b34-628ef6a1dc7d", "value": "SecuriteInfo.com.Win64.Evo-gen.64268345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa02d21-85d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784728413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728413, "uuid": "690942e9-3246-42a5-a20f-cda197f3b5c4", "comment": "Malware payload", "value": "44ec62a00e55d79c8d1f70850b590d7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728413, "uuid": "24f6f470-9313-445c-8c55-5280daf5a35b", "comment": "Malware payload", "value": "856ca29c8e6d858676c8a87fac16ae13617e96140f255ca499c03d5e82ce5968", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728413, "uuid": "cdf718e1-7dc8-4565-901e-0a18e80bd847", "comment": "Malware payload", "value": "9f48347bdee302cc3d1878f7323ce95d2bfe989f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728413, "uuid": "b4f642f6-37d0-42d1-998b-cc50c926d613", "comment": "Malware payload", "value": "7a2de089fcddd0521280931e1f19f206e2a09c9137a0f17cc1bf5470f8cccefd51f2cc34c52cdc88ebdf1d25c54229eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728413, "uuid": "1244930b-725f-4725-b5cd-a66edb8ef6f2", "value": "T1F9138D6956817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728413, "uuid": "a3665353-00a6-43d2-bcad-304d1f157fea", "value": "768:M+lG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:M+1co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728413, "uuid": "88970786-1857-4467-8ded-da53cd619510", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728413, "uuid": "9335cfe4-14f8-4da6-849d-528f3a6a639e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728413, "uuid": "b3e195e3-5ebc-410c-97dd-8090c668bc5c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14a0f86-85b1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784713338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713338, "uuid": "1a3c9521-368d-488a-96da-961c9c321be6", "comment": "Malware payload", "value": "42483f4f8487af89170eded647376519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RareWerewolf", "colour": "#CC035B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713338, "uuid": "e1f7a743-09f4-4c3a-9917-ecb55ef1bc60", "comment": "Malware payload", "value": "864b83647942f5dec0746fb5a40cdcc661bbbceea0b8cbe5df0beb9f30c30d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RareWerewolf", "colour": "#CC035B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713338, "uuid": "9ece4786-3cc4-4a9a-a930-0968e63019aa", "comment": "Malware payload", "value": "d1bb17261ec6f639362c9322fb6c82102b364c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RareWerewolf", "colour": "#CC035B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713338, "uuid": "14c8d467-f62c-4230-b0ce-eb4a3a33bc11", "comment": "Malware payload", "value": "c933a11089f5d3be393452dd4a86bb3ce1f596cb4f2df771694fcdf964f1c272f5edcfc4f5b02fa473cbb98d42aebf71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RareWerewolf", "colour": "#CC035B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713338, "uuid": "fb6d5b2f-9739-43bb-9665-fb7a99c5032f", "value": "T1615523403F22C6A6C9335B72AC6F4A94E763EE5E9441538737947205A8B31B0C97FED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713338, "uuid": "3bc2b387-0226-4b42-8768-7cc748d1d450", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713338, "uuid": "3c0ad496-362e-4da1-8352-5fe2602992d6", "value": "24576:kadGJsuhKFecp7MziuHgkCCpRrjVLJ5EVyk8wuUhgj7nPljs7JbSTRo3rZ:jGJ3KFey6iuHgkCCrdFJ3rlbo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784713338, "uuid": "605ee9b9-dd9c-43cc-b63f-66155cebf611", "value": 1384948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784713338, "uuid": "a17f79b5-d871-41d3-bb9d-a7bfa849a19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713338, "uuid": "c2466549-0053-4257-9728-82ec3a27f10d", "value": "\u041e\u043f\u043b\u0430\u0447\u0435\u043d\u044b\u0439 \u0441\u0447\u0435\u0442.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a5584d-85c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784719577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719577, "uuid": "6d309e3e-ac7d-4509-8f23-76702a3abb38", "comment": "Malware payload", "value": "0d62eca9b2976516b9e8d905acabf283", "object_relation": "md5", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719577, "uuid": "b1d54fb8-049c-4ee1-9810-d6f9922e27a8", "comment": "Malware payload", "value": "8703ee8685a47d4085b737b29aaa0f6f7898985b41963bd15d7027c75a609a3e", "object_relation": "sha256", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719577, "uuid": "07f89e83-f69f-4798-81d8-cc59d8367059", "comment": "Malware payload", "value": "c31558d8ab25d6121d0b10c96f4c7ffe623fda0c", "object_relation": "sha1", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719577, "uuid": "2f692777-ab67-4dd5-ab62-6a32b5c84fbe", "comment": "Malware payload", "value": "0368c6b9a06e9941b6c2b6a0853c94ab0befafc7f03d3742f67db44a32714b22fc791916f75649e300ce37e2113a0a4b", "object_relation": "sha3-384", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784719577, "uuid": "7cf5d1b6-74ef-4450-8c71-28a2440f2486", "value": "T112F5BEC6F7C8A96AC4F75332C9395AE2454B4C268B43DF936D14363C18BB6C45F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784719577, "uuid": "4fc3a880-6730-4c12-8dd6-ff4cffe3b7de", "value": "49152:CauUXJpx3aV5aLY9dupx3zAp/gOEKEyx/Xb9R5gbk0gTwrIW6oxQ4hMUSPY4sR:h5d3araLxy/gU//bsgTwrIIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784719577, "uuid": "fec21bb4-044d-44bb-8817-47efc1079a17", "value": 3352584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784719577, "uuid": "dc3df45d-ce41-428a-86bb-62cc51ac684c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784719577, "uuid": "47acc72a-8660-4cea-8ddb-360af83c5349", "value": "0d.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6e4569-85bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784718053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718053, "uuid": "f2310622-c52a-4e1e-8fb1-917c240cad1b", "comment": "Malware payload", "value": "ca81af0ca59799a8010abe4beddd3b19", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718053, "uuid": "b9749d3a-9aa2-45c0-9843-c3a76e6f003b", "comment": "Malware payload", "value": "876e8f4fefbf25ef1055c5fc7373e0c1e1e57f97af333f80b25fb36d5bb3fe8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718053, "uuid": "240889ac-cfb5-4e66-9822-f363ecf82430", "comment": "Malware payload", "value": "bfb850e616ca2473ed0765a465372f0e1d7e511a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718053, "uuid": "7c762fb7-490b-47e1-8fbe-8b4787784250", "comment": "Malware payload", "value": "87636e74dc147d9f2e9664e2f607ed0359a822dd32f2b9380b16c4097e25cf5121e5f0994705481499dec6e04d0e1fa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718053, "uuid": "b0167e41-d53e-4af1-bf85-49a3341d2a85", "value": "T1E1B5004311E9A4B3721E5E1C8E3A8B9CEC1B82ABCD77BC48785561E4D121DFD039BE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718053, "uuid": "6372b7ba-cc2d-4b4a-a3fd-09c7b1cbec0e", "value": "96:ScPOez7sM83qZN0Io0l/OE01QoKHrZmhiWZZ4/DOCvEb:SclzAtqL0Io0tlQhiWLCvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718053, "uuid": "bdc528cd-1dac-462e-a912-3e2d30f0393f", "value": 2300195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718053, "uuid": "eb208394-0aeb-4b39-9769-06b99bd09ae0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718053, "uuid": "a431bd64-9733-45ee-8470-e67a2ea6ab33", "value": "Copia del pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5024586a-8562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784679272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679272, "uuid": "8f92748f-7de9-496b-bd5e-1d4c8c8c2bed", "comment": "Malware payload (Mirai)", "value": "6efe7bd1cc67ea1c25f0ceebeb4ee4fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679272, "uuid": "3b8ae9ed-2cb9-4191-a252-cdb8add0db38", "comment": "Malware payload (Mirai)", "value": "87c155878e8aa527a3976649fb9bdb511bcd9f0e1507744c69804b2af597dcfd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679272, "uuid": "4f12bdae-eac3-430e-80f0-6760cab1ea78", "comment": "Malware payload (Mirai)", "value": "083c88edec59a5301d2865ee979ec3acb5760996", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679272, "uuid": "1c0ca6a7-4270-4227-934e-e694de76afbf", "comment": "Malware payload (Mirai)", "value": "b73c7a4b5fa12539877337b0e8c82f9586e1cd7c150905b5566ccdf29a1340003f46e959165ff8784618d091e34a2aaa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679272, "uuid": "89d6465f-e260-4ea6-a6e1-58b867ee10a3", "value": "T1D40112C9C100AC10009EEAAC22D75190F410C3CF568A4F25BF6D2D3EEB88C10F067F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679272, "uuid": "ab3ea69e-2740-45f2-8315-ba83652bbc0c", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaDCW6mXCzatH8CSkC4DzUFCuHZ6X:kXCKysE2hi0ziQvZohaDb6O8eupZ6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679272, "uuid": "1520b4e8-a580-4de8-a138-e46f0fefb725", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679272, "uuid": "d4bb0c9f-7260-4f5f-b7b6-c7e321b441e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679272, "uuid": "09cc744a-076d-41fe-a31d-18a49d2544ed", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211a5d8b-85ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1784725579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725579, "uuid": "a452d284-4338-47a6-8401-fa8566a7f6c9", "comment": "Malware payload (MaskGramStealer)", "value": "e15381964ab8a89effec8c6aa724b138", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725579, "uuid": "e35f5279-ed21-489e-b0a5-24bb724c51ad", "comment": "Malware payload (MaskGramStealer)", "value": "87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725579, "uuid": "2d88ddcf-369d-45cb-9057-73e9a2c69e22", "comment": "Malware payload (MaskGramStealer)", "value": "4ce1468b5a2aea310d0f9cb89a3b69903f554aeb", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725579, "uuid": "eb754ec0-2401-4287-b9e9-3fbdf9ab4510", "comment": "Malware payload (MaskGramStealer)", "value": "8d87f4fdf5fafc9ea75d1476a9db3c55e4c28ede73e4065fd642d279763caa6e1ceeaf95d9108b801748a1a5a2db3f69", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725579, "uuid": "55124c54-9d05-4617-8240-2d46f5221abc", "value": "T1C3E6337391E178E4E091923FE8D68B075F27BE31B238EF4D627291714E692823E75670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725579, "uuid": "13dde689-f682-426d-8233-e01bccc71ceb", "value": "d5ad8ad13115b9d52e80226f77cfdf95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725579, "uuid": "e5a60afb-7cfa-45ea-91a1-cdd7d600b237", "value": "393216:5N1wS5eHly8k3QDCvhwJIb8qvcwMeg/p/V:XaSSvk37R8Pigh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784725579, "uuid": "7e7b1507-3035-44f5-8759-feb918a40796", "value": 15106048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784725579, "uuid": "ac240efe-7294-420b-8e3b-271b20ce5b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725579, "uuid": "8c7373bc-2fff-4746-a63c-746ea9675c85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a132a04-8591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784699529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784699529, "uuid": "a61ece8f-7f63-46c9-9053-38a2c1be7ed6", "comment": "Malware payload (Efimer)", "value": "732b551970c4f96c30cfde0565bb638e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784699529, "uuid": "7cc783c2-7076-4726-a054-7159a5f2117a", "comment": "Malware payload (Efimer)", "value": "8836a9fbb659a8bcd2a400fd0f1b971d92b46cea173a583508010f6db52d3274", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784699529, "uuid": "f2c38b35-8bc5-48b5-a72d-30f9c62ca04f", "comment": "Malware payload (Efimer)", "value": "f1e8e55c31892eb323b5f71afcc2dd82938e03ad", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784699529, "uuid": "f6a14e16-b2fb-4060-9abd-e786552cbb23", "comment": "Malware payload (Efimer)", "value": "abf9d105b27fc9e64ae7ff3d8bdfad2b4dbf9bee11eaf1a1bceb798362c28e159021f6270aa7810841fb74bd50be27d0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784699529, "uuid": "afd8b101-22b7-4129-b539-4d45ac1dd70b", "value": "T171E633089AE005FAE9E351BCFDB15D95D9B878722372C6C72BD417A0AE631F04D38627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784699529, "uuid": "80d8ca53-60ce-4463-8562-763342d60292", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784699529, "uuid": "2cf895c6-972c-4a24-9a34-dce07a65bdd7", "value": "393216:n9OgFpfC6rQ5JtQl1QKZqZXMCHWUjXEcuI3/PGTAI:nlFlrGt4QK4ZXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784699529, "uuid": "0350dcd6-17b1-452f-ae3a-fac5b9f641bf", "value": 14310373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784699529, "uuid": "f1b7553a-8951-4758-9015-336b676c29ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784699529, "uuid": "cc227b4a-2c33-4957-9753-b8b71597bc43", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97354a8e-85e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784736944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736944, "uuid": "68c13eae-f82e-43ac-a3b4-a3d06f9046d0", "comment": "Malware payload (WannaCry)", "value": "7c32aa9270ff7ded8ef5520a3fcaceb1", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736944, "uuid": "ee97551f-0bae-401e-9b19-53fd1d910bff", "comment": "Malware payload (WannaCry)", "value": "88a9d62d3cc2290f33ecb40ed5d266792aaf0438b042e0e6998f88cd1b0e8d14", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736944, "uuid": "b288eb22-988b-4e6c-a914-d04fa59a79c9", "comment": "Malware payload (WannaCry)", "value": "f6914d9a337e66152b41793902cf7e8d844565e0", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736944, "uuid": "e8b252ca-44ff-4f6a-b34b-e4dccad20a96", "comment": "Malware payload (WannaCry)", "value": "a919eec809078ce7b2f0e32305d9e2826176b991a4753978d7ab71f9b8ec4336034a6296aae347c469a37642529d0466", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736944, "uuid": "bcdb2e81-a3b9-499a-9698-a063ccfd0182", "value": "T1B4363358723CD1BCE10619B444B38E26E7733C9657BE5A0F8B5086671E13B5BBBA0B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736944, "uuid": "742436b3-c5fd-4bfb-bf29-a5b1ecfd0ba5", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736944, "uuid": "4ab98a37-62f7-483c-a1c4-0626b90f9811", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P5:DXDqPe1Cxcxk3ZAEUad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784736944, "uuid": "cfc64487-4c7e-416a-a90b-36558044ca60", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784736944, "uuid": "a5d287e8-53c5-4a48-9c34-787ff7c26040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736944, "uuid": "1026d1d9-ccf2-4321-b176-aafa7a7bc4fc", "value": "88a9d62d3cc2290f33ecb40ed5d266792aaf0438b042e0e6998f88cd1b0e8d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ebae6c-8589-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784695928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784695928, "uuid": "3d635b2a-8d4f-48f8-ab9e-21b11dba905b", "comment": "Malware payload (Efimer)", "value": "5b1dbd70489b4ea2628d17733f141a25", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784695928, "uuid": "d0b2ce64-5564-469c-b97d-cc89fd61916f", "comment": "Malware payload (Efimer)", "value": "88b1992718e4ba9abeec72bb8be2945c402354ca6a1407dfe09de0a8b773dec3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784695928, "uuid": "8262821d-e931-4f66-9a8c-b0be5f5082d1", "comment": "Malware payload (Efimer)", "value": "e9013962701599851205055884858aa368d5eb57", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784695928, "uuid": "3b8a59b4-c37f-4812-a704-3275a975e260", "comment": "Malware payload (Efimer)", "value": "18065608b097e1876667e0c50dd274059e344a25148e1d24da157af9e9e02c2d27e3d425077cf12f40d78e3426ef0bff", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784695928, "uuid": "120d325e-44b1-4197-b2af-8f59cd146e8a", "value": "T119E63344A6F012FEE6A3D23CDDD152A6CAF134794732C4AF625487E5AF1B2D02D35623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784695928, "uuid": "35aebfdd-2bca-40f7-a2f0-38781370df32", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784695928, "uuid": "afe39b6a-ea76-4f7f-962d-a95cb27a862f", "value": "393216:4n6AGC8za7JOe6fRimfjXXMCHWUjX7cuI3/PGTAI:wFKzAJx4iUjXXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784695928, "uuid": "e3b35387-8bd5-4e97-a0a9-e60e9e2029e0", "value": 14320532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784695928, "uuid": "3c35a68a-2ac6-40cb-a26a-827bb6f95365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784695928, "uuid": "13996bae-b47d-49b3-80f0-1bae08b0a48e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71eac5f-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784705751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705751, "uuid": "2be7e496-dca4-4337-b0a1-aba53ce61529", "comment": "Malware payload (Mirai)", "value": "c567626f74897d7c21dc9bc54e7c240d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705751, "uuid": "9267481b-2054-4fd7-9936-8deba1c3f757", "comment": "Malware payload (Mirai)", "value": "8906f79bb0da23f9b926f9a9e2e2ec02a13019a64f1bcffa9a2a770a3247b103", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705751, "uuid": "ccc5db8d-d9b5-47b1-949e-6c805c73956c", "comment": "Malware payload (Mirai)", "value": "6f20a5cb7ed77bcc6d2066242edf7aa3c47f67d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705751, "uuid": "04f99c0f-eb07-4838-8845-12281422d8e5", "comment": "Malware payload (Mirai)", "value": "72ce83d18505843ef889a38b1e646d2dfdc38375b6fb9d0690270cbcf7dd810e375beb48fc6583410685489a716098e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705751, "uuid": "2296cd0e-c752-42d7-a133-5402fdfc152c", "value": "T11CE32B81FA47CAF7D4470AB502A3A73A8632EC290A2BC655FB2DFDF59F175C47109218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705751, "uuid": "5d0829fb-e806-4fb8-a964-2ddae8195a59", "value": "3072:2Cow4A8/H8uFH1Cigkx1MpU5H7+YTv9nUtv:NznczrYU5H7+YTv9nUtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705751, "uuid": "8044dd66-c8df-4665-bfeb-e5bbd5dd2b35", "value": 155807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705751, "uuid": "301cd52d-33ac-4247-bc30-27cb51fa9c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705751, "uuid": "12cc8b81-d5f2-47b6-8a1b-0d4a31aef996", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f480316c-85f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784740536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740536, "uuid": "682544f9-b5ff-4f15-a4bb-29ed8c136df7", "comment": "Malware payload (WannaCry)", "value": "6d8205a5f509c33ecb191690dc5ff48f", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740536, "uuid": "6ae70c51-e2d2-4efb-9c1d-ee9a46a5e44b", "comment": "Malware payload (WannaCry)", "value": "89f2bd29e1493bba4ca3d25a1a155cc1aa4ed3360a5855be06e90ad81fd28ae5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740536, "uuid": "1b1430e7-cf4d-4d1a-87b1-b99a3cdab552", "comment": "Malware payload (WannaCry)", "value": "ca480840a1602d406e7230b7402a448a2345acb2", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740536, "uuid": "97581827-7870-4e3e-9204-ba47cad10eb6", "comment": "Malware payload (WannaCry)", "value": "867c3459f1b5aaa2584d159f7152d365ec3e514df4d0d59d4c507107ff75f98779a72cf286de002ab91028ca1ccb0b0e", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740536, "uuid": "ef0aa234-18cf-485e-a0c3-415b3ed9e7e9", "value": "T11A363354675C61BCF0A6067494738D29F7737C29A33A871F8794C36A0D13BC3BAA8B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740536, "uuid": "a3648bc8-8c93-4bd2-ad40-06ac04bf8eb3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740536, "uuid": "c771a3dd-ba16-47f9-82f5-cc8ed6b2596f", "value": "49152:jnXnAQqMSPbcBVQKRdhnvxJM0H9PAMEcaEau3R8yAH1plAH:DXDqPoBfdhvxWa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784740536, "uuid": "d0c16678-d616-4af3-8f83-f10e89780402", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784740536, "uuid": "539908b5-6bac-40bc-afe3-dc4c6bdedfe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740536, "uuid": "609a0416-8525-46e3-8d61-00db025c9f73", "value": "89f2bd29e1493bba4ca3d25a1a155cc1aa4ed3360a5855be06e90ad81fd28ae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a13e195-8562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784679208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679208, "uuid": "fa6a8ca1-65bb-4c36-abf1-a00df5579002", "comment": "Malware payload", "value": "5f2e5fcc62332488c7719734e17fdfb6", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679208, "uuid": "d8ee67e0-c89e-4477-9021-02896b64fd55", "comment": "Malware payload", "value": "8c7334c6455f4e7d62a9eac56532463b06c50ddf8755610b71af7d062f0739ae", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679208, "uuid": "d571030d-8a6b-4bfd-889b-3864a1ae9a2a", "comment": "Malware payload", "value": "452f597bf23f1e02f0452ee02ecebea81911e6a6", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679208, "uuid": "2cdb7971-f0cb-4412-8bac-7948d9b3439c", "comment": "Malware payload", "value": "d76b82fbc2c46549bf9dee52e8dd841c889ab299b4c0849883ea9c03492e4bb58a5a808e317f23920a550bdc6b3a3634", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679208, "uuid": "a84a27e9-9d45-452c-bb47-f41433826e36", "value": "T113D5239E7DF529B0D836C7768FA3F43DB02977898B208D837ACD66004D622580D797B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679208, "uuid": "c612a589-34d5-46c5-b400-22bf66e47b47", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679208, "uuid": "cbf1a526-03d0-4f03-8354-abfce3391c0f", "value": "49152:feuv5UBFzm7raanrljR51kwk7UjsLNTOtyH6EfCqIxuKsXlcca8QlVA:feu+zm/JtVjsx8JEfCVHs1V/Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679208, "uuid": "b4a47d64-d76c-40a0-833d-bfcd985fff02", "value": 2958848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679208, "uuid": "f001886f-347a-4718-b2f6-ccd0f04c8bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679208, "uuid": "fe7845a8-f59d-4c9c-ba69-ffcaaadf52af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6fb0a2-8562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784679271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679271, "uuid": "66c4df8a-1345-4eb3-81d5-28bb826a9ca5", "comment": "Malware payload (Mirai)", "value": "e18ec4eb89a970bac2c723658a4b5932", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679271, "uuid": "a079ff1d-1d8e-416b-9c34-2db29a4cb42d", "comment": "Malware payload (Mirai)", "value": "8cb552bced9f715c2c24e058d5f589710e185991af4552e9f22d15d1249ca271", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679271, "uuid": "a656c5a7-8db3-4c45-af4f-ca838ce8e42d", "comment": "Malware payload (Mirai)", "value": "103cbc756e510be712259f4a2a7477f7293ba0c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679271, "uuid": "6846dc77-a246-4b6f-a255-164b25837f1f", "comment": "Malware payload (Mirai)", "value": "7af2f7478567df88d44e7b0f0e2351c85ced2241500eb447ac37593a1383dca4c029d9ee5eb839b99961fc8b241d377f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679271, "uuid": "84c2ae44-8a2a-4037-8471-6bb8ace24d72", "value": "T18683082ABD819F05D4D526BAFF1E924933535BBCE3EE7102DE146B2527CA91B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679271, "uuid": "44b58ef5-c715-4435-9ced-abc511093d37", "value": "1536:Mjn/sQkEG/DKYUIlkvkCCd3cHqDdGg32Hd6NouPAxwuH5llUbiuNa4kZHh:6OEID9g2ICl32Hd6NouPAxRK7NaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679271, "uuid": "279b02f1-0ac2-4edc-af4b-2d6fdd3bc1d5", "value": 83836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679271, "uuid": "77d6e1fc-e662-4e90-a914-accc37d274b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679271, "uuid": "9fed9176-fe8a-4cec-81ea-e6c5e12ed627", "value": "pDY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d531099-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757838, "uuid": "cffb8d9f-6f36-4866-a13b-92d2749980c6", "comment": "Malware payload (Mirai)", "value": "2b40cd455c4d77dfee70a71f8b05d87b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757838, "uuid": "3551211e-9cf2-49db-b4b3-6fea357b35e9", "comment": "Malware payload (Mirai)", "value": "8d7e5addf9b3c791a5be49062a69f91c540a6d5c047ec82c20deafe69d4149f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757838, "uuid": "51cbda80-ba2a-442b-9fcf-a6d6d0a66d55", "comment": "Malware payload (Mirai)", "value": "7c3a78c9b163d9dafc753f1311c31b785c7e55ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757838, "uuid": "d3340670-1d52-4ffc-a07e-624bee205710", "comment": "Malware payload (Mirai)", "value": "d751907e98d0a6c399f1ae10d3efb45a865c8f63d7b0dd45486e5d75104e66bf0728be26bf575bb98674a1cfc1cfe3f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757838, "uuid": "168d6581-5ad5-4f29-9640-5ee1f7628370", "value": "T147538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757838, "uuid": "f3303d2f-d123-44a4-b59a-1663b9672734", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757838, "uuid": "a32b20df-64a6-48da-807d-804d070ba7e3", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757838, "uuid": "3df0369b-aa05-47dd-8b6e-7651b3527dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757838, "uuid": "564acb9a-3432-4579-88d3-293264c96683", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee997bd9-85ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784739238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739238, "uuid": "35356d04-a4d3-4a57-b96a-0c3148e280cc", "comment": "Malware payload", "value": "a74413ec08d51e58917ff869aa63c457", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739238, "uuid": "02e70abe-99f0-4157-b60a-aacaff6c20f0", "comment": "Malware payload", "value": "8dee167a7d2dbdd73ce1e58a9bdece0c2aed182851ce1d965cb39630d1b2e062", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739238, "uuid": "e8f2955b-a176-4854-9a4d-0a1b1131acc1", "comment": "Malware payload", "value": "c5cc7cc5b6fdef0e3342204eda7757ee084146d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739238, "uuid": "345ef124-8edc-41a4-924a-c988327797d9", "comment": "Malware payload", "value": "2f529f66ce19433ffa67d5b50470c89a921825548b343fb058c8bee74a7ec08733159efce97c91cc1d81cd7fcbcd0037", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739238, "uuid": "7378ad8b-2b6f-4b3a-8a37-49a29785bc09", "value": "T11824F1B71BBC67FCED4C9D01B236655663A8B0BDE856014B31A989D342ECDE020979DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739238, "uuid": "7b6431b7-1047-45ec-9e1f-90f7df41779e", "value": "6144:I8yzSYIeMvOHsboMCrw2R6UQo53TdnSx47z:I8yGpecbe02X3usz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784739238, "uuid": "7a26759a-14c5-46ad-87e2-b789e5a99a47", "value": 229908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784739238, "uuid": "91938667-c31e-4f68-9894-54dd51f7101a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739238, "uuid": "089c2d6a-ac1c-44e3-9525-91843533496a", "value": "Miljt51.emz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e6298b-85a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784708724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708724, "uuid": "88f12afc-6283-420f-bea7-7a60a62e735a", "comment": "Malware payload (Mirai)", "value": "d3f9d3dce182a4c1b5f53e8f6e6e8e22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708724, "uuid": "2c9bb957-5e61-4b41-a9b1-919c19b31f71", "comment": "Malware payload (Mirai)", "value": "8e46d874eaac73392dbd40acba11155e862d78d4eef33fbaf874ac922dc6b184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708724, "uuid": "f658671d-d70a-42f1-b17b-399c319a8236", "comment": "Malware payload (Mirai)", "value": "c8bb65b629c67d77bfa809fb2b679d5f1fec0303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708724, "uuid": "ff4c07c6-a342-47f2-9c41-12ea46ec4124", "comment": "Malware payload (Mirai)", "value": "f294187d2edd4d217c093df0ed23979df044ef578a502f5d4ad5b3335552e2aa0e14fa937492797ecf85daf65d344143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708724, "uuid": "89a7de1c-5a74-48c0-b536-e848d3b16b16", "value": "T141242B01BD518F53C5D32BBBB79F42993732672887EB7302DA18BE742F4669D0E26211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708724, "uuid": "94537844-500b-4ab9-bc7c-0b9fceb4cbc5", "value": "6144:9FRCgwuff0HckrAKQk8c779TtyFYKiKH3vtZmLE1SMyV+lH1:9FRCvxrA41NsYKiKH3vtwLE1SMyV+lH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784708724, "uuid": "4145e45b-613a-4558-9bc0-89d6fc3dfd34", "value": 226599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784708724, "uuid": "752db1b2-d841-42ea-961d-40942ecd92c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708724, "uuid": "7d160b6c-781f-49fd-9a09-1740899f2ad1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4804d91-8574-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784687252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687252, "uuid": "35b76021-83a5-4452-ad9c-73e0bc834d92", "comment": "Malware payload", "value": "691a7c469efa2ba0eb10c6fe5acdf957", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687252, "uuid": "d33d15cb-4882-4674-aebd-cb02c777ce64", "comment": "Malware payload", "value": "8f0637cd0ceefdd4a98b8d33c7ab50ca6664647f8e979d23b43f3c56329ab269", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687252, "uuid": "e5535421-b6a7-4e63-b5e3-4c27d9ec5385", "comment": "Malware payload", "value": "9d0c4e3ab13a247a61aac38c5a55b9207972b5f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784687252, "uuid": "7876ac69-99c6-4546-894a-a07ec680b5a4", "comment": "Malware payload", "value": "728c7cd1eaf15732821a56470a366a82236ba6e7ec00ef1b86af560056b8a09ca063a26e3e0f286c784499cbd91026bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687252, "uuid": "cbc1d489-530c-4ab2-a15b-3e7d046ecb7d", "value": "T1D6016BC68650A90051599A9E669792A0F490C3CE198A0B68BFEC5D3DFB9C814F026F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687252, "uuid": "5cc43451-b3e2-4e86-a8d4-cf19112b0093", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaEECxCCOrFLYC8CxZO1esDCBIqmCGsRauD:kXCKysE2hi0ziQvZohaEE59UYZMr1mR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784687252, "uuid": "4bf45aac-8984-43b1-a5f0-012129928d8d", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784687252, "uuid": "d6147ce4-fcb2-4671-b138-9d7b9060673e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784687252, "uuid": "ff355891-4bd0-4d18-9ef1-ae88e81135af", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ced027-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707147, "uuid": "d4c10a16-1f67-4092-8482-0216e82510e7", "comment": "Malware payload", "value": "2e9befb1006d48b41f9f9f027ee4db6a", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707147, "uuid": "c8c1ca06-91bb-4682-a361-a7d62915e925", "comment": "Malware payload", "value": "9015670fa19b6f7bcfbc2f5d24fb095b7030311b5da5adb59c8dd665165ad67c", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707147, "uuid": "0a6f6fb7-9e16-4fe9-a191-01ab7fd901c6", "comment": "Malware payload", "value": "d43c2ad48ac61951c1fef2e3c4106c693a3dbd9c", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707147, "uuid": "55e71274-82c4-4970-81b0-09e07138bd9e", "comment": "Malware payload", "value": "a99c30fd994882db23eba0279e34f219261f35b25db1f7a5d064a0ba73b68a0b5d93ead8a0be2e150ee0ce31319e304d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707147, "uuid": "bffd4c5f-92e2-4ed5-ad66-168ec6f1cb55", "value": "T1F5341260005300B6E05825774FBE0514A8EEABC784B6320A6CEC76D6FF43677EABED45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707147, "uuid": "ef4371d2-ac66-43bb-9a20-2f72f85169ef", "value": "3072:MuhYvtTHq9GC+vAcgpuavDOKPgVkUrR0fk6cO1Gk782QyhDcn06VU/YfnEXwoPe/:MkYvUZRjVPenqM6cO/HQIQ06IYWPlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707147, "uuid": "45fc31de-8e5e-4532-86d0-a67b75f2a70f", "value": 238249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707147, "uuid": "08c6b55d-aae4-488d-9159-cf476a598bd8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707147, "uuid": "5c117187-a9a1-44e6-8bed-b56143985970", "value": "StatementXOfXAccountX-X000RA-V-064.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f284d727-8608-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784750841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750841, "uuid": "f083f4fc-3128-46cf-82d1-ef70fea7adf5", "comment": "Malware payload (Mirai)", "value": "cded1caa7ae5919db4c44e38c4e2eba0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750841, "uuid": "62c01b08-6bf0-4ff4-bdce-32e718cdafaf", "comment": "Malware payload (Mirai)", "value": "917d28f5355d4167f02629ecf3e924e38d99de51528e2a425bd06841221f49b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750841, "uuid": "ca943a45-ff45-4fe9-8ce5-b73ad032c1ee", "comment": "Malware payload (Mirai)", "value": "ebbb7678ece11699b8b5e7e99c17aa982697ee03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750841, "uuid": "11b94c4c-5f16-47ab-b80c-67fffba97fae", "comment": "Malware payload (Mirai)", "value": "cfac83d34d59474c4ae0a0c00e490e51a397a6e50a1f32131da19f5f8414da6ab8526578a45b86843ca4316e6b2389cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750841, "uuid": "da626600-2d50-4436-849a-8dfc4e526afe", "value": "T1FEC36C22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750841, "uuid": "695c9b4a-c6d4-4f6e-b529-0ab8e2a8c468", "value": "1536:eZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnXAlQAI7+tIMPYm5UOhAtxftGbC:r3IbE/HPQbKKaYOUWNbX0st0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784750841, "uuid": "30d6227d-9c2b-4a06-8032-46c27674152d", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784750841, "uuid": "66a50a67-b88a-4fb6-bf98-11086f6df56d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750841, "uuid": "53846424-f2f6-4c6a-b133-24e561113f77", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b4554a-85f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784744140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744140, "uuid": "0c83112a-ebcd-48ab-aee1-76274a838a48", "comment": "Malware payload (WannaCry)", "value": "6fd62b62dee269d1a59d95e4d2370b36", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744140, "uuid": "05c45110-8a2c-4a00-a628-fe6f145108a6", "comment": "Malware payload (WannaCry)", "value": "91cd12ce85d9e32f75f732ea090a1385ab4e31ef0dd6904ccdf7b5d1623ddba8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744140, "uuid": "84b87e31-3c6f-41a4-a790-11942c0ba50e", "comment": "Malware payload (WannaCry)", "value": "fa8568e71e9b948b91e70ace4304b870e124067a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744140, "uuid": "0c604a28-ef5f-47ef-af4c-538081ecdf8d", "comment": "Malware payload (WannaCry)", "value": "35ac958788cbd96a9cb7b71521e1e64dbfa9a761e1a6290a958fdc310e1673818b81d4bc978ceb3cda6f76902c53793f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744140, "uuid": "38730524-0162-4e9f-8cd5-c68ee2c3c7ba", "value": "T11436D642D6D52EA0DDE14BF7267A9B10963A5F1582ABA16F6225000F1C77F0C8DE8F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744140, "uuid": "aa90bc75-d248-4927-a8a1-3dfebf0438fc", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744140, "uuid": "4a230846-7a72-4a64-8a0e-476cb5899535", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+Am:jnXnAQqMSPbcBVQej/1INRx+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744140, "uuid": "a160f1ec-b32c-4598-8edb-816b9196528f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744140, "uuid": "106735b1-bb8e-47ec-bacc-3afe710ad9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744140, "uuid": "4da14889-46f3-4800-a8d3-169a3d3c9769", "value": "91cd12ce85d9e32f75f732ea090a1385ab4e31ef0dd6904ccdf7b5d1623ddba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d61331-85c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784722874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722874, "uuid": "1b3a391d-bde5-4bbb-8b21-ede74e6adc9f", "comment": "Malware payload (Mirai)", "value": "65bc7b804a0f28536b9d0355dc9d720e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722874, "uuid": "7d890303-e6b8-446c-978e-52c4ece3efd4", "comment": "Malware payload (Mirai)", "value": "9226e3b3ad1382e2256d1d5b9fdd5a38995db3117bf90ae3689e829bf5c3df3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722874, "uuid": "1084255e-ccbc-46c3-80d4-a9ea8fa26c1a", "comment": "Malware payload (Mirai)", "value": "76c85bb08a03ecf712ef6b7fb71eb8dcb2071a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722874, "uuid": "61d226fd-3d50-46cd-b10e-4d2060154d67", "comment": "Malware payload (Mirai)", "value": "4ae34a9a4f8e62989e68698598020d967192d986de8a128d3696c55ee1b4e7c01c11998a05e40cb665cc4c843091fb5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722874, "uuid": "3ba3eec7-5ca8-4b7d-9d4c-b3deb4df8d9c", "value": "T18D831859FC806F15E5D625BAFF0F414933634B6CE3EE7212AE205B2527CA91B0F7A406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722874, "uuid": "33df08b7-2b2d-4437-8983-7a940dc24429", "value": "1536:31ntR38ftH6PDCzBSKa0yGFtGB2o5ZlYBmiLsYtuqScZkYgVRXb:JCtsCBSKa0yGFtGBszsYtuqScutX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784722874, "uuid": "648c480d-a5b5-40b8-840d-f0f5356b2ef5", "value": 82000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784722874, "uuid": "41bc6cd1-e4a3-4c01-8599-a34fdcd604f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722874, "uuid": "16cc428a-945d-426e-9d7d-311356d6e976", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c029fb-85d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1784729074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729074, "uuid": "c235699b-de1d-4e8f-9c66-8017d2add367", "comment": "Malware payload (HijackLoader)", "value": "606055ab78fbb2aef6f09d87b4cb5a1d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729074, "uuid": "2b8db077-eb46-47f7-982f-4e24c6d1252e", "comment": "Malware payload (HijackLoader)", "value": "92a067220d9901fc3607beac75cdd6a77154b37dda68fe126e1797f9b3045b29", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729074, "uuid": "9d43481e-c26e-4e13-ad81-4f818e98b36b", "comment": "Malware payload (HijackLoader)", "value": "4b9399e027cf2e965b3c390b97f1c313031aab41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729074, "uuid": "17ec1c7a-8354-4fb4-b21f-493c601d603b", "comment": "Malware payload (HijackLoader)", "value": "dd7e6e419c1a9eb9784ddbdea5cd4802a3f3a99f9e6c36657c5b0763704a05ea9dbd32589c8d89c2ba11779d0bbda11e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729074, "uuid": "44c3dcb6-3641-4ac0-9741-5de79556fb78", "value": "T116563306FA476075E0329C72CE1584123C3BB4BC6EF558166CB9C60F9B396D29DB278E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729074, "uuid": "e5c5766f-b9ac-4839-8795-d8a9646c0107", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729074, "uuid": "6847e1b4-8c08-4f8b-b6cf-a471d535ee90", "value": "196608:w/QxyGNTt5K8NEZUwAB4WL+qqhbSSzGT+9Qd:wqNp5DNgANqFSSv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729074, "uuid": "1f915334-6875-4d27-9696-d6bbe2bd6392", "value": 6378622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729074, "uuid": "6d45857b-588a-4b3f-b4e8-db8bf7e5af4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729074, "uuid": "0e0d48f1-539d-493d-a8da-f77842e21568", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a69a99b-8562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784679235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679235, "uuid": "3206ed07-6d0f-4f9d-b8ab-3208638b6ce4", "comment": "Malware payload", "value": "1707cb5397c121b767fe6ca40d4897ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679235, "uuid": "76396449-978c-4388-9da0-03cece8083cc", "comment": "Malware payload", "value": "9348f83dd587516806782a5bb4cb0a87c4c904152f07c2958e0275b9ce8c63ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679235, "uuid": "9295efd0-74ad-49a9-86d6-abd9db057bd2", "comment": "Malware payload", "value": "3ad4c94b62330e25aaaf65bdc8e38a70eb928ca7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679235, "uuid": "96236478-026b-4546-a9ec-b8a3854e242f", "comment": "Malware payload", "value": "836aae22f56acc72bfbbf86f71d5e7b0a349e08fbebd06c9f374a8eda877cf2fece067c762420f989ecee276f9330b39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679235, "uuid": "5da33fac-e115-44c5-b7a8-e6ba050a752b", "value": "T15D056B1BB2B334FCC16BC030479BDB636835F46601226EB761C4AA352D53EA11B5AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679235, "uuid": "15093f61-87e6-4573-8fa0-ba49fcfbf120", "value": "12288:gu2Lj6HaI/Di80JWm+eKFE0KWQyyaOBgmDeDr:gu2L2HaI/DiNWm9KFhmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679235, "uuid": "b8b56473-0f99-4615-ab58-59e24eab7fd6", "value": 802768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679235, "uuid": "027de23e-f6b3-4581-9b86-1eb638eb49c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679235, "uuid": "adc89484-d55c-459a-a09a-e48798c4343c", "value": "rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0eb061-85d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729325, "uuid": "258f245b-1fcf-4b37-9659-d34fd3c6a929", "comment": "Malware payload (Mirai)", "value": "2f6887b7eedd4e0345fbcb8458e614b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729325, "uuid": "e0299a54-9488-4af5-a271-e65cfa187bbf", "comment": "Malware payload (Mirai)", "value": "935d811f3f917060c42dd12316171216ff97ce5ebf93ebc22d02ea40933afd7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729325, "uuid": "c632a1f2-1522-4a10-b7e4-fc22269eaa94", "comment": "Malware payload (Mirai)", "value": "b72a7dbecc7b3f6848ce842d94e5a6359af3b206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729325, "uuid": "e1636dcf-aa1b-44b7-bb74-23171b62f88b", "comment": "Malware payload (Mirai)", "value": "0004db800cdc1130aeaad1d7e9cbb28bd87357fa274c39cfcc104081a7d8767da85d2c7d64711479515cc51aaa61b79e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729325, "uuid": "baf34c2a-a775-427e-b38e-ee7ecd7cdb0a", "value": "T11B330236D277FFE3EC144C36A44D8C579E236AF280F2637335760C5492A68560B7884B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729325, "uuid": "57b0b99e-98e4-4d2d-b047-b494aedc5db7", "value": "768:S7ERWPB8ZOU1GZ6VcaVb4F5sJaP77IUm9XrAbbDhjtV+GoyKIOuNr9q3UELzv:vRI8Zp1G04F5ss/wrAbbP8BIvKLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729325, "uuid": "254441db-14fa-48eb-842f-b15267a01125", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729325, "uuid": "5ef5fd03-5b6c-4843-9733-677f74bd5e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729325, "uuid": "f5755525-f483-4a2d-94a7-206a157afc1b", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c9daa-85d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784730050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730050, "uuid": "8d2820e2-d66c-49f5-a1c6-ec59b93aef6d", "comment": "Malware payload (Mirai)", "value": "145322dba9a3187e83ef8850bef496dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730050, "uuid": "a3e9de6f-82a9-4aa4-96be-0e9829c470ff", "comment": "Malware payload (Mirai)", "value": "93bc45df6a70321abca3606a30e11d416dd6092089234c15c8a8f9e10a6d0569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730050, "uuid": "549223bf-3c89-4067-89a4-8d3795f4ebda", "comment": "Malware payload (Mirai)", "value": "faeaf379005e04fc4a41e5683a88446ea7ad4184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730050, "uuid": "1b8f90f6-f8ff-43d3-b757-aae4e72f7c0e", "comment": "Malware payload (Mirai)", "value": "1d13443391bb95d5bec3b2068e1cd220c41d2bef04f71b042a1eff4ef5038a6f88bfd514055fcdb496c28fc86ba5840b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730050, "uuid": "5c162287-4fe4-41b1-8825-f96b72a130d9", "value": "T104C30845F8509B13C6C656BBFF4E428D7B261758E3EE720399256F21378B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730050, "uuid": "7562fb00-8504-4bc9-9b07-d77f7790c06b", "value": "1536:aE/U6QhNzkCQw2uC+4VfKNsTZIxRoaaOqJA1UJpamKl6mwyw9BijBdbGAgGEQvjI:aE/6XQwP48eFIxG4yqZZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784730050, "uuid": "87e14b7b-9fb5-4e0d-a0a1-57849b8a5305", "value": 125292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784730050, "uuid": "65ac2a87-16a3-4408-9eed-7f5baecff0dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730050, "uuid": "b9d3e859-ebd4-4130-b466-aa641254b676", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6200c3e5-85b1-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784713232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713232, "uuid": "398cd72b-b25a-4c60-93e4-30bdbf158069", "comment": "Malware payload (PureLogsStealer)", "value": "4aeff1b8916c6a4c9e6b4c65f4012994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713232, "uuid": "1935c4dd-2fea-448a-9fd7-f80da6560708", "comment": "Malware payload (PureLogsStealer)", "value": "942f2668e6611ce547411ba1a04224aefe461acf710f29a9ce7663607a125b41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713232, "uuid": "454b2c93-eae8-485f-bbe7-c5dba1855f09", "comment": "Malware payload (PureLogsStealer)", "value": "66da0fd03399463971ca71d898a8f2ec49a13c4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784713232, "uuid": "71718908-94d9-48f9-bdf2-8b8c4e847eee", "comment": "Malware payload (PureLogsStealer)", "value": "9b26821f0d60209e7a70f10f781a616a57a1cb69a70e5169549fff182c196884521bb4afdc756853449214042bf66079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713232, "uuid": "163bf7c6-75ed-4d1d-a184-d24ae1331147", "value": "T12805BF3B37914E21D24A53B3C1C7490187EA8A4776ABEB0B318513D61D473EEDE0B69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713232, "uuid": "b2aa5beb-8690-4362-a268-176804967cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713232, "uuid": "10d5ff6a-3e08-4e0f-9d9a-30994611388d", "value": "24576:nTvc9/WMOC7kbmf5GU77Rafm+jSHFxoKs2:nrc9/jsmRGs7RijJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784713232, "uuid": "286f958a-6c5b-4ead-9b0d-7dd2d138680f", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784713232, "uuid": "efdb3cb1-5112-4ba9-9a4b-30ea04a8373d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784713232, "uuid": "a9c4c979-f5a5-49f5-aa97-f13d62ed4830", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.43617581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74342561-85c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784723570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723570, "uuid": "1a3759f8-55f4-4138-a1bb-cc0f80973ee8", "comment": "Malware payload (Mirai)", "value": "dc6d0627844bcd93ff2829e0da6fc22a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723570, "uuid": "66c85954-7d63-4403-bfcc-63b6eddf5cf4", "comment": "Malware payload (Mirai)", "value": "9445bf829810a4c30b161e2b00a91635ea445dbf408d30f60967a9d95894830a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723570, "uuid": "52ba353b-ade2-400c-b783-3a9241fc6eb1", "comment": "Malware payload (Mirai)", "value": "8ab3a0e0c0028bfabe11b566d6c0d5866cf32cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723570, "uuid": "de7a0ab9-eb0c-446a-a8c4-0e8cfebe5012", "comment": "Malware payload (Mirai)", "value": "467fe4cfb5d1702f5cdcf2aff679eb51871b720c3ccc01b22be44527535178c70d2ecb6aff851cc742698ec943dcd663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723570, "uuid": "e8e3c02a-5cae-4d79-bb5d-4ee318b9f27d", "value": "T17593F781B8824A6AC6E02379E66E718E33A0B3F5D2CF3127DD615B12779518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723570, "uuid": "1008e97b-9bb5-42f5-9ec5-ef77dd7307fa", "value": "1536:9m0L9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthSDH8ku8oeIH:9rBq1BtD6wq5UIORIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723570, "uuid": "5f3521bc-f404-47ca-9f13-54a645a2dc71", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723570, "uuid": "896abe01-0b6b-4139-9be9-4d41545d3234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723570, "uuid": "28de7408-fb37-44d9-999d-7e1894cd05d6", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35eb422-85a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784707033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707033, "uuid": "c61039cd-b415-4914-b597-c7f8a083baba", "comment": "Malware payload (AgentTesla)", "value": "6d6035d53d3fe5c5a8c9699e9c23257c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707033, "uuid": "212a8281-d93e-4188-92d6-78fc18292e64", "comment": "Malware payload (AgentTesla)", "value": "944cd389c5aa5d2e51136615912d9410a3af2de93831aaa70f309d58fccad010", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707033, "uuid": "9ce14c72-cba3-42b1-a7b6-86e1d7f949f3", "comment": "Malware payload (AgentTesla)", "value": "63493eb7059ceb3240a318fae1d61e4c17f4c895", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707033, "uuid": "9fff1bf0-d820-44e4-a791-1928fda7b7fb", "comment": "Malware payload (AgentTesla)", "value": "409f024e1f187788e09fa50819a93dc6bc8717d4e2e78fe19b91366e229d7e6236062e8edbf44b7d7476ae8d4bd48902", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707033, "uuid": "8abfef5c-dca5-458c-8b39-3e3936ae7cff", "value": "T10DE5C5115724A2767225DB5D923EDF39980E600368EACF44326EC2297E5CD4B936CFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707033, "uuid": "5c464cd5-7dce-4d96-b841-97dfcaefb545", "value": "98304:b9QuMwelo05+ICXO6XoPXGDLh5AF4xjAg5sWXbszQ3uFcjoSivk0sU:hywHh3oGDgFyJsWXbIkEcjovfsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707033, "uuid": "c12cc3cf-42a7-4fca-a929-09071cc52caa", "value": 3293661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707033, "uuid": "dc667022-a5d4-41e3-ab0d-5325ab28788e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707033, "uuid": "e842ecde-06f7-4bdc-8b72-ea0fea797b8d", "value": "Info_New_Order_7132026 _PDF.shtml(~99 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e15547d-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757839, "uuid": "72ac2885-7a94-4185-b697-6f8368b34a61", "comment": "Malware payload (Mirai)", "value": "450fb13b32e19171dfe5432542f7da29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757839, "uuid": "f90632de-3cb2-47ec-819e-7f06fe6a4f26", "comment": "Malware payload (Mirai)", "value": "953b23a485f03ff659a570c9f2ff4efa3fa053c13252914112aba5d95302ba97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757839, "uuid": "7b28423d-f4cd-40cd-a9c7-eb8cf8115e22", "comment": "Malware payload (Mirai)", "value": "8deccbedb46ba862d250441633d7175b6ae910ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757839, "uuid": "6c2c82fd-0a72-4373-8761-5cce318a7843", "comment": "Malware payload (Mirai)", "value": "a80bfa31426c55ac9007f0150e3078dcd7ff4b317140a96e006a178d087e859274b287959a0a0e18ba89f80fef620936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757839, "uuid": "945f316e-9a9a-4260-bbd2-1d56a0a0b188", "value": "T102B2E161A1853E62D770713AB97CC60157AB97F8B0F672753224B7AC4BE2C47607414F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757839, "uuid": "05bb8976-6ac9-4164-9840-2c0f5916e69c", "value": "384:5ZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdL6OtRRhymdGUop5hKg:UX1De9kONQG5xD+jHMDzu+Us3UozYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757839, "uuid": "68ee5115-f64e-4984-8359-bc024bd4cfab", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757839, "uuid": "11d201fb-52fa-474e-ad44-4d6d60be8372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757839, "uuid": "78217bb2-1ab3-4a9b-a024-bf97e168ca5d", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535917b3-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714925, "uuid": "79104fa2-f347-4c45-bf31-b1ce78c868ec", "comment": "Malware payload (Mirai)", "value": "f2afb91a427c436482966b758f13cf9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714925, "uuid": "ba9bf564-36d5-47a0-a124-3d2a144e48ee", "comment": "Malware payload (Mirai)", "value": "965f8171e3ba36cf9921038303bebe76d86c21eb2d88b7d0173c1f55f041973a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714925, "uuid": "58714241-5d18-4002-8214-22cb3846c252", "comment": "Malware payload (Mirai)", "value": "c63e2aca06b8fb149842d9afe2f0fa44431ea4e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714925, "uuid": "df104b89-8ee4-41fe-91bb-a0eee3131546", "comment": "Malware payload (Mirai)", "value": "40ef9b3d1dc6047b762bb34e18a8f6b530aef69fb003ba21a90ddf4b756b54ea90991599cb7cd6cb8b8db5379f2f1cf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714925, "uuid": "553db409-bd2b-451e-b306-2e8ec1b7fe03", "value": "T15733D8C27892B639C2D05777EE5F414E3314A7D8D1DA3353C8281B90BACAA1F1D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714925, "uuid": "f61c2ac6-3e61-48ee-84bb-b99d655254e0", "value": "768:8vgKtmm2PcgtAG7RHoFk22uUVnjR+/oNYpoAV/cbvU7wCVy/rCxHghW1/Kw/tH09:immXdG9bjR/ANczvhWr5sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714925, "uuid": "8eef9524-ffa3-45da-b242-bb4e39c28f67", "value": 50840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714925, "uuid": "f60c16c3-250f-4771-acab-19a7421f6324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714925, "uuid": "1c7cba68-2c40-49b0-9e2e-9272e5f1db54", "value": "phantom.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462527a9-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784705025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "62d0abec-cc17-4f58-8c55-37b319fd539c", "comment": "Malware payload", "value": "3766be4eb1213beaf79d162e07609eba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "948ef933-aeb9-4172-b831-ecc5445a009e", "comment": "Malware payload", "value": "979231c64830c128ad0e87460ddc97d1fe3159ad236f7cd4860cd21eaeeb64f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "82232375-8971-440b-bdd1-6c0638a23d9b", "comment": "Malware payload", "value": "3ffa6dc77c8c8a9d6618a8da74b89440b9d7ec7a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "79ed9a24-b454-4c8c-a1e9-87ced2833b0f", "comment": "Malware payload", "value": "8d2f529936c7fe02006f74ca4ea8341056f194110d7a480de37e753e481a63e10e749b70d5a29b0fea57130503d71a81", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705025, "uuid": "97f36968-540c-4eb5-950e-d1264361301a", "value": "T10F236D661A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705025, "uuid": "d1afc7fe-8f40-471d-99ac-4d3764775ff4", "value": "768:NXRWNGxVB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3lxwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705025, "uuid": "77a09a8c-45e7-4542-a419-b9502d3459a5", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705025, "uuid": "cd706767-5b4d-46c3-b73b-5e362ff926b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705025, "uuid": "44cb097e-5c98-4d7f-b235-8ab7a6d4dfe6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61530021-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784705929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705929, "uuid": "b2cdadda-36e8-4d7d-88ee-81a307547686", "comment": "Malware payload", "value": "636d02b6deed9a15cd1188ce11faf9ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705929, "uuid": "a31c5b18-2614-4bac-969d-6e40dadc33a8", "comment": "Malware payload", "value": "980aee6a1e59ebfd33c9761d92e4f8625f44f279d6fb23eda6a9d0cdd31e7723", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705929, "uuid": "3bf06796-12e5-406c-ae14-366350589208", "comment": "Malware payload", "value": "eed74807a956d685134e093e76bee7c40a6becf0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705929, "uuid": "03b78a63-7394-4fff-8d06-5457b31a04c9", "comment": "Malware payload", "value": "8e818e0d126fb2e55b9a98fba9d7e1d475d491c6cc82a8bac57c22efbc9a5bd34c48c6ad85bb84c2a1869d0c8fc58c20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705929, "uuid": "e64ab2b4-e79d-42d2-ac02-767410c13bce", "value": "T10CC51213A523578D88C0F5663D21A99E5CE846CC3BCBFA972D0D6BE3274F50C4A5887E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705929, "uuid": "60ab23eb-758d-4d6e-b79d-fa5e464db5ad", "value": "3072:mNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcNHNcC:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705929, "uuid": "65163ffa-4fa2-409e-b452-cd944a42efde", "value": 2680199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705929, "uuid": "d57126d1-241f-4a6b-adeb-a2c2c7faaeb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705929, "uuid": "dcd37ed1-1e87-4f20-bb48-b816addc0b07", "value": "Orden de compra 31874.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f111d2-85c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784719817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719817, "uuid": "5188a922-fdb3-40bc-8c32-6ad77f24bbf0", "comment": "Malware payload", "value": "6e905341f616858d9c30e3619ed19ddb", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719817, "uuid": "a584bdaf-4da0-4184-b2e7-4d6d36cab78c", "comment": "Malware payload", "value": "98939c94abb5a8db0dcee4bd319b399f8410ebc837c935b9706751244fdf610c", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719817, "uuid": "b84f0688-888f-4ad1-a87e-009d17bc9c27", "comment": "Malware payload", "value": "bcb6425fbd18a3d43045fcc8cab27ed963870036", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784719817, "uuid": "28061e80-06ea-4d77-b16a-1069bc0b96b5", "comment": "Malware payload", "value": "0a814002c3788f39ae874d39155e6d3fc3e1ca97d2738cccdbf72d053a38240ec8c14e700dac1b529e1d9ad1013c2eb3", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784719817, "uuid": "1283c462-8d6e-426f-9440-45ae1c235ac6", "value": "T16AF733782F362068C425F63A08B357C7E34CD278B705CAF7FF1C4A8964B5B6A9921917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784719817, "uuid": "3d94d9e4-644b-46aa-a69b-99076b86975e", "value": "1572864:8cfKuOoPF2FC06bdn2WGSdfL4zr1I+iZqsIJq7lZV0I3N15plpG3gdd:RfOMd2Z+tZqZJqaI9LQ3gdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784719817, "uuid": "8a5b2f42-e9ff-4f90-b880-b18a66d41836", "value": 73263037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784719817, "uuid": "caf7637c-bdcc-450c-9ab7-35dfc6150a3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784719817, "uuid": "a2c8ed8a-3127-4cde-88b3-338d82808fcb", "value": "OmniSpeechAI-Detect_2.5.4616.0_x64__sh8fphax66b9m.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f19d14-8605-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784749152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749152, "uuid": "14ad74b7-d215-44b3-a26f-1db7d48e21b8", "comment": "Malware payload (Mirai)", "value": "824a0bb3ac4edf5c33e294703d573d33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749152, "uuid": "306aa410-e108-475f-8d82-b7133ffa141d", "comment": "Malware payload (Mirai)", "value": "99051fd15af7d2a7b36a6ecbaf2f8c052f23ab02b7e4a20ebe20b8ddb7b19e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749152, "uuid": "5112d81f-1856-4d8a-a4d2-2894a62180a1", "comment": "Malware payload (Mirai)", "value": "2e368daada281cb8a4b990ab76d8ada70a7f3872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784749152, "uuid": "e158c404-b4da-49b9-bb57-baaf965599fe", "comment": "Malware payload (Mirai)", "value": "e7a54c47d602af092a3d6fc1bc139368b699bf81578d9f9ecb60181b278200252c92c1a16e5473cc20a0eeb58a344950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749152, "uuid": "d08b2035-dfd4-47bd-91be-3a4cc2b15a3f", "value": "T1D0C2D02E370244D9FD5986701A7817886A7205727E43DC12679BFAC3ED874F9B9068D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749152, "uuid": "0b531bdc-8138-4651-bdae-5499e86794ab", "value": "768:aMLqzcIV/LLwl9eaVT5R4iXNjm4zE1JgGlzDpbuR1Jmrt:O3VXmeaVdiiXNOVJuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784749152, "uuid": "cab931ea-1d31-4344-a86e-64650ea8b70d", "value": 26237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784749152, "uuid": "8f5a35cf-06d5-4ef3-a2ce-fe17a615d9b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784749152, "uuid": "74e5391a-78d3-4281-9ec1-6661e84262c5", "value": "99051fd15af7d2a7b36a6ecbaf2f8c052f23ab02b7e4a20ebe20b8ddb7b19e80.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e91d115-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784701549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701549, "uuid": "607a02a2-e0fd-4366-a365-d1313352a70b", "comment": "Malware payload", "value": "339ccd3e934e4a3940887c7bb2c1169d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701549, "uuid": "bac11435-ebe3-47af-9c28-9c319f67db48", "comment": "Malware payload", "value": "998640cbca1a6017f71c7d768ae41f513d741a6620595ac4ac2b9a62d1b00722", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701549, "uuid": "ffeae4e5-1905-4c74-8b69-5d8b05e9ebee", "comment": "Malware payload", "value": "167a7943bc6fa9de37eec0811cc2020ab5d7310f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701549, "uuid": "ca316382-f208-4646-b1cd-af23aebc755d", "comment": "Malware payload", "value": "e2c5be9bdce5e009f6a82db54fb489e0b803977422a5a0e1108137b141a585e8619d8417345456146543265433c61a72", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701549, "uuid": "937db631-ae9a-4c5d-b304-b08b2c88e9c4", "value": "T1685633C978CA6775C097C3B5A102262E72287FC5AAB69C167BF53E0C2E3371505BA385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701549, "uuid": "a8773ef5-18d5-47de-97bc-e41ff9449a15", "value": "98304:rvwTUb+qIIWFmmPsEj9N+GFtAbwdy91J/v+IEhignvGuLTqxuMC2kP8s7AzxWXTT:rXbGFaiPA02DEhigvDy90P8d1WXek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701549, "uuid": "3cec1e80-cf25-4712-ab07-15dad2ab897a", "value": 6041600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701549, "uuid": "c7de69c9-e4b1-4037-a394-24d505327c51", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701549, "uuid": "09102d42-c607-47b7-9e30-1e2e9f4a3012", "value": "setup.1.0.2286300006.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d416948b-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784706122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706122, "uuid": "4de8853f-5716-45f6-a092-ff3078a676e8", "comment": "Malware payload (AgentTesla)", "value": "b7721cf13508b02083feb0b010534423", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706122, "uuid": "ad79dae1-0c48-4af0-9529-2be106cb0c08", "comment": "Malware payload (AgentTesla)", "value": "9992545ef435706e582bd516988195df8bae9985ff70d30ea2c20dc5206dfe3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706122, "uuid": "0808dc82-3575-4522-9628-e85dccbe3d79", "comment": "Malware payload (AgentTesla)", "value": "33ca049d12dcb1f23ba998abb11d08110381ba8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706122, "uuid": "ec91ce19-0762-4463-866a-37be643a0119", "comment": "Malware payload (AgentTesla)", "value": "cdb091dec79009a8fe73239d87dd5499602cdbad86149800b1cb32f0beb6b7c2d94d56852bd3efedcd9010b876fc444d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706122, "uuid": "d0ce5e89-f25a-4e1c-ab2d-2dc0ba08fe02", "value": "T15574E990F249EC97F41615B64D7B9521148EA398D4B9C31E2097B72A6AF334230AFF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706122, "uuid": "67f681f9-5050-4ac1-b9fc-249c61f952b4", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706122, "uuid": "6e790dbe-7772-4311-a5ca-0f54ead0b1d0", "value": "6144:9R+xX+sywYL1S44ElKx5aEasbpK//pUVwnKG:LkiL0Mls5sAuGV7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706122, "uuid": "532d6fc3-1872-48f8-81d6-1a238b6d0143", "value": 370416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706122, "uuid": "cbe41995-9199-4b36-8e8d-c87a6260c32d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706122, "uuid": "11a9eafa-f515-41e2-bc0a-188781e992cb", "value": "Nuovo ordine0029338476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828a77ff-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763108, "uuid": "0334aa2f-006e-42f7-9f4a-b71f079fd727", "comment": "Malware payload", "value": "ed234e65a87f7ecd03727981c841bbfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763108, "uuid": "3cbf0ebd-2c24-4d81-a71c-df1669d053cd", "comment": "Malware payload", "value": "9bbb4b428b34a0ce31da7183bf4a20f48a5a5639d4acf7afb7bd1d0a4205e098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763108, "uuid": "48e29dbe-3598-4271-80bb-c6c737181b8e", "comment": "Malware payload", "value": "91dc840927011260b243ad7619bf63d65293ac21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763108, "uuid": "9ac875bb-ab6b-47d9-9b18-600fe51463c2", "comment": "Malware payload", "value": "d92333a7ebe090fa342bd127c4ae5b31219f4061b2f853d0070d3e6cdf6b0931e0603aedb6c550703461ca9d88b38acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763108, "uuid": "2443f82b-f635-49f8-8e70-c182d6d5e2a7", "value": "T1E2366D4BF1A324FCC19BC434875B99A2B935786901247DBB66C4EE302E33F605B59F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763108, "uuid": "0b292b17-9f03-47ef-bf8c-bda0d4d41ff0", "value": "98304:+jbh6zwjVQMJwkLH3M9YmbOB/KvDVaNOKbKz3naV8qOH+8gLJ:+jGw1yY4OBQ33ae2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763108, "uuid": "c5db502c-0e34-477c-8f7d-4522cc036e5c", "value": 5195856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763108, "uuid": "f380095c-c412-4c2c-b597-876ae84a4935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763108, "uuid": "2978ede6-662c-4ca9-ab5a-e77f56b7e5f6", "value": "63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd3c8a5-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784702142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702142, "uuid": "900fb893-a1b4-4a48-8eb2-9e4917d22084", "comment": "Malware payload (Mirai)", "value": "58d0aba490a07526f4a94f971f3f9ca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702142, "uuid": "a2d6241e-1b02-499e-98d7-792e649b35f7", "comment": "Malware payload (Mirai)", "value": "9bd20ffda8ebfbcaf193fae77cc0c365c07126fdbd32dba162bb9ecaf0c56ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702142, "uuid": "30789b56-02f1-4dd7-8fac-27d84a190e49", "comment": "Malware payload (Mirai)", "value": "805f0d1ff83d18dec051afad056a08ac77885910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702142, "uuid": "03805717-2333-4006-b505-5ff3131be620", "comment": "Malware payload (Mirai)", "value": "03f0750400fa2c510742481e0a4196df965b12f9fd15b3ceb0227337a0bc35fc3206533dfa7a1457c44d4060c3ac432b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702142, "uuid": "c4455062-06b0-4403-86e6-180ff6081417", "value": "T1D133F1B7D36B1973D4B4ED71F0638E82A70363E4E98DB07F146462D5BE5408B12A16C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702142, "uuid": "e1c8c689-20fe-4c22-98fc-ef968a47a477", "value": "1536:aQDMKB0lJqfw7+Xe6LdXM2ahG70jcI3nb4Ii+/j3:BMGcIRXv4Tj/3sIiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702142, "uuid": "a7f85e23-fbe1-434d-9e59-e80bf3277210", "value": 51620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702142, "uuid": "4369ecb7-49aa-4e04-a69d-c8f890fabe3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702142, "uuid": "1bf21ed1-0ef9-4b7d-827a-ce15b7f33973", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57aecf4b-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784705484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705484, "uuid": "bb915e9d-b009-48ad-8d07-643e9383c9c4", "comment": "Malware payload (Mirai)", "value": "7251858f6556ca3a77d9a19d603414d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705484, "uuid": "c911f565-1950-4683-9b0b-55962937dbd2", "comment": "Malware payload (Mirai)", "value": "9c1bc8b3e1080f24e472cddc5a5a66a63f92bd52d4e3698e1068d0bec936e13a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705484, "uuid": "ec71694d-e7b8-48b5-a7d2-54ec3ef23006", "comment": "Malware payload (Mirai)", "value": "ee35f1e6ad7e04e7eca65b452b0e77778baa6a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705484, "uuid": "13f0b832-4357-46b3-a831-85891ffee003", "comment": "Malware payload (Mirai)", "value": "20c09f94786ff51835f3e765cf5481eb7791d0d48139154939c4d54fc313e1321aeeac9aabf0c61ee766367e308a3ad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705484, "uuid": "0450bd4b-7dc8-4c39-93d1-ff5d154b645c", "value": "T16543F19799306280D0234533CC358257AF1E17EDB59472E70ED542F93FFA682A2BDE29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705484, "uuid": "b6e70380-f794-4a53-87a0-593261e38948", "value": "1536:699391nJ8PMwIN67RbfscLsQXNb6VScTjouFxG2v:6rttJ8PDINIRbfsJQ9b6VlTde+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705484, "uuid": "46e879ed-51e3-4862-8363-4d34fb1b9bfa", "value": 60384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705484, "uuid": "206fb8fd-ea62-4b72-be16-4fbb5394a952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705484, "uuid": "2f02a369-391e-4b5f-b9c7-11999d636e47", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5fb30f-856a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784682653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682653, "uuid": "4fdbb24b-a085-4379-b8bc-0b770e2a1b00", "comment": "Malware payload", "value": "7a1938d0b98691454ba4b6d8d122be7e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682653, "uuid": "a02e67be-9138-4315-a1ef-654cfdc91958", "comment": "Malware payload", "value": "9c4d1d8077938fef89508c207e5fc0c56544d84ac34c08c7ffe7a9c107e68237", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682653, "uuid": "6c0a39bb-5d3e-41c0-aada-74cfdd1f4bc0", "comment": "Malware payload", "value": "05773ad8937d2e33b4fb318358347738174bda47", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682653, "uuid": "b7a5c2d6-0d08-42a1-b21e-7fba228b27e6", "comment": "Malware payload", "value": "d33433f8586b87a671e665cfacb5359e3e7eba6ad2334062daab70b213360007076b0bae35d17226ffd7ae909e6d0e66", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682653, "uuid": "8fba0025-8891-4195-921a-85456c70eaeb", "value": "T1DE236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682653, "uuid": "3cd1a6d1-d61e-420f-bbe4-fda0c6b3f9a0", "value": "768:gXRWNGxVh/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0lxv4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784682653, "uuid": "73762872-72c6-42dc-ad12-e40d882fbe25", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784682653, "uuid": "34631666-6711-4c48-b516-8b8a6a3daa92", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682653, "uuid": "84aea8f8-7070-4b51-aab3-46cbdf9bf136", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0666f8ee-8594-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784700623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700623, "uuid": "a753df97-e378-4e3e-8c72-162b67e3b945", "comment": "Malware payload (Gafgyt)", "value": "28f71535f2e9761607a5ff407c8b20d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700623, "uuid": "010b63d7-8d56-420d-a1b4-502543f3dedc", "comment": "Malware payload (Gafgyt)", "value": "9cab3483f2f0fcd6fec9ba593b3261b731bc823a74b97ed18e6287dc52b03496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700623, "uuid": "a2d9993f-bfa3-45ec-9b05-60fbd56bc06d", "comment": "Malware payload (Gafgyt)", "value": "23890608afdf7221078a6b3e684e55842a694e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700623, "uuid": "055f635d-2a74-4af0-9778-fad1541cca0c", "comment": "Malware payload (Gafgyt)", "value": "606bd223b4d1b75dd866891a6b4e21a1a62d5b3303bed329381bc18913e60d34a8e78cd126f1204988f2f409f3929f6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700623, "uuid": "d1252306-06c4-4d65-b03a-7eff3a478b91", "value": "T1AB53016C0614CCBDE96924B144ED7BE01DB686F9A506E8B10F25F4FEED390250A7F41B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700623, "uuid": "72af9c5a-65bd-44ca-8697-a6b89a09b501", "value": "1536:dbkS9+suglnCxhdQeigLCTZyFVrkUN564TBVEWeL:dbkS9NnMhdFCYFSUN56CBVEpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700623, "uuid": "995154d4-7099-44bb-a60f-2684311e6e8c", "value": 64168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700623, "uuid": "0db865aa-9efa-4318-9e63-fc13069da663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700623, "uuid": "8ecd644d-9eab-4b89-8738-2feb8f0fe9da", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3372d776-85a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784709288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709288, "uuid": "7fa7628e-711b-449e-bfa3-b95668e9c1a7", "comment": "Malware payload (Formbook)", "value": "63f0a90d02a53d468fd0084f01f5c051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709288, "uuid": "dea611e6-e739-45d7-bc13-e6bb564969c3", "comment": "Malware payload (Formbook)", "value": "9e3a55fb3dc6ecda84471b6b425259095f7237c607f5843af1582ecd0eddd624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709288, "uuid": "0a140c56-7e9f-4821-a108-1ef99a7990bc", "comment": "Malware payload (Formbook)", "value": "9f064fac0e6fefc09338717338946002ee442d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709288, "uuid": "5de724c2-31d9-412a-abf2-3ca370b848e0", "comment": "Malware payload (Formbook)", "value": "88425b7192cc420591802f57fa4b91b8090f96b4dd59ee06d02398a8fea9cd01da1417a44cd977ded84e43797d28638e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709288, "uuid": "f054df66-87c4-478a-94a2-349fd3f9a584", "value": "T15385BE09B3C41AA9D91AC535C72B9632C2B2F8520B71D5CF1A99E70E1F37B915F3AB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709288, "uuid": "ef7f9854-2b89-4164-af4a-6c92d43c1922", "value": "3804f7077eaf12e4b365e7584f309e03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709288, "uuid": "263cc6b7-0b8d-4ef3-9b10-1aaaa5d9536e", "value": "49152:9OIJuS9PLmA0J5UNFdl4ol08rPbnU95svl/VcWRv7klw60ao4Z:dNLmoJ4L8rjU95svl/VcWRv7klw60ao+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709288, "uuid": "3f268cde-3578-4375-b0d4-fd0a228fddb9", "value": 1767424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709288, "uuid": "dddf16d2-c068-4e54-bed0-8ddddbeed22c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709288, "uuid": "94ad29d4-eb3e-4f5e-93de-0a16821d4568", "value": "Secur32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460957a6-85c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784723493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723493, "uuid": "3719da37-1401-4a85-9a15-b12cb5baecd6", "comment": "Malware payload (Mirai)", "value": "0bf7e7d4675896b14430b7e01afc54f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723493, "uuid": "263df581-afee-4dab-bc51-3b12d3e2eb96", "comment": "Malware payload (Mirai)", "value": "9ecd3a38bc69ff5a12d2d5b15c8c32afe523b07504f3173f6e40cf30491691ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723493, "uuid": "37c8fcdb-67f3-428b-99ff-b8e5eb567cdf", "comment": "Malware payload (Mirai)", "value": "847cb652cc11e132c765e17f0d8ec0dbf82d70b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723493, "uuid": "c7f06f21-c8cb-4ffb-a15e-1bcf453b8537", "comment": "Malware payload (Mirai)", "value": "0a863dcaa65cf42a6f9fa6b144620bd44e8bdfc233912af76821f6db8485ca93bb521fb816ef95c221e0265c41df5ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723493, "uuid": "fc4cec45-50cc-49ee-b5bc-ea3cd938dab2", "value": "T101E2E2A224C01DF1C671C431EFB491C6B6832A3C8197A55F7A498FF4A6F99D80AB8947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723493, "uuid": "fe8ffe71-7e86-40ed-b7f3-4951cdb246d8", "value": "768:SZ+6GyLuOzsD5AwQhe4ljYaDTTqu79rXPuxs3UozLr:SKawDq3he4ljYaHTqu79rmczX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723493, "uuid": "fa08a7c1-29f0-44ae-ba3f-9f3fed3066b1", "value": 32900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723493, "uuid": "e8cfbc6d-e8e9-492d-ac4f-a7a9e2492b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723493, "uuid": "40eadd11-40de-4738-85b8-e3eeba6425f9", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f07e1bf-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784702114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702114, "uuid": "430e823f-361d-4e5f-9099-79b0ad14a50d", "comment": "Malware payload (VIPKeylogger)", "value": "3ca8d713f0e883a450ecce633fdde049", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702114, "uuid": "fde82e9c-5c16-4c70-8295-e9ddfecf02d9", "comment": "Malware payload (VIPKeylogger)", "value": "9f0507efcc8322ddab687734926b7a027aafc8b2cb0414c609906f4619f79692", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702114, "uuid": "1ea66867-fa99-4ae1-93bb-f488985fb85e", "comment": "Malware payload (VIPKeylogger)", "value": "cc8710180d07e9771a35ae41d87d5e58ea9bd8db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702114, "uuid": "7ab20aa5-88dd-4574-8b0f-e5fc55d74b1c", "comment": "Malware payload (VIPKeylogger)", "value": "0b0e94a6cac8fdb9dcf224e4d29dc84d794cfe4bcbfc3af1996b0834a70da91aeccc8118c9dab6b54c42a9d12a7f8958", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702114, "uuid": "f8205d54-b660-4aaf-af4f-6f119d15c3c1", "value": "T191B57EAB0A9F9ADDC5027C27DE2D9248CB939ADCD8FD03641D3178DDE741CA84638876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702114, "uuid": "5871f751-beec-4989-a0a7-69d2c114a292", "value": "768:B8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8s8sr:3ifGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702114, "uuid": "b4cbf08b-6ffe-4fde-876f-bd1cb652eea5", "value": 2319242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702114, "uuid": "d546a95d-e0eb-4696-bc42-4326a3f951d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702114, "uuid": "ca4c6736-ff9a-4f7b-bb3a-c25c8920cffc", "value": "S\u0130PAR\u0130\u015e FORMU 21-07-2026 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b138a1da-85cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784724532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724532, "uuid": "cb6bb07f-32d6-4f35-93ca-4e91e290ba70", "comment": "Malware payload (XWorm)", "value": "9de33da38dda2613746cd7a30d594ced", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724532, "uuid": "c5dabdc9-109d-44e9-8667-c46c63e59734", "comment": "Malware payload (XWorm)", "value": "9f6d15bb97ea15e7851a18adff64f76cd1dad6333e61fd59890d9d37157366f4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724532, "uuid": "46be1fc1-e9cc-4c4d-b0a3-29a1daad514b", "comment": "Malware payload (XWorm)", "value": "e20fd42d51f311e2299385be6be198f75f62a81e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724532, "uuid": "9502574d-41b2-456b-b6e4-b1076010a456", "comment": "Malware payload (XWorm)", "value": "be300505498f40a6dc1064e730419e00517be2b5d665f63854dbd62f8c77989362085ef15cddd8136afb135359d342ab", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724532, "uuid": "b3a7fc98-7110-45ea-b8a3-274b20d5da41", "value": "T15544C986F48F790A2097E8BFC0DE40E121EB486EB8C5ED68A1F9ED817535E2D051C81E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724532, "uuid": "745afec7-48ce-4843-a130-4107fb9929df", "value": "1536:1qNNNqNNNNNNNqNNNNNNNNNqNNNNqNNNNNNNNNNNNNNNqNNNNNNNNNNNNNNNNNNo:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724532, "uuid": "56f3c355-02a5-4895-97c6-b152d580a6ed", "value": 270478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724532, "uuid": "f0afb11f-5b99-4d31-ad8a-7fbe351d32f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724532, "uuid": "eb882c2e-dbfb-4cf8-934e-af66d3b1cb6e", "value": "Cotizar.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4799da-860b-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784751800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751800, "uuid": "0ca35209-8508-4271-9de6-821d154767ea", "comment": "Malware payload (CoinMiner)", "value": "ac5609bd06ae0e36c1e82a77df430f6c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751800, "uuid": "0e0ea9d1-5122-4556-9376-cca81d29f245", "comment": "Malware payload (CoinMiner)", "value": "a0493b5b7524c51c7d97757e014a35140cb61be1fdf2b620e9c5d1eb23c9cc21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751800, "uuid": "cdce2b8c-9b94-49fe-b21b-06136392b00b", "comment": "Malware payload (CoinMiner)", "value": "ade7759e50bee3e54dfab2f540d5d1ee3aea73bb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751800, "uuid": "cf8bf9ea-33ec-4038-9fe2-38fa4218ed3b", "comment": "Malware payload (CoinMiner)", "value": "373f806bb052bf52b9e4b0869526c6cdf18ddb73c7c7edf94b764bbc6f7f6571db01fd16e7383482fce69001a19bc0de", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751800, "uuid": "03da5a39-e3d7-4e16-be9f-d54e63f54fff", "value": "T1EA3633E62DD684B4E403CB745243356FF37E3B955A25BC0BBACC2A400D1AE2A583E7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751800, "uuid": "790b3572-ea19-4d80-a1ca-0ac72bf223e3", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751800, "uuid": "8190aa29-2228-4c22-bc5b-f3fbb36f5f82", "value": "98304:WbKqQpl4zJxFJQieuyg1wJ2xp8FQzJ6OMuiO6hfC5K6KmpzEfLzrvvoBKj6dQ:qVWcLFJQieiPn8azUO3mSK67zzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784751800, "uuid": "90714ce4-820b-4bd0-816d-9e34aa5360c8", "value": 5264384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784751800, "uuid": "e6c45b0e-dda5-4fca-8aa2-2b098daf507d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751800, "uuid": "febaf237-2fda-4b67-b215-758e14726599", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad475856-85ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784739128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739128, "uuid": "529b37f4-c143-4017-8d5b-0098bc0caceb", "comment": "Malware payload", "value": "e9593859bbc2752c4d19de03e0606f4e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739128, "uuid": "823af9eb-5242-44ae-9cde-0200753ef220", "comment": "Malware payload", "value": "a0e092065fee647bd449bc16bc2026d2cd42633929fb77cef69132822e595b70", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739128, "uuid": "83267541-6fc8-4574-9037-69111cdd478c", "comment": "Malware payload", "value": "3e05330ac44a5b2f5e43bca4bb04cb976fc12e8c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784739128, "uuid": "9002472a-20cd-45dc-9e47-7470258128fb", "comment": "Malware payload", "value": "d5f9f92b1821015781ca4e1448b47049d67c7244172bdb10fdb918d878d3c7fde603618fb6a4db6bd8e1d457a5a4f490", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739128, "uuid": "79fdd635-669d-477f-a1d1-df0400e53077", "value": "T118E633ACA5E215EEFA37803CE9E05A66E17CB4670776C5CF579883816D272E0193D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739128, "uuid": "b36474af-c8f0-4e78-b7b6-e6974c6781cd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739128, "uuid": "3c305489-0ccd-4d95-80a9-e600aa404985", "value": "393216:+k+0cXbKnR/AlN7HWKXMCHWUjXscuI3/PGTAI:+R0VnEXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784739128, "uuid": "601a318d-bd97-4156-ba39-aa8c487145c6", "value": 14278322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784739128, "uuid": "52aaae5b-b835-4d7c-a7d4-2d3c9724536a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784739128, "uuid": "3a2d9ca0-964d-43d8-8200-c28310efd31e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c881645-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784702083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702083, "uuid": "e67abaf2-b965-458d-bff7-545494d5c236", "comment": "Malware payload (VIPKeylogger)", "value": "02abdf6a5314cb2326e813afb6776983", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702083, "uuid": "5e54e01d-2a49-43d2-bc4f-d9ea2ba2b55a", "comment": "Malware payload (VIPKeylogger)", "value": "a175f9bd5b67f3a200841e52381abf8bbb09ff8f2d7f7b6afe7dacb7fd5b2bab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702083, "uuid": "1d97f85c-4057-4ce6-a93d-71b0ccc29cbf", "comment": "Malware payload (VIPKeylogger)", "value": "f4572993d1f4a1b678ac5c4342908785cc6fe470", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702083, "uuid": "c430c444-9956-4cd5-a71e-c73001446a04", "comment": "Malware payload (VIPKeylogger)", "value": "ec8b225954fe854b2a75008c9176eae92394a50781a7ebe8f884b98e5db96dc18c3bc228af2c729bac34e58b40718cf4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702083, "uuid": "8c9aa65b-f74c-4bd8-b72b-d1befd4a87ac", "value": "T1579500B6FD4C339886B37731298E6E1165F2916DBE91778AB290FB5830D1DC7A108D32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702083, "uuid": "673fc58b-07aa-435b-880b-58d885157728", "value": "96:oEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEt2WEtA:7XUtVaOjLewR5aCr5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702083, "uuid": "f92d24b9-25c1-4025-9afd-7c09fcb394ad", "value": 2010631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702083, "uuid": "54a40494-2fc2-441f-a9f0-5120b6c28b52", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702083, "uuid": "9711fb38-7cae-4c16-b408-37f7a42479ad", "value": "21-07-2026 -T\u00dcB\u0130TAK-SAGE-TEKL\u0130F \u0130STE\u011e\u0130 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142a5d97-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700217, "uuid": "8ed135c7-de34-4c52-b532-954f8101fc42", "comment": "Malware payload (Mirai)", "value": "ea95e6348e216d8957c94627445ff853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700217, "uuid": "bed9ad51-2766-446f-b324-60b4ea6a3071", "comment": "Malware payload (Mirai)", "value": "a3b6be2dfd547725c7b835eb29505775b6b948fdb9a4af9edd2a987c25d115d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700217, "uuid": "ee90814e-cb95-4b53-8358-9965fdf37154", "comment": "Malware payload (Mirai)", "value": "8b9ee1f60140bdfc769ffc41b19a0dbd632bd471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700217, "uuid": "f02ddb33-5d69-4e00-86e8-2135a4c11e44", "comment": "Malware payload (Mirai)", "value": "8c670096e6cc24e1296fb9ab91dfde279f0df29a4afd81ebc37739352ddfd1421d8cab5a180899ddc4663b0b410cfb65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700217, "uuid": "6dc50b4d-47b5-4f9a-ba71-3d0aeba9c61e", "value": "T15653029DF544A9EBE8AC4C78977F0B93B9C96498F06A5305B3104CC183B6F52769E8F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700217, "uuid": "62ea4542-9ab3-4d4a-95ea-70bba0b628a0", "value": "1536:ZXmiy+HUZDE7KyLWmfoYfrX8o4k/nwVNIkCQLPNZ:VmiTcDLkLfrX82fEIkLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700217, "uuid": "c943ad80-8646-4f68-b651-5e6474bded50", "value": 65324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700217, "uuid": "4aa706c4-be91-4497-957f-21c7585e6584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700217, "uuid": "680f3ed3-8aed-433f-a4fc-beb6592fc13f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c67e9f8-85ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784746750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746750, "uuid": "8fbaff28-edf8-407a-874b-12ba12ffe54f", "comment": "Malware payload", "value": "e5fec924182015563e10b7d2048f374e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746750, "uuid": "67466652-88a3-4c6c-9287-8f52980b38d6", "comment": "Malware payload", "value": "a4117583d175e81e653892c26ea8fb6c3013a7c4c92d3e310179dd69b0d30f7e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746750, "uuid": "d7dac4a9-7705-4e56-a3c6-955664f4a3e5", "comment": "Malware payload", "value": "548fae1433fa9e3b71e0bcfd3d6c0348c38aa005", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746750, "uuid": "cc335edb-6afb-4e2d-9d7e-1703d4847c5d", "comment": "Malware payload", "value": "a88dd5cf14055ae82f03f9f61584fde7079e79e97427f5da1ad5c4762cd7a8f0fae349a24ccf3957b30e82eaa442e213", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Kaizen", "colour": "#3623AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746750, "uuid": "a4ce88e9-5b1d-440c-a8fa-dc9942a77793", "value": "T10614CF83E332B87ECDB3457A4D090332677B751ACA13AB4BF5646B19246B2D92F087D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746750, "uuid": "763ae821-9d91-431a-a03e-4b509bfd0c89", "value": "6144:2l+4wkWcTS6ISZEd5yzwZEWHvyWlo7NZv:2AntcTSxt5T6ZPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784746750, "uuid": "79429056-2f29-4157-ae1b-a34d25ee8800", "value": 202551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784746750, "uuid": "2536f6a6-835d-4d6e-b579-3a37136aa4b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746750, "uuid": "b9a0d3b9-2265-44a4-b0ab-f2afc0812976", "value": "a4117583d175e81e653892c26ea8fb6c3013a7c4c92d3e310179dd69b0d30f7e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f6137c-85cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784724729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724729, "uuid": "14c40a81-8eb1-448e-8afa-eb6409d3703b", "comment": "Malware payload (Efimer)", "value": "11281bb4b3bad8f97282bd9007702927", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724729, "uuid": "f1f67ba2-1377-4122-998c-9ae7cb3303e1", "comment": "Malware payload (Efimer)", "value": "a4764c06b55f26d9c4fff0b6fb01fc17b0f9da1411f8659583310e03421c2bef", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724729, "uuid": "57e7c4af-e6d5-421b-b5dd-eab70d2c4929", "comment": "Malware payload (Efimer)", "value": "71a0b4e0e0da7fab86c5e72553b36670b7b049f5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724729, "uuid": "2b122933-d601-4564-93f2-11d2dbbefc3e", "comment": "Malware payload (Efimer)", "value": "879738277de8c23c80a63d7b9f51f1b38fc056b26ede42820b2d4ed1385bafd4aed8358f25cb13ccfb572bb35d755647", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724729, "uuid": "0f4aedac-fc21-48a0-90ec-4e145cb46197", "value": "T16BE6331866E012EEE1B3403C9FD26651E9FDB8734772C95F07688BF16DA32E1C979182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724729, "uuid": "ea285ab1-f78c-4e03-8adc-b23cd585249a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724729, "uuid": "314609f2-5792-4d9c-9259-430a925edbbf", "value": "393216:nXaGbDiZfD4hj4v2PXMCHWUjX4cuI3/PGTAI:nXkfMVM+XMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724729, "uuid": "7ef4ff89-e8b8-4e2b-a91d-14fa7fd0ee29", "value": 14326500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724729, "uuid": "40f0b281-bcff-4011-b11c-9b01a9269fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724729, "uuid": "ffebcf71-23f7-4703-a1bf-62e689056c69", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8f94a0-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784723152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723152, "uuid": "382fbf3e-b386-4c21-a71e-47717d93a531", "comment": "Malware payload (AsyncRAT)", "value": "fd8d8b121e031be774b7c7cd19eaa409", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723152, "uuid": "9633f7be-48a8-4765-b514-01071e1185ca", "comment": "Malware payload (AsyncRAT)", "value": "a5158f3c215e31e1741c60510b6f01c634d8c18e5b5e8adc2f3d0545cb836d67", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723152, "uuid": "25ab90cf-2e8d-408d-a734-31ddc5c085c9", "comment": "Malware payload (AsyncRAT)", "value": "aad63a8929d7191fffb78a5244c8490fbd202cdc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723152, "uuid": "b53a08ba-498e-441f-8f99-e32b57b84d49", "comment": "Malware payload (AsyncRAT)", "value": "d51c0b3daa1eb8a0b614e75fa3b92866ae76d9827ee584f522588268daefde2dba54bd3fcdcea93113a95c3958cbf872", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723152, "uuid": "a963c9c4-13cc-4cc8-81ba-67af9e5df2a4", "value": "T142C23C0833E4C672D1FE4ABAC83385109779E55B9923D75A5FC490AE29337CD8A18FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723152, "uuid": "dbb10d6a-adff-446f-8333-6e36f5bee03e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723152, "uuid": "5820265a-fcfe-4923-a327-bfb63b711253", "value": "384:sePtsFjV3WuGOsVa/KFHbZ0yH9qbuUscCbQxnCJfJBndnjJWKy+:sctIg1VDHd0wIb1BBiBnXy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723152, "uuid": "234d46b7-9d65-4c72-ad9f-423ea5132a02", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723152, "uuid": "257a00aa-9918-4cd2-9555-6c8076b3f983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723152, "uuid": "8a55a09b-e928-4b99-a51a-94ff5f8a4321", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba4f1a3-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784753379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753379, "uuid": "9d633727-6d67-41df-b56a-8ccfcc6cadae", "comment": "Malware payload (Mirai)", "value": "4e62c11964cbae5182133edd8d7dd7aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753379, "uuid": "384a9949-200d-4051-b991-cbd85506d245", "comment": "Malware payload (Mirai)", "value": "a53dd987ba4c34030e10da19431fa7f81208c7ce010ec474bc62ee82dde6fa61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753379, "uuid": "43b7dfe0-c949-44ae-bc4f-2d5e095640ac", "comment": "Malware payload (Mirai)", "value": "f0fc37a116a5b1d36045b3aa0b65985cdb301dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753379, "uuid": "e3424379-f303-4dd4-84c7-907974275a33", "comment": "Malware payload (Mirai)", "value": "63fc64b04142e8862b2d3ed73287fca593c4628c06b1a99a1c8ad651ce2d2ee31760b415a75be9f7cd7631ba10262f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753379, "uuid": "910c035b-f1fe-4e83-936e-e243f01516ab", "value": "T1FBA3E55AF9819B11D4D525BEFE0F818D33235BACE3EF7212AD145B2537CA92B0E7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753379, "uuid": "500e017d-cdde-4fee-8c06-0ef8447a24f2", "value": "3072:rnMfSQSO8skjsQRGYNiQaoeSN/UoCffwRvS+MoLPXnbI4:rnMfzSVjssG29aoeSN/VCHwg+MgPrI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753379, "uuid": "0a00feba-f1d7-44d8-bc7d-1d37bcef7f56", "value": 105128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753379, "uuid": "b9f173bb-61dc-468c-9aa1-ba015c38bcdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753379, "uuid": "0d91a15d-20e3-4482-9491-4f3624324600", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdefa624-8566-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784681281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681281, "uuid": "08393890-56ab-47e5-ac0b-d32f84a8b06c", "comment": "Malware payload", "value": "0ce852b26b4116d9ab05ef7a527e0ba7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681281, "uuid": "94ec7f86-c035-455e-9305-d1650f7d8255", "comment": "Malware payload", "value": "a54c005d853b1e8085c6cb4289561bd16365181e8441b204bea491425b0b3cd4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681281, "uuid": "c3f9508c-82c4-4819-8f63-a755852f4e41", "comment": "Malware payload", "value": "31a07f54d4f371c2b89e4367419f42ac01457aff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681281, "uuid": "716a34f8-ae37-4141-8f17-5bedf86507f8", "comment": "Malware payload", "value": "88ba15cff323fdcec57942e44ae16def1f3105da3a23d67ddc4774b0c649d0fd7ea821e62e75d8f14703f555fc5ca70c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681281, "uuid": "a42a3bf7-670f-438a-8e48-04d8d4f1ffaa", "value": "T1CEC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681281, "uuid": "726ca410-ac30-43ee-8f53-99658242b8f3", "value": "768:f8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:f8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784681281, "uuid": "4091788f-c34b-45b1-9f8f-dbf8533746ac", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784681281, "uuid": "3b3b921b-046c-46d9-91c3-0e61c28544de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681281, "uuid": "354f8c8a-c8c1-4249-9067-2d4a8080bd30", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef23761-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784732796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732796, "uuid": "627680b0-4779-42be-aa41-51307e408a95", "comment": "Malware payload", "value": "0228b2fbe66646d19e60c870d575ce8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732796, "uuid": "610f0773-04f2-46f1-9564-65bd20f2e50d", "comment": "Malware payload", "value": "a5b1fcf717a07107aec03d700fdedf673ebb5d3b38313a0a357b23314c6cc2eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732796, "uuid": "0a592fe2-895c-45e7-a33a-d087ac2f46a8", "comment": "Malware payload", "value": "16cb9325b2a79d8a406d674bb2692115685b358b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732796, "uuid": "165b69dc-15ac-48c3-8864-ef029e4d47f0", "comment": "Malware payload", "value": "6b4168e09534a5808f8514ed7987432c87dcd42932b1f4940ff8e16b3bc28827d11f5ec6a4561e3626453b080de399ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732796, "uuid": "ea5f7448-bbb1-4530-a6e3-c94a5c36738b", "value": "T15C655C3110C612AF62A2546E877D45261DBFDF72F33C106E0B286532EFA7A44961EB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732796, "uuid": "36f8721d-7e40-4d98-a800-48a0f7001836", "value": "24576:ZzJbWZE5TbAGFmhqE9/JmQZlIbLil4xxONehfL:1JbWZE5TbAGFmwE9/J3ZlIbLil4xxON4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732796, "uuid": "7f9944c1-c2eb-42bc-86d7-0278fade4a1e", "value": 1548340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732796, "uuid": "399e2be4-748a-486c-a291-ea45e87e8c6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732796, "uuid": "7392fea1-d310-494d-8448-f6a5f352671a", "value": "confirmar cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6101fbce-85b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784714948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714948, "uuid": "6692a9b0-ad15-4424-a901-f98bd6210ef7", "comment": "Malware payload (Mirai)", "value": "6f5675ce5b40d956e01f3654f1791537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714948, "uuid": "93d0a253-31a0-40f1-a01a-bd78597bb7f2", "comment": "Malware payload (Mirai)", "value": "a688b5cc10ba04a55c96c23cac59476306f2ea9d15d7d96b637377605c1e5710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714948, "uuid": "984a4a87-1216-4ce5-9565-264873b0deab", "comment": "Malware payload (Mirai)", "value": "b4658cffd446f9e346046c951708bc1cefd66c95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784714948, "uuid": "c6460649-7615-4a40-a413-c648b4c9b8ed", "comment": "Malware payload (Mirai)", "value": "cf4f808ccc3aef0d08005b1f0e1b89cf83676117ebeda86897f02536c2338a6ef9b8b5ffc376b917a0e67b4ea33f2a2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714948, "uuid": "56cf76b5-4ae5-4a01-b76c-fb5296379740", "value": "T1FC333AD6BC02AD7CF88BE6BE80124E09F63123555053172767A7FDE37D332A49912E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714948, "uuid": "615e3193-553d-461b-a73f-2a1cae32a0e8", "value": "768:jseDHFJlDnn5QX2kzj3FLQQPFmpAgFHUpAu8WeTHpy1oJTrH/iH8Ib:owJ1n5QGMJltmdFUpJ8pVy1oJfH/o8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784714948, "uuid": "93fe1ecd-d537-4635-a1d4-d03eda9da6eb", "value": 54116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784714948, "uuid": "ae833a54-ec6f-413d-a059-3876775c52ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784714948, "uuid": "a1298afd-9004-4f58-bc6d-d28f30173f34", "value": "phantom.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546845de-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784707196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707196, "uuid": "83f1e31e-c594-4ade-88cd-681b02140f2f", "comment": "Malware payload (Formbook)", "value": "b679a2beed0436eec3009d85882e57eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707196, "uuid": "f1c8698b-8b97-4ce3-bc4a-8105305774b9", "comment": "Malware payload (Formbook)", "value": "a767946d8b54dfd0059012f87afeb9113d112b01e32db8359cadf60233b5bdd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707196, "uuid": "087d9724-43d5-4641-9fe9-e4e90967eeef", "comment": "Malware payload (Formbook)", "value": "44ec8792f73c32880fca4997687734c671a052cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707196, "uuid": "2150768b-7fb1-42cd-9926-8178c94d1ce6", "comment": "Malware payload (Formbook)", "value": "d70925e75ab967d41dfc22cc018311b6b910110dc8109856aad2952581e280ff79c49104400c7d67c8ebf85adfc2ba21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707196, "uuid": "741afbff-de6b-4bc7-a221-b454e5cc857b", "value": "T133350295332ACC46C5A35F711E70E3B442BD8D88A505F7338EFABCABB8793866D11191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707196, "uuid": "8e545029-1b35-4b4a-af2c-0429ca3a2eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707196, "uuid": "cf83b0e3-ff04-4833-b65a-4bc70c409149", "value": "24576:iwjR6pFsR2DQyIEuaIoSjSuTp1gaQ+x+QGjxRhTz:ptimR2kyRuGSuG13Q+GjxTTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707196, "uuid": "cbf748a9-d673-4028-a2a3-e1fa674f0539", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707196, "uuid": "d3420d40-4945-4c26-ae68-1289387e1f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707196, "uuid": "02067f76-37d7-458b-a027-71f8f10fb4fc", "value": "DOC.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb1fb5-8578-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784688927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688927, "uuid": "18923c8a-ea73-4796-af11-ea5c1eb1287e", "comment": "Malware payload (Mirai)", "value": "03bcd0dfe8eb604d3db8cf929415e883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688927, "uuid": "d71819ef-0ebb-45b3-9ed4-7eda4d3ba71b", "comment": "Malware payload (Mirai)", "value": "a804ec4400e8da43e2d7e0a3429a3b85abff41f383a9d07041c5730492f8bce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688927, "uuid": "79edd51a-9291-4a93-baf0-90c0a3175ec7", "comment": "Malware payload (Mirai)", "value": "00140df8601bf15f6530103fbbc626f74ed74f48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688927, "uuid": "9e71b011-b642-4f91-9036-3eb291fb7b15", "comment": "Malware payload (Mirai)", "value": "603fc0cc7b4e8acbef62e2fb9c13c1d5c723b490a442d2acc034e4790a9cb421eeb3bec4e945003d32323477ad9761d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688927, "uuid": "395ed0a8-bfb1-47aa-8ea9-6ea676a78a85", "value": "T194C2D19394A9CD06C862423B6E1F159B61242439134DFE2E373FEFEC62464B8A235DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688927, "uuid": "45709832-b12e-4c2e-a88d-ef983eab5bb8", "value": "384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlFe:45+Kcrb9VDJe5FLTYTlPFnz/rANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784688927, "uuid": "26aa5dd4-19d2-4628-a1c6-f5106be2606c", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784688927, "uuid": "66327df4-44c1-47cf-a430-aa1261b6f56f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688927, "uuid": "42cf5a6e-469b-41b2-9b29-b637c2abd565", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b185491-85a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784706268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706268, "uuid": "e7d2eb4e-a532-4b0b-9713-5e3823037d37", "comment": "Malware payload (AgentTesla)", "value": "dcb004c43fb05ea6a889ca29d1c2a77e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706268, "uuid": "97c81d41-b945-462f-9bbd-5b28695a6bf7", "comment": "Malware payload (AgentTesla)", "value": "a81237863338db207c02fc470ff6e76bdab677cb6e34bf6214adae170b52010c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706268, "uuid": "b89db280-499f-44fe-97f5-70088f82756a", "comment": "Malware payload (AgentTesla)", "value": "493753cec15a6d9ff79ab264b952b3c4af9afe86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706268, "uuid": "0bea0f0f-858c-4be9-8e75-18da83a3668c", "comment": "Malware payload (AgentTesla)", "value": "c74ffef3a178d7669fbb7e1d3d6b657dc1d359dfe298327e6981ec7ebce131d0573e10a19167229cd7aa33284edfb090", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706268, "uuid": "a13ac054-f9b0-404e-bb4b-96c62b44c75d", "value": "T1F3E330496AE0F44807972B7B361BB4EAF4FF08D9698C8547E550FCD0B1E6206FAE1931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706268, "uuid": "e5633f81-b59d-44b8-a762-c0d0233f9e8e", "value": "3072:/4LPkgwKdoGDJ9U8CWt76JI7GmLrmGIrZXEaaq2:/4LPkgwKdoGDJ9U8CWg+p4ZXER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706268, "uuid": "4885ccad-6274-4138-8f6a-5f87f4e2c2cb", "value": 150551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706268, "uuid": "1f7ee707-c103-4e2b-80c6-7adcfd1dec6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706268, "uuid": "4839b549-3d76-4010-884a-fd58c690512f", "value": "Documentos--020260713.pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b19eae5-8611-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784754345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754345, "uuid": "928d7845-0300-4624-b62f-a21574367c1f", "comment": "Malware payload (Mirai)", "value": "a695e4adb7b392a5da6953cdc10feb9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754345, "uuid": "58e36cf1-36f3-432c-9698-65df3bd8e94d", "comment": "Malware payload (Mirai)", "value": "a81f233036fc9ef73c2284fd74d1e08ce74d9dd87e858a17d0bed45d23d26b3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754345, "uuid": "e6c046dc-2f55-447f-ae46-872e14212bfc", "comment": "Malware payload (Mirai)", "value": "050dd026c5dca0b02219b45ae0dee33153fa465c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784754345, "uuid": "1601aaf1-ff8b-434d-83e2-7224e5896e74", "comment": "Malware payload (Mirai)", "value": "a8a2578daafeebd99896ce8ead24c2c1550444c43b8be60135a8add9650bc7c943f7a2fd32c3c8d0daaea1ee44f33a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784754345, "uuid": "42850e67-72fe-4f05-ad2b-1a5fb0d23667", "value": "T1D2C32949FC819B01D5E526BAFA5D51CD33270BB8E3EE7116DC211F2167CB91B0E7AA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784754345, "uuid": "1c09e19d-04fa-4a1d-aaff-ad56c13adb84", "value": "3072:PouG4KvvOZlQVDyzT0V8KRWwwAsLkr/1CtPyL0Yl0L6a:PA0bzTnKswwAsLytYPyL0YiL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784754345, "uuid": "53a3bf04-957f-450b-a89c-dbddd23bfce1", "value": 118372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784754345, "uuid": "2954b7e4-a433-4259-be21-bb687abf85da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784754345, "uuid": "0eff514f-35aa-4f96-b65f-5777b89b0596", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddbed4b-8578-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784688744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688744, "uuid": "1a42840d-fa05-4bef-bf6e-0425859a2554", "comment": "Malware payload (Mirai)", "value": "fac71ec093c24565c5c72ac2a3af2e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688744, "uuid": "bcaf93d8-ea88-4cf8-9412-e8e84d7529d9", "comment": "Malware payload (Mirai)", "value": "a8908e6188e828c37eb51771ec60f7468dfbae22c00e0737825c4b97d0004411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688744, "uuid": "c7713931-93a9-4623-9b50-5bfaa8988fe7", "comment": "Malware payload (Mirai)", "value": "51af14ae139df08040217c37df67d766258a310f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688744, "uuid": "46cd47ea-f072-4dfd-8b3d-f6f538597ef1", "comment": "Malware payload (Mirai)", "value": "6d1dfc8a49fd2b36c272d048b0102b3db16342c12534b88c5f235c8f510262f89160851f46ef9d360591dc2c2524edcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688744, "uuid": "814ea9c1-6aeb-4ffe-a0b8-45aba511aaf0", "value": "T134A3FA1EAF611DBBD81BDD3305AC070274CCA61772643B793538C528BB8A54B8AD3CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688744, "uuid": "f21149e9-1a58-4a63-b523-8968226f2f8a", "value": "1536:zKAeGLVAMtCde3xXi60QAzVm7qauTKN810g5lU02kxXBgz04EE7:7L+ywe3xXD0nzVyioYxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784688744, "uuid": "ecc56810-5303-407c-a0bc-8c91f0e29b7d", "value": 101156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784688744, "uuid": "2830af6d-1045-4a2c-a83a-be4a79fd03c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688744, "uuid": "2e9026ea-dc92-458b-ab10-9ebaf2311f54", "value": "oeC6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ad9ce0-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763093, "uuid": "d734fa1e-baaf-4b5b-aaeb-6ab0301c77f2", "comment": "Malware payload", "value": "a6d3283d9bcb36f9a44e0f8b3a14f8d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763093, "uuid": "4ef14f97-940b-4797-ba48-9eb768f24fb2", "comment": "Malware payload", "value": "a8b6f96c0e23b700f97b4104142d75888b2dd2f91d00119810be625958485046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763093, "uuid": "27458707-1239-4bb8-a614-168aa912f428", "comment": "Malware payload", "value": "2c7f9edd1dae4ccc51e203861e7b30085a7cb35a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763093, "uuid": "725b3ddb-a7b1-46e3-817e-58efb5210b37", "comment": "Malware payload", "value": "a2a65c7cb60e733d6552fecf37d6f6d56f1c32426048fa8222c08f48754055c175118bf7eef5e459f2a6263731941e2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763093, "uuid": "f261fe43-cdf4-45fe-993c-8e8656e16d7b", "value": "T10E065C81FC41CF52C9D03A7AF66E828833530779C2EA70099D255B7467DF99B0F3AA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763093, "uuid": "9e120616-b7ba-49fe-a114-4a05ce9c9e8d", "value": "49152:6FG29jovKdP68uEYsejO9ZvfwFuha4ChU5O/JQpp6:oG27dP4NseiTINhU5ORQpp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763093, "uuid": "d26b4652-86c5-4ff5-afad-0929bc10a6b5", "value": 3924792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763093, "uuid": "8e2fb397-d6d2-4cd8-8831-e1c8b6551a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763093, "uuid": "a7891c8c-6bfd-4c07-870e-97f78e59ee1c", "value": "efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3709006-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784732669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732669, "uuid": "1ec08560-607d-4ef1-84fa-90db949d488f", "comment": "Malware payload", "value": "971a3440da13c56f0e9b841b7d1a191f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732669, "uuid": "53974917-aab4-4830-a7d5-7088435e40c6", "comment": "Malware payload", "value": "a992268232b8511e94eb2736c6139fb66ac35b994524ee10aa5309ee7efe3e14", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732669, "uuid": "c3abce06-a9e8-4ce5-b005-5b610b615daa", "comment": "Malware payload", "value": "edcfc4188cae66233511538c8df3d8a82da3a1c2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732669, "uuid": "1201708b-d77d-4547-8354-8b96cee46c82", "comment": "Malware payload", "value": "40d7c108dac49a0c169b87dae2261b2a305839d8bc4dbd82fe91e9cce63aecf85b122f74963fa8b14e7535f3163401a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732669, "uuid": "ca20deb7-4b12-4d5c-8a74-33240c2f2e3b", "value": "T12DE048CB011563714B1C9DD87C7B44BD79C0D2D571A23626F4048479C2CA1187C1372B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732669, "uuid": "36b979d4-edc3-4451-b3c3-a042ff39b402", "value": "6:VS3kzRrdP8khELVBQ3kzRr/Q8ksWQELLcBQ3kzRr4xh9yLcMBQ3kzRr5xhbQxIMb:VS3kzLPfhE3Q3kzlQ8ksxgwQ3kzkhgL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732669, "uuid": "f5b6ce70-6f1a-4e4e-9834-14c6257f0fd8", "value": 322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732669, "uuid": "2b1139b5-9100-4131-88e5-dc78d7833ebe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732669, "uuid": "80360822-4bbb-4ce1-950b-a113d0ae4fa5", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d039fd-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784723003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723003, "uuid": "f2e2ad5f-8138-4500-8c65-5aaa1b9f96d0", "comment": "Malware payload", "value": "786b89d824ccd5f3a7f5f889537549fa", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723003, "uuid": "dc4a6957-319d-4714-9bb2-56a67ee86646", "comment": "Malware payload", "value": "a9d06f23967f62c6bbcd7aeeaa6b02e25585cb4c7e992e485c26849574ad2742", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723003, "uuid": "4608bbd5-26ea-4134-af91-b486ef3a4e45", "comment": "Malware payload", "value": "3144bab532727541d46fa67a06410bd987efa743", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723003, "uuid": "40d0ccc7-6d53-4c99-9723-0ba36005e373", "comment": "Malware payload", "value": "3a952d8d281e5a8d41ea1679c5f0482e5022d1f07e7ba3420a3287ec5e033826de66cd1f3a3ab5937a3da0266f73a79f", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723003, "uuid": "f0add334-3589-4eca-ab41-054a082f47cb", "value": "T1A2C68EB5643CD81ED083E0F87A8B87E27D09F46003B0514737A57F7ABE64E5019AD7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723003, "uuid": "4e261b73-b496-4b7e-907b-87cacbd3920b", "value": "196608:F6mfRFzoPE9WL62ceJUEdzr7ImvaTM5UDmtXmEAE9WL62ceJUURzs:FvrzoPE9WL62ceJUQzYmvaQ5UDmhmPEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723003, "uuid": "4763b01b-1add-42ff-bac4-122fed8ff05d", "value": 12244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723003, "uuid": "6feae084-8b49-49ee-a1e8-25e1438baed3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723003, "uuid": "d1d29cbc-3b69-47c7-8f4e-8d8c3385d833", "value": "loader_agent.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466ae310-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784705025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "1393b446-61e1-4220-8ff5-a05023d6cff1", "comment": "Malware payload", "value": "8359b758ebf559d3e74da8907bcd4d5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "d0279107-c406-4336-9176-f2bff4c195d8", "comment": "Malware payload", "value": "ab13109a86fd0d2c8426e5c545ce34540096cddfd3b7865b5d5d1a8975e70f6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "a3d74d89-a6a4-4d36-b83c-2b866960eff6", "comment": "Malware payload", "value": "9134e72dd5d5e1c40a77c366f75022c2e077b82d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705025, "uuid": "5f82c0e7-4e6c-416c-896f-a88d9481a8d5", "comment": "Malware payload", "value": "83bb3813f1738f814bf9ce0e70b2807da308fdb2d9ebec24a0e051d8472696d7bb225906f24fa2877fe58c5b17f7b6eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705025, "uuid": "3b5e764e-758f-42b1-8ee8-7b496a333a82", "value": "T170533988E383E4F6EC0B0570102BF37EAA75AD262124DD67DBD8FA63AD32752911351C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705025, "uuid": "20927672-0547-4ac5-ac07-6c63f7d6960b", "value": "1536:sjhqr9Kn33WCNCpLhON+SeSik1ths1sM:sj48NUON9eQP4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705025, "uuid": "abea842b-c659-4ad4-8059-b5b639d3e030", "value": 66404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705025, "uuid": "59f7569d-7548-4ba4-9df5-b6fe67be3e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705025, "uuid": "23b47967-8d87-4572-9619-9a843a94598b", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8320c5cf-85f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784742923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742923, "uuid": "fb769b36-0465-4aa1-ac43-e1ad2a5f9885", "comment": "Malware payload (Mirai)", "value": "8c146cb8d0f953f4f499c22dccad4ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742923, "uuid": "856d7e93-d74a-4332-aae2-36d9087a3ff8", "comment": "Malware payload (Mirai)", "value": "abfb82063edae5e261ad2a1a6759feb184c59d1aa36c3d8fa4755a9365af85fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742923, "uuid": "e7533cd3-5925-4c5c-a604-5bfe870a6e8e", "comment": "Malware payload (Mirai)", "value": "93174aba5f41f52604c9d0b47e04232a1c1fc7e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742923, "uuid": "ca416e36-73da-4d8c-817d-3fa96efdf5ea", "comment": "Malware payload (Mirai)", "value": "fcdb7bdadf67323af067678f460af43ce7b446b32e64be594fdef8249597a6ac51ade37c4086d6e85e49f6e7070ad562", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742923, "uuid": "38357efe-86ed-4c88-bac2-a9dd375a610d", "value": "T10FE2E1300E8C8861D67301F5DF668C8635634A7EF5E766ED59318125C5C624C3FBA4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742923, "uuid": "69032860-04b9-474a-878f-74b858b63dac", "value": "768:GZ+PXTm1Mj1nDuOToXH8HEtsUe9Zctz/wTId9s3Uoz3x:Gyyuj1D/eUssXLct7wTmAzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784742923, "uuid": "714d3a24-d96c-4051-94de-159f7d1d567b", "value": 32884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784742923, "uuid": "a31799f1-edf4-44bd-a829-9af2e96a6c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742923, "uuid": "dbf51f87-2df2-4d85-b902-b3433bf00000", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911042d4-8567-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784681528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681528, "uuid": "05000183-0950-4525-9519-e4012c20e450", "comment": "Malware payload (Efimer)", "value": "710f0942c75f9b12c61f55c166b50fc4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681528, "uuid": "b21fe192-005b-4920-a83e-bb32f61e2074", "comment": "Malware payload (Efimer)", "value": "ac197dc54bf1c690dce6eff2024651fee1c57f3273ef4deb253854fe2b0afba7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681528, "uuid": "276e713f-0dde-4eeb-893b-09bf13e4b204", "comment": "Malware payload (Efimer)", "value": "e433cca452309f84f87100208fd3354d643643b5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784681528, "uuid": "34dbb834-b3f2-4a8a-85d3-37c014182730", "comment": "Malware payload (Efimer)", "value": "55cc802a106ebfebb5125d3613e0fd29fd58d32dd69a7a4cfb824fccec105b13ca3d8f741460c53dfc1912f3292c465b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681528, "uuid": "2adb7bbc-06e8-4221-ae1d-1d83f3977d45", "value": "T194E633488AE001EDE5FB403CEEA156A1E572747453B3C6CB47AC43E26E571E09E3E61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681528, "uuid": "b1c7ea6f-acb8-4b8b-82da-48aa2c4566b4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681528, "uuid": "a0108d9c-63dd-4f0f-ad9e-ae62f09df5f9", "value": "393216:OdubvQoZsJjr3rXMCHWUjXWcuI3/PGTAI:Ow7TAr3rXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784681528, "uuid": "1a75ba77-ce43-4604-b940-f011005f9109", "value": 14315154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784681528, "uuid": "77079c75-8132-4c93-81e0-558a801ffa76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784681528, "uuid": "e66bb32a-8eda-4a3e-9bac-5636afbbfc11", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad4a398-8569-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784682457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682457, "uuid": "69f14d78-1bbe-4c88-9c45-5228a41b9d24", "comment": "Malware payload", "value": "e47a765a7316c12f481db1e622510df7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682457, "uuid": "8644f15b-730c-4ee1-b009-8abc55e83f09", "comment": "Malware payload", "value": "ac59f3d4e45369275a7c9fc49bacb32fbc4348e57b5af5f3a12a018904d386ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682457, "uuid": "f989c709-505a-4e5e-bb74-748cb8c54ac3", "comment": "Malware payload", "value": "d12ea3d30ae780eec51982095f9f0ad8b8e1d53a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682457, "uuid": "787ef3f1-611b-4ad7-96fe-ddfa50fd7db0", "comment": "Malware payload", "value": "70a66837403beb237fe6531e656ff054e3013629fd7247545def63f8aeb67ccf006c1bd6daa2532c5d1b9a79771ff6a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682457, "uuid": "bf5c45ce-0061-4cd4-ab25-51f040a0fa7b", "value": "T1FA237D652A817C14AA98C4371D7E2F0CB9AD43E6320452ED7FCF3CF68C5A69D921871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682457, "uuid": "af9c982c-9c79-4f85-8bda-a6c3d08ba4a5", "value": "768:YXOGVvn9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:OLIcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784682457, "uuid": "1a156c71-9fb3-46f2-a531-b40d7af1f79d", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784682457, "uuid": "ffafe4c1-71fa-4dc4-8bbb-d631999c2d53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682457, "uuid": "6e4cedb2-3b3d-49f5-bb96-143259e8f2f1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a72532a-85d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784728601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728601, "uuid": "ed399cc1-0006-43e7-9f08-5ed6370de0bf", "comment": "Malware payload (Mirai)", "value": "635c4ef6e8e3225beda9276ce07b798c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728601, "uuid": "4f538880-9e22-4e04-8558-0d48ccb9d982", "comment": "Malware payload (Mirai)", "value": "ae776a1281b4936cfcc76842227f27f33017783d03476a84dfc46a9851dcbfbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728601, "uuid": "d46d568c-e083-4c09-9f5a-d675fae63a90", "comment": "Malware payload (Mirai)", "value": "f4f0e287c741c5c2b2afc83dd2b5773aab6c210f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728601, "uuid": "8a1ccfb1-be36-4bc5-9d9d-2d21c640d2bb", "comment": "Malware payload (Mirai)", "value": "46785ab623109175f23f290017e61d1ca41750e5f4cb0e9fc669d6d897d39ced8c13fc8539aa163ff6b3b50116f58839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728601, "uuid": "02c31e28-78fc-4d34-8e4c-e733705d2164", "value": "T101F3765E2E228F6EF67C873047F74A25A76D23D627E1D684E2ACC1141F2025E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728601, "uuid": "2621b910-4dba-4450-b9e6-30a908e5f7ec", "value": "1536:o3rjKv2ABGK88u8d4tAzWwrSL2fQfLW+f0eexHRzdGth8TleSFqzsiZxRffLS:qq+/8XUhwrSL2fQ6+fsRzM/S4zsYfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728601, "uuid": "fbfc9b77-0144-44e3-98a6-c38dd3ca9406", "value": 168936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728601, "uuid": "bdd30b2d-d6e6-48c4-bc08-6f6721a245a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728601, "uuid": "1ff393db-9bd2-48f3-9963-f70a35a126c0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aa97a3-85c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784722771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722771, "uuid": "fb816128-3f57-4da5-a7b5-4f9a451e94d7", "comment": "Malware payload (Mirai)", "value": "ecdd8d3ecff7058a7cc946783e9b6d09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722771, "uuid": "52781a31-28b8-4663-96ad-fb874f4bc450", "comment": "Malware payload (Mirai)", "value": "aebe6c8a3c3a65159a761b6b67f7b9c3c5d070188f7fdf469c9ead6e125667a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722771, "uuid": "887c7077-3551-4cab-a860-0398cad6d443", "comment": "Malware payload (Mirai)", "value": "15752a27171b1e7574d645ff19184fea89be5a22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722771, "uuid": "88231d95-76fd-4bbb-b1ed-6329de48b266", "comment": "Malware payload (Mirai)", "value": "2a820ce2b5321384030e54b262aec9f5eda3e2eeaca72c1296dc21ea30c033dbe3617d4bbd5758f64f39baa4dad0fd95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722771, "uuid": "6ebb153e-aade-47ce-abcc-3a190e1f39de", "value": "T1F3B3AE36E81968F4C07E8574E5A4BE790BA3F48052931EF716E6C6B65047EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722771, "uuid": "b93f4c35-dd89-4556-8f6b-5855c062e3f4", "value": "1536:t/juy48gLDajwrmRZ2QprowQi1YKiC7p74Pe/9C/6otd1pHh:t7uy7eaMYZProwQi1fiQye/93efpHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784722771, "uuid": "d779f91d-2f02-4bef-ac15-68439e402b51", "value": 109776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784722771, "uuid": "ff75fbb0-a9a5-44a7-a5c4-6a8c2cc1c0b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722771, "uuid": "704459ba-1fa6-4f19-b3b1-ec42f9b3c8c5", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf45df9-85fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784745706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745706, "uuid": "8599b911-f225-42ec-946f-4fb3bc7a5d4e", "comment": "Malware payload (Mirai)", "value": "6b6691d653913a5ff8a9dfb03680b1de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745706, "uuid": "b0d7d2da-7883-47a3-bfba-2f9c98250f36", "comment": "Malware payload (Mirai)", "value": "af6b4bd3e6b09ba0ff0ed72ad1162cae6f4b78099f26fdd0b7992fedfe9b0833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745706, "uuid": "3e0d3e3d-a74b-4b9c-90b1-c0d615ec25bd", "comment": "Malware payload (Mirai)", "value": "71cc2d1d9cdecac65876ff7bc6a564fccf7a954e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745706, "uuid": "41eaf143-07a2-4e3e-995f-c3d511e164d8", "comment": "Malware payload (Mirai)", "value": "4040f3b5ff89afcc15b012514b360a425bb5e9f96614c5a0d6b915c5011fd47b440bd3360fc215296f517fea4c566031", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745706, "uuid": "23ead49c-6cfd-41c6-bb2b-3709cc8e0524", "value": "T14FC34A9AB4019D7DF94FD6BB48636D1AB930A35251831B26239BFD93AC321F47C12F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745706, "uuid": "c17c47ec-c1e3-4b1d-a054-c2ff32d2b694", "value": "3072:2T/qXTVJICl5Nd0fUTRML8fJBqYWPEL6bFNsUs:kiXTPICl5FqgfjqYGbFNsUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784745706, "uuid": "61535a67-6343-44fd-9012-249228997396", "value": 125912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784745706, "uuid": "4c5e8dc1-e1af-465e-a862-ad71122b28af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745706, "uuid": "dbad45ce-f11c-40cb-83c0-15df3ecc55e9", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d0d1a7-85f1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784740667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740667, "uuid": "bdadc424-acd9-405a-a1f1-2d480b54574a", "comment": "Malware payload", "value": "4c29ebf69a89b9fa27ddf71b72cca280", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740667, "uuid": "f2dd42c7-e04e-4a9e-b7cc-003e4d0db104", "comment": "Malware payload", "value": "aff385e48471ae461ee8e0b27e31bd41c90c99b4d2c9100eaacfdeea234da1a6", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740667, "uuid": "23884bbe-1e41-4e26-b64c-eefe50be634f", "comment": "Malware payload", "value": "72e2ad1acdddbb16888ebdba5dfed440da261bb5", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784740667, "uuid": "1b928213-31c0-4367-ad43-3f5c25e01906", "comment": "Malware payload", "value": "a7b77c2d37bb4ad27b3ae2d3d07b029c43637fdf77f6c61926da44a7e8aea06d663f88e380bd2c5146413b424f0ff524", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740667, "uuid": "a398c356-89aa-44d8-a4bf-0c40a821db9d", "value": "T17A3423EE28F472F9BC35BDE2750A392489CD575361725F42105A3BAB0B48DA6C47F882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740667, "uuid": "104abb8c-541a-4ee0-8604-73b7176a6dcf", "value": "6144:ZZYystSnCqRvZTTJ+gUgyf40S6y311EETfJYDQkDD:ZZ8t2XRL+9FSrrBkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784740667, "uuid": "86f15696-66c7-4ed0-98f2-a967142d042d", "value": 236350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784740667, "uuid": "adb1d79a-de08-4f62-ac74-d7a8cfb7d830", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784740667, "uuid": "01bd9597-62fe-439f-8c6d-756f75cf968a", "value": "Avk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199b0f0b-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784729431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729431, "uuid": "310665eb-c1b2-40e8-ac25-006f4d3f2907", "comment": "Malware payload", "value": "3807f8a0251480122d99c35c04d882db", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729431, "uuid": "7382114c-9d2c-4a1c-9438-fe4b072aa3ea", "comment": "Malware payload", "value": "b0190be1089b17ada36dbcdf183d6996e840a993f29bd376b0bd3c327572f936", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729431, "uuid": "d75a51c9-38e0-45d6-81f3-33f4353cbabf", "comment": "Malware payload", "value": "4bc224e3bdb6701b2c1402af78b6bc2e17bd9dbf", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729431, "uuid": "23a721e6-54f8-4d4d-91ad-696ab600d2c6", "comment": "Malware payload", "value": "6545a249e87057031df8e296719f56f4b104262a25bc81907efd12318e6ad9e61f64de3d6bd07756f85b3307692cf3a8", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729431, "uuid": "0590ce31-9dc7-4129-aac3-e071b38013bb", "value": "T1FCD5235DFDF619B4E876C3B39A83316DB1297B8986744C5771DC5B002D23929AC3A338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729431, "uuid": "b1ae8d7f-f43e-4cc8-8d29-a9a005335067", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729431, "uuid": "5ebe5b4c-7358-4785-b598-49ef5df5be0e", "value": "49152:p/QiN1eFMLWJd0gwVwYgpYfgRT35Dd9dZ19612WPysNqwLoGmfNnvG7c:p4ibBqJ3wV/gp1p/8PysNLoGiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729431, "uuid": "ffa04412-cfdb-4b87-bcbb-d0fd8745ce78", "value": 2948096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729431, "uuid": "3902ec00-8d3f-491f-adb7-9d99419ce904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729431, "uuid": "ec4e19cf-6cfb-49be-a182-6b7111e47111", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c935dd4-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707183, "uuid": "bfdcd861-4552-4c67-91eb-648d35e9fe69", "comment": "Malware payload", "value": "b05e1a11768be54f310fd49f97d58adb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707183, "uuid": "0f16f557-0a4b-4f20-9e53-4b23f2daca7d", "comment": "Malware payload", "value": "b03c0a682b9714d27d6c1c54792224f2eede4156a4f5d57962d50da840640707", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707183, "uuid": "5b356d43-cc8c-47a7-b1f8-07dea63ddbb2", "comment": "Malware payload", "value": "8db424ef26fcad06a6c80617fd47ef218ff21e15", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707183, "uuid": "40d30398-beed-427f-8a4e-76617b516816", "comment": "Malware payload", "value": "537a85bdd23f979a7e2669642f673a8cf4e17e0d63e55836b3ba3714d520ba0a61bbdb6189083aae33f237e070302c76", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707183, "uuid": "189a73df-dcad-44cc-81b7-9e85106a3262", "value": "T10B236D6516857C14AA99C4375C7F2F0CBDAD43E6314492DE7FCA3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707183, "uuid": "c5d034dd-3867-4dae-9559-c3c44817f31d", "value": "768:lr9NyXsZztCE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tHusZMcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707183, "uuid": "80696ece-2f05-4ebe-88a9-981c17f4ff58", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707183, "uuid": "fe524cff-9cd3-47e2-b96d-46ca431d5a72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707183, "uuid": "d0bd9ac0-9a8c-47bc-b308-f5fa2506d693", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9178de0-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784707473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707473, "uuid": "84f64df1-e0d5-44e5-b0cc-670525bc1dc2", "comment": "Malware payload (Mirai)", "value": "f47a3b446a637a44d0c398a7520acb6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707473, "uuid": "b839c5b7-9415-4c4e-8c3c-36ecaba50793", "comment": "Malware payload (Mirai)", "value": "b06c7f8c22f7beeebab2721245989ce19a439989b3109458e9baf920c29321b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707473, "uuid": "31fb1b0d-71c8-4dc1-a941-4e478e10417d", "comment": "Malware payload (Mirai)", "value": "c7306772e0670acc580df5db03f6449b9ae43b4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707473, "uuid": "0c74b28b-4543-4dc0-b3f7-9602a504d1e0", "comment": "Malware payload (Mirai)", "value": "1792df226c65ead14436bb436b73d1afdc522b0f066ba6a9ea3e4f0002a326a17f796808b1fba323871db70210598edb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707473, "uuid": "cff1d284-3ece-4611-b649-3e3815e55e3d", "value": "T1B80159DA86006D106099C61D2A9B5454F821C3CE198B8F69BF6CAD3DAB88C24F026EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707473, "uuid": "7ee89d04-c6fc-4d4a-9b8e-f3fe7f345a95", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkasEC7aCRQC+B11jC3SCipDCssTIX:kXCKysE2hi0ziQvZohaT8n2tjD7NrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707473, "uuid": "9f4f90b0-a8ec-44d7-abed-7f2c941ae834", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707473, "uuid": "cae4fb49-90eb-4cc6-8c1d-12ecfa1dc97e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707473, "uuid": "cd7da3e9-ebc6-4513-9861-0e531bb586cb", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71e6636-85f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784744379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744379, "uuid": "be4abf0e-3f55-4596-acd1-62af8056918b", "comment": "Malware payload (Mirai)", "value": "8ba0cd120848d1cfc638ab993d928e9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744379, "uuid": "bccf4252-2146-4d30-b519-0408ada46d68", "comment": "Malware payload (Mirai)", "value": "b07b64629d8b996e2165471168e887d55e292b0a00d90c099a18aa169652eb3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744379, "uuid": "ed0d79e5-e375-49e5-a94d-77f3f1c86c46", "comment": "Malware payload (Mirai)", "value": "8d779e11d2112793e0a1e5d2b2714f7cb50b1bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744379, "uuid": "def770f4-4af8-4cd3-9da5-7728336b4dd3", "comment": "Malware payload (Mirai)", "value": "a1b98f348788d00f62040e920ed58e38801bd4614c9699f64ee35c4cdd2b01e452690bafac42eb422ec8975a77a80746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744379, "uuid": "dccd026d-2525-4055-a29a-604575741cf1", "value": "T12CE3E80E7E218F7CF795823447B7DE1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744379, "uuid": "71fc85fe-8669-4c0c-b216-9957acfc7737", "value": "3072:hhdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpURzrnPcH+14tTI7V7mFM7mYIrf:/dK+SE7ktsNOT8wR41M7qlkoKrMh8XQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744379, "uuid": "129fc770-d848-4c8b-a333-009c33a07e6c", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744379, "uuid": "1c652ab9-5e6d-4774-9805-c651fc497c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744379, "uuid": "b32d3c70-3d6d-4fa3-bcaa-4ba905258645", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f158514-85b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784712717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712717, "uuid": "cdb6c8ad-491f-4270-bee4-4f278bdbbbf5", "comment": "Malware payload (AgentTesla)", "value": "2d569c5eaec74172ee46fb7af42962fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712717, "uuid": "0b7a31f1-8d35-4a2a-ac01-3b2b2cf29d5e", "comment": "Malware payload (AgentTesla)", "value": "b134896ab4f8a75cb79f559a1f3aa65b5cae52a3c39fb95ac8371d600c2c92a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712717, "uuid": "a12125b8-3a14-47f7-9918-1813bedfc007", "comment": "Malware payload (AgentTesla)", "value": "60e26cfee4817ebcdfee1448396ef6e6a9b05469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712717, "uuid": "aac33e78-6cc2-4fe0-a9e6-b7952d609435", "comment": "Malware payload (AgentTesla)", "value": "a61b1dcc9647f92a81cac6a9f3f00cf0bec08952186cc8ef189e151efd8f62805a3d0cca9c161c28ebef2666490bad30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712717, "uuid": "a2ad4994-0a15-4cab-98b9-1b0b956f8273", "value": "T12074C0A1F299C8DAEC52227158BBDC3315577E69B875051F312F3629ADB33C3106BA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712717, "uuid": "aae2e6cc-8fc3-4245-a43f-1568c5282802", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712717, "uuid": "01902080-ad0c-495c-9ce8-005e2bf9bd53", "value": "6144:EgORaspjQel+F3MjvEypW/VFNUCFIrsai8:Egyjz+F/gW/zNUCF7ai8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784712717, "uuid": "09d2f321-f0b5-4d45-8ccd-ca957194fa57", "value": 338976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784712717, "uuid": "62c2a2b1-4726-4f58-bb6d-1e0f923f1a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712717, "uuid": "1103528c-75f4-4c2a-86dd-32bd3aa6c1c8", "value": "0092837465509072026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47950ab-85c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784721128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721128, "uuid": "9a2bc9ad-1e2a-470b-a8d1-96fa087c6708", "comment": "Malware payload (Efimer)", "value": "b0c149367245352b5a12e181664da0e1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721128, "uuid": "32b89413-5ae1-4b04-9590-410294ee0a51", "comment": "Malware payload (Efimer)", "value": "b172dbfbe82bb1ab9455c62688e47256a16233c21925ac450cab33b708c0ede8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721128, "uuid": "bfb70edd-b3df-4c2c-9436-7f81b56e5a00", "comment": "Malware payload (Efimer)", "value": "d9ea5b44988c76f0c7051fd66eba3fecd440d6b0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784721128, "uuid": "2f10e5a8-b17a-4e9b-b354-94f6e3d91426", "comment": "Malware payload (Efimer)", "value": "63ba48f650477baedf92f82e3559ba52ec210a35883656e94adde8479092228b046102b18b17d6fc2c5150e9e69c1da1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721128, "uuid": "2a049635-0811-4041-87ed-0bc518f95457", "value": "T13EE63368AEE002ECD6B39439EDE147E1E47C34364B30C29F6B50D6D56E171E09A39B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721128, "uuid": "df64c5f8-6f20-4afe-8c16-48e3adb8e083", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721128, "uuid": "fa979520-8165-4b97-a89f-680a46e44390", "value": "393216:BzHTagDaDkfBSiK0kVJWExJXMCHWUjX1cuI3/PGTAI:BaCaDgz4VJHJXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784721128, "uuid": "6843df66-1bc9-4122-a24b-9926462d086b", "value": 14278710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784721128, "uuid": "b19f7a85-c569-4f4d-a7b5-32f359ded949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784721128, "uuid": "ae6b0439-ca22-4116-a826-dc067184d68f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160ed4d8-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784729425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729425, "uuid": "4dbb5056-cc02-4ede-9f11-6161fc868963", "comment": "Malware payload", "value": "19b3d02a7e9b104f58b376978ee1b698", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729425, "uuid": "517bfa5d-7f94-4451-be85-a838bf2e033d", "comment": "Malware payload", "value": "b1c4f1c73e004961b11485e8dda5fabb29926abe917a34cee23e370600ec0525", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729425, "uuid": "2576b8df-e15d-451c-98ae-966bd980a8ce", "comment": "Malware payload", "value": "f22f85bae3f2ee494d1af48e47c4bbb1c6ac62dc", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729425, "uuid": "4ea8117d-6e07-4458-b31b-d2a2169332d4", "comment": "Malware payload", "value": "1661687cb7504fbf2dc6b17d0b652df757fb6427108799d8900de4b71d4ea44db343b75833bdb489a64c7fccba439c19", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729425, "uuid": "8ec95778-2b5f-48c4-aa34-19402057e2ef", "value": "T17FD523856CF20979C063C3B68FD3E07DB46A3BD587B58D06F68CA4408E23684B97B765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729425, "uuid": "8095612e-6bc3-4dad-ab77-acc3da7c05b2", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729425, "uuid": "b651e7d6-4da5-495c-a863-acceec13a689", "value": "49152:6/vwVmaiXjBI8uqZHkMqZ1gnmdiLPGCKPX+d9IAK5Fi6MPD5GlgtC5xb+yKcNw3:XoaiX97v1cDkeC6+FGLnKow3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729425, "uuid": "9e129ede-29ae-4679-b423-3567b9343ae6", "value": 2889216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729425, "uuid": "4490b4e0-5eea-4b71-9cfc-90a5604be1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729425, "uuid": "a54630c5-90a8-4a8c-bff7-0ef9ec5425e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a179e6b9-859e-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784705178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705178, "uuid": "7a058503-a156-464e-8bce-1c029c413a36", "comment": "Malware payload (PhantomStealer)", "value": "7192731baec2a32f438a994c15f8ce8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705178, "uuid": "468f80d6-95a3-4cbe-995f-1f0cae5c1a00", "comment": "Malware payload (PhantomStealer)", "value": "b24fefefe8a95d6a765caff9b0ae40ed480dfdbfe2e5a46848b1a9d895ec83e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705178, "uuid": "d8e66f52-8bdd-414d-ada6-2440a43d008e", "comment": "Malware payload (PhantomStealer)", "value": "9175fbce719442bbd2768a1e67c4fb94a6f3c367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705178, "uuid": "280f9521-5b45-4919-a21b-43ce18e415b8", "comment": "Malware payload (PhantomStealer)", "value": "2f5f279c5fdbbe08012453c4e9d648151d52d57ee43c988abf081268203eeb8835d171fd8227e85cfe0333562710fa0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705178, "uuid": "5c621255-d644-4f87-9113-d165af37241b", "value": "T1B4A5120C27E85B56EC7D8B3A84345AA493F0BC42A72ADB5E7E4C31ED0E357C0A946753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705178, "uuid": "13af8712-1b2e-4783-b0eb-7b73b3fd0d70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705178, "uuid": "7d2a0a8d-fff1-4b0c-b54f-34d9c9f8ea62", "value": "24576:uf2UxAPqGcv/+Duyx4tVItPAO8I8vo7Ve752lkO8/MshOXzBuqLG2rZkRJxT:u3qPRcvEAGtE1A71cYBM2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705178, "uuid": "67249926-ae7d-41f7-99c5-2875b02498f1", "value": 2087424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705178, "uuid": "886cf81f-afe8-40e6-ad4e-e6cbb643927e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705178, "uuid": "46e6ac60-824a-4d60-892a-d4201949c4de", "value": "Shipping Doc..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4c785c-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763076, "uuid": "de144dcb-b3e3-4f37-9f68-ed82a7001996", "comment": "Malware payload", "value": "d2eca70f82a952805ab7c2cf79578223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763076, "uuid": "1a7020db-5895-4909-ac83-ca146050d7a3", "comment": "Malware payload", "value": "b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763076, "uuid": "3bca8371-463a-4516-bde4-7d06ce2cfede", "comment": "Malware payload", "value": "84e08fe68fd905b6032d206c33af1e351e1ee73b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763076, "uuid": "a9834212-66b2-4429-9ff6-374a0d0fef12", "comment": "Malware payload", "value": "fad85361e6cf03a210b16895c6c20dd48e5b28c41f07f45db168af6f238c8db6a4bfe5cde7693a2fca1a7cfd309b11a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763076, "uuid": "b0e7c445-a3a5-4441-9411-937860d2b84f", "value": "T109853306827ABFD99761F4B0D07B4A297F26DDE4806471A4BD942DF1C2FBE89039B0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763076, "uuid": "901325bf-85ab-4f89-b64b-302199bd7ed4", "value": "49152:9omBNlGJqFRSu1+Nz5wPg0ZpYHVIJYukcwS6qKCx:vG04g4z5J0ZpYLbcv6q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763076, "uuid": "971eae22-e858-41cd-a739-f2cc7a9ce879", "value": 1832668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763076, "uuid": "eb2b3851-94d9-429b-8c0e-0ae332aceb51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763076, "uuid": "d22284b3-b5a9-493d-b95b-1ba0ac554da4", "value": "b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25937cc4-85fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784746202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746202, "uuid": "7c3a4d75-7eba-4ab5-8351-e8dfe6043306", "comment": "Malware payload", "value": "3a2aee8d0e903f7687fa160b632eaca3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746202, "uuid": "b19e7b88-d8d5-42f8-a8a5-d4573350a888", "comment": "Malware payload", "value": "b59926d8f62f2c71eabc66314c11ddee505f97e559c7c051b63e9d7b06c1b143", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746202, "uuid": "b8046e38-8e2b-463e-8742-dab6af0a4461", "comment": "Malware payload", "value": "770eb73715294989dee34b022be621444d10cc9a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746202, "uuid": "9c4d0a49-5c26-4b7d-b266-6bfbc0ea01ba", "comment": "Malware payload", "value": "cfd7219c89a60adbcb164fa1fe1932b85a72bee0da9617729ce7f1624ed7e0bbe11af8164231864e04d731b613c274f8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746202, "uuid": "94be1edf-224b-438d-a1fb-a51051ca5e9d", "value": "T164825B0FB9424626C0D210B49671977BDABA6872338414DBF7D48AE90B686D5FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746202, "uuid": "375cf54d-7be0-4590-bf06-1e4d9b99d624", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746202, "uuid": "ac51edad-457f-4bdb-a3fa-1663f8193930", "value": "384:TIqQlV6lLN+v0CvBu94gXTcVv4av8U9c2QF:HE0IE9y4a0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784746202, "uuid": "bcc560e1-fedb-493a-a082-604adae8bb21", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784746202, "uuid": "2ff7f412-623d-48aa-af7b-fcf535fcb609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746202, "uuid": "7e5143f2-a612-4e76-9d6e-204c8d1f014f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfa4d69-85cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784725516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725516, "uuid": "ddfca7be-bf34-401d-b54a-80ab5562b051", "comment": "Malware payload (AsyncRAT)", "value": "b5d7ec7c5ea14d00d56e7ffbaac1a803", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725516, "uuid": "30134e56-ef80-4cac-9129-11e1d8e3708e", "comment": "Malware payload (AsyncRAT)", "value": "b65652fadf25dda777fe0374fdae972d1bd8b2321df47da858fe3a3dce28851e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725516, "uuid": "c703f46f-73ea-43fe-81b1-a335d75c5cd5", "comment": "Malware payload (AsyncRAT)", "value": "2b5c541bd24f8c67d17a7dafcf7acea3c5fb302b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725516, "uuid": "1412072d-64d5-4366-9a2e-41808161da23", "comment": "Malware payload (AsyncRAT)", "value": "ba31b1f107533ab908646131313fe29ea1ebed90bf7a35d609927d428c8be1d432cd48ff10c1603accea53ad5631968c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725516, "uuid": "903d8851-779d-4803-ab02-3c860c2006f8", "value": "T127C23B0833E4C572E2FD4ABA8C33D6108B75E55B9A23D75A6FC490AD293378D8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725516, "uuid": "08856af8-fee7-4e41-aae2-afa3461ffaef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725516, "uuid": "90adf643-429f-4374-a7b5-9f3c5845fb64", "value": "384:MN3SaTSXW9bVWw7HtZARPn9jWH9qbuUszbQxnCJfJBndnjJ7FKO:MN3SaT5Lt+IIb3BiBnoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784725516, "uuid": "5e6d6249-fb06-4e92-9d23-a943ee3ef5d3", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784725516, "uuid": "1b2e2439-9f13-4c6c-8cc3-7ee0c3397f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725516, "uuid": "7cd84db3-e55b-4521-a446-252ad3e079c9", "value": "SHBETAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f174aa3d-85bd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784718627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718627, "uuid": "0bf231ab-37b9-4713-baf4-17570a03a928", "comment": "Malware payload (AgentTesla)", "value": "7cec47740ae2e3a5914bb46bc2d0ffc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718627, "uuid": "1e0c3c97-1be6-41ee-bcab-f36c9ef02889", "comment": "Malware payload (AgentTesla)", "value": "b811dce1aae1c0e0da249d5eb19dfd5b2640214627c9603b97f6f79c25a22e97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718627, "uuid": "7cdbaa75-b8c8-4b6d-9299-e9e84cafc9ee", "comment": "Malware payload (AgentTesla)", "value": "154484d6e6775ebef39dfdf7d3ca6c2f2a99d4fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718627, "uuid": "1c1dc889-35ea-492c-9b8c-663c21960ffc", "comment": "Malware payload (AgentTesla)", "value": "cf31e3fc2ea38919832c0a6f70f30a276c5ca6358118d6151367118c6587fd2de51f5d527297ecffd354e78772cbea76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718627, "uuid": "0f375f45-0430-4e9b-a10b-7fea119039e7", "value": "T11984CF93F980C6AAFC2D4C75D5A752301B72ADB696858F4393D879123FB22C0353B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718627, "uuid": "b3123439-0808-4479-8420-70a9910b6601", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718627, "uuid": "507c453a-54e0-4974-90ce-cd866259533c", "value": "6144:8mGIhCrl0WKxHId8Cc3IcgAYhXLnun8q+Jlq56zL:rm0Nxodvc3lgAyan8pfq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718627, "uuid": "7a32af2e-17b7-413f-bf8d-9f9521fd67c8", "value": 396472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718627, "uuid": "b5e2f0f7-ed1a-48d5-b74d-cf7ce7f96f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718627, "uuid": "a4ae8a3a-e6fd-4b68-bd2e-cac08a0af4bd", "value": "Nomina 07.07.2026-97685878464674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59827ff8-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700333, "uuid": "f1040434-e39e-435f-a626-3b9210fc92d2", "comment": "Malware payload (Mirai)", "value": "fad224de9035b466fb262c29fd3721e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700333, "uuid": "b907021a-34b6-444d-9683-e5142a42dbe9", "comment": "Malware payload (Mirai)", "value": "b8abc008562bc7f0b68b18695846d7421922dcf8867b6d9cce73506715db9476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700333, "uuid": "7429ba90-7c6a-423d-983c-11cb06c83a61", "comment": "Malware payload (Mirai)", "value": "b6b1199dbed8fb36867c280347ff14cc616aafd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700333, "uuid": "1333ae66-61d9-41f1-8790-eff566ccd1a0", "comment": "Malware payload (Mirai)", "value": "5fcd1aba6f30c31fa569e90a2c954ed074461d3b3b5303fdb31bc485eb5cbad80224efe84a9796316ebdafe80d4b2a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700333, "uuid": "5917ad0f-d66c-4d55-a4af-e1fbb7a39f56", "value": "T1EA230259638F5E58DE8AACB33D39F8576216F8082730275B6DCE94B359F0E36240C98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700333, "uuid": "17bd9968-13f1-4c33-8cf9-ce27458f0019", "value": "1536:Ro6An9+rRpU6sJT0GA7KV0OK9c0nouy8jG:Ro6AIpUdYToutjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700333, "uuid": "3594c68a-3ff7-4fe3-8356-9a90e1b82d41", "value": 49776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700333, "uuid": "e9c2abb1-9dc8-402c-89cc-60a9b8a85982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700333, "uuid": "c5e405cf-6323-469b-8256-82cdabe848ab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20821e7f-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784732449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732449, "uuid": "1736c86c-f862-414d-87e4-441a4d1da607", "comment": "Malware payload", "value": "92607dc640817c603ec000ed1ee8294d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732449, "uuid": "83b530c9-efb6-463e-9a34-0e74863eab0d", "comment": "Malware payload", "value": "b91e8bad35786f3033407ca9c673d693900928b008d8a0037d4e20571285a055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732449, "uuid": "a3fe514e-56a3-4fd7-93d7-ebc7b64f2e5d", "comment": "Malware payload", "value": "c4b99c9c276aa033b22b272da753c2c2ad276fe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732449, "uuid": "e8e5f5d8-7a85-4cb3-b040-724a64a54b00", "comment": "Malware payload", "value": "b60f43fecc26106aaa672d9aa75122028bd9ce66ce3975757251439f6ce920255d6a0e4d74e2d2f441639eeea2354b11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732449, "uuid": "7d1bf309-16e4-49ca-b96b-33a8c561ad76", "value": "T124A3FA0ABF611DBBD81BDD3749E80B0638CCA61771693B753534D828FA4A90B4AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732449, "uuid": "bbb874d9-5370-4a6b-9cd8-244356cd7d6b", "value": "1536:wW0A0XxJLY3XMbmOnLXEH60wAzFHsupusglFpApU20S0Q201PtagRZE:w2SLkkmOnLXz0HzFM3NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732449, "uuid": "1e8d32c8-888d-4492-905a-25f8583f6f05", "value": 101364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732449, "uuid": "ffc1e8c7-d88f-41f6-b976-77a9d482b6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732449, "uuid": "276f7ab7-4994-45a5-817f-cd7ac5440716", "value": "vsxv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a40b7f-8608-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784750739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750739, "uuid": "c2fa1917-ee83-4cce-b27c-1cd80bb74746", "comment": "Malware payload", "value": "8b80aa77556660b567476214d6bdfdb6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750739, "uuid": "ae4f0bc0-764e-43b9-bb18-b11aff5c2d75", "comment": "Malware payload", "value": "ba05777d708eaf75377e5af8b3953587ecb6586a03f006728bd83c1e0903c886", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750739, "uuid": "1e4a2e9a-0480-49f1-90d3-e1a4499cd6bc", "comment": "Malware payload", "value": "751a0424a5552cee1c651a029ab708c20290b792", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784750739, "uuid": "1a31aa64-4e8b-416f-9079-3d9c9797d6cd", "comment": "Malware payload", "value": "b622de66cd0572d0245fbee770e9c6d25f1270feddde29956324516db573df358f355c6b0785fa82d9241e27eef751b7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750739, "uuid": "4b78e91c-1e5c-40c5-925b-8adecbc74c2f", "value": "T174137C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750739, "uuid": "71f8ccd1-5b30-461f-a133-2f49f906deeb", "value": "768:xr9NyXsZztCm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:JHusZ+co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784750739, "uuid": "4b0677c1-e501-4e3b-a66c-607f5d08737d", "value": 45497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784750739, "uuid": "3b722c3c-84e4-449d-8afc-93b790b2c3de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784750739, "uuid": "b027c0a8-708e-438b-9708-3a69e6d441ca", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ce7d52-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757846, "uuid": "518a24a2-ba74-486a-be11-473f6f923c8c", "comment": "Malware payload (Mirai)", "value": "2e9b5026bed50803df438316b13ae9ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757846, "uuid": "5122edbe-3247-4527-9d18-245f99661c50", "comment": "Malware payload (Mirai)", "value": "baa7ca2de29b4ee51bc03301be779a282b55a2e2739d4c0fe6cedaa37b762d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757846, "uuid": "3b2737a4-8656-4afe-b604-6a81bd92165f", "comment": "Malware payload (Mirai)", "value": "5d88214a6fe4f808ab1106b22c6c538178f3b2c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757846, "uuid": "f6b85784-23b4-43ee-9444-d0ebbe330f56", "comment": "Malware payload (Mirai)", "value": "1ef12d671afbeb5f9c3ec149465d1321c797f5c37ea7f291b466aa08cacfd1ac77c11714552490cb2a7ca84958f3a011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757846, "uuid": "ef0fdf35-aefc-4a39-8603-68bcb2fdf557", "value": "T1CDE2F111691A847AFB30C471E0F6858677691BBCA9FEB1A25462060DDCC3A4293F1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757846, "uuid": "9ac6f447-c258-40b2-be2e-691bfc25fe4a", "value": "768:TEKkUgXAnURCr6HmDFStmYtKq9q3UELdB:/kEn7uHEemTfLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757846, "uuid": "10d7a695-ca93-4343-ab3f-c5cb16437799", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757846, "uuid": "d4dec463-abef-4bbc-99b0-332723a1e6ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757846, "uuid": "cbdc4b6a-153f-4671-9e2a-bb5517d34aeb", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3250f7d4-8582-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784692966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692966, "uuid": "c9d80499-c3c1-4751-aef1-d27b09c9d4f5", "comment": "Malware payload", "value": "c72af06b295c0441321a3820c43e8e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692966, "uuid": "b8144e88-f04f-4042-93ff-b9852427ab4c", "comment": "Malware payload", "value": "bafefe5e38e58ebc59b414637f745604e591afeaaf9b5621f06d62e4d89c2e82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692966, "uuid": "cb2bcd3b-621c-4552-800d-9cb3e3bec934", "comment": "Malware payload", "value": "88c322c7fb7435952cabe58cb982c59da266ac05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692966, "uuid": "0ad0f072-dda5-46f8-818f-e2bbec979e20", "comment": "Malware payload", "value": "e33cde984ddfdff27fa982605ab2926be76d8ecda5f3a001f8ded8a2b145ce2ffcac9dc4c1e4160930d72366578cfc4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692966, "uuid": "18b925a6-c43a-4227-97c2-8b77892c3093", "value": "T17CA3C71E3E619F6CF3A9C23487B78B34A65D63D127D1C684D1ACD5002E7034E691FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692966, "uuid": "ee8a2ac7-f162-427e-8791-a0e186946baf", "value": "1536:HqBBcTrIJij2DTZsZt8PryiNFd4EIIPD4WrceLQHAkDgMEO6x73M5uBc:HqNJij2DTZsZt8mk75cCkljJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784692966, "uuid": "c6e36723-7511-4c3b-9d5e-d695bcf69400", "value": 101108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784692966, "uuid": "54a8d8f8-4793-4485-93d7-6b8641c9345a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692966, "uuid": "904c707a-06f7-4cb9-84f3-a31b3b700922", "value": "bB3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c8ee30-85d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784728779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728779, "uuid": "c53e212f-65d0-4238-af3d-794da00d6fff", "comment": "Malware payload (Mirai)", "value": "f1d59fbf4c378d51178d350deacf497a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728779, "uuid": "4295ea7d-1631-4db1-9ba4-67a3f1b489fe", "comment": "Malware payload (Mirai)", "value": "bbfc782b9b5e257160e893a87937f3a0bc60b69508b9e3bd77a6913168f338c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728779, "uuid": "8d1f8f85-b54a-4fb2-b5fc-6998604df31e", "comment": "Malware payload (Mirai)", "value": "6b97764615aa3e91e4cb30b4b409db392187667a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728779, "uuid": "d7adbdc2-0b07-4866-8dd3-70926dae8a7e", "comment": "Malware payload (Mirai)", "value": "3b57c363b6a945ec1067cc994565914e820fc3a5dfe57455ec15f3520bfbabc1734752a34b24f7bed8f672ddbf37e755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728779, "uuid": "ee3a2158-ed51-46b7-908b-1771c8a68c9a", "value": "T11633F19AC4B038E6D89E5D7F11C913637C14F1A86C89AE4803498B2DF3F22677D4422E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728779, "uuid": "290d23d4-64f9-48f4-9e2b-25b66545e354", "value": "1536:wwSq2vLf0ahO9YYAU4ln9zQAgaNBgknBeEvgn:wwYLfRhtrZ/g8yGpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728779, "uuid": "f1787527-5746-48e4-8367-34b53a5816f7", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728779, "uuid": "8aeb458a-06f1-4b12-8921-d13d1cd95e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728779, "uuid": "614be2e6-4921-4b2d-94fc-db60bb4871f8", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5678d0b-85aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784710339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710339, "uuid": "8db7836f-a97b-4d53-9f64-a380c834c3c3", "comment": "Malware payload (Efimer)", "value": "a751e2fa583b9460ba600c6b43a51aa2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710339, "uuid": "307457a8-6992-48de-89e0-2be7d45425d9", "comment": "Malware payload (Efimer)", "value": "bcb032caab1a92fa1257409a53bfa6d4704d8ed02b02572b0c6db1d206f5f870", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710339, "uuid": "5cb0d6c3-77b2-4de9-a2c2-21f698f885f0", "comment": "Malware payload (Efimer)", "value": "f9804fb2d1830fec0d58512d29e6ae809467f7ae", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710339, "uuid": "0cbed928-7cb9-4d30-9d45-735cac204ccb", "comment": "Malware payload (Efimer)", "value": "a0b77eb1e9092bc7800085e4f729d8a2608055ade1518dc11ea7df259542c307c169f010be265e737e67d8c2d4f6cf33", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710339, "uuid": "96f415c2-f9e6-41b4-befd-ba9fa5c6b271", "value": "T1E7E6332C57D042FEDFB3003CAED265A2E67974750B71C9EB1A584294BE1B1F08D3AA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710339, "uuid": "49d1cd47-e551-49da-b2ae-3665682a981b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710339, "uuid": "899435c9-78eb-4954-8315-9083a554f267", "value": "393216:xQnxSBX1l6+Mdx5mBO96XMCHWUjXjcuI3/PGTAI:xjdMd6B06XMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784710339, "uuid": "c0371cd6-2a8d-47a6-b2b8-fcadd8bed1b4", "value": 14316965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784710339, "uuid": "2b6c5c79-2b03-4e35-9cdf-fe07a09e84dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710339, "uuid": "76a1d542-bc07-4974-bdbb-599644e6090f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4632ad-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784706191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706191, "uuid": "86e57b62-231a-4710-85d9-b06f0b02314d", "comment": "Malware payload (AgentTesla)", "value": "86936f1b2cf5988ce6ed51d911d7e901", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706191, "uuid": "5a5a6b55-9721-47ad-941c-356cd1ef9c7e", "comment": "Malware payload (AgentTesla)", "value": "bd44eaac3410c2d8e2ba7d7a128174cdcb648c16161404814e84f14fab36960e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706191, "uuid": "7a6e8b18-d8f8-4eb7-8c6e-4e6079d4646d", "comment": "Malware payload (AgentTesla)", "value": "aa37a852d8bd22b012c6725658365be9fc113b60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706191, "uuid": "5be2f04b-da72-4f2f-82e1-2d84ae7601be", "comment": "Malware payload (AgentTesla)", "value": "c663c16d784454f56df35830443ef2718a599e57ee3fb891fce5d86547cafc7a6e75fd6ee69250609bd8cfe79ea44a46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706191, "uuid": "f830df1e-729f-41bf-a8e9-9b34869a4e15", "value": "T1C1241F0577C1B45823862F7B751FF0E6F86A48ED3C89454BE210FC50A8A56A7FDE2A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706191, "uuid": "ca35a935-008d-4038-8eb9-728ce7df5dae", "value": "1536:1NYM8spLKSRwz16cueYwHenLanbGoAC3RfkLQpAsIu+oxlB9+Wuq51sT9dxrjEXO:184b0KC3R29SlcdTFjEzzBO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706191, "uuid": "3634efc2-19a7-4c4d-b3ce-33fc1914cc54", "value": 218351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706191, "uuid": "95f6fbfa-1d30-41e7-9b78-25d884697ecb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706191, "uuid": "1aa488f0-dba9-420c-97f3-dea9b1f30cb6", "value": "Documentos--020260713.pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a27d1f7-85a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784706374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706374, "uuid": "af832012-49e8-4d57-b287-98e33b653e6e", "comment": "Malware payload", "value": "80e9ca77acf0a4b6b7855ec611ffcdc9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706374, "uuid": "9288e667-11ce-4a1b-81a8-7381ea6be372", "comment": "Malware payload", "value": "be29fd39faecf5fa2e62bd4857390a93ef52ff90e70813cf6a0654f1991a09d2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706374, "uuid": "3d7bc7a8-ddf7-4ba3-b12c-08d5d75ff8c4", "comment": "Malware payload", "value": "853af125603bb663c9470a1acc9f87009de1a26d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706374, "uuid": "d61cede3-f5c9-4bf0-b4f4-5a51b30c349d", "comment": "Malware payload", "value": "44536f6f86f1b69e658db85654c6e0ce2ff0eac1e55dc85bb5254e0204cfec986232f80de8eada9b2f8f6f52d7ba66d5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706374, "uuid": "663d6822-e094-4a28-a29b-d85da41bc454", "value": "T1462523177AFEE713E1B793348A22941D86DDDE5C772A814732A87105127DB3F228F928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706374, "uuid": "2360a8dd-4e59-4015-9e19-f2fe8e93c6ea", "value": "12288:2GfwI82f2XfjTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/rb6nz/n2hSFCQIb:vfwI/uveR4eNK1QwKFgEjbCz/agCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706374, "uuid": "3319b290-e164-4406-a6e8-f33891507179", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706374, "uuid": "fd2e0d2f-ec29-465b-a2e2-5cdb32c56694", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706374, "uuid": "bbbbb466-6e7d-4a6b-afcb-47ed11230f59", "value": "BK-SFI69020260.xlsX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22c4e0f-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784707461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707461, "uuid": "93106ee8-26db-4ae8-a7dd-249602aa03b8", "comment": "Malware payload (AgentTesla)", "value": "91d7ed6f58fc10eb750eed00c79c1764", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707461, "uuid": "d206d7f2-f226-406e-9286-23f931145f0c", "comment": "Malware payload (AgentTesla)", "value": "be33d0b62d0df6fd5529ae90c822054ac3837ccce8db56bbf1f4b349477053d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707461, "uuid": "e6d7039c-aea9-496e-b5f1-6e1f393e1689", "comment": "Malware payload (AgentTesla)", "value": "199e24e1a84bf37813cc83b3b591106cdd8a352c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707461, "uuid": "573e141d-064b-43d7-b6cb-ab5b80234033", "comment": "Malware payload (AgentTesla)", "value": "bf500e78592c4e76f4e1fece74ef6f4dc41e6463a110f9bb38c4d429088e03d980d416d1d94f531d2cb07ad26be2eb7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707461, "uuid": "f1244f4b-7b3c-4832-89be-ab4f792030d6", "value": "T1F044224573C4E4580797AB3B2A1BB1E5F5AA0CD9778844DBE214FCB8F56430AEED0A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707461, "uuid": "c815785c-6ce1-4a16-8324-1c6f3aa07fdd", "value": "3072:6IxPZr8zehqXXlxSu7SrYwhLF451WSReXjf2JDgxl6ITVk8TLaUkwqWd:3Mwqh7S45cXfADgNC+LNeWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707461, "uuid": "4dcba3e6-5b02-4038-a998-77603580cbf6", "value": 273567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707461, "uuid": "fbabb16a-c0f2-413f-8266-5fda4dc27c4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707461, "uuid": "6d91c5bf-d943-4b07-a470-2e5f2bcdf29e", "value": "Directrices de pol\u00edticas para empleados_2026.pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865a2097-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707280, "uuid": "69be34c0-70fb-4d35-b570-53ca7257933a", "comment": "Malware payload", "value": "6a63cb4c89cf16afabcea6714e0b3066", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707280, "uuid": "d6a14468-bb4d-46db-98b6-22b5b1504ba3", "comment": "Malware payload", "value": "c07cac2848f8fd3faa149c8d2481e56d470e0136b90529db6dfab756d1640efa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707280, "uuid": "03d593a0-287c-4b42-ad87-b7a6ef3c24ae", "comment": "Malware payload", "value": "03baf16b6e922c9e3a58809b3d029dc6e3e99ebd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707280, "uuid": "fd79ca4f-d846-481f-b327-609348115c5f", "comment": "Malware payload", "value": "2b884d777b346f0d9a21609e38e3e8923cf25fa78126046dc321a068ec79274581dd26a3b8064fa5559f634b8f32bdd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707280, "uuid": "aeb13e7d-3c44-4f17-9b1d-778702191be9", "value": "T152956278BF820A5F30666116ECD1349BAA9BF351717C4EA4AC88474F423708FAB55F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707280, "uuid": "c5f503d5-f67e-40f8-a43b-139a47fd6149", "value": "12288:S9ECZyJkAbq/kG1Nd+8T+cYRNdYdEx6MMhKTqMNf/280WW7:4byPd6cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707280, "uuid": "45df60c4-590e-4c8f-8c73-c67027aad768", "value": 1877836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707280, "uuid": "9afea289-0a70-4227-ba68-98fb2bc5a776", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707280, "uuid": "8517608f-51fb-4b9a-b71c-52f618998fcb", "value": "RFQ#1002289#.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdaf1ad6-8597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784702246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702246, "uuid": "1cda4d14-f384-4525-bc6f-dbba519dd761", "comment": "Malware payload (Mirai)", "value": "78eac125accd6f15238c27cbfb0c59aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702246, "uuid": "f67407e6-ae4a-45e2-bacb-5ac4e27b6ed4", "comment": "Malware payload (Mirai)", "value": "c0e68eb66e3c3ef16c3f060566fe699767e65276a210dd334e3904ee7694fd3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702246, "uuid": "b23b136e-9f36-4413-a6f7-03f213131991", "comment": "Malware payload (Mirai)", "value": "3b509015fcc70931783f9ed2b0c08c86a0d4012f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784702246, "uuid": "6135fea1-f79b-4b47-af1c-1179035d9e8d", "comment": "Malware payload (Mirai)", "value": "3ddff18b3517a2618391bc871d42fb234248bcbe883a826718332b993018cca538512ff67fff98b5412e52f6355a5d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702246, "uuid": "53470b78-6440-49c5-a710-e28ec53d86f8", "value": "T17BC30745BD819B10D9DA36BEFF4E028973575B6CE3FE7202D9214B2127CAA5B0F72502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702246, "uuid": "2c0f2c72-d612-43c3-9a79-4087c1e15524", "value": "3072:zCnfM0g2bkJf+M34c4Naq5WA+1k1Nota2OCeK:/0M+MoPNaq5WA+1i+aXCeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784702246, "uuid": "31742563-631d-4566-a537-9ec7e403a655", "value": 118372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784702246, "uuid": "04fbc926-dc76-4bd1-98d0-4e652474bf36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784702246, "uuid": "d95410b3-c121-4dc5-9ab8-8832b8094e04", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dedbb0-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757884, "uuid": "cc313584-2a2e-4e4f-ac06-dde3d8876fb6", "comment": "Malware payload (Mirai)", "value": "18fae24d870fe97bbf3ad0132ced889a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757884, "uuid": "cf79741b-d46e-48cd-851e-7ef31e4339fd", "comment": "Malware payload (Mirai)", "value": "c1def8cce8b6ecb69adf65c60d132981789e7460c38a043795f6826f7a35f3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757884, "uuid": "0d060b7f-bbb0-4ccc-beb8-abbf5eb8f805", "comment": "Malware payload (Mirai)", "value": "9cca0f8a60c4daf61cd2e174ee7ab49e95b4a677", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757884, "uuid": "a2269ccd-c3f8-4384-8af0-1883c1d7081a", "comment": "Malware payload (Mirai)", "value": "2743bd4685943aca93b3aad702272c2b01e542b000e43c6edeecd3d60a3026194a757ca951f53d99a13b33f5d0fdb12d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757884, "uuid": "9f0b4df9-7031-4315-9a92-e1285b1cffc4", "value": "T13D533B02B2280A5FF9D319B0343F1FE197BEE9C035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757884, "uuid": "5696d386-ca5a-4538-a8ad-52cabdad6964", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaal5:VMLSBq14Se4GHLTBygfGXAgIVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757884, "uuid": "68f0d5d7-7e04-4fc1-ad1f-55fab818de3c", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757884, "uuid": "0972428d-f083-4ad7-8e68-1f0e34ccc2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757884, "uuid": "15353cd1-30c9-487b-9010-b5cea4773c26", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040a17bd-85b6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784715222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715222, "uuid": "209a3c2b-1649-42df-9b1c-913115be21fa", "comment": "Malware payload", "value": "578cf1b851b46878b94f3bbeba86a092", "object_relation": "md5", "Tag": [ { "name": "103-193-173-199", "colour": "#DB0D76", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vpn-rujun-xyz", "colour": "#F9912E", "exportable": true, "hide_tag": false }, { "name": "workinghardo-link", "colour": "#7C368D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715222, "uuid": "0480803b-f74d-401e-a2ad-591ec49559a2", "comment": "Malware payload", "value": "c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525", "object_relation": "sha256", "Tag": [ { "name": "103-193-173-199", "colour": "#DB0D76", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vpn-rujun-xyz", "colour": "#F9912E", "exportable": true, "hide_tag": false }, { "name": "workinghardo-link", "colour": "#7C368D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715222, "uuid": "f23b1179-4d9d-4d61-8062-8a913272f421", "comment": "Malware payload", "value": "f6b5a311ae505b15d3c4f276ceca779e93ee259a", "object_relation": "sha1", "Tag": [ { "name": "103-193-173-199", "colour": "#DB0D76", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vpn-rujun-xyz", "colour": "#F9912E", "exportable": true, "hide_tag": false }, { "name": "workinghardo-link", "colour": "#7C368D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784715222, "uuid": "bed2b5f6-bd12-4566-87dc-697235aa5b53", "comment": "Malware payload", "value": "9606ee6d7bf469c7f50cdc1fef0f5378020b0f52049074b9dd6a3c5987b1ec7c815d32614018f232a650f8e5d38ca76b", "object_relation": "sha3-384", "Tag": [ { "name": "103-193-173-199", "colour": "#DB0D76", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vpn-rujun-xyz", "colour": "#F9912E", "exportable": true, "hide_tag": false }, { "name": "workinghardo-link", "colour": "#7C368D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715222, "uuid": "56f0e386-6d65-4945-89c5-30e494067fde", "value": "T126C65B03E8A241E9C5AAD6308AB6D163BB717C495B2037D72B50F7382F76BD06E79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715222, "uuid": "cf8b1baf-317f-45e5-9bab-60eaed97f9d0", "value": "3c46c2ce1de4183d9819b8fc63b99ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715222, "uuid": "8f17c86d-4492-4199-805c-fa50b7218051", "value": "98304:wkDIu0jVz14sqCPTgH5lx0QDksHn7pFBOAoSEkPMKiJqxZ8S:wkDIj34sFPTkksbpF0ASC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784715222, "uuid": "00605d93-d965-4b9d-8f14-d02f79acb27f", "value": 12450816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784715222, "uuid": "1b43e796-8d33-4338-a1d4-5d13f4fb031f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784715222, "uuid": "61315612-3ae6-4b51-8dbf-a9d46eabd791", "value": "RiotClientServices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584cdea5-85d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729966, "uuid": "a44283d0-a65d-49c0-8e17-b66f68bfb5b6", "comment": "Malware payload (Mirai)", "value": "896aa43f4b1a00398c6e29cf17561cbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729966, "uuid": "c7986e5c-bcf0-4cb4-86f0-82b70d96fd86", "comment": "Malware payload (Mirai)", "value": "c2b5b5e89743138ede8b44ac7d781def88b897a4290d98021152a95aac6ee886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729966, "uuid": "b194b434-65a8-4e7b-ae8d-64b11a1e579f", "comment": "Malware payload (Mirai)", "value": "adf2bea28f267b95637be9bdb865f52b8af315b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729966, "uuid": "80db3749-1102-4b2b-b5f6-8d9e6ba944ac", "comment": "Malware payload (Mirai)", "value": "9c747a0fff0804e1162a20f5efa0a08a80d3a98097aeffd8b1d63e55ca4f44c2d566d8f424a1e4f864db9772b70ebfad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729966, "uuid": "3543c591-b69a-45a7-844c-4ec40e9b6501", "value": "T16B2302A781D3C2CCD8076075A12E3E5C8C42D64F43AEA4B14D1376BB345BBE92A74ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729966, "uuid": "b53260a8-8e85-446f-a4fa-cf71cd987970", "value": "1536:wDv1E6pS5woE0wPOx9ujypS9HnCM+XuQjwTnouy8oyW:wj15paE06Oxqp1n3+Xkroutc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729966, "uuid": "3fda4334-b446-4e3a-a907-bba601fb84a5", "value": 49816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729966, "uuid": "98df836c-23c2-4ff2-982b-5581b1eedabe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729966, "uuid": "94bd96d6-c2c3-4a47-8416-e01ce7365b32", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de71d4fc-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784711723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711723, "uuid": "35ee2680-a6ab-4d54-92f4-de15086f5a9d", "comment": "Malware payload (RemcosRAT)", "value": "991902b7e11534d58ec45716335ba27b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711723, "uuid": "f10741b7-54e3-4b73-9487-afaafa8e60a3", "comment": "Malware payload (RemcosRAT)", "value": "c51bac8ae8c65dc4498871d8bfca6c89efb58da23438478fa58ceea7c01abf99", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711723, "uuid": "67f764ab-2716-483f-aa20-92acc3720027", "comment": "Malware payload (RemcosRAT)", "value": "98496aacfcadf136e7232b3c70a556ee1be8d029", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711723, "uuid": "a6cae174-c2b1-4cef-85c7-f6282d715e07", "comment": "Malware payload (RemcosRAT)", "value": "45c6180bab69f5a954a9c31cfcdb450e244a0e04e140a0378717c739457f28c339892e05d5fd57bc1620662a4a7cad3a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711723, "uuid": "81a7ab1c-25ba-4cfc-96bc-95ae28358d66", "value": "T1DF134A63ABC40E3F0D87579FAAA80B5799BCC52951317CACA5EC771FD00265CD73A228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711723, "uuid": "ad94bd81-c079-47af-bd3a-5de115ba6c14", "value": "768:xQBUkJJBKZgUHUAvyC9QL2R2MtdRRJH0Em4MFWHiwXMcDqKTt:xQBUkt2RHJ/2E7iw8cD/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711723, "uuid": "c1ed1ef1-6abb-4c7a-bd79-069bd18b141d", "value": 45301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711723, "uuid": "55d0051e-0052-4b5b-9c31-2beb9224ede7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711723, "uuid": "fac65ab8-27f8-4102-8206-48d2be1d9ae8", "value": "SPEC_DOC 1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfe9957-85a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784706568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706568, "uuid": "9d587234-de5a-42ef-92ec-aee70e3cee82", "comment": "Malware payload", "value": "4cf2fcd18a808e66e9878035a29215f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706568, "uuid": "7dbcf3d7-734c-449d-befb-490dfb0954f9", "comment": "Malware payload", "value": "c75029f80b274ea70027d86191330e74121d4dca5df873bedc44b80a02759b95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706568, "uuid": "2be9bb31-1821-4ee3-b00b-3cb667b001bf", "comment": "Malware payload", "value": "9da176ff5293469d397522c7a60a775e91f1353c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784706568, "uuid": "b5f57c4b-3ad7-4077-ae94-b4bea0e612b3", "comment": "Malware payload", "value": "b70cf0f4520d5ee490992efe043e9a7cdc36fec60ea65a24a9201b8ab0c998ed5b0a5a43abb0c51d80cffb4e151a878c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706568, "uuid": "beb5c951-ae2f-43c4-9eef-061809f819b7", "value": "T1B9A50318DF5B051D68335D687AC90C5FA19DE2C527EB582A4279DECF0703C1AEE78A2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706568, "uuid": "7204a69a-4776-4041-8326-22fee1434d27", "value": "12288:dE6Bj0DnMoKkohMb6nlsBL+K8PkHaEOaeFzm4cxZmIMJhRk5mwMvpLhlJkhImIz/:hNmM4StRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784706568, "uuid": "9395cf5a-4b31-46ad-b6ad-5fb4e0a3ed4e", "value": 2096980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784706568, "uuid": "088172bb-de29-488d-834c-65baed1246a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784706568, "uuid": "031804c6-da21-478c-8265-29c7d7042144", "value": "351635-PAR-P1Z1-LA-XX-DR-500001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b249342-85ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784724012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724012, "uuid": "ef8e5546-4b57-4e20-a1db-062789d66525", "comment": "Malware payload (ValleyRAT)", "value": "573ea15e370de7a533219c7697d2f5a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724012, "uuid": "71f4ac9f-9eda-433d-ae7a-8d3caf7bb7a4", "comment": "Malware payload (ValleyRAT)", "value": "c756660569e43baaccf34dde82851fc4b0e4ca33de468afa147f19d164e3f5fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724012, "uuid": "bee63987-5831-4d4a-9afc-2ade1fb1d939", "comment": "Malware payload (ValleyRAT)", "value": "01a63f47f45d69dfe4815f0f8918d29fd968718e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724012, "uuid": "fabc4c8d-6dc2-43c5-89ad-7d2f56b72208", "comment": "Malware payload (ValleyRAT)", "value": "4362aa316947c3c2279419d24dc5c5a824b6bdcfed676e8841766dccccc59f37b62c388da99fc5f56d2b524bf94de671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724012, "uuid": "7c02dd8f-6704-4665-a89e-33cb9c3cc538", "value": "T158468C30764AC52BDA7E01B0292CDA9F556D7E720B7154D7B3DC2E6E1AB48C20732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724012, "uuid": "f700d977-af46-45c0-9eb1-2d3d4929680d", "value": "836688c7d21e39394af41ce9a8c2d728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724012, "uuid": "962568f9-2c07-4958-a058-4970bae828a1", "value": "98304:thDq6qXCP7yKPNmxecLushvf7UmAYWux/KeAJ12Qzw2TgvVG6KReen:DDq6UE7othQzR8G6Kk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724012, "uuid": "dd564400-754e-49cb-9621-77f585271d55", "value": 5763465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724012, "uuid": "8f5afb8d-0fa6-4a05-a7b1-70170327cdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724012, "uuid": "00414c45-c3e5-4dfb-b582-817eed2ee400", "value": "573EA15E370DE7A533219C7697D2F5A7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb193201-85d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784728065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728065, "uuid": "54c73f48-d19a-4545-aafc-f9c7e2ed074f", "comment": "Malware payload", "value": "567960bbb107c52c109910d25005ebad", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728065, "uuid": "93386178-3425-48b7-90b5-0869814f4dea", "comment": "Malware payload", "value": "c759b4e65c92c5f51920e0cf517e4f52736a4c68d91333adad4d2a52dcca7ca9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728065, "uuid": "3a3025ec-9f8b-48df-903a-c4f2bad81223", "comment": "Malware payload", "value": "2d9cf4029a3672a9f39c6d1641753f12f0670167", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728065, "uuid": "e9c65ab8-aaea-4b8b-8eac-b6b8e506c3e4", "comment": "Malware payload", "value": "fc6fbf392f2cc5f6ac3069721c999a799f9be0c0ebd66c0d15c8deb6e460ecd6d8bcb009b8543330012c22bc4ab52dd1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728065, "uuid": "7f4f05a9-914e-4cbd-8f0b-4b0c8237458e", "value": "T12F04349CE74E01A4CF95A37B531A0A4985FCB73EB75101B174AC533033ADD2D49A69BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728065, "uuid": "fe15b4d7-75e9-4581-9ef4-3fa1a2353c3e", "value": "384:swSquHHGW3TV0xljUqwKFSfGzsqXRPLoDfRUICA4PxGdOgKITK:sdquHmeTQxUqjQqXRPLouJG0uTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728065, "uuid": "12210326-c28a-44ff-a437-8a1cbfee2a7b", "value": 185260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728065, "uuid": "429f280d-b657-45e7-bae1-0f17af7eec7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728065, "uuid": "7ff75517-d362-4675-b099-2959083c3b52", "value": "RequirementsXSpecXSheet.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71318f5a-85fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784746329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746329, "uuid": "1c1e9d95-e6c6-4fba-86de-34142d1f9d0a", "comment": "Malware payload", "value": "7b948c60693fa1efee747c1abf61974a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746329, "uuid": "61806980-bf24-4fb3-b1d3-9988d33a1c9e", "comment": "Malware payload", "value": "c7fe4c7b2e1ddbdabce5f1c89ef97c8c40bd7a7a5a0ac07761fd8ebcf5ca7187", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746329, "uuid": "8837199b-5017-4bb1-940d-8b72b389b9dc", "comment": "Malware payload", "value": "df225b2a7a5f6d7baf50d60f989a213f9eed7868", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746329, "uuid": "fc20d77c-7040-4bac-bbda-5c2d3d7c1457", "comment": "Malware payload", "value": "a2d20675877d004429a7ae8451909e4236b64f768570a89451118fc030b14966127d9989f939728063db94f5aa27b987", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746329, "uuid": "a5daab56-4d8f-4874-9ef4-774dc0ad5ccd", "value": "T151E6331DABD012FCEB72413D9EF116A5F8AA74634732CD8797648BA06E1B0E4C93C653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746329, "uuid": "e2e2ad03-89bd-44a4-a421-63672361e939", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746329, "uuid": "0bbfa708-5ee5-47c5-928b-f787fa00c043", "value": "393216:638swLCSR2TV31XGi0jHFt26jteXMCHWUjXrcuI3/PGTAI:6G5Wl12i0jb26jteXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784746329, "uuid": "998f5c4d-e764-47d3-ac91-624089f48ed2", "value": 14319660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784746329, "uuid": "bf2dccbd-267a-44d0-a1ba-828aa4c38a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746329, "uuid": "58e7aaad-8a0e-479e-aa5b-26de79ab7b58", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2f8df0-85fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784745007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745007, "uuid": "319049f8-e05a-4787-ac12-697f188729af", "comment": "Malware payload", "value": "5ecc15cad387e92b6d020ddcecec9db2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745007, "uuid": "c9ff4eda-97d0-4dbb-9368-253afec4427f", "comment": "Malware payload", "value": "c954447ecf2b7e8877f73d9c53368c7cc41e4fac729cea8d0537d2cb922d4524", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745007, "uuid": "c2a4242b-2e3b-41d3-802b-dc4858b1ab6d", "comment": "Malware payload", "value": "d0860bfa184466f2e04f5057a1876f9757b004e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784745007, "uuid": "2baf5c6c-3020-461d-bb9b-1bb6a5144c1a", "comment": "Malware payload", "value": "26c45c73ffa37831db1000b3db4af6a4b1e5be578bb5f79a2a01316bd4982024bb2c4375c47ea3b58acdbf6f8a601333", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745007, "uuid": "001b76e6-1a1a-4ecd-a747-a2249b5d8836", "value": "T18A825B0FB9424626D0D210B49672977BCABE6872338414DBFBD48AE90A686D5FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745007, "uuid": "5de1a422-f1f5-4ee5-abef-cdfd082ec3db", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745007, "uuid": "50e005fa-a141-4711-9597-5753c60966a6", "value": "384:HIqQlV6lLB+v0CvBu94gXTcVv4av8U9c2DF:TQ0IE9y4a0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784745007, "uuid": "c02a0f4e-096b-4d4e-8131-8a3c1b604b2b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784745007, "uuid": "50bf664b-3393-476a-a90b-f1edfb5db0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784745007, "uuid": "bd4bdaa9-22f8-45ac-8401-a4c58137f257", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22114a13-85de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784732452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732452, "uuid": "a7aa0c55-637c-440e-98b5-89e644e6a66b", "comment": "Malware payload", "value": "3496a8661fe22dc6309479d2ae2021fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732452, "uuid": "c7f8420d-a4db-4271-973e-043b4e9f7e42", "comment": "Malware payload", "value": "cb0f0d095728f35528d8583f6cc9deeb1ab3cfe21323ba41cf8d72c377423a24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732452, "uuid": "5f21a33e-4b14-43f9-aa7b-9e74fbd3b61a", "comment": "Malware payload", "value": "6eb95ae3ee88662d871b0b0032c03c3af1f93f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784732452, "uuid": "f1df52bc-deed-4a07-b6c4-855ea2aac12e", "comment": "Malware payload", "value": "420611b5bc310bec0880d13e5a28963cbea310ef14fdb519cd3d67629e50b2644035c9ae03819800e1a513d74737fa35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732452, "uuid": "26b09451-f882-4aaf-b213-f705dfc1b5e4", "value": "T125A3A51E2E61EF6CF369C23487B78F35A65823D12BE1D684D1ACD5002E7434E641F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732452, "uuid": "9672b607-ddf3-4a5f-a48e-45901d7d6777", "value": "1536:b5RL1NNBcBft7MljhEMPGASNFdOcELoZDZGE5TPi4fUXZDqmOTTC20TI:L14MljhEMxDcNZDZ7aZZWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784732452, "uuid": "015b49ce-bd45-4a77-92ae-d7068761feb6", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784732452, "uuid": "9a6410a3-8865-4075-99e2-728a7033b67d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784732452, "uuid": "07aba46f-9488-44bf-aab0-718d20d745f4", "value": "jc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c4b1f2-85f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784742949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742949, "uuid": "b1073d2b-f995-4185-b2fb-d2002f4443da", "comment": "Malware payload (Mirai)", "value": "83bb293c09e41eb7e06e6bb1d9da5cc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742949, "uuid": "9336a160-53ba-4ba3-bd68-a0461ff6fc1a", "comment": "Malware payload (Mirai)", "value": "cbfbd71fe52b4f507617bfee6cc1b4ae05d0e0ebb02007ffa0f8494a87281394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742949, "uuid": "b343b07c-5dea-444e-80fe-b2e5d6ecd00f", "comment": "Malware payload (Mirai)", "value": "be4e6f9292a1cee09bb48b646119f4068e5d7c62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784742949, "uuid": "db837317-956e-4b9a-be6d-42ca2a2d760f", "comment": "Malware payload (Mirai)", "value": "3d1adfb341262bda2d53b88c6e65e170cb80b94ef12229e04276b648f030746d97cec21f80ba3b0644a34dd90bbca656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742949, "uuid": "2fb7dde5-f1e3-4fef-9d62-3618947384b1", "value": "T1EE93F781B8824A6AC6E02379E66E718E33A0B3F5D2CF3127DD615B1277D518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742949, "uuid": "e6544340-5cdc-458c-8896-e0c4b3060df1", "value": "1536:NmcL9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthaDH8kX8oZIH:NjBq1BtD6wq5MIB+IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784742949, "uuid": "218ead32-f6b8-4eea-981c-14e95d93eec3", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784742949, "uuid": "c6167e19-0f41-4e87-969f-c0a9af53908f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784742949, "uuid": "2e1a5c37-9a1c-4be6-b0f7-0828ea9fea45", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff321bdb-85a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784707483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707483, "uuid": "34e145f4-7cd9-4078-950d-acf7ab0d98dd", "comment": "Malware payload (MassLogger)", "value": "e8a7ac97305bb29d2125dd9edeada249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707483, "uuid": "3b1fcfbe-3be9-4321-bc4d-fed8de10fdf4", "comment": "Malware payload (MassLogger)", "value": "cc947171d75e10754ecc10f1c560fbc9aa640e47fc10365d158a011677301310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707483, "uuid": "ae486bc8-c5ae-48df-910a-5b63805828ee", "comment": "Malware payload (MassLogger)", "value": "56fb375e0034f74fe8d698101fc4a4bd55b4decc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707483, "uuid": "25c6a2bf-e4f5-4c02-bed1-732fb6519607", "comment": "Malware payload (MassLogger)", "value": "b46ee34b83c12e93c22d59af8d5f9e0f4399ada8c781bb3b299a8a3de9a83c05dcb343af9953d75e0de342a3c04a2664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707483, "uuid": "bc8c3179-8233-4386-84f0-1727d8402f4c", "value": "T13B75BE24E3E811A8E577DB34CAA29233D6B178464770E48F0689C3551FB3AD19B7F31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707483, "uuid": "1b6437a1-8837-49ac-8089-1145d0c6e5e8", "value": "f35cfcc6a3cb25841aefe38eee53876c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707483, "uuid": "ac98d0e4-eebd-4318-b1ac-dd5d5438a8d1", "value": "49152:94XhUKsJf3nYxF2S7n0LLjak4X+4ZlOpq17tap:cQ1kkpulOpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707483, "uuid": "1a23b73c-7f57-45f9-8a4c-fa06f775f15d", "value": 1702400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707483, "uuid": "74f351b8-4140-4516-a3d5-579f5b34b4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707483, "uuid": "3a6a8828-cfce-4eac-bfe1-02fc62c13c38", "value": "orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203eed64-860b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784751776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751776, "uuid": "3bb9759a-ff22-4e3c-9db1-f407f3775b2b", "comment": "Malware payload", "value": "301a4d2ce76773a5eafa916ad47d4e0c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751776, "uuid": "72fbb0d1-27e1-41cd-996d-36ba968003a2", "comment": "Malware payload", "value": "cd729223ea3fbd0a61a301df483381e44ada6e0b2a96af470951dc26d92cf0f7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751776, "uuid": "075cf1c9-24ec-4e18-9394-1efab29d07c8", "comment": "Malware payload", "value": "fd0fb31274a86a10f2bbba7f3a95a5b66b4192e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784751776, "uuid": "584f1f42-0c8b-4663-95cf-50ba1b5ae188", "comment": "Malware payload", "value": "d1ff0c8841ca4e81aa11988b4a984e0914f7cc173afa166759c70452ba3d089c448799ab3ab6d7f2533fe50a503c9da9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751776, "uuid": "b0d1ff4c-8c35-4e78-bea7-11cbcfc529a8", "value": "T1B0D523A6E4F222B4C877C7B6CF83F4ADB06A778587A48C07FADD58008E13694553A771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751776, "uuid": "9cce1ea5-0b2e-4709-9a9a-d1ae800211e0", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751776, "uuid": "a0e10ce2-c9bd-41da-a116-5183125c302c", "value": "49152:iv6WZscxiZ1NW7dX8OLDVNrlcuZ2b26/2tO+oYgxBCdtIFWXxwJ4u0q:ivndx+1NQdMO3VhlcuZe26/2tOhVz+tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784751776, "uuid": "ae6f2771-574e-469e-818c-8d281707329b", "value": 2915328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784751776, "uuid": "fe764235-0698-49bc-9e53-81ff39e114e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784751776, "uuid": "4878848f-d56f-451e-9b54-224a12ee020a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bbfc41-85d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784726574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726574, "uuid": "57ee336b-1987-424d-8692-9a170aeffc3b", "comment": "Malware payload (Mirai)", "value": "5036de66ab1d4d3eab82b728d9906dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726574, "uuid": "07e07904-6125-42a2-b8b1-5e4cc6b4872f", "comment": "Malware payload (Mirai)", "value": "ceed4c0ba6989f4ee977ffdda23a47c5fb4d62b78af75fdc3d37007256e4f414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726574, "uuid": "c65ecc2d-4c99-4cd3-9fc0-a0ed69749e5c", "comment": "Malware payload (Mirai)", "value": "8a32de0de1b8a8d8c9629448ccd2c2eb00e009d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726574, "uuid": "a958936f-67c9-4f49-a9b0-7b7d5339d23b", "comment": "Malware payload (Mirai)", "value": "63d6633ae03e7bd01d7b0b441ebde97dcd88b52818c8987b80ca61bfdbc3a4b869b1fe414bbc4a5eb20b47e59ee7df2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726574, "uuid": "7d880759-37ab-4501-ac31-a128454eca36", "value": "T19AB32907BDC08DFDC089C038477F753ED822F4ED0239B2AB67D4AE262D5DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726574, "uuid": "75c6214c-177d-4f4b-b257-6b57b8bd0076", "value": "3072:YHoNuKAnZ+/9+gTdkkpz/AKPCv8R0PTIc2UtXYxSO+:YIoKAnZ+/9XTdkkTIrLIOXYxSO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726574, "uuid": "27e6b0fc-3eaf-41fc-bc15-bcbfdb98e23d", "value": 117712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726574, "uuid": "73601833-b7d5-4aa5-b83d-7014e6644677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726574, "uuid": "b4fa0a50-903e-4142-9354-c6d041967177", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637d7a74-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784723113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723113, "uuid": "ddbfd299-3b35-4faa-87f1-d86caabd8cd1", "comment": "Malware payload (Mirai)", "value": "108968bdf33633679e16c4d39ed248fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723113, "uuid": "8dcc6bea-0577-4c7a-9fd4-3a6a4a5b3e7e", "comment": "Malware payload (Mirai)", "value": "cf7cc3484f80ab80b6971fc3e419380cb86857ec310d95887603511085655b66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723113, "uuid": "73e46c1a-08c9-42a6-8043-00c6dc1876f7", "comment": "Malware payload (Mirai)", "value": "f728dce08359170df49c44ae9d91fefbec1f1f7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784723113, "uuid": "09406155-4aab-41b7-a3cf-bd7136f5af6b", "comment": "Malware payload (Mirai)", "value": "b9d45e60c4b6da9430768a823477e5db1e1eaff080596ba462effbfad227275bd39c77068d62605878e6a35673e3eeb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723113, "uuid": "9fd3c784-9ddc-48a5-a346-5d232f10ec5b", "value": "T109C3F745F8509B16C6C651BBFF4E828C7B265758E3EE72039D256F24378B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723113, "uuid": "b59d8503-dba6-49c2-afe5-350eb17d9f5a", "value": "1536:QewbCQ0QKdEbbl5r2CdP4V2QiXTU6HB4QaWOBbpxvSTB58luZwywkZXjexMPKA8g:Hw2JGB5rd4nWrHBXGtS9JerR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784723113, "uuid": "a03b5a62-ad0d-4a19-9aad-fc3c6f565546", "value": 121196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784723113, "uuid": "1f6af882-6bfa-4cbb-9788-822a08330613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784723113, "uuid": "aaf8934a-8880-4ea1-8c4c-30e906a4c0f8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faef1709-859d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784704899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704899, "uuid": "5f756a42-5f3e-4fa2-80d6-e7241439a2d9", "comment": "Malware payload (SnakeKeylogger)", "value": "b0a3221096478ce6a89495224ba4deb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704899, "uuid": "00c31aea-54a5-42c8-adf2-2a85f2298c26", "comment": "Malware payload (SnakeKeylogger)", "value": "d0285d9b5584f7af316b695a7a45f65c7a7f1c83dca76e4029ddfb97bce25049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704899, "uuid": "387742de-4dfe-4314-8306-c162a4e9439f", "comment": "Malware payload (SnakeKeylogger)", "value": "bc63c420e9112c2b4fb9aff97a0ffab8c93b5d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704899, "uuid": "79ab23f3-0db1-47ec-be5c-51a4b9474413", "comment": "Malware payload (SnakeKeylogger)", "value": "4ea821a95e9d0477dfd2da342e206da2098e622996c9bc70fb142df758c7cb604c60b4ed63c477635958d2b154b83efa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704899, "uuid": "3129e52b-b62f-4264-8143-4b7339795f52", "value": "T1F6E31211C2A0A2A1CF0DC37ED079A6585D726174122DDB2D58C970AFAB1B7D8CF93E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704899, "uuid": "adac6bd7-7a92-4f30-9f15-f7acaec694a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704899, "uuid": "58c8ea43-8517-47a3-8e9a-da8a785741a2", "value": "3072:ms6uEg1XONXVQ75OrYh0GWf9D3VwgbXeTGS0d32:MZweNXVQ7QrYUfXwgLqGtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784704899, "uuid": "85df1568-cee5-4b99-9eb4-cf2dfeac90f6", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784704899, "uuid": "0f1b4540-f8e1-4292-a64d-dd56d1cbb578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704899, "uuid": "dd52f9b2-3366-40c3-a5f5-5640a0192f78", "value": "TR987654567890.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd274aef-85f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784744362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744362, "uuid": "942903e5-f56f-4d53-909c-19d0b8e678c8", "comment": "Malware payload (Mirai)", "value": "2cad359dcc80371d9825e05d2da3f74a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744362, "uuid": "e24295a0-f5a0-4d25-bc2d-323d3f367035", "comment": "Malware payload (Mirai)", "value": "d02f97bf8d46da0f09d12d4703053fca5b8f703f9a63b1b0a850f005c0f001c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744362, "uuid": "0a8e74e1-adca-4fe7-ad18-008083f50dc1", "comment": "Malware payload (Mirai)", "value": "76504e6a8d4263f32539f6e85392cfd1726d62e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744362, "uuid": "06ec36bf-8ed1-4a84-83d5-1553c67da67b", "comment": "Malware payload (Mirai)", "value": "b7aa6063cfd65e25559af44adc1b99e66f43ab2dcd144e9efd280fd900f18125e1040cca951d85d5518296ac464de24d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744362, "uuid": "bd8c7338-879b-49b0-b416-898650925b41", "value": "T1D23302B52AA494C6CD59C4F1B9A04758B5682D56F8028E0B6A1B7F03DF4307C7EB2EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744362, "uuid": "7134857b-627f-473e-846f-c6e63628f9ee", "value": "1536:dVm9wrIwv5Iw2JNJcuC6CnRhAbQblqkQVJuD:/m9wrIFVJnhCyQ5DQVQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744362, "uuid": "bb1088ee-2b19-4bdb-b0cc-e4d0f4d736da", "value": 50500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744362, "uuid": "72b40d9b-f5d8-47dd-8887-6a9c0a6aed6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744362, "uuid": "88cf51dc-c4a7-499e-9791-bd4c65490c1b", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1c90c-85ac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784711064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711064, "uuid": "9f083f52-2032-4629-9ef6-328e43c7cd88", "comment": "Malware payload", "value": "c7394f4041c678b6eb105c76ebd436dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711064, "uuid": "8a91d212-d7f1-4f7d-94ef-c7d2e5c271ef", "comment": "Malware payload", "value": "d0f4de5986d0ea142b7b7e8377496861988f5c6e9f438a244799ead574996e7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711064, "uuid": "37b9815e-c447-46b8-a160-3a516522922a", "comment": "Malware payload", "value": "fe63de8b516e4c8f942a646649a1202433791ea8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711064, "uuid": "39a7028b-6fda-4b5e-b30a-ceeb3ab35ed5", "comment": "Malware payload", "value": "71c93d8c49b42d4299a4564098ef0d476a36b4d02c3e76a20432badd45a195a7294f46f0721377fe8dcb92987d020113", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711064, "uuid": "9adc7fdf-5f38-445f-8c1e-d2253300d673", "value": "T158A523B21E8EC08967F6D349EC48C24F3A82EC215FB78CBE764EE5A745805111693CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711064, "uuid": "104cfe19-d8f0-44f7-92e8-6959d15738a1", "value": "384:LEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjEjM:FSbFrVsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711064, "uuid": "6bbdb195-4c8a-443e-8e3f-06f4518e1f7c", "value": 2264012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711064, "uuid": "9c1ef4b1-b204-4e19-84bc-87008a6ba452", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711064, "uuid": "3007d9a2-14c5-4c2d-8046-0d4a39ec49fd", "value": "Copia del pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1a44d4-85d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784730165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730165, "uuid": "a76738bb-f386-42c2-878f-4fa3ee13ff9c", "comment": "Malware payload (Mirai)", "value": "cd4f0e66172e40ecec34392f4ba664fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730165, "uuid": "ebfac746-2677-4ba7-a316-9ba5fbe7b66e", "comment": "Malware payload (Mirai)", "value": "d175cd90462a4cb163a4379ff63fcc590661c9014128feeb37bcf2cbf10c1aef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730165, "uuid": "ae90c9ed-8a1b-4ceb-a4a3-5d169e177315", "comment": "Malware payload (Mirai)", "value": "c616c04a53f6e14003bd839cea6f9456716e271e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730165, "uuid": "e4e5eff7-8124-4b87-88aa-de1827c26287", "comment": "Malware payload (Mirai)", "value": "e31c90e2d597f4eb3f1d774b3bc699db8b4b1caab8db89d46446e4a412eb0525d6a369b3053769036fe07e61077d8d52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730165, "uuid": "7d06aca2-b199-4526-b5b3-52be7f1ef0ad", "value": "T11CC32BC0F98B81F6C40B88305166F73FDB7198A95123DA9DEF999F72DA73981912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730165, "uuid": "64870a1f-c8cc-4c19-bbde-6374e13ca00a", "value": "3072:69jlzYNVoZXRgn4c30tItERjnDPBUlsWrhK8Hw:OYNVoZhkD3OItYzD2w8Hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784730165, "uuid": "2b708f7b-baf1-4148-a047-b51db7dfca6e", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784730165, "uuid": "4a23d636-108d-4336-b201-688948274b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730165, "uuid": "a9fb544a-5c33-4fb9-ae93-cb05f750647d", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe526031-8602-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784748284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748284, "uuid": "95d77f19-a23a-44d1-bcdf-cb317aa48310", "comment": "Malware payload (Mirai)", "value": "98f6eb6c6a8f3149f6d164c0e9ee7ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748284, "uuid": "9231b6f0-c7e0-436b-ad58-40eb277fb33a", "comment": "Malware payload (Mirai)", "value": "d1782bb9948f4b91b832b73c74998ab679aa643de40d668ce30a96db541052a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748284, "uuid": "f98b3b0f-d06e-4a49-9a9d-af1d396bf901", "comment": "Malware payload (Mirai)", "value": "9c35ea779b8779b49c6b6cdb51c74019a947c6a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784748284, "uuid": "e507cd17-de3b-451f-88d3-89b1f86fd200", "comment": "Malware payload (Mirai)", "value": "746442d482b62dc82ecb8cd05c6226a80882e1e1b45b0222b196844be3a5eb83d7d8e37bb70631516dbd8edea62c9dd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748284, "uuid": "4ce9ccdd-7a6c-4ba4-8edd-90359698e10a", "value": "T171C35B0273180B47C5A31AB02E3E37E687FFE5E021E4BB89251E8B564575EB76449FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748284, "uuid": "2d058b49-c4f0-42ab-866b-a4fac45c7663", "value": "1536:s6V1hv1xI7CTe5djskUAn2Kx+NWIli3GFZ+1mO1vKiUDgHVY:s6V1hvMrCkxS/LFUm7KHVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784748284, "uuid": "99a25439-2395-4b73-82bc-e4a52156b3c2", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784748284, "uuid": "5a99c0bf-73c1-4600-b2d2-ffc5609c5c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784748284, "uuid": "00425a05-3b60-46a9-91ff-0e67d03fb658", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc5f903-859d-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784704875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704875, "uuid": "082027ea-5bef-4535-b01a-1f5bca68c624", "comment": "Malware payload (RemcosRAT)", "value": "82c7408b734dbd0be735985210c18660", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704875, "uuid": "cb0f7165-60e2-4a91-9aba-c8864137543d", "comment": "Malware payload (RemcosRAT)", "value": "d2a1fabb9b5572ba9974e153686b53c1eafd3697ae0a796994e237188272d1ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704875, "uuid": "65b8a643-004f-4c16-a5af-62c02f868e25", "comment": "Malware payload (RemcosRAT)", "value": "5c437a4fdfe842f06c885bbed07e32ad0ff30d8e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784704875, "uuid": "5d6fb8c7-d783-4244-a6ae-7b3081a25d4a", "comment": "Malware payload (RemcosRAT)", "value": "c4d8140fbef354b4398761e9a4eb0e62f02e6e8f009e6a0e32c1645ac195179d04c5db609b315908d001ccf62a37bea4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704875, "uuid": "41ec2e0e-3805-4be9-b3e6-ef178e648073", "value": "T17A87CC6E28F94BBAF0D070DC5A3899A09A67F11666B8317888E5F344CDE4F4CD496F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704875, "uuid": "9e6f7618-c3b4-40d8-994e-ce2f03262012", "value": "768:0IyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyIyB:k2t+uGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784704875, "uuid": "23b6b898-cd54-40a4-b108-1e94ac3f244a", "value": 38584324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784704875, "uuid": "0108b877-0fdf-4183-863a-a2877538c103", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784704875, "uuid": "de2831da-e900-4e06-bc27-e67b6db7c68f", "value": "DHL MNLR002855244.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae47e98d-8581-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784692744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692744, "uuid": "44e42c3d-e16d-4aa7-8ce0-cb333d94a6e4", "comment": "Malware payload (ConnectWise)", "value": "4c2dcc452a001e8d2d24f656e39ade24", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692744, "uuid": "ccaa2961-8d11-49a5-b27c-09deabbca7d5", "comment": "Malware payload (ConnectWise)", "value": "d522aa8fab045f887e61992612d29696444e68104c1aa151219a526115ba1f4c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692744, "uuid": "99e5d4ae-83ac-4cc2-8b55-fb8e3511b41e", "comment": "Malware payload (ConnectWise)", "value": "d7953815217ebc2c5b4055a48de5783ef06120de", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692744, "uuid": "00751efb-2205-4d54-9122-1383f26cdb90", "comment": "Malware payload (ConnectWise)", "value": "ed638deac3d04e141f5af5a9a2e89a8e024b1f52e3e4066eaf0873b0bb48a69bf0ac6bb599c48b2f7ccf4c03d560c429", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692744, "uuid": "54ac8e9e-34dd-4663-8449-e9ab767ab82e", "value": "T1FCD62312A3DAC035EDB20EB6D97641714875BC289B3AC4CFA7A0791ED5B09C09B72773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692744, "uuid": "79286adf-53d5-4aad-8277-c64eca86a864", "value": "fb40ad72cb65f1767a2e06fa73fcbc83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692744, "uuid": "a80f7793-c72f-4894-9554-8c3feda916cd", "value": "196608:L4Edr1uQwBuS0m1uQwBuSm1uQwBuSy1uQwBuS71uQwBuS:L4E7wr/wrwwrUwrrwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784692744, "uuid": "a2beee84-6c01-4b45-b53a-ad53504d6d43", "value": 13337600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784692744, "uuid": "15bc58ca-6f68-4fcb-a898-098a7eab8c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692744, "uuid": "e8b5e061-ee02-4a0e-b831-80c422dda8e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3899c284-859b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784703714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703714, "uuid": "2e4605c2-f699-4066-a868-cab7bde3b7bc", "comment": "Malware payload (Mirai)", "value": "2cd152ce7e09d16813e46f03ca711f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703714, "uuid": "4e1a57c6-4a56-4e55-8c13-50d477af4dcb", "comment": "Malware payload (Mirai)", "value": "d524ca05cb333f6c602a7889939d2900fbbc51b906925d5d69a33a4abedd88fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703714, "uuid": "f47e9223-0944-4630-b6c2-3b2efa7ed4c1", "comment": "Malware payload (Mirai)", "value": "5adef8c94c2af03d5369c7a8915801a7b36b4fd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784703714, "uuid": "dac2a350-a4ae-40ea-87d8-1f38fb1ac8d5", "comment": "Malware payload (Mirai)", "value": "8e8d17aaec042d2f850d30373620d1e0f939738ed73939a536dcdd3f36dac4491f7adb4c62f7c1cbc22d74d80d3a9805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703714, "uuid": "dcf206e6-1f20-48c0-ab0c-0f92dac709a4", "value": "T11DA35AC4F68BD1F6E41708754027B33FC732D6295036CA6BCBAA9E37DE776825606209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703714, "uuid": "9dcaad9c-5028-4971-87dc-94e8ca075076", "value": "1536:iKanrW5eqk1FHauLfGtBU4K6SiWWMvyR6acArWBddZQqXtH:iKYrXhLfGt3KJzvyRZNrM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784703714, "uuid": "f0b583d0-103b-4264-8a46-446664bad9a4", "value": 100684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784703714, "uuid": "c42cf8fa-5dd6-463a-875c-b52ddbbe4208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784703714, "uuid": "cc2c7afb-9c2a-4b6b-9761-95ee83ad01ec", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a0c9dd-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784705722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705722, "uuid": "e4330b89-891f-4b85-9ca8-4612d2e6b685", "comment": "Malware payload (AsyncRAT)", "value": "021bc72a86d323f036fbbc3ffed481cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705722, "uuid": "72bad208-e42d-4e24-908d-68f4e24cd355", "comment": "Malware payload (AsyncRAT)", "value": "d5e5431aea3478bc46ab0a93e8a671c4bc00ec50220f211da61eab0836f371a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705722, "uuid": "5d0a1d00-5b2c-40d6-95ac-81d805a18653", "comment": "Malware payload (AsyncRAT)", "value": "5bc05120f086d1295fd2bac316f8478cd55e71b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705722, "uuid": "21f972b5-ce3d-4580-9d1f-9bc10b4869c1", "comment": "Malware payload (AsyncRAT)", "value": "d50cb6e622c4e1973cc938ae9afc9d71c409caf25d2f5a260ca55dcf437d725a5cfb433dbd76c362924464a467616be7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705722, "uuid": "9c279236-5e2c-4fb9-ab27-1ee0c3e7dec0", "value": "T199C4C0146BC8BD5D039E0F35E02FA1DAFAE209C92486858AD722FD47AE65701F8735F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705722, "uuid": "2078c868-1e5f-4a2a-b8ed-9d658e1e9118", "value": "12288:nFOnANlQE142KplQoxmGOY4Z3NtfMGIPnJd3:FOMQt3ZfOY4xjUzPz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705722, "uuid": "c085f89b-a7f0-432a-a6f9-1013e1bdfffd", "value": 585665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705722, "uuid": "e0e8b21f-8d4b-451e-9824-7ca97012cce4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705722, "uuid": "71395e64-c07a-4f00-b2cf-99dc5d0ba339", "value": "S28C-126071109450.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d542f3ca-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784701829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701829, "uuid": "a2abc863-c775-46f2-b3d2-7c4418f55565", "comment": "Malware payload (MassLogger)", "value": "f668e2640e9e3c2c4a71ff6e2fc384d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701829, "uuid": "737685be-eb3b-4b7e-9038-b266efae1513", "comment": "Malware payload (MassLogger)", "value": "d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701829, "uuid": "dcf78eba-40b8-45ea-af78-f22d7a27ba8e", "comment": "Malware payload (MassLogger)", "value": "2dd3d4c0ff2515dac1d752844b78ab04bf054d21", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701829, "uuid": "c4fa3b86-94d0-49cf-b645-541ee0c4df8e", "comment": "Malware payload (MassLogger)", "value": "cfee7b97e18108e4c92bfbd4aafccc4a1483a3ec052ea559d0962608ff74107c21cbf5b4eb40136240edbcb0852405d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701829, "uuid": "e32efb95-9534-420a-979a-035df16b3384", "value": "T1DB655B34B29A766EF9364A0E41BB413287171730ED38504D174E83B7A9DF548E7EABC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701829, "uuid": "8270e960-6dd7-438d-9443-9d7360b8872b", "value": "12288:rMjVNMHs5YeYrAAaqzY3RfPvbOJz6SIqyBP8v:wjVNMsXYrA9q83RHjOJ+1pP8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701829, "uuid": "2960c581-b464-4107-b432-a8507ad93d80", "value": 1539068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701829, "uuid": "d4c87ee6-37c9-4fcb-85f0-3a965093c89d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701829, "uuid": "9bba248c-10a9-4d6f-acb3-ddad0c169c7f", "value": "ORDEN DE COMPRAS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66af49f7-85e7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784736433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736433, "uuid": "53840d38-f409-4f34-9978-a85ac2e0eff1", "comment": "Malware payload", "value": "c2ed8d8a64ebaf51d41a8a4f1eb87a0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736433, "uuid": "aac65bd5-a501-4170-a31c-3a9f31ce6135", "comment": "Malware payload", "value": "d84bc0b76b8439105781d6048152cd31b2de1d26e3bb7a39787c081ec79dcc79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736433, "uuid": "646bec1c-609e-4023-b51e-eb873135d65c", "comment": "Malware payload", "value": "a1c29d117f6642b71cc3948715a5647531e3b4fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784736433, "uuid": "7ba23343-bb23-43d3-8d67-0d98871d13bf", "comment": "Malware payload", "value": "aecf0bd85d6a28e0c7af1d42a3eb44d80e6716dd5ed4ed92d2cdcb6c339bc373850d4f64bfda173c134db7eac008d68c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736433, "uuid": "e13f4f6c-6f8d-475d-be30-03385e900ce5", "value": "T137F58D07BCA408E9C0AE9371C9B655963B75BC480B3267EB2B50B6783FB2BD05D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736433, "uuid": "872922f2-8e22-4c30-b07f-a0c9ad010f5c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736433, "uuid": "1637b36a-0b40-4782-9b52-ff84a3960cac", "value": "49152:C8rHsrvfPl2oiPJtlDpsbUyCzwCBemWY0HvmGCp6DXBTl:C8ArHN8JwPY0HvmGZXBTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784736433, "uuid": "8f46db24-ea8e-4e95-a530-17b0b69f2dd8", "value": 3522560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784736433, "uuid": "d4908494-ea9b-4a2a-ba8d-2b491a17335d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784736433, "uuid": "a9969cf3-24f1-4b31-b908-151c89a82545", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c4259f-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784705640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705640, "uuid": "880a70c0-c286-4c27-a03f-449a7d8e3d51", "comment": "Malware payload", "value": "503c6b74f0ffa68f932f461a92987d07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705640, "uuid": "dc92b260-85c6-4cc2-bf21-4d6f7755744c", "comment": "Malware payload", "value": "d8e02e67df3d951b735b1aa879df5001e345b961ce50c56d29d9c35e1a5cfe2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705640, "uuid": "0105dcd6-8857-443a-b12f-298ac883e9f6", "comment": "Malware payload", "value": "9a8e4b088ddd9a0367ff741bc7f2d30b9fd92f7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705640, "uuid": "65b33bcc-d292-4494-a7b0-fa4a15a924c9", "comment": "Malware payload", "value": "73a73025904f213b3f8f8c4e5b83b423843f12d45fa8dd50a4278e9bd288f0efcf07cb7c1f4dbd399373ef5863305be9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705640, "uuid": "e73a54e4-bd98-43a7-bfaf-c4fe8255ece1", "value": "T155E30946B8819B15D5D611BEFE0E128E37231B7CE3DE73029D245B307B8A8AB0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705640, "uuid": "31c7e1df-4ac6-448e-880b-7cf61aba2448", "value": "3072:LITqolOsXUbPP+ufrws45aJaMAQOBILIP1o154Wd:CqGIOufEsMaVCIUNo15zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705640, "uuid": "70002555-ddd8-47de-994d-cefca20090e3", "value": 157160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705640, "uuid": "2f38f8f9-a8f3-434d-bb13-6f971c9c8697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705640, "uuid": "a75f1bd5-598e-4135-9a57-d79ae6485770", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51876269-85a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784709768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709768, "uuid": "ed04b99e-f48c-4bae-9941-50e96b5fe294", "comment": "Malware payload (CoinMiner)", "value": "5789ea58a3526ca028be23ddfcc70e9c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709768, "uuid": "422ac198-2216-4654-8fa2-b49c750454d4", "comment": "Malware payload (CoinMiner)", "value": "d91084567f60c19702fd31ccbb03eab02b8681ade212212084e528c72370b66a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709768, "uuid": "f42d06b7-4fa3-466e-a418-862e61896b20", "comment": "Malware payload (CoinMiner)", "value": "aece1880087650e010c675a008cc780ab449720c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709768, "uuid": "9c0fda6b-ca43-4a0c-aabc-d51026526dd8", "comment": "Malware payload (CoinMiner)", "value": "9f050bf53a6705b51f138104825b90ac6b26bb19b31353b950fc03fc487d4529b423ab71a2a724602b7e56823b232b8b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709768, "uuid": "318a12dc-e6ac-4b73-8484-1235e5a6b613", "value": "T1383633EABDC75871C02AC3B055A2B9AE71BABF6055747C07728C35098E57F09A87F384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709768, "uuid": "00e7f5b1-875f-45ec-9549-c4a8f2a549ad", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709768, "uuid": "357ffe3a-4cbf-41a4-ae39-9bca63ad2b25", "value": "98304:vm2Rf58lAAcPSt7pREFyF8+cirXTH3CTt2mjr5uBRJyzGi7r1GQZWAyAVE+wnH:vm295LAcPmV8+c8THSB2HBRnuBzUAyLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709768, "uuid": "52356624-5cb5-4172-8cbf-2499e86edaae", "value": 5223936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709768, "uuid": "81e472c6-ff9a-497b-b2c7-0f30c844e320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709768, "uuid": "ed669eca-f256-487c-86f8-82a1342d25a2", "value": "SecuriteInfo.com.Win64.Evo-gen.18747649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3ffccb-8569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784682297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682297, "uuid": "369de048-c411-44a7-b5cb-29bfe90e5759", "comment": "Malware payload (Phorpiex)", "value": "218561da1c8f6b975d088e8ac4976795", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682297, "uuid": "a6758eb2-f1fb-4c4d-8f76-5c614c6c44d1", "comment": "Malware payload (Phorpiex)", "value": "dab034d5e6609eee42d40f4d61a0b95aa9dc4765c15d3d3dff81a2a16d7315bd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682297, "uuid": "a3e34c9e-4720-4ea4-b0a3-823ff3ca7860", "comment": "Malware payload (Phorpiex)", "value": "65ecb0ec3954700dc5a7f9759996032e08c653e5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784682297, "uuid": "107328b1-9f79-49b8-afd3-9237932cec2c", "comment": "Malware payload (Phorpiex)", "value": "43674248c3798fdc727e4e44704d98aa8048de3004f4eeffb02627f29d04967a2ad02ab26a38179ac5cc061531f5cb3b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682297, "uuid": "048839cb-2f6c-4874-949f-24983d429121", "value": "T18FB38D2034C1C432E567217988EAC7B58A6DF8310F7566D7BFC406AE4F276D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682297, "uuid": "0fdeff0f-0820-45f4-9871-0c8d4d5b71f3", "value": "cf1136126b3340920376499ac9490ff7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682297, "uuid": "30bc8ee3-3265-4d54-b2a3-15fe219a56f0", "value": "1536:q3L/ED9LEo5D+ZPJ4m6G+zZTATLu3dKVI7IYM5XDd4i5cAOy:oL/cl5Mi9G+zhWLqwZ5Xei5cAOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784682297, "uuid": "96b451cf-fa5c-40f3-a53c-d99642869af1", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784682297, "uuid": "10ac4e6f-9e91-403c-b770-2d413817f506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784682297, "uuid": "aacb4422-fdcc-4ffc-8f96-45a24dd40aef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d20d02-85a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784709772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709772, "uuid": "a61e14a8-c21d-4e12-81d5-f18012145ecb", "comment": "Malware payload", "value": "e3b906f0acacf59d044b4cedee606464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709772, "uuid": "6f5db356-0a0f-4d18-8e04-2c85b0fbffea", "comment": "Malware payload", "value": "daceb4fa08abb38b4d3adb8db6c93f1f69885ce10ab0b40bba58f242c97f3ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709772, "uuid": "b3a1a48d-68f3-446e-ad8d-b08c12b57c55", "comment": "Malware payload", "value": "bda54c64e8b8244fc244e5fcf832d63f6ab63d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784709772, "uuid": "b2b94d2c-1aa3-4d8a-8702-d2b265a32c74", "comment": "Malware payload", "value": "dfa32f7d216b84be53468e70f8f7a7c0427894202ee4eeaa488724ec0134d4f5041121bffbe9c9d0d9ac4a8cd9531c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709772, "uuid": "876ebbda-a4f3-486a-bc9b-f293a70962be", "value": "T121D5225EFCF61974E436C3B34283B4AEB07977418A618C577ACC67106D63928BC3A279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709772, "uuid": "59d8ff87-7e7f-473d-a094-3d295614a839", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709772, "uuid": "624f155d-5132-4019-b30a-f003d0776ae6", "value": "49152:+HT941VfTDA0DzYtTa80PKx/ORU660shrlT7yrMnJxDN9OOlyM/bDCqC8C1muj/t:nQUzY16AFn0aT7yrqxD/yMXCq0ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784709772, "uuid": "ea526202-a9fa-4fa0-b2fb-fbccb08330a3", "value": 2976256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784709772, "uuid": "97ba50ab-cd89-47d2-9540-c9ba1df07ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784709772, "uuid": "73a97118-a880-47f8-86c3-6be847292749", "value": "SecuriteInfo.com.Win64.Evo-gen.81761531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614d1c50-85bd-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784718385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718385, "uuid": "af3b3e60-e8ee-4b6b-b089-cdfb6e8adaaa", "comment": "Malware payload (GuLoader)", "value": "b63697cb6128ae927b67e1f95fcbbe0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718385, "uuid": "5e835f9d-155e-4873-ae7a-fa0281fa86d1", "comment": "Malware payload (GuLoader)", "value": "daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718385, "uuid": "66733a2e-48da-44a6-a112-0068d53925a0", "comment": "Malware payload (GuLoader)", "value": "bbf557d7b8ae61cec5b68d251ea12c78c97453f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718385, "uuid": "8f798b3e-920f-4dc2-b5d9-4b6f760cbfc7", "comment": "Malware payload (GuLoader)", "value": "2617d8e29fc8e41c3bbe497074a193c5fae4bc2ff3effef9fc6a0d6455d0cb1b900eae6022e2287afc655206c4b7e9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718385, "uuid": "7ab90272-1dcd-4ab5-9ed4-51f6756b1709", "value": "T1E994CF53F694C986D81112F04C7FD82922676D7898A3520F3EADF73D6EB3292F11724A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718385, "uuid": "6e6bd998-ac1b-4170-8d99-e2eb0e84e74e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718385, "uuid": "e868cf02-c199-4f49-bb8c-8339c6c47fda", "value": "6144:HTA8oPSCIjFo6XHfvTx2yQy8ARUvOa40Di4Ynu+ja:HTA6FoAHoy8ovz07A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718385, "uuid": "2ec4da6e-3d94-4019-a72d-d7e11c1e7b00", "value": 428256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718385, "uuid": "694976a9-433b-475b-8e50-f5089005bc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718385, "uuid": "86873bbb-e064-49b8-823d-4282c01e995a", "value": "Directrices de pol\u00edticas para empleados_2026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640bc933-857e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784691331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691331, "uuid": "41335712-55cd-4fda-bd4a-0de9e00aa580", "comment": "Malware payload", "value": "1733c79bc9d392d200ae90726154d54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691331, "uuid": "a08e4f1f-8f72-4794-b499-ae00aa19c446", "comment": "Malware payload", "value": "db9e55535159db148bef69090be530fd01408c303b67f0f16f658d01c7c5ee6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691331, "uuid": "46c587ae-5dd9-44d5-85d2-94879c38f067", "comment": "Malware payload", "value": "07da26b2f7fc6bf0a1f14b9c31c125259c8324e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691331, "uuid": "57a0d505-74f4-494a-ba69-193905f73faa", "comment": "Malware payload", "value": "c437e060f936f76d13764db9e3e0f9b163cfb7f9cc2ede4ad72692a763d4127d2da786f8d7da0ade2f28812ac6e915b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691331, "uuid": "2e597e81-1212-41e2-8ea9-6c3dfb924f5a", "value": "T14402F943BA484A86D5BAC8F408576E17F991713341E59E79FA8CC4900F3932AB3BC16E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691331, "uuid": "6ed7b1eb-b88b-4cfa-9a85-37f32b53c2b0", "value": "5d79c27709f823d77f8028442a671a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691331, "uuid": "55413a3e-0774-4a31-ac3d-fb2552c6bd4b", "value": "96:vDn/TpzBoLpNnHRPOtYyL9A7elvD0MEwULVh9Z0Grh0DLcy0jhAuD/Elif/4/qd:7LpzUNn1O3L32MT6cchDD/zf/4/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784691331, "uuid": "eb81e73c-f441-4806-9765-a506bb0cd0ef", "value": 8295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784691331, "uuid": "824f05e7-09c6-4096-a30b-161d10941c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691331, "uuid": "c01af81f-6049-4daf-8692-40b0af3e37d1", "value": "SecuriteInfo.com.Adware.GenericKD.61155092.527.27382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e1dd1f-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700354, "uuid": "24836317-24e5-46d5-8061-811bf39c0576", "comment": "Malware payload (Mirai)", "value": "c4f1dfa53a35162c997e382d2cc3d855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700354, "uuid": "71eed409-fb38-4a5e-8b04-cd86afc77bf0", "comment": "Malware payload (Mirai)", "value": "db9eba7c0bb08a667b71865820e169bebdc8c6bd8d12cabc9309ca9dbaf0f303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700354, "uuid": "b062d410-dc1f-4260-b9d9-97c7538c9364", "comment": "Malware payload (Mirai)", "value": "68d0f191bdbac6e9dcc2895bbf43ccd39b844ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700354, "uuid": "ac855cb6-67fc-476f-9f81-8f36bf72da42", "comment": "Malware payload (Mirai)", "value": "03c69ec8e7a1394bb6fad96da4941a60aa6987f4704f402945d15a0a6fc63bde43f45368a8b52b666eae0f359e6589fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700354, "uuid": "85f9d003-76e6-4241-9c34-623532480ad0", "value": "T114B37CC4F687C0F5E81749718027B33FC73295299035CAABDF6AAE76DE27641960A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700354, "uuid": "5b7987ad-20f7-4a6b-a887-65730da7c0b3", "value": "1536:Vn5BkD7GrQ3ZhsF302KqAeUfCUGK7CWfycfxu0087yjnkIerolBFJ:djA7P7w7A1fXBz6exN0CyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700354, "uuid": "40175d6e-4ea6-4f8a-9d31-2ee0f1e4de7e", "value": 117132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700354, "uuid": "f91e03e3-3011-418a-87a6-2ed340518e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700354, "uuid": "d3c3f0c2-2abc-4350-a042-88867578d3ad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8a2720-85d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784729327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729327, "uuid": "ce0e44ca-5ea6-4dd6-8176-756bb6838560", "comment": "Malware payload", "value": "26a28647744d70f5fe3ebbf1853d51e8", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729327, "uuid": "5b6ad082-29e3-4792-989d-dd9b8a23056c", "comment": "Malware payload", "value": "dbdc236a611a38ede95f2f0445d838de5871ed483def4330b44f1e3b3eb1564c", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729327, "uuid": "e8a33033-304c-4ce0-92e5-335acb3403f2", "comment": "Malware payload", "value": "cb299f9bfc587a4b07b1d8b82e82dc3c02126aa6", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729327, "uuid": "e1252630-567e-4c78-8156-251d754b43bc", "comment": "Malware payload", "value": "cfa4d7b6631f87038b1f9a9540a5fc2b60d35668d2f537b6bd31d8763653e3935954d61d4737173b8ea8861b733b1984", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729327, "uuid": "c4062585-cfab-4d30-a6cb-1accb330cb3f", "value": "T1B5325C4DE6F31CFE090602A6A6EFC050D28723DB65095607767FE2AE3B956F153B0413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729327, "uuid": "83a8e349-9439-4454-87b8-71b0290c42c2", "value": "192:2p+uZB1jdGjjM1ezUEizah+qcGXEse24pPTde0vtJAprwHfhPzCWGCW:w1j0jM4+zaoGpe24pPTde0v3AprC5P+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729327, "uuid": "a2de5180-4c84-4cab-9def-4c12601e7466", "value": 10984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729327, "uuid": "e3c2291e-511e-46fc-9313-39fc7a4502b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729327, "uuid": "65b12b7c-23df-4ac0-a261-ed13f686145c", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309bf760-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784705848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705848, "uuid": "efb660c6-00fe-479b-a670-e00e257ebfbe", "comment": "Malware payload (Mirai)", "value": "b576f29608e5ec9f209cc2aee1dca5bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705848, "uuid": "4ff9024b-8c55-4ab1-96c1-f61130099a3c", "comment": "Malware payload (Mirai)", "value": "dc47ffe4770049e05c97cd51af16af02154057fc59f13d9da6a11dda42a41336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705848, "uuid": "f4aa9996-77fd-4c64-822c-c997acd0d8a1", "comment": "Malware payload (Mirai)", "value": "6bfc8b9c89203eb5ea51231a905dc11eba05fc08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705848, "uuid": "27615c27-34b8-4a2d-97a3-8b2d99b680ac", "comment": "Malware payload (Mirai)", "value": "a854c854c30d8830d636f521dd1803a7e92e400a1036eadbc0956e169bb8be81bd44f21a189de9462d91b114c571af8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705848, "uuid": "f7757002-198a-4f89-8ee2-9077c01b91f7", "value": "T1AC53F1BF883D7A8CC2D9D632344F17D7F95072CC311A87D99318CEA26B394DA9C55990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705848, "uuid": "6cd46dbf-fd5c-435c-815a-d6ac353f2a25", "value": "1536:IewUOqt6rFVySivEW+/TXtxh3/EISCDpBPll4wNe:IewUSFufeTdxhM/if4Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705848, "uuid": "ae945fce-430e-4b14-8fbb-1e9456a80ffe", "value": 62440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705848, "uuid": "369722fe-8141-4e11-8bc5-da751e8cd25e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705848, "uuid": "ddeac39c-1df2-4c48-98ac-d037484eb1b7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74b5cb5-8615-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784756298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756298, "uuid": "b8e420f5-c231-4ba2-beb3-43f9b813b8ce", "comment": "Malware payload", "value": "72772a7b9b2e045b217a07d2bd585d7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756298, "uuid": "b03e6375-4479-4266-9f2b-c1b9f07c29e8", "comment": "Malware payload", "value": "de366c8e91207ad27a30fdf10182d63512dc45aa97f077c9859c5678a7bd144c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756298, "uuid": "e8d72495-be94-4b43-959e-0fcf484712bb", "comment": "Malware payload", "value": "0eca05491646d7039a319a5b9bc816142f94bcb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784756298, "uuid": "40de6a6e-c397-4f2e-b2ad-152f960ac827", "comment": "Malware payload", "value": "f94e0cdacd91d9825cb712c7873fec710f377269f8110d3be439e5cf35234ed2321f262a1ee6aeab0effeaa5ca3cb8bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756298, "uuid": "45b8ba31-089b-4696-af4d-289732df2925", "value": "T198137D695A953C249E9988371D7E2F0CB9AA83E1300851DDBFCB3CF28C45ADCE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756298, "uuid": "bdeda157-93b6-4fb2-80d3-1fdd0468a634", "value": "768:5VEJVIhtMg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:XEJ2Mdco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784756298, "uuid": "8be5ffe1-6015-4917-9cb5-2d5a3442674f", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784756298, "uuid": "53c867de-e464-4fc7-bdef-d78abe2a82bc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784756298, "uuid": "cd3ebe84-7f9c-4661-8fad-20f035102d48", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f6c5ab-85aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784710475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710475, "uuid": "a95481b5-f026-4fdf-8844-3f976cc927de", "comment": "Malware payload", "value": "22cd72ec5aff5f214a8e73a2413518a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710475, "uuid": "a04be04e-1dfe-496a-a001-f95aa0fc6ea2", "comment": "Malware payload", "value": "de680c55a484e349d8e9135a6b7035b173fd86f7a68eb9567ca5da821e0dc484", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710475, "uuid": "758627c7-2d42-401c-b25d-c96ff18812dd", "comment": "Malware payload", "value": "a0c064db2e24d05c3f30585fb712b930a750dfd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784710475, "uuid": "87b834a3-4d98-4858-9e8b-824e796e63a4", "comment": "Malware payload", "value": "29cd10fc3d8bbecab64e096ce14da570bbf75162528e7f10182f5648937af734b38d10ec8d6205b69098d9f13c6b9971", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710475, "uuid": "794116b7-fc91-49e0-ba9a-477fa6325b9c", "value": "T172A5023127C87946DDAA73169EE0B79EEF71C00334D65B3DA0589AC82BA1E5F3171A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710475, "uuid": "454ee2dd-bf64-4606-95a6-ceb95a8dd1f0", "value": "768:uUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUK:Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784710475, "uuid": "f120d430-a416-482c-b33b-6b60510fb4fd", "value": 2181750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784710475, "uuid": "6cafeb20-0051-48da-9aa8-12111d847a09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784710475, "uuid": "e07be2c0-cf36-4bb3-ad15-cfe87fea3d8e", "value": "Comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21497c75-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784701527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701527, "uuid": "540adb2f-be93-4ef6-857a-3fe31e0af97e", "comment": "Malware payload", "value": "76c4ac14310e4e1032f5876945e0babc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701527, "uuid": "25f3e307-f1ec-4471-ac3a-9fd1287f2f09", "comment": "Malware payload", "value": "df00d1da1b70d8009aedb5671116aa5b3b2cbdc05a451e8d9aa81e7fe6201753", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701527, "uuid": "7185ddf5-7f4c-4f7a-9af5-e1464a6dd1ae", "comment": "Malware payload", "value": "f4018d5eba3fa51cfef34d81a426708824ce78f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701527, "uuid": "69489990-6d34-47c6-8efd-0a0c4850cf11", "comment": "Malware payload", "value": "d8f71a833009b36cba8477d100975a6d055e7a9688727eab8870c75b93f352713988a247b1fd11510610c05e2f33d6db", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701527, "uuid": "c5cd3ddb-b436-4238-bf9e-60a37505892b", "value": "T195236C512A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADDA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701527, "uuid": "e4f529a5-f901-4841-93ed-6779b840f6f0", "value": "768:YJFWzZx5M9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Okzbcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701527, "uuid": "ec6e22d2-0957-4234-bed4-a20b1ba56b06", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701527, "uuid": "1924d78d-22cc-401b-9329-bd28e436093f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701527, "uuid": "dfda9d41-6ed4-4f6f-bb0f-b90b3af4fae7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2594636c-859f-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784705400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705400, "uuid": "0c7eb31c-a744-4425-9f8e-157d929222de", "comment": "Malware payload (PureLogsStealer)", "value": "2a019ce8b4f8ae7f4303aee9164e22f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705400, "uuid": "70b8936d-61a7-4d5c-ac08-61306c55c977", "comment": "Malware payload (PureLogsStealer)", "value": "df23df75e3b341e3ba7826cf6d76e9b199ec91537b657071c1e1ae0da4571d19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705400, "uuid": "4d253ad3-88ac-434a-8834-2b8d3d2e26c1", "comment": "Malware payload (PureLogsStealer)", "value": "932a765d1b04b09c977db348607070134bda489f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705400, "uuid": "05466072-bbf4-48b6-aea3-0b53fcb751a5", "comment": "Malware payload (PureLogsStealer)", "value": "32909cdefe1e458f2bde4234dc3dc8fc59a1324785a187bb6dc77431dbde07d1767fe25f005c3f4d1eec124d88eaa3ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705400, "uuid": "a356fd30-ad10-41b8-9ad4-ba43be9b8ad8", "value": "T16965AB7121FA97243833AE81CBE9326B7377AF5332B614988C652784E507AC65CD137B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705400, "uuid": "3a65e64c-6de7-43de-9a65-7700a0747510", "value": "3072:tZ9ygK28ie2AEYABkUWjvh6x3JKMVGViYP1dgtPgA58YvCYFkGrZO3SVPi1GLmgN:S0do/+X2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705400, "uuid": "4a1f6f06-a3eb-4de1-8bc8-e11d9ba863b7", "value": 1499654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705400, "uuid": "f23ee799-d8b7-41fe-b7c2-ae6035cb81d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705400, "uuid": "43284747-163d-4b4f-999d-8679338060fa", "value": "Purchase Order Quote_Confirmation_November27-2025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4eab34-861e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784759930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759930, "uuid": "fa85df97-8721-4dd7-aed2-f6aa932b7a45", "comment": "Malware payload", "value": "991f897750ebdb9bf7104ffe4cf3faaf", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759930, "uuid": "b2c55961-0f9f-4995-8ec5-a6111a5fb5d8", "comment": "Malware payload", "value": "e149f36cb6c001aa340c388d7684c8a055f59152026e8e0d1d678264d7c084d7", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759930, "uuid": "04d687e0-f451-4a8d-85b7-d8602b72d0c1", "comment": "Malware payload", "value": "8499f094477c8474c2550929c8fcba3bea310e2b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784759930, "uuid": "a7eb40f1-3cbe-400c-bccd-0c05e2eb36a1", "comment": "Malware payload", "value": "223864b4e603e9e0853664976b9961e6162fffd528e875d61831837dfff4dc4df3d18f24c9f85473a130acd566184270", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759930, "uuid": "b6248dbc-e0e6-4e74-bb52-396bdc6c44bd", "value": "T17796E112EEC508F6D158E2318AE592AA3672BC15AB3117F72A15367C3FB2FE01D76344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759930, "uuid": "d2a6c34e-afa1-49be-81dd-1f7e7acd0c8d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759930, "uuid": "7df34254-a643-420b-9ebc-4cc03af5e569", "value": "196608:3wYTW6kTnDWQGAc0CE70GFy/fkl5Mt9TYdBGhN:3xCVzDYuCO0GFy/06YBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784759930, "uuid": "ab7ce2fd-dc8d-4038-a96c-343070b98b9d", "value": 8648048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784759930, "uuid": "3a18ba32-01f4-43b7-8fa6-4476171a9389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784759930, "uuid": "4a477fdc-3247-4fd3-9317-f0f2633685db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a44a357-8593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700334, "uuid": "e51efeab-ad74-4e5a-8aca-64f486b33f78", "comment": "Malware payload (Mirai)", "value": "7fdbe0485849cd25021bdebeb03a8b53", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700334, "uuid": "bdf69087-64f4-4207-a9f5-b113c97d5fea", "comment": "Malware payload (Mirai)", "value": "e1ceda2c259e9ccdb478262166ca492d69e3b81074fd39049e219c136b89ff13", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700334, "uuid": "8e941a31-4492-4ab4-a4d2-3238264c1155", "comment": "Malware payload (Mirai)", "value": "2c7182ba40996da5b1fb92cd0a20ece7bbeb384f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700334, "uuid": "9ce07f41-98da-455e-ad6a-a680356a1039", "comment": "Malware payload (Mirai)", "value": "d8710f9553703d0e7a17ffc4f5c61d4bc36d7c61f4596db45d1482d81c2676d6e11db6b3568d0a858e788833ee4be21d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700334, "uuid": "05a5db3d-cace-4030-9744-c113be59fc72", "value": "T1210180D686006D105059C51E66D75190B421C3CF494B4FB87F9C6D3DF74C914F026E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700334, "uuid": "51fb157e-1494-4d2a-8353-45b04a511975", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkasEC7aC9QC+31jCUsSCiKsDCssAauD:kXCKysE2hi0ziQvZohaT8n6hjd8gNt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700334, "uuid": "ec7534ad-a41d-40cd-ae1f-f493dfe3f99e", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700334, "uuid": "80910157-6bcf-47fe-b9d8-995589d4d81d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700334, "uuid": "0ac73e82-005f-4d1d-a898-d8aac1ac7dd3", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70387b95-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763077, "uuid": "8dd1ee6a-0df4-4509-8401-98e891228bce", "comment": "Malware payload", "value": "0cdad2d6ad1e55967121ed478bca8243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763077, "uuid": "41fdda4b-1e32-4887-ada8-92bd962ea2af", "comment": "Malware payload", "value": "e2bc7981064d3c9ed898a0f62d659fdc2fc9646dee47a9ca92b9b28b96c27a3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763077, "uuid": "9c92524b-9695-4a44-9db9-bae42a7524c2", "comment": "Malware payload", "value": "872d7fe3362ae01cfc4430c78f89abae58df6713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763077, "uuid": "44bc58b0-ee98-416e-944a-020e66a3bc9d", "comment": "Malware payload", "value": "06b689fdc5d304da1cec0423bad6c7c1a24c6fb8789a3d3a58e9428a341dea724575a92fd55438099b8b75e93ed4798a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763077, "uuid": "68abca3b-bc0a-4b2f-8b9c-168e80fe80b5", "value": "T129853376C5647C4AAC4A907DBAF39ED3E3C2C04675186991AB707ACD93A80464E373F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763077, "uuid": "fc20205a-c54e-44ba-8018-cb74fb448a6c", "value": "24576:5SMoXbJ4prFSdP1w0OJX9ENKTxeGfL7oYPUZ7uPxskPdXZs4qs14sYkj5cT:ToXGVFkROVagTxSW46SkPdXZTqs14Zq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763077, "uuid": "6adf49a5-dc8d-4fb3-b354-0f7bd7dfd060", "value": 1756088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763077, "uuid": "49f3d60f-d359-40d2-a58c-7858ba06b550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763077, "uuid": "1c0ee697-5476-4869-83e6-de8c16a110cc", "value": "e2bc7981064d3c9ed898a0f62d659fdc2fc9646dee47a9ca92b9b28b96c27a3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412d12c5-85bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784717901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717901, "uuid": "4bb42c3b-97d3-445a-ad9a-db208483ca3d", "comment": "Malware payload (RemcosRAT)", "value": "8f8549765763d0057be7c3123ba902d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717901, "uuid": "c479a09b-18ff-49db-98e3-1f4e1745bd54", "comment": "Malware payload (RemcosRAT)", "value": "e30a48561633927186baa68ecc44d59a780b34e11e5d7e9f01475b9eda59884d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717901, "uuid": "8ee73c01-13e1-4186-a81c-b256310e3ff5", "comment": "Malware payload (RemcosRAT)", "value": "200dedd10efd542cfb0455c772b0e96387e6d908", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784717901, "uuid": "9a7a60a4-81e9-4318-a684-fc2212b3bb75", "comment": "Malware payload (RemcosRAT)", "value": "46305c1c49b3031209604096395f2eb3ceba35fe675fee5c44a241fdb297cd8f7ec0b3d82079a22d0f526c9f4056ef49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717901, "uuid": "9579432a-d840-408c-8a8c-74ecbbdb3f76", "value": "T149759E8DBAC974E1E91ADE77B159BC7EB022B3CB9C052C0B22B165A507F1541094FCEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717901, "uuid": "fd2e29c3-19f6-403d-b8eb-53ccbae62a0d", "value": "49152:2LGbbdXghlriLI7UkbfSgYiO5XmWIT2a2:2y/9ghtiE7U0fhW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784717901, "uuid": "eaac44af-beac-4d2d-bcec-27a224162306", "value": 1659711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784717901, "uuid": "fa498e2c-6256-4370-9128-76de89e750d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784717901, "uuid": "89f701f2-ff4a-43e7-a6c7-edf2ec172e44", "value": "PO #267113294.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cac014-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784729459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729459, "uuid": "254d7560-bf78-414f-b1a3-56f5f85e8cb5", "comment": "Malware payload (CoinMiner)", "value": "f81ec05e28e57d32f2a33fd0721c907d", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729459, "uuid": "f9a26852-eb1a-4492-832a-c2de9e2368dd", "comment": "Malware payload (CoinMiner)", "value": "e4710869dc5deaeba46756b9b65777240f714922dc9ce1a8621460abb3e69c2b", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729459, "uuid": "d077975c-876d-463c-aa3e-b8174087675c", "comment": "Malware payload (CoinMiner)", "value": "7ac8a194ba81e39ee7c1098a5540d756568223b0", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729459, "uuid": "68e6a4ca-38ea-4dc7-a18a-7409a3190ced", "comment": "Malware payload (CoinMiner)", "value": "cc88114ecae4456af1de06671a9d0b2baac59030a78fbf1ccbd71a5bccd581348600b18d845b8e88dfd60692fd5eacdd", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729459, "uuid": "fc42b6a4-7879-439d-8f62-fc2a752f7573", "value": "T1E53633977DC611B8C486C3F4A59360BDB13ABF564B20FC13B99C2A49CE5EA54603F782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729459, "uuid": "670041dd-8796-4ae1-bac0-37cd9a1e3e05", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729459, "uuid": "aacd2d6d-fea1-4cf4-a4a8-66aea8c11097", "value": "98304:qDNhC/j/Y5/CINLCxN8cgBF0G4TgSWktTTwwBgx1OoaT1Sxn491:qRODYNLUYBF0GOWOTM+gLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729459, "uuid": "9fbfa52c-fa50-4b65-9ae9-ab76558f7f35", "value": 5219840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729459, "uuid": "06fe637c-c74e-4ccc-9656-aba5684abbb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729459, "uuid": "a52b98ad-3852-4945-8152-7bffda6b7661", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747d1e07-857e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784691359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691359, "uuid": "858e2d4f-3000-4842-a536-6facc4117c95", "comment": "Malware payload (Mirai)", "value": "d4e0f4c0454dfbd35c0329c11018d7ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691359, "uuid": "53ca88c7-ec4b-4652-8343-c39c300732ae", "comment": "Malware payload (Mirai)", "value": "e4d2ddc80e1c236ae22bec38090883648b411e140e94a2a5d554aac66bae030e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691359, "uuid": "7e87d196-c92c-4f3e-bca0-3e0c17243118", "comment": "Malware payload (Mirai)", "value": "1466ded9638bd13138478e877455246798489e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784691359, "uuid": "266226de-3c72-433a-a708-2e1d7ef03310", "comment": "Malware payload (Mirai)", "value": "47930184899991c519d501c3197bf8af3d25c5d8eb8a983715627af71d24f7731cebf801c8ea50377d8585122a6a71d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691359, "uuid": "afbfa4bd-008a-420e-81e2-6ed85b024b08", "value": "T167A3D70AAF611DBBD81BDD3705AC0B0278CCA657716837793538C528BB8A54F8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691359, "uuid": "be0fe048-46b2-4d55-8c3e-2ec3c2ea1929", "value": "1536:7K4tIZ2+Fy7KXz6XnAbOOKoubmSFCyLlPAJ1U02Ux+2gvvO7er23:tW4+Fy7KXGXAbPEbm2cxbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784691359, "uuid": "aef4d23b-0d74-420e-b730-b5201c4da246", "value": 101108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784691359, "uuid": "55f2881e-0239-48fd-b5c4-fa7c25b467e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784691359, "uuid": "e65867c3-33a3-4d00-9ee3-c2ad9f61ed3f", "value": "WgR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea158dd-8596-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784701898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701898, "uuid": "1bc8d88d-3b71-47f7-b807-b3515b17bfad", "comment": "Malware payload (RemcosRAT)", "value": "d81969601d9d0b7b001bbcafce3377eb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701898, "uuid": "ea379c14-5f84-469b-9bb3-76cd898b4429", "comment": "Malware payload (RemcosRAT)", "value": "e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701898, "uuid": "3715b0a6-0ad4-4ecc-9612-4809cf033af0", "comment": "Malware payload (RemcosRAT)", "value": "b062d85bcbde7df13a75a80f07b19a0237b00ecd", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701898, "uuid": "6349e85f-c9aa-4145-b092-b1bc50f4e90e", "comment": "Malware payload (RemcosRAT)", "value": "35f9125849e762b1bd853f9f6e0d1e66e3490476074de530b5c43d4063777780791abc4ce96e32ce4389ad7c4bc7bb4e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701898, "uuid": "df91559b-6544-41e1-a0da-498c2975dfed", "value": "T14372427D8009D9D43167BAD96D26C6B96050D6CBE0B07DF22EABD75F8A2320560C27CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701898, "uuid": "8f42517e-9cee-48d5-959e-45818cef52bb", "value": "192:gqrmE9Aw7zdP0IEwJVWTTbQniNVgDqJJg5s:L46hXQjQiNyGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701898, "uuid": "d5b6402c-41ce-43c5-9b64-aa59390ffb4a", "value": 16172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701898, "uuid": "9e839942-6d31-4e81-8cc6-e55c628b10d9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701898, "uuid": "4b8e43dd-850e-4bfe-9799-e422b2933dde", "value": "Orders.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1565bbfd-8562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784679173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679173, "uuid": "c5ccfd6a-2f9a-457b-8cdc-eaa5a320ef9d", "comment": "Malware payload (Mirai)", "value": "768a64cc044e28cd8b6e32ced93817f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679173, "uuid": "a7b86df1-4bc3-4719-aee8-6c0e40b009fb", "comment": "Malware payload (Mirai)", "value": "e580389c650f257fa14de379ebe93eb86ea56a123557c7eadb0a2ef4a6a37303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679173, "uuid": "ff91493b-179f-4ade-a6c2-5f473345b39b", "comment": "Malware payload (Mirai)", "value": "dc6e5d38a045b640c84f1d111718eecab2c5c11c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784679173, "uuid": "9d115c4c-42c4-444d-9a42-52bb9d61aa02", "comment": "Malware payload (Mirai)", "value": "0bc4db25f744f50505090557f29a71c82ccf5b05194c71f16c76295ea64c9689503a95c159daf2c1960e9539512b325e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679173, "uuid": "46525245-eaf0-4408-8410-d22ba4eb764c", "value": "T102631935BC819F16C5D52677FF1D8348335B23A8E3EA7213EA156F6537CB82A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679173, "uuid": "f341350b-589b-42a9-91d9-bb20bb61ce14", "value": "1536:ZVbW7juSBQNy3bJZPCbmeT1yz3y5ocidWmsZcOzkFS1UPbi4p:Z1qjuwZ3Om81yz3oocidV+ZAFS1UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784679173, "uuid": "c98eac3f-4be6-48af-b0d5-1f519bfbdf5c", "value": 71200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784679173, "uuid": "b87a090f-cfd7-47ed-8ac1-d9512bc69dae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784679173, "uuid": "a8dd0cff-c762-4d95-8740-2bb39cf26c73", "value": "9a0L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c373731-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757890, "uuid": "3728a91f-045d-47ac-b673-3308d92e2fb6", "comment": "Malware payload (Mirai)", "value": "625b2fa9f7d3e06966d1bc662384aae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757890, "uuid": "cee8ce8e-e537-4ad7-98a8-dcf1fb245a0f", "comment": "Malware payload (Mirai)", "value": "e596320b1d716908045f377f843d5c0c3fadb2dc145d3732f83f8acbf1c2297c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757890, "uuid": "24669426-cda3-40ae-8fce-ee4a7c212581", "comment": "Malware payload (Mirai)", "value": "1cd435882b7f298c01dafab1742ae90d425988bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757890, "uuid": "34c22328-7cb2-4a9f-bac1-02a4c1132219", "comment": "Malware payload (Mirai)", "value": "fb743ea6e8c3194d1ec850e0e4412afa7b8230f7f8d3732890f2cbb0f725a0c67951d03cd8cc43b135ea972c25120b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757890, "uuid": "3201ba7f-7656-4ac0-b573-56410a51201b", "value": "T1D753F891B8426A39C2D1577BEDAF548E3314A7D8D1DA3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757890, "uuid": "328a5987-4339-4b58-a885-6e4536bbfb36", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757890, "uuid": "26b16372-9b02-4758-b24b-6769d5854776", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757890, "uuid": "98a73754-cd0d-4856-b434-e341b3e546ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757890, "uuid": "1c3a1904-940c-4c48-84f2-77a95e0f2d8d", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63501949-85d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784726549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726549, "uuid": "826633d5-3408-4708-ab82-f3f6030823cd", "comment": "Malware payload (Mirai)", "value": "626fca12409a95deaa3a9eabd3705062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726549, "uuid": "03b04575-df14-43da-b70a-0f1c9165e98f", "comment": "Malware payload (Mirai)", "value": "e5a6d9c5f78f142873b9390d410f76ce8a7b900549cd60d85aa9478a6de5058e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726549, "uuid": "6cfbc474-a111-4fc9-ade3-4719230f5a09", "comment": "Malware payload (Mirai)", "value": "14e85f3a9f52071c37b7f0d5d8d6ccb4a108b01c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784726549, "uuid": "b81d1bf4-94e6-4605-8314-d2af1346faa6", "comment": "Malware payload (Mirai)", "value": "ae3f1330d1ff7d2e3d4a6c8ae5efa426c0caa4fd256e03b83de82eb0f01b345ede0c592a931fac3ade6e8ce8669ed63c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726549, "uuid": "dfd9962e-4b58-445d-a823-fc6988a6bc17", "value": "T1D123F17740FBD1ACD4B7E4B3449B1250E697A60F97E213B9910DB3FE4AB25062C20BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726549, "uuid": "c8834056-bbd2-4209-962b-bcdb0edf05a2", "value": "768:pA5pukg5eylMoMvDeA0hD/+86N0kp7eRdHKaA3gHTTM8vg1vk6Cx0Y2:/wmZM7C286x6dHKaAywtcFx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784726549, "uuid": "c364dd4b-2e73-4f44-a7a0-48d1004a2842", "value": 49508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784726549, "uuid": "5dd7a00a-6f74-4508-9d21-359cd65b7a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784726549, "uuid": "c5eeb5e2-1a60-42ab-bd9a-c78983c457c8", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff071ae-856e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784684721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684721, "uuid": "cb9f987c-ddc3-445b-aa60-92cc13d435fc", "comment": "Malware payload (AsyncRAT)", "value": "24f1c6fbb6cd28d53117bfbef3e9ec08", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684721, "uuid": "219ba013-f60c-4d28-9ebc-71059849107b", "comment": "Malware payload (AsyncRAT)", "value": "e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684721, "uuid": "587ec8d5-167a-4b6a-85fd-fbbe59206a0a", "comment": "Malware payload (AsyncRAT)", "value": "056db76657f3108c8db03a33c59db1fa8ee1cd14", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784684721, "uuid": "c7e04363-7b89-4d4e-a5bc-cff18319e456", "comment": "Malware payload (AsyncRAT)", "value": "1e17b3b01def9203df4956f6254de6889e55aa972b1fde480d25e444065eebfc4c2027cf01c35d010dda3f6f7840e3ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684721, "uuid": "d89147a1-14f3-4634-a62f-862c87a83103", "value": "T1D2A5AE19E3D812A8E167DA74CB51A332D6B178534771E19F0A99D70A2F73E908F3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684721, "uuid": "faa72704-234e-4acc-b843-4d1722759a11", "value": "46d844d880996af2766416e3e2079244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684721, "uuid": "53cb18db-1526-47a3-80a5-763843620249", "value": "49152:W0ao7zY6iUSzvEHTf1PLudGRSY3yOZ2S+oeATrfK:WqeY3yOZ2S+oeATrfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784684721, "uuid": "4aababaf-6801-4e90-bc3d-9a52a37a4316", "value": 2171392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784684721, "uuid": "2df65a1a-d47c-4ef3-9de6-c6cb1867b7e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784684721, "uuid": "18598918-ecc9-4e4c-816e-022bdb50882b", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13eb4a4f-8594-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784700646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700646, "uuid": "28bebf2e-a7e8-47e8-86fd-14f237ebe2c6", "comment": "Malware payload (Mirai)", "value": "639f69f33252b5ef9d76dacbadcf2f7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700646, "uuid": "61ced491-cb11-4ed5-a428-c176f3e9f700", "comment": "Malware payload (Mirai)", "value": "e73f6c754fba84f30d5e15b5c6b1386f794ff8368591c12c50c31fd9706ea62a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700646, "uuid": "26e0c1ee-7c86-4223-a216-6a73d2a94f26", "comment": "Malware payload (Mirai)", "value": "cc3efaec1ea805629f483ff2a11abb08ab567748", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700646, "uuid": "b65244d6-ae60-4e58-95f7-55772bbfd986", "comment": "Malware payload (Mirai)", "value": "c3cf57795c2730d0c3ed7e86f4f2a2dc8ebb4ddc20db4e46a29fc7a676720a25e5001582695c5304aad70ab6d1c43d40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700646, "uuid": "a37c0408-fa16-4402-b677-cbec87f10285", "value": "T11614A61E6A228F7DF768873047B74A20AB6D33D627E0D645E1ACC1105F2439E546FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700646, "uuid": "755ac757-95ef-46e9-8648-e5d28e5ccc90", "value": "3072:QEC/Ie6KFDs8ZOztwK+6PElS3k7X6wwLu+WuHSyvPTA:QEC/Ie6YQ8ZOzltP8SU7XzWuGHSibA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700646, "uuid": "0c00a6ac-1c4a-497d-bef0-0d1effffb493", "value": 203928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700646, "uuid": "93d03522-dc4a-47f9-9adc-7bff8a803d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700646, "uuid": "0764c19a-6ea8-42f9-8515-f7541e3230fb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e671f5f7-8560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784678665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678665, "uuid": "ad4556eb-fe4f-4471-90f6-eba3b8bbe1d1", "comment": "Malware payload", "value": "e50e48152dc0ebb9a3b469b92db24480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678665, "uuid": "fe1beb45-d0c1-4c6a-9bad-7fe6bfac1aad", "comment": "Malware payload", "value": "e747deb0d49a53cda8ebc02a97c5eeb875d6b5b07e1be8dfac5545adb78760f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678665, "uuid": "4b86889d-acfb-4e04-aece-a8db5276100a", "comment": "Malware payload", "value": "b83bc08928caa895748990ac65c1756d742c9519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784678665, "uuid": "bee7fe68-9792-483a-b19a-10b57520c7c0", "comment": "Malware payload", "value": "072dedada4a118a4b009eb067de4d3f0695f4ccebe7bcceb0036e2d8a2c5a60c0ab31575ae2827a68e080cf0d93b31e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678665, "uuid": "9c60401a-b713-491f-90f0-223b152f9026", "value": "T13D655A55A6A441B8E0A29578CB5EC933E7727CC60F70968F02D47DA73F33250BA297D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678665, "uuid": "5919bfe1-25cb-42fe-8cc1-ee2a4b58270c", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678665, "uuid": "b7bff575-8be5-4c02-b87c-825235f94e7a", "value": "24576:JRSfrAEH9XIYpj0BEHBwSQJWAXPGfjuIb1iN1Eob4d:JgTbH94YxV9QI521o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784678665, "uuid": "30b2ce0c-1fb7-4983-9b5c-c16baf69bc94", "value": 1548291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784678665, "uuid": "d0db7beb-c062-48fd-a2cf-87c084e64c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784678665, "uuid": "cb1748fd-2848-45da-93a6-119ea91ce11e", "value": "SecuriteInfo.com.Trojan.Siggen33.1331.16114.201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa5a22f-85d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784728520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728520, "uuid": "50771303-7d37-4ce3-9a2a-daa304a7b355", "comment": "Malware payload", "value": "484d5c55d4f18f855e05576f030fecea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728520, "uuid": "200c9b33-6f43-44b8-b713-131730f1ed24", "comment": "Malware payload", "value": "e793b9b2780fb9777975b3af3a4a41f1baa954cf35f3f5c22a9823498cb11ccb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728520, "uuid": "6e7117e3-fba7-43d7-9e49-84b79ad952e6", "comment": "Malware payload", "value": "a95451be2bb1a543d0b50d62325a6df781149a13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728520, "uuid": "d86a9862-542f-43d9-80f5-7bc88fdbb2ad", "comment": "Malware payload", "value": "6a78c47562e062f9b8538f8fc21e4c81576f2a23345f08c0c80416874bd5ab5ba1924df334690c46df2f432a8b6c20ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728520, "uuid": "b3ba92e7-8ebd-4fb2-84d1-27578e28e73c", "value": "T1F6137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728520, "uuid": "9c273ddf-b468-4db3-897d-13ec8fa10391", "value": "768:H+RU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:H+7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728520, "uuid": "44dc8187-71f9-4b74-a052-f8ecbb412fe0", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728520, "uuid": "1dd36539-2891-4316-a1f1-c16e0d4d6ebf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728520, "uuid": "fbe6e7d8-1943-4ddf-9a6a-46e2d545014c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39525062-85ac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784711016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711016, "uuid": "e8ac878a-17d5-412b-b3f0-e696b3ec6a80", "comment": "Malware payload", "value": "05e346cc83a9d898981fb4484c2689c3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711016, "uuid": "ef6c3d5f-46d0-4f8c-9ae1-8457773a3c98", "comment": "Malware payload", "value": "e7adbfb52e089d4cd095375a7bb841359376735d94bd31638dcd7b09324d409c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711016, "uuid": "affe22c4-0e04-46e7-a04a-572070ef3bd8", "comment": "Malware payload", "value": "6719340cfcddba05ef5f8eb64922e9604f4ef362", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711016, "uuid": "88641327-d7b7-4701-808a-1f711a4e6301", "comment": "Malware payload", "value": "1fe151ea40f5268c2bbfd4617fd738ba29714136cc20fcd2885d597f93276f50168460cb3c92ae0f00ac42ea3745c486", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711016, "uuid": "ed73712f-c777-44e2-9a44-f50d65fb47ce", "value": "T1394733E0385C9B618C9D8597F7CC2CF35B22AF5937972CF026DE16950ABC80294B572E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711016, "uuid": "b5a9d988-5d09-40ba-a9dc-e168158b721d", "value": "786432:kJ8yo7m+eYa1vREVIPj2tOPR/hh3XGirm/2vJX:kK/uvR6AEOPR/2iMAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711016, "uuid": "dc1a2a63-43d1-426e-8d1f-ed928e51a6d9", "value": 26214427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711016, "uuid": "fd658738-2fa9-4256-b289-9d51c525b5ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711016, "uuid": "4538b4c9-06b6-41ee-8386-687ad7df5950", "value": "Arhiv_elektronnoho_dokumenta_22.07.2026.113674.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96c2b4d-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784753295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753295, "uuid": "3b97e51a-a6f0-4514-89eb-c972c34dc3f8", "comment": "Malware payload", "value": "5dd50153c2a1134b3f6c4a19517cce3f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753295, "uuid": "a2b98fd6-0d35-497b-ba3b-dc6a6965a62f", "comment": "Malware payload", "value": "e8b878380479b10fcf7e524edf018bc92ead303e7b9a6d117aa48dedc8e20daf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753295, "uuid": "74bf60f8-0b49-48e5-b973-caa930a3cdd3", "comment": "Malware payload", "value": "6fa12492aaa813bb2539f401b537c3a619e1d3d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753295, "uuid": "5a56bbaf-8a2e-450a-b36a-644fe2550092", "comment": "Malware payload", "value": "1655d3bbb14157db9d18511c9ae9699418edde56682bfedce32eb94223b32a481dab9ec1969b238785061689b90a56df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753295, "uuid": "6b4deec5-4f8d-4968-bc50-e12edf252c7a", "value": "T19DF082DF20502AF80D44944DB6B3BC8DB42082E6992F8F5CB91DA27CF585C6D7229F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753295, "uuid": "d5780936-df12-4310-bd6d-6f382c507293", "value": "12:nGogrcYGk3VW4oZgrYlGk3VW4oZgr/YGk3VW4oZgrTsGk3VW4oZgrTblGk3VW4/:G+k3M4Ick3M4vrk3M4jnk3M4jIk3M4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753295, "uuid": "dc89d442-3d27-4afe-a8ba-bf11be39bb7a", "value": 500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753295, "uuid": "16a954e4-fec7-4451-a343-0c26ba06474c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753295, "uuid": "08ebbc41-a207-4edb-8d43-ad0ba3be37a3", "value": "goahead.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b9f5ea-85a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784708113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708113, "uuid": "c7122b27-e273-4688-b0eb-fd70bbeb8314", "comment": "Malware payload (VIPKeylogger)", "value": "4ad659f7bd42b022f1ebfb0521a37f66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708113, "uuid": "2bcbf300-e2a7-4eca-8a35-d3e976dcbd54", "comment": "Malware payload (VIPKeylogger)", "value": "e8bee7f7db0dee3dbad580fbc12db2eafc7fcfa6d0634fb811b8593ba0d8b39c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708113, "uuid": "71d1aa06-0158-4118-9273-8fd561c28a36", "comment": "Malware payload (VIPKeylogger)", "value": "036a6d93b8445696cc8264cd37bb1fbf70a0cc27", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784708113, "uuid": "d18fa1d9-49ef-4784-a4b0-355884aa853f", "comment": "Malware payload (VIPKeylogger)", "value": "ddbe58bf652fe65d22fd27b85a64bb1354438ac9845f6583fdf1862297574ca3ace353210474a748454a413f75d0f8a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708113, "uuid": "83f8b159-1d15-4334-acbe-6c4dad333d5c", "value": "T119B57BF7F68BC12D60F08741C8AABD94DFAD65FE59A20EB33C4805AC197291AC546F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708113, "uuid": "4ad6005d-343d-4113-a1f1-df912c191d8a", "value": "192:5hQaxcVTNj+wVBzBVgF1Rd5VIJf985W/OuUcCuClWJQYs:5hQa+xB++BdVgvRd5VIJf985RcCRlWJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784708113, "uuid": "84c59545-1a20-4aea-abbf-dc229e271711", "value": 2404692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784708113, "uuid": "3d48604e-dc85-4a68-8a0e-5b82423d5c5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784708113, "uuid": "38fea0b2-00a9-4555-ae7c-cf414986b0c2", "value": "S\u0130PAR\u0130\u015e ONAYI-AMF2026125_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404b8207-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757843, "uuid": "18751db8-035b-425c-9d61-0c8a3720cbb4", "comment": "Malware payload (Mirai)", "value": "5092bbec79a17df249d88909a14c06b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757843, "uuid": "ed9b8fc7-3dd5-4137-9b69-da173694bc32", "comment": "Malware payload (Mirai)", "value": "ea96505d42088957397f4358b6413bae386eae80194ee7252adb0e3ddbcdf096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757843, "uuid": "7e0b124d-6cd3-492e-85aa-03a5008306d4", "comment": "Malware payload (Mirai)", "value": "94f175765877a0f567c34522ed1bad68a31afe27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757843, "uuid": "202cff62-7169-4ee0-b9d0-d42ad80e9845", "comment": "Malware payload (Mirai)", "value": "b57feaa3d194572c426a665693f0f1ed559247824f7c931f19c26adbdbaf996290833644515b0ec1430ac1abb68cb14f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757843, "uuid": "690b1cb5-c54d-4f64-be21-937b26ab88ce", "value": "T18BD2D1BC6B0145D7CEAAA1788DE50B262D60CFA2E0426C076558D9D7BB0986D3CBADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757843, "uuid": "dd3e29b2-18f5-469f-a18c-0f1c4d124f60", "value": "768:E4ylAtv6pqLJM0RXaxGyUbXtheU/S49IJgGlzDpbuR1JT:XMBqTRXa+Zhr/QVJuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757843, "uuid": "2d6e55cc-4b99-4edd-bcfa-ab3cb9eb9700", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757843, "uuid": "8c59ff8f-8663-444b-a720-022b98c3a218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757843, "uuid": "a7d58259-1702-428d-a507-20acede5ee3c", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ca5f1c-85ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784711629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711629, "uuid": "aba1354f-9e23-4de1-b63e-e83ba8001a48", "comment": "Malware payload (Mirai)", "value": "829142025ac9ba669f466c36fe863805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711629, "uuid": "f5ff1d73-735f-4286-88fc-6e659bfca093", "comment": "Malware payload (Mirai)", "value": "eac2ed5c5df936f635e38e8211d664036d91fe94cb7b2b2da4243959dd92638f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711629, "uuid": "43f60cf0-de40-4b2d-a390-3c927d3afce6", "comment": "Malware payload (Mirai)", "value": "4b885f95b5c770ab7b71caeaea0cedee2b1dbf62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784711629, "uuid": "ea7985a8-de68-4344-8370-188711b2e88c", "comment": "Malware payload (Mirai)", "value": "7c8f4e9ea8567b00bd8dcc055af941df78f8596c3f34d4d8e1b036c10e1faae784313488ca54ade211e9f54f5f04f9c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711629, "uuid": "0bf8b6fc-0785-4248-8621-e12e24cd2488", "value": "T17E63A7193E218FBEF79C82384BB78A215648339637F1D584D19CEE011E7078E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711629, "uuid": "09e9e30f-37c9-477f-8301-76e1c50f4788", "value": "1536:MWQXy8iy8JJSn3kwykg1w0vELws5irPEnnu7x0mIub:MW4yBy2qUwq1w0cEsSEnnu7x0Fub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784711629, "uuid": "e7df1979-4deb-448e-b923-90537bcccbb5", "value": 71672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784711629, "uuid": "6cec3ec9-d81d-4ceb-ac16-82e0c079956f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784711629, "uuid": "91b0a71f-a3e0-49bb-9104-8201f0aa0073", "value": "6d2b2f72bc45c6276818298de8b5f24140947c808a89c72fcf63d5e48281ada9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090b0391-860f-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784753455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753455, "uuid": "f757ac9f-d548-4200-8ec9-f361b445e713", "comment": "Malware payload (CoinMiner)", "value": "3707767f5b9befd038bed9cf5294e370", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753455, "uuid": "fb39a717-bc5f-45d7-b1d6-d40253a0a2e9", "comment": "Malware payload (CoinMiner)", "value": "ebb62d8bb972d004cbe583b15bed4fccd7d003af90eb0530c5120c36cd7251a4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753455, "uuid": "18663bbb-14d6-4143-acca-343a152db8ca", "comment": "Malware payload (CoinMiner)", "value": "a4c964c694e69e3048690d57daff2ae3dee8a4e1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753455, "uuid": "d08b5a0c-da38-40d8-b0cd-1e806f3af0f6", "comment": "Malware payload (CoinMiner)", "value": "010df5ee72b4d2a2fba3c306a45552cd6ade9af406f5fe51554bc698ee304f966597f8f53b0daec06cab561c5b036eb9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753455, "uuid": "027b236d-c32e-4580-88b8-2f3c1f7bd82c", "value": "T17722391A6E894231E39449F016F64B4E563D45737783B3EFF333D2880B996498411AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753455, "uuid": "93994ba7-6da4-4297-9774-79221a1e96f9", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753455, "uuid": "ab31e6ba-07df-4575-bb8d-a79b81a7345f", "value": "96:NXlYd2osmYz/J4h2gNaBWdiJAD7lx+ZQRkThM6JPFJxGE9mZ2FFhxC7tCEiUun:LVosVWaBUx+eRQPFJxTEZmFhSiUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753455, "uuid": "3ebaf84c-7b15-44de-8eb0-a1130a06c4ca", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753455, "uuid": "20db2d9c-f563-4503-b7c5-36c3011dfda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753455, "uuid": "7aa4a0ab-214b-4214-a00b-f13ca38bd9de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a4d664-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757897, "uuid": "6e260faa-122f-422b-b130-1098dbc8de07", "comment": "Malware payload (Mirai)", "value": "65f3b1e29756c0bbf9ff50a7f32da34f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757897, "uuid": "f16e04b2-39aa-46a1-b60d-177d8df85617", "comment": "Malware payload (Mirai)", "value": "ebcdaa839b26cc9a2777e6b481e977a77ef77117288fa74b5777a5e9b7f1354a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757897, "uuid": "f5891fb3-6618-4639-b21c-33855b6386d9", "comment": "Malware payload (Mirai)", "value": "100af46d32a5efc763c6de92b648c63fb75befd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757897, "uuid": "602ac494-1fc7-45c7-8f09-223ea8e77f39", "comment": "Malware payload (Mirai)", "value": "eab5383e264b32d5c31d56c0ef7b0daba6fd5e4532badccdde312775d1fb967565e5b7dabb969c21fb257473170284b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757897, "uuid": "f9f0e108-21f1-4918-90b0-3342181ffb3f", "value": "T16C83C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757897, "uuid": "cc3d778c-2b88-4caa-93a7-0045a9b63f69", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoArgR:x/8RHTgMcJ0fmqJZOpkM/sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757897, "uuid": "30326fe6-6adf-4624-b611-f37196644523", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757897, "uuid": "9207892d-b7d8-48fc-9323-1ec76884aa78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757897, "uuid": "8fd70b29-44e9-4180-9885-3939f7bbe5a9", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f31496-85d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784729420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729420, "uuid": "cf69591f-5bae-438c-8d3f-f3b672c6aa4e", "comment": "Malware payload (Mirai)", "value": "121cc75a431924a7e90008315240f1b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729420, "uuid": "b8815a9f-c351-4179-8b22-f0617a83e31c", "comment": "Malware payload (Mirai)", "value": "ebdc4f10d937bec20ad9234057e4b508a1d5f0a05321e087b48cb582f9a1c016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729420, "uuid": "7a131095-c9b2-4ed9-8431-66c213331277", "comment": "Malware payload (Mirai)", "value": "5ebfbcb6c9b8cd18e9882548518ba5dc1bb64dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784729420, "uuid": "e41492ed-708f-423e-ade3-0ad56de05dd9", "comment": "Malware payload (Mirai)", "value": "d7122a26d61bf27591cd4aeb9254d5589f750da4c03f8f91f5de06e5190845268a6d52cee55b19dbc9ae513c29ec93ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729420, "uuid": "3830713b-d9f8-48df-834b-b30cbe3016dd", "value": "T186B3AE36E81968F4C07E8574E5A4BE790BA3F48052531EF716E6C6B65087EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729420, "uuid": "0fe4672d-266b-4e2f-a2b0-366b44d1b89e", "value": "1536:t/Luy48grD/jwreR52YZSyftYKCCz574iundC/6sVV9xHlR8:tzuy7u/8w5HtftfCovund3q/xHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784729420, "uuid": "7e417aba-1a3f-40b8-91be-88d50c98d61d", "value": 109768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784729420, "uuid": "0f380d47-83bc-413e-94cf-52b9e9784517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784729420, "uuid": "299f3902-dc04-42a1-bf6f-f3d95c4617b1", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69291b6-8594-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784700892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700892, "uuid": "247d853b-7b7d-429c-8de6-8fa776503c57", "comment": "Malware payload", "value": "fb29954629138387dfe8ed2b3ee1f3ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700892, "uuid": "8411bfb1-b7f4-4bb1-9a8a-6099ffebfbbc", "comment": "Malware payload", "value": "ed56a65600f82b642b4d1a3facd06a740ec29ebddb57a02b2285d963fe94ec13", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700892, "uuid": "3caaeb10-aac0-4a2a-964e-497044871163", "comment": "Malware payload", "value": "2c659639693b50a20bba33ddea473c3863e31fa0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784700892, "uuid": "e16c5f46-9359-44b2-911c-c87737f751ae", "comment": "Malware payload", "value": "9d2ec5963a96ec8c4057c67aabb02784b4114735190795f403fb3974bed01362ae6b4317ffbba86ce671fc908a644e25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700892, "uuid": "8cbb1a20-b331-4213-bb24-3a3389861750", "value": "T173C28D956A867C44BEC98A3E4CBD2B1D6DF4C3D1324942AC3D8A3C71DC15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700892, "uuid": "194487c1-76c2-4dd2-8277-df3d60503e92", "value": "768:d8vCB+25j6es8RSq9FYpMSUpi+20qUpi+20YQX:d8l25Jpd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784700892, "uuid": "988a2ac0-bcde-4302-bf14-44791523f566", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784700892, "uuid": "e60ffc86-98b2-4387-96f3-187c0c004e3e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784700892, "uuid": "be756533-a5b6-4621-9be6-d05c691f8fce", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7825267-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784753292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753292, "uuid": "13c52c1c-936e-436a-a9b4-699c8b76aaaf", "comment": "Malware payload", "value": "08e6c029077ce785d1ad6c7a679a2ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753292, "uuid": "1f4d6e2c-f932-4db3-b5bc-afb13894e299", "comment": "Malware payload", "value": "ee56b8f51fd5722918ff2082c0027cc6183429554bcf177ea20b17af7d46a2a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753292, "uuid": "edf253e6-6892-4eae-96be-461695a71d5a", "comment": "Malware payload", "value": "fd337996a583d80c0f7b12719d1e26a8ddbd8529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753292, "uuid": "b5f461e6-3e9b-4e2f-8b74-3300987f1292", "comment": "Malware payload", "value": "727d8258e61489c74237926d4b9faf3029f629b20727ffea84f32dab03ab133fa9a3972ed29dc1c11f07fcdca46bbc08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753292, "uuid": "fd0b3eeb-9238-4a6a-8ee1-876b802287fb", "value": "T1E3E3F849F8519F22C6C615BBFF4E828C772617A8D3EE72039D156F25368B85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753292, "uuid": "9741a4d4-2bc9-4162-bd3a-e6814256c72f", "value": "3072:JvuexuKWNe/BQn04BCfPYatEARCnuXZA:Jvu6oCw04BsPYaXRTXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753292, "uuid": "08e59674-0a1c-4d3b-a057-41f551e7ccc7", "value": 147436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753292, "uuid": "59bcbef7-b945-4260-9dcb-bcef02aa6b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753292, "uuid": "5186f885-f783-49d6-aed9-b675c7e4c6cb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a627bc-85ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784724075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724075, "uuid": "10acb451-4682-4d9c-9d61-bcea8a978978", "comment": "Malware payload (Mirai)", "value": "9a1fbd754f3791bef362564fda5521cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724075, "uuid": "a80ac96b-914d-461b-81d0-f244afc53007", "comment": "Malware payload (Mirai)", "value": "ee8c1ecd3d04c08d6610459f4529cab04f23d9c344a0c97157dcd7bb9dcbca06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724075, "uuid": "31d6f3cd-3485-4048-8215-cc6016814a78", "comment": "Malware payload (Mirai)", "value": "0f47856ac0356b29f7c2388ec5fbe35a5b9aeee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784724075, "uuid": "3b68f556-b7c5-47de-8630-0f2981693a1f", "comment": "Malware payload (Mirai)", "value": "52859505a7cc35c3e11bed3a5aec1ead7fe7ef4824a9581eebd4191c0e3b06a7c8cd761a5b24132f953f2e2b5e153af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724075, "uuid": "70d1944d-8009-49fc-930b-b5dc9fd1b8cb", "value": "T16C23F112619E79B0D9FC03387AADA98F72060EE4D6C5730F272967A873CC71916A7605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724075, "uuid": "9d2f6b79-82b8-48b9-8c27-1d13d58df813", "value": "768:Ba4qwsMicR0iSKWLgPZEmWI/rMSUqJQb6PldfHny0HKAUGqX89iJzps3UozC:BqGR0/ELJUG0KXX5M8oz0zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784724075, "uuid": "1658ba0b-25c8-47fc-bc91-9f80e926fa90", "value": 49272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784724075, "uuid": "3b198449-5df8-439e-9e3d-634bce467293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784724075, "uuid": "2f1e5ccb-2d84-4e73-a9a5-1607a88a030c", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d94ae2c-8625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784763073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763073, "uuid": "4e1774a0-2020-4997-8b75-bb2dc0b9e692", "comment": "Malware payload", "value": "f65de2728c489ebec26fe37afbcb9b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763073, "uuid": "c23e5758-18ab-496c-8923-83223f0e8217", "comment": "Malware payload", "value": "efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763073, "uuid": "bd958da9-8ed6-4168-b5dd-fbe135fd8f11", "comment": "Malware payload", "value": "2c1775ee86fa501ef87c7bc14aa849b1716f61ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784763073, "uuid": "ca694851-da7b-433e-939a-b0735c555138", "comment": "Malware payload", "value": "eafa0bb8dfd574c2340ea7314a4172a8611e400901a81f256be683ff313728ec9697370d6c2fd35ef914b2982e94e693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763073, "uuid": "0a420e9c-b4d7-4cd9-bce6-11925ed46da9", "value": "T1A165338C02969A7AC27B43F3FD6F4096A5997709FF41F7C3CA2684584DC7E62D881AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763073, "uuid": "4181535b-0581-4668-8bb7-be87709af224", "value": "24576:xSAQa9HmfTcRtRRWI+ZDTL9BYBGwevXs/9VYk3covvUq1kPbJY9yjFLqtVKVYeYn:3Qa9H8cXoDvrYBGwxVAobmbJY9WW/K6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784763073, "uuid": "79087aee-840b-4c2b-8b71-25daec3bd164", "value": 1446604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784763073, "uuid": "fe2a9502-74ba-41b9-badf-5e73c2b1e1d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784763073, "uuid": "49f8c417-90fc-402e-85d6-dc7b295e2efb", "value": "efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54abc528-8578-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784688728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688728, "uuid": "6fb31ce2-6a6d-42d7-a504-8093340ad825", "comment": "Malware payload (Efimer)", "value": "cb223174213a026c0dea090fc60de840", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688728, "uuid": "e921afc8-a058-4228-be5d-deb3968fbfca", "comment": "Malware payload (Efimer)", "value": "efadd757ffcdc156c9dbcac6745e70be5ca5174636d8853518839da82cf7e7b6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688728, "uuid": "5baac634-83c2-491b-8984-2186dac653c3", "comment": "Malware payload (Efimer)", "value": "f464e40ef739466b9a836b725575c4c396a6cb9f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688728, "uuid": "b2e7bc52-c119-4923-bc34-f65e582da92e", "comment": "Malware payload (Efimer)", "value": "78c9201c5052fc2d1c0482b7dca90f25700b13d06ff371031699868b5f63748ed4fc760226b9373d6132f429c4ff9d72", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688728, "uuid": "3f74e2f6-03c8-4b7c-95f7-008b21ed0071", "value": "T14DE6330CAAD041FDEA624039EEE14696DAA474B54B72CE9B27789328FF475E40D3C743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688728, "uuid": "e0d00ed5-6921-4bbd-88bc-e253aeac04c3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688728, "uuid": "5b07aa16-5380-4319-8a2e-faeed92d1a32", "value": "393216:oCejAgyimIDE4eR95QXMCHWUjXwcuI3/PGTAI:okglbSrQXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784688728, "uuid": "540432b8-9899-42c5-b6ec-93905d09f011", "value": 14262369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784688728, "uuid": "f66eb63c-9b44-48f5-8219-7a69aeb0fc18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688728, "uuid": "d6478c94-4d88-4d0a-a53a-075b5e8f6596", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9da2d8-8565-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784680712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784680712, "uuid": "d41d1f4a-44e7-495b-b62a-c582c1ffe30a", "comment": "Malware payload", "value": "f2d569d4cbc57ec985af41968bec6d50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784680712, "uuid": "8482c049-8a9b-4ad5-a18f-67b5ef265a35", "comment": "Malware payload", "value": "f08dd221aabdc54de26f51b466ae2cdf5b242b918d27bc02eaa1a18fc6a4113d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784680712, "uuid": "91e466c2-3854-4ea1-b163-81742a73f053", "comment": "Malware payload", "value": "620d723d4bc37375275fdc7dec59777eee2526ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784680712, "uuid": "575ffed4-1023-41f3-b8d6-fd3b3b998f11", "comment": "Malware payload", "value": "f718b2be8575ba9d52003006d79c1e640adab729bf3f78428139d23c28ebc7c80355e82aef1304f50fc738ab41a5afe0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784680712, "uuid": "99985ca5-4d2e-4469-b23c-ba4899a3a02e", "value": "T15CD097AB0A3300301432AC54F1CBF41074084F3F6C1D872DB4A718302F42308F5E1396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784680712, "uuid": "0fc4073b-26e9-49a0-bcdb-24c184a0079a", "value": "6:hTDpcF7bFfxGtOpAulNXYq4HvXDG+NjVsNXYrkJ:VDyF7bF5G2Piq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784680712, "uuid": "402c9542-86ca-4339-8d68-45f543740a0d", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784680712, "uuid": "c7303f7d-a27e-41c4-87a2-a6b45a02cb7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784680712, "uuid": "6f4c0147-6186-4da5-8ed3-923895413ab7", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fead222e-8595-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784701469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701469, "uuid": "2c076781-5dff-440d-a9cb-4a7862ea06a6", "comment": "Malware payload (Formbook)", "value": "411ba5fe7a02e876911a832fe105657d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701469, "uuid": "b433050d-8fef-49b5-855b-67583175e108", "comment": "Malware payload (Formbook)", "value": "f0f8c5389c9639798e99825b0ef038868c6170d7225d7fd7509cb8a246fb411b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701469, "uuid": "b79d4707-f3c5-453b-89fd-4208fc124184", "comment": "Malware payload (Formbook)", "value": "bf3b34479b707b5653f521e4ad68cde6eee4723d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784701469, "uuid": "1871ae95-a879-4ed7-b50f-d1a90dd70f41", "comment": "Malware payload (Formbook)", "value": "bdaf1395dd666e663e68641d09daf08c63ca8d809e8529a7206a3ea8f55417658e74817d9ad13d4a3863ca7329fa41f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701469, "uuid": "b418be40-d41b-4bc8-ad01-9febebfdb964", "value": "T173547C1B3A899E35C8E0A97E38D77EB4B7D3EBFC254446C2210A67063831B5116DE739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701469, "uuid": "2f12c12e-2d3f-4237-8ecb-7de4f8ce6df0", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701469, "uuid": "61635e91-8d1b-4495-91b9-53668a9ecc9f", "value": "6144:Uh0sesiM+Hz5+LykB61h1sME7Sec9S1pLNCQwsFieYznM:lsiM+Hz5+LyhsuS1OQwGief", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784701469, "uuid": "31e90a31-068a-4060-913a-bbcca9e06dbc", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784701469, "uuid": "75b8c3b1-b827-48d9-88ad-729abfd1ec7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784701469, "uuid": "3e58495e-f9a7-4a89-a4e1-de226672cfa0", "value": "Orden de compra 67321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87c21be-860e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784753293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753293, "uuid": "3ffadf36-4da3-44ed-95fa-dc03b0e44e47", "comment": "Malware payload (Mirai)", "value": "ca56000d4bc54e6fe9014c7f0cede475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753293, "uuid": "d1983b01-a1d5-4906-9b30-8ddea4439147", "comment": "Malware payload (Mirai)", "value": "f105326c65e40d64430bc80c367485295b73d5255164f4b022868dc97b71955a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753293, "uuid": "000f11ac-07d2-4215-8da8-56386b0ded8d", "comment": "Malware payload (Mirai)", "value": "60ff980bdbbeb1a5b56a7c7724e4f330a2dced7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784753293, "uuid": "71579d23-7466-4fdc-a590-07c72239dd4a", "comment": "Malware payload (Mirai)", "value": "da0eb0e975ae2c655b2193c441ffa164f6b9e807a6cc4abf4275cfafa86a0a3b0e701033fa6297fe8625486bad744f68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753293, "uuid": "ae0859eb-6529-4063-be8a-ad65246ae1fc", "value": "T1C714B71AAF510EFBDCABCD3701E90B0629CC654722A43B753574D528F64A94F4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753293, "uuid": "62f91385-1eeb-4b04-8523-0670c294c15b", "value": "3072:Y/qAencQWNijdHnBBtlUAZ5Vyt8vnuWMeI:YEbWNiNnXzjkJWMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784753293, "uuid": "64f606c5-1637-41bf-ac05-57a9e089e13d", "value": 202068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784753293, "uuid": "4f156e7f-9a31-4fec-b669-80c2eaf90dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784753293, "uuid": "d89a79e8-903b-4e3d-8454-464dffb7a769", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969fc41d-85bd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784718474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718474, "uuid": "e978e2b6-b6c5-49bc-a4bc-fcd1d7710c14", "comment": "Malware payload (AgentTesla)", "value": "a6482ea44033007a9da963cd3ff5ce49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718474, "uuid": "072c6e41-4c4f-42a3-b84f-d5602943ef22", "comment": "Malware payload (AgentTesla)", "value": "f12c120af203e20c35f019ff8eefc52a3cc5fae18b4a55e9a8c835d6ee88f098", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718474, "uuid": "c3501893-5ddd-42cb-99d6-6da13f616060", "comment": "Malware payload (AgentTesla)", "value": "2430d4d428b8f4a4f63b3f62d917ae49afeed37a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784718474, "uuid": "09eb7919-c314-4e90-a854-a2925b073899", "comment": "Malware payload (AgentTesla)", "value": "144e525d9700a945dd605293ac4cbb0df53c48f489248c6f0eae36e3d3591b3d075a25f98bb111a64fc300088edc704e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718474, "uuid": "c583fbd6-1c1e-4345-ad47-98f531693aa8", "value": "T12994BF13F654C986D81022F04C7FD8292263AD7899A3560F3DADF73D9EB3292F11764A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718474, "uuid": "06d95f90-4d73-4bb2-ab9d-496c089907ec", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718474, "uuid": "145c27ea-130c-444b-85bb-a8996fd793fc", "value": "6144:mTA8oPSCIjqP6r93+tF5yglzXLvX1YO6hsKYnu+jVig:mTA6eowv1lzXLvX1f6iKAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784718474, "uuid": "a4225866-05a0-4af3-be66-111691d5ba23", "value": 440216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784718474, "uuid": "a0c5933c-8fc8-45e1-ae67-7930dda13114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784718474, "uuid": "87791975-6877-4ded-b201-d09d623269e4", "value": "Nomina 07.07.2026-97685878464674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016a7aab-85a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784707916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707916, "uuid": "3b47f7bf-26cc-44bd-b9f9-905ba7e412c7", "comment": "Malware payload", "value": "724ca906659e3e1e5af6eeca909fd2b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707916, "uuid": "20b46c30-6af7-43c1-9023-e137b488e7fb", "comment": "Malware payload", "value": "f2bc804a84dfb3717534856402c6d6959d33d62dfdf7ca990e210f093da1318f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707916, "uuid": "f9195cd6-481d-495f-9655-1de83361685e", "comment": "Malware payload", "value": "02e76094f57b136cca3d1fe24c27cc65e17b4039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784707916, "uuid": "3f316517-3464-4165-a7bc-2a030d613381", "comment": "Malware payload", "value": "91d37a866dcdea8f602e14e5134b51db0e20ba6f56edeed243ee95e6b2e8f15d9982c495c43ab7c2f4daa483b6bc271c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707916, "uuid": "0202b03e-cd45-440d-b43f-e369b110b0b5", "value": "T16936123FB28B753EE06E1A397A76E210583BB66165574C1696F4C88CCF250B01E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707916, "uuid": "3e2f8d21-db92-4240-86b7-7393d117b100", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707916, "uuid": "d72c9c95-c2c8-4a0a-a6c9-f11e7c382e90", "value": "98304:G5OCIXKQsDDfiXfedkmJZDXOPJWlRKLJykh/BVb7TgekQs:KRYyDpuxWlR8tnUek7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784707916, "uuid": "d05f3d3e-385e-4e79-aaec-643f3ee01105", "value": 5111120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784707916, "uuid": "74497829-4263-48dd-b545-bcc5ade17637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784707916, "uuid": "424a870f-6646-4ed3-9132-862c48170ef8", "value": "SecuriteInfo.com.FileRepMalware.75298531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0388ac0f-85c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784722952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722952, "uuid": "39a9941d-a661-4942-8a98-5623cbeadffb", "comment": "Malware payload", "value": "f45dd38810c460ac20850571e7a608b6", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722952, "uuid": "6e8a8118-0025-427b-9fa6-e20bfdd01162", "comment": "Malware payload", "value": "f2ed264a15b32c47d14b21ce2176a8412856ffcb3990f1904af283ac21850a99", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722952, "uuid": "9be2aac3-593b-4c62-b2a7-3686e5c5071c", "comment": "Malware payload", "value": "e28aff26ada916b9dea2c06d3c6c3a0a35da35a1", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784722952, "uuid": "ab186dce-444f-4f44-aceb-0a935b7d4c3b", "comment": "Malware payload", "value": "79038f2c0cb5d421d6d3bd21ae5a14a6b3a23c68644bc0b186449448f0bb6a99eaba1f234f2db6cfdfbd46be5bd06f90", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722952, "uuid": "4d611460-760b-4267-a3d5-81b78a3c1a1f", "value": "T15D75239387F841B6F7B777B9A9F21267627638545BB767DF0200469C09237C29231B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722952, "uuid": "1e365b01-fe7a-4c27-9187-581236be1d83", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722952, "uuid": "0513becc-a838-4e22-b1fa-bf90ea663b80", "value": "24576:q7tlODrEVSRTxQ3H+IQmNAqRLWFeM9Drx8CK0X+QA+Jv9hGVFpv6cuor:q7GDwaxCH/WmLWoi3xS0TASv9hiXScH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784722952, "uuid": "5e1a89ed-5b05-45bc-b120-7ac818d7bef3", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784722952, "uuid": "c2b32a5f-5cb3-432c-9efa-e82c02d53b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784722952, "uuid": "8d98bdc9-4cba-4923-a52c-5106c90d09bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5235a51-8580-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784692326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692326, "uuid": "65509160-3de9-484f-a049-8666fa907a98", "comment": "Malware payload (RemusStealer)", "value": "79fe4da41e8136ba9fde4b269b497681", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692326, "uuid": "b321d496-4d2d-4ade-802f-bb9d54aae261", "comment": "Malware payload (RemusStealer)", "value": "f407599100049194ce1289c24ab29a1aae7b9315369a08c012bbce2a72836297", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692326, "uuid": "d3aae8cc-2d46-4b22-bd95-d5e65d659d54", "comment": "Malware payload (RemusStealer)", "value": "33ace9fc8f80a4dbc35c9ffcacbf48ed10e372f4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784692326, "uuid": "65cf5368-ac7d-4c7c-885d-43a01dd1873f", "comment": "Malware payload (RemusStealer)", "value": "e780a321d83f7dcf3a194c488a946d7c0a990f8f0c83b23032412371f1df9b82768bd234e8e355588d620db9aad25b77", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692326, "uuid": "41bd6a7a-2ac8-43e5-9bbf-8ed02d62f9d7", "value": "T10675292C27F969A8F1B77F358AF56145DB3BBB72A93BD64E0600820F1531A018D52F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692326, "uuid": "f17717a1-8661-4728-8935-ff2e3d2b486f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692326, "uuid": "5905e336-2938-4f78-9931-15c90ccecf5e", "value": "24576:fV6Nob6tPwBgWT1Jy+RZfjEERR/4OhUrDNtHeTCWVwcHZK64vmMBj5:9qVWDy+RZfLfhWDNQTCWVw+064uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784692326, "uuid": "a73d7777-3cf2-41d5-88e5-2e72580721d6", "value": 1682432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784692326, "uuid": "f7e8ec81-fda0-4d22-b180-8660759e5e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784692326, "uuid": "220a71db-0ff3-44e2-b977-3470c431e782", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6c6d8d-85f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784743937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743937, "uuid": "f202d976-78d5-4452-b6c5-5b01018fb7e1", "comment": "Malware payload (AgentTesla)", "value": "4745d28389b6646311fc306231d4dc5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743937, "uuid": "131bef30-5829-463b-89e1-30ec4650e98b", "comment": "Malware payload (AgentTesla)", "value": "f5205c1729935d440fb9a9165d51ad78629f60b6d79da9a33ee445ce02e42570", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743937, "uuid": "edaf80a8-739e-4521-9d74-345da96e85e2", "comment": "Malware payload (AgentTesla)", "value": "42ffabd58dbc8893bca4f74ec4eb0680fea09d23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784743937, "uuid": "15e034e9-a2be-4af7-8bf1-0f39bbcd0b70", "comment": "Malware payload (AgentTesla)", "value": "3b86dd803bc8c0b49dd0860989565f1c7aa781c40d863eb242f7eb06ae8743f8fca18ac7fb4a39e040adc03bd3a46746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743937, "uuid": "2542f559-e595-432f-a15a-3a3b21c6ff64", "value": "T14E25F1502222AA41E1D697F6BCA0E33433B50DCF78D2D3D25FE56FF738297811A58292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743937, "uuid": "fda6dc61-6cd6-4c15-9366-0156190552b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743937, "uuid": "0f0405a5-66fd-4cf0-9678-62c98eca22e9", "value": "24576:top50nXaBtAZqRkXcYzzsWFu6rZ+W2zHI88/p51K:Cpmm+qGcYzzxJZx2zHUp5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784743937, "uuid": "57decc0c-a06b-4547-9232-91c829c7e5da", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784743937, "uuid": "e88683c4-b613-4899-a320-d249145487a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784743937, "uuid": "9da9bceb-6b78-414b-bc36-aae08da7fb87", "value": "pedidos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965fd00a-8617-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784757129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757129, "uuid": "30c11eb5-c624-47f6-8008-a58a050f63ab", "comment": "Malware payload", "value": "99eeae80567fd81fb151afe190d03e71", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757129, "uuid": "7512c5e7-4895-4eab-abbb-85a601a9c2de", "comment": "Malware payload", "value": "f5a92dcadc6bed2e1cf5efff18221929b0a3fbb7db1a69f26f53f4c7295fab35", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757129, "uuid": "bf56d84f-70d3-40ab-a0f7-803500fe45bb", "comment": "Malware payload", "value": "4358456c8735248e0286d2b91575947364de42af", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757129, "uuid": "2cf99f29-dbc0-4186-945d-89c805666f52", "comment": "Malware payload", "value": "794c526a50ab7ba3b6ace89d68ec30d154dfb048d215214eb288401971ec80cea3ef898f4718e130a53f34daeefb7379", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757129, "uuid": "e6266809-daee-4180-b57c-18d8b099b8c8", "value": "T1B2E633184BD426FEEAF3C03CEAD196E5B5A8786107B1D99F17A483615F473D08C3EA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757129, "uuid": "4f99849e-d042-42cf-9913-ccd21d117c4d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757129, "uuid": "f967f89c-7a8c-43d9-89fd-cf1c424ad5c5", "value": "393216:3HXeZbuFpIgMk3GobNOC3mQCvXMCHWUjXWcuI3/PGTAI:3HrdMWf8mPCvXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757129, "uuid": "8ff68e82-8b40-40f4-941b-b2454b30f908", "value": 14297216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757129, "uuid": "85b52208-e69f-4975-acaa-b702a42feb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757129, "uuid": "6574cb7f-c79f-422d-9b6d-0db272db8906", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d49634-85d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784728519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728519, "uuid": "fb0453ad-778a-4410-8cfd-e56ba680f3ed", "comment": "Malware payload (Mirai)", "value": "001d22a58d0a2bc61eb272214287bafa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728519, "uuid": "dbf83427-c0f5-4d5a-8fe0-df9aaeb636c7", "comment": "Malware payload (Mirai)", "value": "f75b5c9ee32e093f7a888e47f16799c1b2939b55d40be1012a4311514fda67a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728519, "uuid": "8ac820f1-2ef5-4578-825f-36c255bdad65", "comment": "Malware payload (Mirai)", "value": "02bf850d1973cc31bcb3d05e477c4d9950d089de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784728519, "uuid": "20a7064d-5947-4971-86b0-2a14fe3a3d22", "comment": "Malware payload (Mirai)", "value": "71a9a02c1f03e18cdc5a1b41447012fef8e20c5d3f8926b3c1801d0b2d73a2df7dec3f38dac2711a7ea0600cbdb113a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728519, "uuid": "1465faf8-e1cb-4b85-a3e5-05b16e280e28", "value": "T144730280C2B3727494201C3B346D8E46356EA77B6BFA36261B1F6588BDBD4286F63581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728519, "uuid": "e7caa7f9-8c36-4875-a03f-32e03b9e872f", "value": "1536:f4CBDSNeLdK6lWJATzPW451U1NWFLS8bLBWxewmo/LYrAf4YfS1RWVB+YtT:pDeKRlWJqPB51U1NW88pWxeRo/LY84/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784728519, "uuid": "165cf4d1-1018-4620-8882-81f61d61fb76", "value": 74864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784728519, "uuid": "2e2f10d2-8334-4ce4-8364-d48e177717f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784728519, "uuid": "edd57ee3-8ec9-4e57-8459-7c9d040abaf7", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4522781-85ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784746898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746898, "uuid": "8cccf3e5-d791-4fcb-8ddf-69118d4001d6", "comment": "Malware payload (Mirai)", "value": "e592399328986a555bb507227366d6b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746898, "uuid": "40b28693-d630-4b87-b74c-d5c593b65b4d", "comment": "Malware payload (Mirai)", "value": "f8f253076085d03baf6336eb2de85ec15274d1547f926654928c247bfa972a04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746898, "uuid": "c68be55b-3c15-4a2e-af3b-ada575c0fe43", "comment": "Malware payload (Mirai)", "value": "0b08ceb0a2e434d5d4227e1bc5218d73b10eaf37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784746898, "uuid": "924a0dd6-d756-405a-8fd7-85c564330acf", "comment": "Malware payload (Mirai)", "value": "42e26c9bf8bc81c4536cb7e3a2a880242b04fe95d63507126f3a513f3ad51db4ab6fcbc9e96c509d9608a997bc5fd7ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746898, "uuid": "5790f48c-f0b2-4132-a635-8ac98aab663f", "value": "T107C32945B8829622C6D723BAFA6E21CD336163E9D3DF3113CE219F11378659B0D67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746898, "uuid": "d25e8c7e-4ced-4979-bcbf-0bd4e1e853aa", "value": "1536:FKSuAASQ6ei2cdv/Lpl+9RKp1anmmY4zQyPRjP1bJS46mOlcQBPLv7H7t:c3AA/6eedYZYlGP1bJmxn7H7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784746898, "uuid": "3e3d298f-c61f-475a-8666-6992adad95d2", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784746898, "uuid": "6cbbd8e5-92a2-4008-bcad-7b78ca64bbe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784746898, "uuid": "4752a8a4-2981-4c9a-8f3d-bba44d4da403", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8e9d17-8578-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784688953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688953, "uuid": "b062ec35-e026-438e-819f-fd47134295b7", "comment": "Malware payload (Mirai)", "value": "1481ee89e78aa844452e7776711575f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688953, "uuid": "a1b9e774-22b2-4d25-94fa-ca1c75644cec", "comment": "Malware payload (Mirai)", "value": "f9cc910e56e63b80fc8d357374daf473655ef4e4f3ff28e8f0b04f717e9fb78d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688953, "uuid": "b0179c5c-f230-4c48-82c6-4054f4370966", "comment": "Malware payload (Mirai)", "value": "3614e05d8f8dcabecb8ad759596dc89ca5c0cce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784688953, "uuid": "96984710-8914-41c0-bf6a-c57a8c3cf755", "comment": "Malware payload (Mirai)", "value": "602ede2918c9f0f7ffa45de180bef9c512457f694751af8d2dd55132664054a11abccf237759017d3817a900e822e437", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688953, "uuid": "70488de1-f196-47b8-a7e4-552149da7c3f", "value": "T1174349C4B183F9F1DC05017C306AEB325E33F0B6713AED9BD7E455B3A855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688953, "uuid": "147cdb31-16f0-4bd0-a021-550742448b6d", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbVGoPCdgZl7dbFfGf:xzuXndFq4ZthB/VUfOWhGoPKgj7dpOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784688953, "uuid": "908c966f-1d92-4ee9-9bfb-68fc782f11ba", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784688953, "uuid": "00d6ac33-1a39-4ff0-9a9d-fcd4505fc69b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784688953, "uuid": "86b213ee-699c-4d15-9849-15ec53633a32", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24c9dac-85d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784730144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730144, "uuid": "225f9d97-7d8e-4dd3-b7d6-da786dd7a5fa", "comment": "Malware payload (Mirai)", "value": "fdb779d260ea2e00cffc4f93b9ebd279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730144, "uuid": "4fa00d7d-0ef7-4073-8a62-0d93b1be6aaa", "comment": "Malware payload (Mirai)", "value": "fa210b795422f3f17e7c3c17552c985a31142ef6ac015bc7a666aee80dc6b99a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730144, "uuid": "33563826-edd0-4056-b0ce-e42958903a31", "comment": "Malware payload (Mirai)", "value": "688812fe34feb221a49040e72a4c5c740bb91fad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784730144, "uuid": "a6044452-f4ab-4164-b57c-99740ce7de6d", "comment": "Malware payload (Mirai)", "value": "20f6615a51237ec71b0599500abcdd5ae54d61daf032a04c2cd2a79679b4bdc4d9f6f91f46b41615838f174938bad4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730144, "uuid": "e6219fc9-8f92-4837-81f1-e9e29b705e75", "value": "T1E1230223C9D49FC1E0FA0738259A6A2F6025750922DD5BF7166CB4B29BD27319D342F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730144, "uuid": "7a4eda90-f513-4548-a5fe-7bb27cda3782", "value": "768:FQceCT2VXydTdwTx03epKVcyxXynpJwB2Csu7N9+X5FI7NAbsCvTVzCysAFUpgnS:icbT2VXyXgx03oKVVXynpe4u7yCZv8dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784730144, "uuid": "c00e271f-39fb-41aa-be97-3ab18dc92a53", "value": 49084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784730144, "uuid": "2575e05c-838b-47fc-959a-0d2ba222664c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784730144, "uuid": "116b17ba-9313-4cff-b45c-3a8ce310d0cb", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b934400-85b0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784712658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712658, "uuid": "df575f40-072d-423a-9cd0-7ab9cb65b78d", "comment": "Malware payload", "value": "da32ab0504fc688b28df1739cf258bcc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712658, "uuid": "725799b7-8706-41c2-bbe5-16827fd059a0", "comment": "Malware payload", "value": "fa229dcb2cda1b814f4108bfc96af37c484d1484dc77808b23f2b4a34627483d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712658, "uuid": "d159a98a-d243-4c54-bafe-fa740f222626", "comment": "Malware payload", "value": "691526e318204b1383e9d72993094b09ec9e49db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784712658, "uuid": "a33b3516-352b-46bf-a365-cf370cc6b9ee", "comment": "Malware payload", "value": "ed5f2c8c2e4b2e8adae3918b79d4106bb2af82780976b9dbc9fba09f98f33a059ca9c0f301514dfd9cdd3a66873a8fbb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712658, "uuid": "65987f0c-5fcc-4784-aabe-c7717664c29d", "value": "T155F6030232D94E39EF773542522E5F1EC886332FEA76A1B43D2DA87461EF44A47D05CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712658, "uuid": "8e7605fa-0936-48ba-ae28-55b8f9c71b04", "value": "768:ZgtAmrSV61gd1beXCOiMaAyg55wXareK/F5XuQBWRxS7RzqanfC89TQNJhzmGhPh:jx9Oev9Lwk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784712658, "uuid": "02cecbce-6dde-45dc-b33c-2458e69f3a9c", "value": 15946430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784712658, "uuid": "a15ed2b3-7d36-4087-b513-9aa81047c6b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784712658, "uuid": "3a5b7d23-ff97-4691-9a9c-acdca4feae8d", "value": "Invoice and BL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cab3b6-856f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784685128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685128, "uuid": "dfe61738-e770-477f-b9c3-189f49339033", "comment": "Malware payload (Efimer)", "value": "b7a1013cd426ba6847ed608ea7128584", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685128, "uuid": "ea42ea95-a84f-4d05-8694-016bb266806a", "comment": "Malware payload (Efimer)", "value": "fb881f10b82cd577893fc57375fcfa43a5650c395f82ab42c18eca04874679d4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685128, "uuid": "4a8a0316-4531-4149-99c0-1f03566dfcfe", "comment": "Malware payload (Efimer)", "value": "b4887b506b23eab809e9ba44c7733697ee82173c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784685128, "uuid": "b172801f-0f36-4dc0-8dd4-d056d0764c6c", "comment": "Malware payload (Efimer)", "value": "a3f24867e240013b18fd7b56b92edbcfae45923d3ae3ebaad926c9fff1386a3937dca8ef283cc621b9fdd3ca6d2fb32c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685128, "uuid": "b5a8f7d7-bf72-4cf0-abf3-12e7387a7acc", "value": "T10AE63358F6E015EEFAA7503CDEA35160F5B474764B72CAAB47944264BE132E08C3D32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685128, "uuid": "549a3c1e-d193-4b4e-8665-85eabb29b364", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685128, "uuid": "9cf443c5-1b25-48b8-8e6f-3c52177283ac", "value": "393216:wDz8RrzCYvoekgsLYUCvlMG7XMCHWUjX0cuI3/PGTAI:wDOrzD9kgsLvG7XMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784685128, "uuid": "f5b00f2c-be94-42ca-89a4-b5aeb41f1b40", "value": 14304407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784685128, "uuid": "cba05fe2-6dd3-4028-944e-2a997ecaf9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784685128, "uuid": "aa12a42c-45ff-47c9-af96-8e933f0a962f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d032726d-85cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AMOS)", "timestamp": 1784725443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725443, "uuid": "d29fa3aa-7dc2-4a56-aa95-5b67bb342243", "comment": "Malware payload (AMOS)", "value": "2990c4b21076c457b7e11c117ba3b3ef", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725443, "uuid": "bd8e8ae3-69f3-45c1-9308-ff9e60415db5", "comment": "Malware payload (AMOS)", "value": "fc2009166867bee88885f2f889a608260cb971c1e946bbb79ea7d75ae0d429f6", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725443, "uuid": "c7493642-87dc-4da9-9579-96362ea6a921", "comment": "Malware payload (AMOS)", "value": "e09bb220036fad6a30ad66539879a17fc0ed548e", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784725443, "uuid": "0377ca93-7190-4fc7-9937-c7167e4cec23", "comment": "Malware payload (AMOS)", "value": "41e488e5b6350477e27ce839ff562f92a8ae4fccec64475aff97e500a5b8a9781bfafef214bd2ddb05eeb1651fbf4261", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725443, "uuid": "0b3b7ca8-c0ff-4942-95f8-6c6e22280e2b", "value": "T19964CF37629DF8A5D015FE34FA4B46EF59457A3980DF29538BE2CC0008A39872B66F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725443, "uuid": "6b18fbf8-7433-4528-ba09-e250907e1aae", "value": "6144:9YABwQQIWYEfNajahiOjMRABwQQIWUifN:9h6QQIWYEfsahiOjMK6QQIWUif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784725443, "uuid": "d46afc92-a00a-4851-8f1f-fc5722a64ef5", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784725443, "uuid": "39eb7985-8c75-4a1c-b45a-3c2bf68cdf16", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784725443, "uuid": "9dd1baff-5af4-47c1-9b71-c2dfbb8fbc7b", "value": "malwarepayload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428a1aa1-8619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784757847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757847, "uuid": "35ad2d91-4436-4848-81eb-722752d6b92b", "comment": "Malware payload (Mirai)", "value": "c6e03a69408dfa0446fdeeb299e446ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757847, "uuid": "819fc006-b314-4e83-8972-085c6821fbc5", "comment": "Malware payload (Mirai)", "value": "fdf4a9e66cd7709a5b9d53ee60640951030550b1f7270f993e5b428264527931", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757847, "uuid": "9687ea87-47fb-43a5-b602-d1cd5f5c2f08", "comment": "Malware payload (Mirai)", "value": "96711ed62f6dc508f283e501e09cf20d36ad2373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784757847, "uuid": "60b53225-2d48-406d-bad8-41ea0d50012f", "comment": "Malware payload (Mirai)", "value": "dc4548cff5aef31fc2746e42992a17db37eb2d668661cb6938f1bdd555399e7a4758b1880a8bc9412706aa3e213c5539", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757847, "uuid": "61cf6f10-2715-47cc-9426-6e1ce6f928ec", "value": "T10CD2D06EE57582C9FD8E5C3E848C3FA10E59E181221BDB9177228C4D5B32C57F27A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757847, "uuid": "2e84fd0a-0ffb-452d-a9f0-9041823d55fb", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjEbRWGVCz0Nvi:8MYHb62x4ahQ3CfdwLj9W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784757847, "uuid": "857e5916-bbc5-4261-bab6-33babcce1da4", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784757847, "uuid": "8443a4b6-2c2c-4bc6-8c62-79993d4de836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784757847, "uuid": "4d9d4b4a-20d8-490b-9abe-a822c2887f8e", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511200eb-85fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784744986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744986, "uuid": "b7d29015-a1da-45a5-9413-54fdc2af48e9", "comment": "Malware payload (Mirai)", "value": "8ff2c11bc437d296e1e31d6cc6efb558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744986, "uuid": "183aa1d7-5eaa-4a9b-b607-6dc5838548e9", "comment": "Malware payload (Mirai)", "value": "ff0505f010971ddaa354ff717283644d446b6ae27bd9f8ce2ff4a7ea575d3d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744986, "uuid": "4a897759-324b-41df-9663-9c01c08a88c4", "comment": "Malware payload (Mirai)", "value": "a9d31729187259e4ebca83a09e54b7edbbfb385a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784744986, "uuid": "969f40d8-4a2a-4dbc-8d72-3ca0d8ac61a5", "comment": "Malware payload (Mirai)", "value": "4fd70511435422d68e2404792862aa33efa662e25574d2c2a4c8208e8dd81851052f6cc33d639094b9d502fcd79d5159", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744986, "uuid": "e859659a-4b82-4441-9513-646a68e8e729", "value": "T1F7E3BEA7F6872091C96302F407CB7BCD2E6322825F9BD9E36D2F753B59360DA5402792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744986, "uuid": "687d5af3-6623-4c68-bcf1-8d6b19489c65", "value": "3072:fggV8NxE67yxTLJohs9PooOQewOJ4gi7qnq:fqhMJwoHj7qnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784744986, "uuid": "ba0c966c-4a62-4e95-91f0-62c6f4502c02", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784744986, "uuid": "5a9ffb7d-9c43-407f-acfa-cc128d061ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784744986, "uuid": "aff85e7a-3c1a-4ad7-a20c-8c01db32ef5a", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810898ef-85a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784705983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705983, "uuid": "d15e4111-edb6-4299-98cd-5acdd20fb6b0", "comment": "Malware payload (Formbook)", "value": "f1b7fa9202ea087443cb2f32c2ec6f56", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705983, "uuid": "a0bff58f-a421-4c89-98da-18b97b4f5249", "comment": "Malware payload (Formbook)", "value": "ff49e0d0a092845dee3310445dedc2d06928ac0ac45a671ba735f847a2a98253", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705983, "uuid": "0d52c419-0f6c-4cf5-adcb-a76b61487023", "comment": "Malware payload (Formbook)", "value": "f8430fe88cc6226421f8884bbe327c61dc6fad42", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784705983, "uuid": "ceb29356-82ad-4161-9787-ea1d2fd3046a", "comment": "Malware payload (Formbook)", "value": "207c81596168e06ed8942fb37912b9fd4c4e7b88dc57cdb36f5368010a326a394729e121569a3cfc9991516587a7b763", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705983, "uuid": "5a1dd6be-1e4b-4db5-9c78-3bfb74fa02a0", "value": "T1E54523329D5B2CB89BB88175209FEC1C27D41B964938FAF777A865CD3C1AF401DA25B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705983, "uuid": "8418def9-c828-4e8e-9a1f-752697154174", "value": "24576:6RJH6dmLP0YP/G50IhmIHfr6rHvAv1Z1EraqTzZKVJg:6n8CG4vAvZi/PMVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784705983, "uuid": "2823800f-4171-43f8-9fa7-4015179b93d1", "value": 1263755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784705983, "uuid": "2a331f2e-6b48-40e0-b9af-7021db68a9a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784705983, "uuid": "07f20255-0d29-4b8f-a3e6-a40d1203bb89", "value": "W Bank SWIFT INV5200102325.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }